Feeds

Kraken stripped of World's Largest Botnet crown (maybe)

Is it new or is it Bobax?

Remote control for virtualized desktops

RSA If you're looking for a good reason why security professionals might want to pool their research about botnets and other cyber threats, look no further than findings released earlier this week about a botnet dubbed Kraken.

Zombie hunters at Damballa said they were tracking a new bot army that claimed more than 400,000 infected machines and had managed to infiltrate at least 50 networks belonging to Fortune 500 companies. The malware at the heart of Kraken, as they dubbed the botnet, was undetected on 80 percent of computers running anti-virus protection.

The thing is, other researchers say Kraken isn't new at all. According to Joe Stewart, a cyber gumshoe at SecureWorks, the reported bot army is actually one that goes by the name Bobax and is one of the oldest known botnets used for spamming. Damballa researchers respectfully reject this contention, saying Kraken bots use fundamentally different means to connect to command and control channels, where they receive their spamming instructions.

The mix-up is understandable, given the way malware is spread. Distributors frequently infect a PC with multiple bots at the same time, and often use vastly different variants, all making identification difficult. Complicating matters, competing botnet operators frequently appropriate snippets of code belonging to their competitors.

In a report issued Wednesday, Stewart has stepped forward to share data on what he says are the 10 biggest spam bots, complete with the strings that other researchers can use to identify a given network. It's by no means complete, but with contributions from others, it could grow into a resource that advances the collective knowledge of one of the biggest threats menacing the net.

"We all as an industry need to share information better among ourselves," Stewart says. "We each have a small scope of view of the activity and that's why we all need to get together and share it and magnify our view."

Agree to disagree

In an interview at the RSA conference in San Francisco, Stewart said he has no doubt Kraken and Bobax are one in the same. How does he know? He says each botnet displays idiosyncrasies when sending large volumes of spam, and that the pattern in this case is identical.

But Bill Guerry, vice president of product management at Damballa, said he has no doubt Kraken is distinctly different. Its bots connect to command and control channels using encrypted transmission control protocol (TCP) and user datagram protocol (UDP) over port 447. Bobax, by contrast, uses unencrypted hyper text transport protocol (HTTP) over port 80.

"I can appreciate why people are saying it's the same thing," said Guerry, who is also attending the RSA conference. "But when you look at the fact that it's a completely different C&C, that's just overwhelming evidence and irrefutable evidence that it's a new and distinct bot army."

The differences don't end there. A few months ago, Damballa issued a report that said Bobax was largely dormant, after being taken over by Storm, which according to some estimates, was believed to be one of the largest known botnets. Stewart says Bobax is the second biggest spam bot, with 185,000 spam-capable bots and a capacity to blast out more than 9 billion pieces of junk mail per day. (The actually number of spam sent is much lower.)

He counts Srizbi as the biggest spam botnet, with about 315,000 infected machines. Rustock and Cutwail and Storm are third, fourth and fifth, with 150,000 zombies and 125,000 zombies and 85,000 zombies respectively.

One reason for the discrepancies is that Stewart's report counts only the number of bots that are capable of sending spam. Another is that botnet counts ebb and flow wildly. The biggest botnet three months ago very well not be the biggest one now.

All of which is more fodder for Stewart's argument that researchers should share their findings in a more thorough and methodical way. That way, they can receive the peer review they deserve (and customers and reporters won't be left wondering who's right and who's wrong).

Guerry says Damballa is game. It's in the process of posting more granular data about Kraken to its website now.

"We're looking to put out more information so people can see more than just raw data," he said. "What we want to do is post more of our analysis of what we did on our website so that it's a little more transparent." ®

Check out all our RSA'08 coverage

Intelligent flash storage arrays

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.