Slashdot Log In
Massive Botnet Returns From the Dead To Spam On
Posted by
timothy
on Wed Nov 26, 2008 03:07 PM
from the late-entry-for-hallowe'en dept.
from the late-entry-for-hallowe'en dept.
CWmike writes "Gregg Keizer reports that the big spam-spewing Srizbi botnet, shut down two weeks ago when McColo was shuttered, has been resurrected and is again under the control of criminals, security researchers said today. As of late Tuesday, infected PCs were able to successfully reconnect with new command-and-control servers, which are now based in Estonia, said Fengmin Gong, chief security content officer at FireEye. The comeback confirms what researchers noted last week, that Srizbi had a fallback strategy. So, in the end, that strategy paid off for the criminals who control the botnet."
Related Stories
[+]
McColo Briefly Returns, Hands Off Botnet Control 242 comments
A week ago we discussed the takedown of McColo (and the morality of that action). McColo was reportedly the source of anywhere from 50% to 75% of the world's spam. On Saturday the malware network briefly returned to life in order to hand over command and control channels to a Russian network. "The rogue network provider regained connectivity for about 12 hours on Saturday by making use of a backup arrangement it had with Swedish internet service provider TeliaSonera. During that time, McColo was observed pushing as much as 15MB of data per second to servers located in Russia, according to ... Trend Micro. The brief resurrection allowed miscreants who rely on McColo to update a portion of the massive botnets they use to push spam and malware. Researchers from FireEye saw PCs infected by the Rustock botnet being updated so they'd report to a new server located at abilena.podolsk-mo.ru for instructions. That means the sharp drop in spam levels reported immediately after McColo's demise isn't likely to last."
[+]
Estonian ISP Shuts Srizbi Back Down, For Now 237 comments
wiedzmin writes "In response to the recent resurrection of the Srizbi botnet, an Estonian ISP has shut down the hosting company that was housing its new control servers. Starline Web Services, based in Estonia's capital Tallinn, had become the new home for the Srizbi botnet control center after the McColo hosting company (which was taken down earlier this month) has briefly come back to life last week, allowing the botnet to hand-off control to the Estonian network. After Estonia's biggest ISP Linxtelecom demanded that Starline Web Service be taken offline, the newly acquired Srizbi control servers went down with it. However, as the rootkit is armed with an algorithm that periodically generates new domain names where the malware then looks for new instructions, it is only a matter of time before a new set of control servers is created and used to manipulate one of the biggest spam botnets in the world."
[+]
Tigger.A Trojan Quietly Steals Stock Traders' Data 212 comments
**$tarDu$t** recommends a Washington Post Security Fix blog post dissecting the Tigger.A trojan, which has been keeping a low profile while exploiting the MS08-66 vulnerability to steal data quietly from online stock brokerages and their customers. An estimated quarter million victims have been infected. The trojan uses a key code to extract its rootkit on host systems that is almost identical to the key used by the Srizbi botnet. The rootkit loads even in Safe Mode. "Among the unusually short list of institutions specifically targeted by Tigger are E-Trade, ING Direct ShareBuilder, Vanguard, Options XPress, TD Ameritrade, and Scottrade. ... Tigger removes a long list of other malicious software titles, including the malware most commonly associated with Antivirus 2009 and other rogue security software titles ... this is most likely done because the in-your-face 'hey, your-computer-is-infected-go-buy-our-software!' type alerts generated by such programs just might ... lead to all invaders getting booted from the host PC."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Zombies!!!!! (Score:5, Funny)
Argh! Zombies!!!!! They're bound to be after brains! Well they'll find none here! Take that you evil zombies.
Random or crashing? (Score:3, Funny)
Which part of "random crashing" is alleviated by Linux? The "random" or the "crashing"?
Further Proof (Score:5, Insightful)
Re:Further Proof (Score:5, Funny)
It's nice to see that somebody's IT department has the funding and expertise to implement a backup plan.
It gives me hope.
Parent
Re:Further Proof (Score:5, Insightful)
the alg it uses to get domain names
Why would botnet harvesting be done by domain name anyways? Wouldn't it be easier to collect systems by just running through accessible IP addresses?
And if the botnets are doing double duty by both propagating spam and attempting to hack into systems via ssh, I can tell you from my IP logs at home that most systems in the botnets aren't behind any particular domains.
On top of that, how many languages would you want to sell antivirus software in?
Parent
Re: (Score:3, Interesting)
You misunderstand.
Srizbi has an algorithm to generate a pseudo-random domain name from the current date, and looks to that domain for command & control instructions.
The author of the bot has the same algorithm, and can calculate the domain names days and weeks out. Thus, if their c&c server is knocked off the internet, the bot herder just has to register a few domain names that Srizbi will be looking to in the near future.
This has nothing to do with the domain names of the bots themselves, or of the
Re:Further Proof (Score:5, Insightful)
Parent
Re:Further Proof (Score:5, Informative)
Parent
Re:Further Proof (Score:5, Informative)
A little windows trickery:
Right click on internet explorer and click "Run As" run it as admin.
type C:\ into the address bar. Navigate to whatever folder the programs you want to run are in and run them. Anything that spawns from here will be running as admin.
Parent
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Worth mentioning, sudo is essentially UAC, only somewhat less annoying. But it's still a broken model.
One thing a lot of Unix daemons get right is, one user per task. Basic, stupidly simple security model -- nothing should have more access than it needs to do its job. Server systems still handle this reasonably well -- small things as root, only where needed. Take Apache -- it's root mostly just to bind port 80; everything else is www-data.
Things like this completely go away with modern desktops. The only t
Going back in time ... (Score:5, Interesting)
"the big spam-spewing Srizbi botnet, shut down two weeks ago when McColo was shuttered, has been resurrected and is again under the control of criminals"
I'd love to go back in the '50s, find one of those future drawing artists, show him that head news, and ask him to draw what he think that means in the year 2008.
Hilarity ensue.
Re:Going back in time ... (Score:5, Funny)
Never fails - I never have mod points when I see posts worthy of them.
Parent
Re:Going back in time ... (Score:5, Funny)
I don't know what he'd draw, but I know it'd be covered in chrome. :)
Parent
Re:Going back in time ... (Score:5, Funny)
I guess it would a giant, dilapidated 50's-style robot vomiting a stream of cans of spams to crowds of innocent people.
Parent
They stopped them once. (Score:5, Insightful)
The sooner the better. My good:spam ratio is almost 5:95 at the moment
Re:They stopped them once. (Score:5, Funny)
Parent
Re:They stopped them once. (Score:4, Interesting)
Parent
Re:They stopped them once. (Score:4, Interesting)
If that were true, then that might be a good argument to upgrade...
Parent
Re: (Score:3, Informative)
I read that they had. Servers in Estonia shutdown quickly but one left up in Germany.
http://www.theregister.co.uk/2008/11/26/srizbi_returns_from_dead/ [theregister.co.uk]
What intriques me... (Score:5, Insightful)
Re:What intriques me... (Score:5, Funny)
Well of course. With no worker unions, government bureaucracy or international laws to get in the way, they have it easier than your average law-abiding citizens and companies.
Parent
Not really. (Score:5, Informative)
They also have to deal with various groups trying to stop them. As in TFA:
So the spammers had to have thought about and planned for such a contingency.
And still bring in enough money to pay for the connections they'll be using to control the zombies.
So while attempting to register the domain names, work was going on to update the zombie software.
The question now is how to get those hard-coded references to the various ISP's in the world so that they can block traffic to/from them and stop the zombies from updating again.
Why isn't information such as that ever included in these articles?
Parent
Re: (Score:3, Interesting)
Yeah, but do you really need to block the whole country?
The bots obviously need to find their home. Most likely this is via either a hard-coded IP, or a DNS lookup. So, just publish whichever one it is and then everybody can blackhole either the DNS entry or the IP address. If the major ISPs do that the bot dies.
Now, if the bot uses IRC or something like that it could get trickier, since blocking that at the protocol level (short of killing an entire irc network) isn't possible. However, the irc network
Re:What intriques me... (Score:5, Insightful)
Parent
Re: (Score:3, Insightful)
You mean, "by not even trying to appear as though you give a shit about who you inconvenience".
If you've tried to contact Customer Support of any corporation (especially any outsourced CS) you know that that company really only pays lip service to the concept. Most corporations only provide just enough CS to be able to show that (massaged) stats re
Thats strange... (Score:5, Funny)
We don't need no stinking backups... (Score:5, Insightful)
Re:We don't need no stinking backups... (Score:4, Funny)
Parent
Re:We don't need no stinking backups... (Score:4, Interesting)
Swedish TeliaSonera and it wasn't done directly, they purchased the link through a third party and made sure it was activated just as the weekend started (probably hoping that no one would shut it down before the weekend was over).
/Mikael
Parent
A McColo with Fries (Score:5, Funny)
Some Idiots (Score:5, Insightful)
Re:Some Idiots (Score:4, Informative)
Parent
Re:Some Idiots (Score:4, Insightful)
Is this because some idiot(s) let McColo get back online for a number of hours, or was that fallback already in place before the McColo initial shut down?
I would be inclined to believe it to be more of the latter than the former. Why wouldn't the authors of the botnet software want to write something in to allow for the creation of a new botnet control system? These guys aren't idiots, as much as we might like to wish they were. They know that it takes time to amass a botnet, so I would expect they included some way to bring back the botnet, should they get caught somewhere.
need to be talking to each other when they blacklist a site
I might be missing something here, but I rather doubt that botnet control comes down to a specific site anywhere. Didn't they just say that the botnet is now controlled from a different country than before? I'm not sure that any amount of activities from major ISP's would be able to be both tolerable to users and capable of restricting the botnets.
Parent
OK now... (Score:5, Insightful)
Re: (Score:3, Insightful)
How is this surprising to anyone? Do you not understand this is a business, illegal or otherwise? Do you not think cocaine smugglers have backup plans too?
They missed the chance (Score:4, Insightful)
Re:They missed the chance (Score:5, Informative)
Srizbi will, in fact, accept an uninstall command from a bogus C&C server.
Lots of stuff about Srizbi [fireeye.com]
In the course of invesigating Srizbi, researchers had 250,000 bots under their control for a span of a few days. Sending the uninstall command was one of several ways they could have crippled this small portion of Srizbi. But honestly, no citizen has the legal authority to make changes to hundreds of thousands of other people's PCs. Maybe if some law enforcement agencies would get involved, that would be nice. Or at least give blanket immunity to researchers who would do so.
Parent
Soft on terrorism (Score:4, Informative)
So where are the US antiterrorism people? This is an attack on US assets by foreign nationals. We have a whole Department of Homeland Security. They had a good computer security guy in charge of dealing with such attacks, Amit Yoran, and he quit in 2004 [computerworld.com], fed up because DHS didn't really want to deal with real problems. His replacement was a career lobbyist [dhs.gov]. Really. "He served as Director of 3Com Corporation's Government Relations Office in Washington, DC where he was responsible for all aspects of the company's strategic public policy formulation and advocacy." That's America's first line of defense against cyberterrorism.
The FBI has an antiterrorism operation. What are they doing? What they say they're doing is working to "strengthen and support our top operational priorities: counterterrorism, counterintelligence, cyber, and major criminal programs." [fbi.gov] What they're actually doing is flying around the FBI director in the private jet purchased with antiterrorism funds. [wordpress.com]
FBI testimony before Congress, 2001 [fbi.gov]: "The FBI believes cyber-terrorism, the use of cyber-tools to shut down, degrade, or deny critical national infrastructures, such as energy, transportation, communications, or government services, for the purpose of coercing or intimidating a government or civilian population, is clearly an emerging threat for which its must develop prevention, deterrence, and response capabilities."
FBI testimony before Congress, 2004 [fbi.gov]: " In the event of a cyberterrorist attack, the FBI will conduct an intense post-incident investigation to determine the source including the motive and purpose of the attack."
So where's the action?
Heads need to roll at DHS and the FBI.
Re: (Score:3, Interesting)
Tens of millions of American computers are under the direct control of hostile foreign interests. At any moment, they can be ordered to do anything by those interests, including erasing files, sending financial information, or attacking infrastructure sites. That's a much bigger threat than some guys mouthing off in a bar in Miami about blowing up some building [cnn.com], which got the FBI's full attention.
(H|Cr)ack attack (Score:4, Interesting)
What I wonder is, why don't some of those white/grey/black hat hackers out there don't try to hijack the botnets, spammers, or the control servers of the spammers and shut that shit down. I'm sure it would be challenging and billions would approve.
The way I see it, spam is a distributed problem that ignores virtually any boundary you can think of, so the solution must be equally pervasive and distributed. Such as an equally (dis)organized group of spammer-attackers. Sure some innocents will probably get nailed, but ain't war hell?
Money was involved... (Score:3, Informative)
Re: (Score:3, Insightful)
Re:Money was involved... (Score:5, Informative)
Parent
Update (Score:5, Informative)
The Estonia based Command and Control servers have been kicked offline.
Only one server is still online, based in Frankfurt, Germany; name registered through the Cayman Islands.
This is not the server that's hard-coded in to the new Srizbi patch, just one of the backup servers supplying it.
source [fireeye.com]
In related news ... (Score:5, Funny)
Re:Aim for the head ... (Score:5, Funny)
You don't have much experience battling hydras, do you?
Parent
Re:Blue Frog? (Score:4, Interesting)
As far as I can see the only real solution to spam is intelligent filtering, which Google leads the way on: it's got to the point where if a spam mail gets through, I open it it up and have a good look at it to see how the heck it got through.
Parent
Re: (Score:3, Interesting)
Because Srizbi has an algorithm that generates new pseudo-random domain names based on the current date. If the hard-coded C&C server ever goes down, the bot herder can calculate what domain names Srizbi will be looking to in the near future, and register them to reclaim the botnet (and push an update that changes the hard-coded server)
Technical Details of Srizbis domain generation algorithm [fireeye.com]
Re: (Score:3, Interesting)