Feeds

Kelihos botnet BACK FROM THE DEAD

Bloodied spam-spewing zombie staggers in

Secure remote control for conventional and virtual desktops

The spam-spewing Kelihos botnet has returned from the dead.

Microsoft collaborated with Kaspersky Lab to run a successful takedown operation last September. The takedown decapitated the botnet by shutting down command-and-control server nodes, directing the bots on infected computers to contact a server under the control of security researchers, rather than one controlled by the attackers.

In the case of the Kelihos peer-to-peer botnet, Kaspersky researchers pushed out a new peer address, which the existing infected PCs began polling for new instructions.

This "sink-holing" action meant that compromised machines in the network were no longer receiving instruction and spam templates every time they "phoned home" to command nodes. Even so the machines were still infected and left with an open back door that might be exploited by cybercrooks. A deliberate decision was taken NOT to patch infected machines, a problematic process that's illegal in some countries. Instead it was left to users to fix the security on their compromised machines.

Almost inevitably many didn't bother.

Over time miscreants have used the botnet's complex back-channel network of proxy servers to regain control of compromised machines. These machines have been infected with a new variant of Kelihos that uses modified encryption schemes and algorithms to mask communication. Two different keys are being used, suggesting that more than one gang is controlling the botnet, according to a new analysis Maria Garnaeva, a security researcher with Kaspersky Lab.

""As you can see, two different RSA keys are used within a tree which makes us think that probably two different groups are in possession of each key and are currently controlling the botnet," Garnaeva explains.

"Our investigation revealed that the new version appeared as early as September 28, right after Microsoft and Kaspersky Lab announced the neutralisation of the original Hlux/Kelihost botnet," she added.

At its peak, Kelihos spewed out as many as 4 billion junk mail messages, spam-vertised unlicensed pharmaceuticals, stock scams and other tat from around 45,000 malware-infected zombie PCs. Current spam levels are nowhere near this bad, even though they still pose a problem.

The reappearance of spam from the botnet underlines that sinkholing alone is not effective in killing off botnets. Security experts knew this even at the start. Garnaeva suggests that only patching infected machines or taking botnet controllers out of circulation would be truly effective.

Last week Microsoft filed an amended lawsuit alleging that a Russian national was involved in both creating the original Kelihos malware and running the botnet network. Andrey Sabelnikov of St Petersburg, a software developer and former employee at two Russian security firms, denies any wrongdoing. ®

New hybrid storage solutions

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.