Feeds

Kraken stripped of World's Largest Botnet crown (maybe)

Is it new or is it Bobax?

Internet Security Threat Report 2014

RSA If you're looking for a good reason why security professionals might want to pool their research about botnets and other cyber threats, look no further than findings released earlier this week about a botnet dubbed Kraken.

Zombie hunters at Damballa said they were tracking a new bot army that claimed more than 400,000 infected machines and had managed to infiltrate at least 50 networks belonging to Fortune 500 companies. The malware at the heart of Kraken, as they dubbed the botnet, was undetected on 80 percent of computers running anti-virus protection.

The thing is, other researchers say Kraken isn't new at all. According to Joe Stewart, a cyber gumshoe at SecureWorks, the reported bot army is actually one that goes by the name Bobax and is one of the oldest known botnets used for spamming. Damballa researchers respectfully reject this contention, saying Kraken bots use fundamentally different means to connect to command and control channels, where they receive their spamming instructions.

The mix-up is understandable, given the way malware is spread. Distributors frequently infect a PC with multiple bots at the same time, and often use vastly different variants, all making identification difficult. Complicating matters, competing botnet operators frequently appropriate snippets of code belonging to their competitors.

In a report issued Wednesday, Stewart has stepped forward to share data on what he says are the 10 biggest spam bots, complete with the strings that other researchers can use to identify a given network. It's by no means complete, but with contributions from others, it could grow into a resource that advances the collective knowledge of one of the biggest threats menacing the net.

"We all as an industry need to share information better among ourselves," Stewart says. "We each have a small scope of view of the activity and that's why we all need to get together and share it and magnify our view."

Agree to disagree

In an interview at the RSA conference in San Francisco, Stewart said he has no doubt Kraken and Bobax are one in the same. How does he know? He says each botnet displays idiosyncrasies when sending large volumes of spam, and that the pattern in this case is identical.

But Bill Guerry, vice president of product management at Damballa, said he has no doubt Kraken is distinctly different. Its bots connect to command and control channels using encrypted transmission control protocol (TCP) and user datagram protocol (UDP) over port 447. Bobax, by contrast, uses unencrypted hyper text transport protocol (HTTP) over port 80.

"I can appreciate why people are saying it's the same thing," said Guerry, who is also attending the RSA conference. "But when you look at the fact that it's a completely different C&C, that's just overwhelming evidence and irrefutable evidence that it's a new and distinct bot army."

The differences don't end there. A few months ago, Damballa issued a report that said Bobax was largely dormant, after being taken over by Storm, which according to some estimates, was believed to be one of the largest known botnets. Stewart says Bobax is the second biggest spam bot, with 185,000 spam-capable bots and a capacity to blast out more than 9 billion pieces of junk mail per day. (The actually number of spam sent is much lower.)

He counts Srizbi as the biggest spam botnet, with about 315,000 infected machines. Rustock and Cutwail and Storm are third, fourth and fifth, with 150,000 zombies and 125,000 zombies and 85,000 zombies respectively.

One reason for the discrepancies is that Stewart's report counts only the number of bots that are capable of sending spam. Another is that botnet counts ebb and flow wildly. The biggest botnet three months ago very well not be the biggest one now.

All of which is more fodder for Stewart's argument that researchers should share their findings in a more thorough and methodical way. That way, they can receive the peer review they deserve (and customers and reporters won't be left wondering who's right and who's wrong).

Guerry says Damballa is game. It's in the process of posting more granular data about Kraken to its website now.

"We're looking to put out more information so people can see more than just raw data," he said. "What we want to do is post more of our analysis of what we did on our website so that it's a little more transparent." ®

Check out all our RSA'08 coverage

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.