Feeds

Next-gen botnet armies fill spam void

Out with the old, in with the new

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

The demise late last year of four of the world's biggest spam botnets was good news for anyone with an email inbox, as spam levels were cut in half - almost overnight. But the vacuum has created opportunities for a new breed of bots, some of which could be much tougher to bring down, several security experts are warning.

New botnets with names like Waledac and Xarvester are filling the void left by the dismantling of Storm and the impairment of Bobax, Rustock, and Srizbi, these researchers say. The new breed of botnets - massive networks of infected Windows machines that spammers use to blast out billions of junk messages - sport some new designs that may make them more immune to current take-down tactics.

Waledac is a good example. It appears to be a complete revision of Storm, that includes the same state-of-the-art peer-to-peer technology and fast-flux hosting found in its predecessor, according to researcher Joe Stewart of Atlanta-based security provider SecureWorks. But it differs from Storm in one significant way: Weak encryption protocols, which proved to be an Achilles Heel that led to its downfall, have been completely revamped.

"Several researchers are actively studying the communications, but I don't know if and when it will be broken and hijackable," said Jose Nazario, a security researcher at Arbor Networks. "The guys behind the botnet seems intent on staying up and so evading researchers seems like the most appropriate thing to do."

Waledac has amassed some 10,000 zombie computers so far, a tiny fraction of the bigger botnets. But Stewart expects it to be a major player in the coming months.

Meanwhile, a spam botnet called Xarvester is making similar inroads. It is the world's third-biggest spammer, accounting for over 13 percent of the world's spam, according to Marshall. What's more, its uncanny resemblance to Srizbi has sparked suspicions it is a reincarnation of that notorious botnet. Similarities include an HTTP-based command and control center that uses non-standard ports, encrypted template files used to send spam and configuration files with the common formats and data.

It also has a sophisticated feedback system that helps bot developers squash bugs so the software is harder to detect on a victim's machine.

"Just like Srizbi, Xarvester has the ability to upload the Windows minidump crash dump file to a control server in the event that the bot crashes a system," according to this analysis from Marshall. "This is presumably to help the botnet controllers debug their bot software."

Last year represented a bonanza for security watchers, who toiled for years trying to take down the networks. The monster botnet known as Storm was taken out of commission altogether, thanks to security experts who discovered a design flaw that allowed them disrupt it. Bobax, Rustock, and Srizbi were severely impaired - at least for a time - thanks to the shutdown of Atrivo, McColo, and another internet host provider that provided connectivity to the rogue networks, and so far, they have yet to stage much of a comeback.

But more than a defeat, the closures more likely represent an upgrade, in much the way Microsoft and Apple decommission older operating systems to make way for newer ones.

"Ultimately, the authors of Storm, Bobax, and Srizbi chose to stay down for one reason or another," Stewart wrote in an email sent to El Reg. "Sure, we as researchers may have been degrading their ability to keep their botnet as large as they wanted, but they made the choice to not come back online (or chose to upgrade, in the case of Storm)."

At the same time, new botnets are on the rise, Cutwail and several other established spam botnet are also taking advantage of the lull. Stewart has a list of botnets to watch in 2009 here. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.