Feeds

Kraken stripped of World's Largest Botnet crown (maybe)

Is it new or is it Bobax?

Choosing a cloud hosting partner with confidence

RSA If you're looking for a good reason why security professionals might want to pool their research about botnets and other cyber threats, look no further than findings released earlier this week about a botnet dubbed Kraken.

Zombie hunters at Damballa said they were tracking a new bot army that claimed more than 400,000 infected machines and had managed to infiltrate at least 50 networks belonging to Fortune 500 companies. The malware at the heart of Kraken, as they dubbed the botnet, was undetected on 80 percent of computers running anti-virus protection.

The thing is, other researchers say Kraken isn't new at all. According to Joe Stewart, a cyber gumshoe at SecureWorks, the reported bot army is actually one that goes by the name Bobax and is one of the oldest known botnets used for spamming. Damballa researchers respectfully reject this contention, saying Kraken bots use fundamentally different means to connect to command and control channels, where they receive their spamming instructions.

The mix-up is understandable, given the way malware is spread. Distributors frequently infect a PC with multiple bots at the same time, and often use vastly different variants, all making identification difficult. Complicating matters, competing botnet operators frequently appropriate snippets of code belonging to their competitors.

In a report issued Wednesday, Stewart has stepped forward to share data on what he says are the 10 biggest spam bots, complete with the strings that other researchers can use to identify a given network. It's by no means complete, but with contributions from others, it could grow into a resource that advances the collective knowledge of one of the biggest threats menacing the net.

"We all as an industry need to share information better among ourselves," Stewart says. "We each have a small scope of view of the activity and that's why we all need to get together and share it and magnify our view."

Agree to disagree

In an interview at the RSA conference in San Francisco, Stewart said he has no doubt Kraken and Bobax are one in the same. How does he know? He says each botnet displays idiosyncrasies when sending large volumes of spam, and that the pattern in this case is identical.

But Bill Guerry, vice president of product management at Damballa, said he has no doubt Kraken is distinctly different. Its bots connect to command and control channels using encrypted transmission control protocol (TCP) and user datagram protocol (UDP) over port 447. Bobax, by contrast, uses unencrypted hyper text transport protocol (HTTP) over port 80.

"I can appreciate why people are saying it's the same thing," said Guerry, who is also attending the RSA conference. "But when you look at the fact that it's a completely different C&C, that's just overwhelming evidence and irrefutable evidence that it's a new and distinct bot army."

The differences don't end there. A few months ago, Damballa issued a report that said Bobax was largely dormant, after being taken over by Storm, which according to some estimates, was believed to be one of the largest known botnets. Stewart says Bobax is the second biggest spam bot, with 185,000 spam-capable bots and a capacity to blast out more than 9 billion pieces of junk mail per day. (The actually number of spam sent is much lower.)

He counts Srizbi as the biggest spam botnet, with about 315,000 infected machines. Rustock and Cutwail and Storm are third, fourth and fifth, with 150,000 zombies and 125,000 zombies and 85,000 zombies respectively.

One reason for the discrepancies is that Stewart's report counts only the number of bots that are capable of sending spam. Another is that botnet counts ebb and flow wildly. The biggest botnet three months ago very well not be the biggest one now.

All of which is more fodder for Stewart's argument that researchers should share their findings in a more thorough and methodical way. That way, they can receive the peer review they deserve (and customers and reporters won't be left wondering who's right and who's wrong).

Guerry says Damballa is game. It's in the process of posting more granular data about Kraken to its website now.

"We're looking to put out more information so people can see more than just raw data," he said. "What we want to do is post more of our analysis of what we did on our website so that it's a little more transparent." ®

Check out all our RSA'08 coverage

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.