Feeds

Pushdo Trojan outbreak: 11 THOUSAND systems infected in just 24 hours

Just 77 machines in the UK, though

Website security in corporate America

A wave of attacks by cybercrooks pushing a new variant of the resilient Pushdo Trojan has compromised more than 11,000 systems in just 24 hours.

Indian PCs have been most affected by the outbreak, but systems in the UK, France and the US have also been hit, according to security software firm Bitdefender.

The Romanian firm reckons 77 machines have been infected in the UK via the botnet in the past 24 hours, with more than 11,000 infections reported worldwide in the same period. Other countries that have been heavily affected by the Pushdo variant include Vietnam and Turkey.

Bitdefender figures come from traffic towards the sinkholed domains associated with the botnet's control system.

Traffic to these seized sinkholes came from 11,000 unique IP addresses in a period of 24 hours. These pings represent infected hosts phoning home for instructions.

The most affected region seems to be Asia, with India and Vietnam topping the list of compromised hosts and accounting for around 10 per cent of infections each. The US accounts for another 5 per cent of the total.

“We managed to successfully intercept Pushdo traffic and gain some idea of the size of this botnet,” states Catalin Cosoi, chief security strategist at Bitdefender.

“The sheer scale of this criminal operation, unsophisticated as it may be, is rather troubling and there are indications that the botnet is still in a growth phase. We shall be continuing our investigation as a key priority and further updates shall be made available in the coming days.”

The Pushdo Trojan has been used to distribute secondary malware strains such as ZeuS and SpyEye, but over the years its main use has been geared towards spam distribution. The actually spamming is done through a commonly associated components called Cutwail that are frequently installed on compromised PCs.

Despite four takedowns in five years against Pushdo command-and-control servers, the botnet endures.

The public and private keys used to protect the communication between the bots and the C&C servers have been changed with the latest variant, but the communication protocol remains the same.

The latest Pushdo binaries add an encrypted overlay not found in previous versions. If the conditions specified in the overlay are not met, the sample does not run properly.

The DGA (Domain Generation Algorithm) used by the latest variant has also been slightly revamped. DGAs are used to periodically generate a large number of domain names the zombie hosts can ping for instructions. The approach (pioneered by the infamous Conficker worm) makes life harder for law enforcement. Its successful application in this malware goes a long way towards explaining the resilience of Pushdo. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.