Feeds

Kraken stripped of World's Largest Botnet crown (maybe)

Is it new or is it Bobax?

SANS - Survey on application security programs

RSA If you're looking for a good reason why security professionals might want to pool their research about botnets and other cyber threats, look no further than findings released earlier this week about a botnet dubbed Kraken.

Zombie hunters at Damballa said they were tracking a new bot army that claimed more than 400,000 infected machines and had managed to infiltrate at least 50 networks belonging to Fortune 500 companies. The malware at the heart of Kraken, as they dubbed the botnet, was undetected on 80 percent of computers running anti-virus protection.

The thing is, other researchers say Kraken isn't new at all. According to Joe Stewart, a cyber gumshoe at SecureWorks, the reported bot army is actually one that goes by the name Bobax and is one of the oldest known botnets used for spamming. Damballa researchers respectfully reject this contention, saying Kraken bots use fundamentally different means to connect to command and control channels, where they receive their spamming instructions.

The mix-up is understandable, given the way malware is spread. Distributors frequently infect a PC with multiple bots at the same time, and often use vastly different variants, all making identification difficult. Complicating matters, competing botnet operators frequently appropriate snippets of code belonging to their competitors.

In a report issued Wednesday, Stewart has stepped forward to share data on what he says are the 10 biggest spam bots, complete with the strings that other researchers can use to identify a given network. It's by no means complete, but with contributions from others, it could grow into a resource that advances the collective knowledge of one of the biggest threats menacing the net.

"We all as an industry need to share information better among ourselves," Stewart says. "We each have a small scope of view of the activity and that's why we all need to get together and share it and magnify our view."

Agree to disagree

In an interview at the RSA conference in San Francisco, Stewart said he has no doubt Kraken and Bobax are one in the same. How does he know? He says each botnet displays idiosyncrasies when sending large volumes of spam, and that the pattern in this case is identical.

But Bill Guerry, vice president of product management at Damballa, said he has no doubt Kraken is distinctly different. Its bots connect to command and control channels using encrypted transmission control protocol (TCP) and user datagram protocol (UDP) over port 447. Bobax, by contrast, uses unencrypted hyper text transport protocol (HTTP) over port 80.

"I can appreciate why people are saying it's the same thing," said Guerry, who is also attending the RSA conference. "But when you look at the fact that it's a completely different C&C, that's just overwhelming evidence and irrefutable evidence that it's a new and distinct bot army."

The differences don't end there. A few months ago, Damballa issued a report that said Bobax was largely dormant, after being taken over by Storm, which according to some estimates, was believed to be one of the largest known botnets. Stewart says Bobax is the second biggest spam bot, with 185,000 spam-capable bots and a capacity to blast out more than 9 billion pieces of junk mail per day. (The actually number of spam sent is much lower.)

He counts Srizbi as the biggest spam botnet, with about 315,000 infected machines. Rustock and Cutwail and Storm are third, fourth and fifth, with 150,000 zombies and 125,000 zombies and 85,000 zombies respectively.

One reason for the discrepancies is that Stewart's report counts only the number of bots that are capable of sending spam. Another is that botnet counts ebb and flow wildly. The biggest botnet three months ago very well not be the biggest one now.

All of which is more fodder for Stewart's argument that researchers should share their findings in a more thorough and methodical way. That way, they can receive the peer review they deserve (and customers and reporters won't be left wondering who's right and who's wrong).

Guerry says Damballa is game. It's in the process of posting more granular data about Kraken to its website now.

"We're looking to put out more information so people can see more than just raw data," he said. "What we want to do is post more of our analysis of what we did on our website so that it's a little more transparent." ®

Check out all our RSA'08 coverage

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.