Feeds

Kelihos botnet BACK FROM THE DEAD

Bloodied spam-spewing zombie staggers in

Protecting against web application threats using SSL

The spam-spewing Kelihos botnet has returned from the dead.

Microsoft collaborated with Kaspersky Lab to run a successful takedown operation last September. The takedown decapitated the botnet by shutting down command-and-control server nodes, directing the bots on infected computers to contact a server under the control of security researchers, rather than one controlled by the attackers.

In the case of the Kelihos peer-to-peer botnet, Kaspersky researchers pushed out a new peer address, which the existing infected PCs began polling for new instructions.

This "sink-holing" action meant that compromised machines in the network were no longer receiving instruction and spam templates every time they "phoned home" to command nodes. Even so the machines were still infected and left with an open back door that might be exploited by cybercrooks. A deliberate decision was taken NOT to patch infected machines, a problematic process that's illegal in some countries. Instead it was left to users to fix the security on their compromised machines.

Almost inevitably many didn't bother.

Over time miscreants have used the botnet's complex back-channel network of proxy servers to regain control of compromised machines. These machines have been infected with a new variant of Kelihos that uses modified encryption schemes and algorithms to mask communication. Two different keys are being used, suggesting that more than one gang is controlling the botnet, according to a new analysis Maria Garnaeva, a security researcher with Kaspersky Lab.

""As you can see, two different RSA keys are used within a tree which makes us think that probably two different groups are in possession of each key and are currently controlling the botnet," Garnaeva explains.

"Our investigation revealed that the new version appeared as early as September 28, right after Microsoft and Kaspersky Lab announced the neutralisation of the original Hlux/Kelihost botnet," she added.

At its peak, Kelihos spewed out as many as 4 billion junk mail messages, spam-vertised unlicensed pharmaceuticals, stock scams and other tat from around 45,000 malware-infected zombie PCs. Current spam levels are nowhere near this bad, even though they still pose a problem.

The reappearance of spam from the botnet underlines that sinkholing alone is not effective in killing off botnets. Security experts knew this even at the start. Garnaeva suggests that only patching infected machines or taking botnet controllers out of circulation would be truly effective.

Last week Microsoft filed an amended lawsuit alleging that a Russian national was involved in both creating the original Kelihos malware and running the botnet network. Andrey Sabelnikov of St Petersburg, a software developer and former employee at two Russian security firms, denies any wrongdoing. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.