Massive Botnet Returns From the Dead To Spam On 205
CWmike writes "Gregg Keizer reports that the big spam-spewing Srizbi botnet, shut down two weeks ago when McColo was shuttered, has been resurrected and is again under the control of criminals, security researchers said today. As of late Tuesday, infected PCs were able to successfully reconnect with new command-and-control servers, which are now based in Estonia, said Fengmin Gong, chief security content officer at FireEye. The comeback confirms what researchers noted last week, that Srizbi had a fallback strategy. So, in the end, that strategy paid off for the criminals who control the botnet."
Zombies!!!!! (Score:5, Funny)
Argh! Zombies!!!!! They're bound to be after brains! Well they'll find none here! Take that you evil zombies.
As Ash said in the Army of Darkness flick... (Score:2)
"It took Linda('s e-mail box.) Then it came after (my e-mail box,) it got into my (windows box) and it (turned zombie,) so (we got McColo shutted down.) But that didn't stop it, it came back big time."
Re:Random crashes (Score:2, Funny)
They're not random dammit! they always occur where the real part is a half, well the non-trivial crashes anyway.
Re: (Score:2)
The random crashes will occur until you install Linux. You see, Linux is the fix for the random crashing!
</tongue-in-cheek>
Random or crashing? (Score:3, Funny)
Which part of "random crashing" is alleviated by Linux? The "random" or the "crashing"?
Re: (Score:2)
Some days, I think you get to pick one.
But that's only sometimes.
Truth be told, the only problems I've ever had were directly my fault, and what I was doing was usually highly unusual or warned against.
Further Proof (Score:5, Insightful)
Re: (Score:2, Funny)
Re:Further Proof (Score:5, Funny)
It's nice to see that somebody's IT department has the funding and expertise to implement a backup plan.
It gives me hope.
Re: (Score:2)
Or get into politics.
Re:Further Proof (Score:5, Insightful)
the alg it uses to get domain names
Why would botnet harvesting be done by domain name anyways? Wouldn't it be easier to collect systems by just running through accessible IP addresses?
And if the botnets are doing double duty by both propagating spam and attempting to hack into systems via ssh, I can tell you from my IP logs at home that most systems in the botnets aren't behind any particular domains.
On top of that, how many languages would you want to sell antivirus software in?
Re: (Score:2, Informative)
Why would botnet harvesting be done by domain name anyways? Wouldn't it be easier to collect systems by just running through accessible IP addresses?
RTFA. The bots are generating domain names which they then attempt to contact in order to re-connect with botnet control.
It's very clever, really. The algorithm can generate a near-endless list of domain names, and all the botnet owners have to do is register one of them and set it up to respond to the bots.
On the other hand, in order to block this attempt by the bots to re-connect with the botnet owner, you have to pre-emptively register ALL domains which the algorithm generates. So in the long run, it'
Re: (Score:3, Interesting)
You misunderstand.
Srizbi has an algorithm to generate a pseudo-random domain name from the current date, and looks to that domain for command & control instructions.
The author of the bot has the same algorithm, and can calculate the domain names days and weeks out. Thus, if their c&c server is knocked off the internet, the bot herder just has to register a few domain names that Srizbi will be looking to in the near future.
This has nothing to do with the domain names of the bots themselves, or of the
Re: (Score:2)
So if we used that algorithm ourselves and just started querying a seedy registrar for these domain names, they'd squat them all in advance. Then we could query some of the other seedy registrars, who would check with the first domain squatter, who would then jack up his prices so high the botherders couldn't afford them anymore.
Sounds like killing two birds with one stone, if you ask me.
Re: (Score:2)
Why can't someone honeypot a bot, move the system time forward and intercept NTP queries, and watch the traffic to see what DNS queries it generates?
[Sorry for the bad grammar, grammar nazis need not reply]
Re: (Score:3, Insightful)
Why can't someone honeypot a bot, move the system time forward and intercept NTP queries, and watch the traffic to see what DNS queries it generates?
Actually, they managed to do better than that: they reverse-engineered the algorithm, and didn't even need to VM a bot.
However, where the plan failed was not in guessing the domain names, but in coming up with enough money to preemptively register them...
Re:Further Proof (Score:5, Insightful)
Re:Further Proof (Score:5, Informative)
Re:Further Proof (Score:5, Informative)
A little windows trickery:
Right click on internet explorer and click "Run As" run it as admin.
type C:\ into the address bar. Navigate to whatever folder the programs you want to run are in and run them. Anything that spawns from here will be running as admin.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Worth mentioning, sudo is essentially UAC, only somewhat less annoying. But it's still a broken model.
One thing a lot of Unix daemons get right is, one user per task. Basic, stupidly simple security model -- nothing should have more access than it needs to do its job. Server systems still handle this reasonably well -- small things as root, only where needed. Take Apache -- it's root mostly just to bind port 80; everything else is www-data.
Things like this completely go away with modern desktops. The only t
Going back in time ... (Score:5, Interesting)
"the big spam-spewing Srizbi botnet, shut down two weeks ago when McColo was shuttered, has been resurrected and is again under the control of criminals"
I'd love to go back in the '50s, find one of those future drawing artists, show him that head news, and ask him to draw what he think that means in the year 2008.
Hilarity ensue.
Re:Going back in time ... (Score:5, Funny)
Never fails - I never have mod points when I see posts worthy of them.
Re: (Score:2)
Okay, maybe I'm a bit slow, but someone's going to have to explain the joke in that post. +4 Funny? Seriously?
Re:Going back in time ... (Score:5, Funny)
I don't know what he'd draw, but I know it'd be covered in chrome. :)
Re:Going back in time ... (Score:5, Funny)
I guess it would a giant, dilapidated 50's-style robot vomiting a stream of cans of spams to crowds of innocent people.
Re: (Score:2)
"the big spam-spewing Srizbi botnet, shut down two weeks ago when McColo was shuttered, has been resurrected and is again under the control of criminals"
I'd love to go back in the '50s, find one of those future drawing artists, show him that head news, and ask him to draw what he think that means in the year 2008.
Hell, just go back to the 60's and hand it to Mr. Crumb. I'm sure it would be filthy and funny by turns.
Re: (Score:2)
They stopped them once. (Score:5, Insightful)
The sooner the better. My good:spam ratio is almost 5:95 at the moment
Re:They stopped them once. (Score:5, Funny)
Re:They stopped them once. (Score:4, Interesting)
Re: (Score:2)
My brain refuses to simplify, reduce, or factor. I don't know why, nothing else really gives me the trouble.
Re: (Score:2, Funny)
Re:They stopped them once. (Score:4, Interesting)
If that were true, then that might be a good argument to upgrade...
Re: (Score:2)
Re: (Score:3, Informative)
I read that they had. Servers in Estonia shutdown quickly but one left up in Germany.
http://www.theregister.co.uk/2008/11/26/srizbi_returns_from_dead/ [theregister.co.uk]
Comment removed (Score:5, Insightful)
Re:What intriques me... (Score:5, Funny)
Well of course. With no worker unions, government bureaucracy or international laws to get in the way, they have it easier than your average law-abiding citizens and companies.
Not really. (Score:5, Informative)
They also have to deal with various groups trying to stop them. As in TFA:
So the spammers had to have thought about and planned for such a contingency.
And still bring in enough money to pay for the connections they'll be using to control the zombies.
So while attempting to register the domain names, work was going on to update the zombie software.
The question now is how to get those hard-coded references to the various ISP's in the world so that they can block traffic to/from them and stop the zombies from updating again.
Why isn't information such as that ever included in these articles?
Re: (Score:3, Interesting)
Yeah, but do you really need to block the whole country?
The bots obviously need to find their home. Most likely this is via either a hard-coded IP, or a DNS lookup. So, just publish whichever one it is and then everybody can blackhole either the DNS entry or the IP address. If the major ISPs do that the bot dies.
Now, if the bot uses IRC or something like that it could get trickier, since blocking that at the protocol level (short of killing an entire irc network) isn't possible. However, the irc network
Re:What intriques me... (Score:5, Insightful)
Re: (Score:3, Insightful)
You mean, "by not even trying to appear as though you give a shit about who you inconvenience".
If you've tried to contact Customer Support of any corporation (especially any outsourced CS) you know that that company really only pays lip service to the concept. Most corporations only provide just enough CS to be able to show that (massaged) stats re
Re: (Score:2)
no face of the mob perhaps,,,,
Sample bias (Score:2, Insightful)
how efficiently the bad guys always work.
Not really - we only ever hear about the efficient ones here. Head on over to Fark [fark.com] (or even Youtube:) to get some examples of bad guys working....inefficiently.
Thats strange... (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
We don't need no stinking backups... (Score:5, Insightful)
Businesses (Score:2)
Re: (Score:2, Funny)
I have worked in more than a few offices that have no backup plans for when things go wrong; power outs, network outages, supply chain disruptions, and the like would stop work cold. I find it amusing that a band of criminals are running a more flexible and 'professional' operation than many ligament businesses.
And here I've been wasting my time trying to set up an organ chop shop in Hong Kong!
Re: (Score:2)
Re:We don't need no stinking backups... (Score:4, Interesting)
Swedish TeliaSonera and it wasn't done directly, they purchased the link through a third party and made sure it was activated just as the weekend started (probably hoping that no one would shut it down before the weekend was over).
/Mikael
Re: (Score:2)
to all that has been said about how efficient they work and how they do not have to deal with bureaucracy etc one must add motivation. They are motivated by direct profit and by the fact that if they screw up they are possibly in big trouble and I do not mean lack of bonus at the end of the year.
Re: (Score:2)
Are you implying that none of these guys have any backup procedures? Have you personally contacted all of these guys:
connective-tissue.com
Bones-to-bones
Bones2bones.com
JointsRus
bone-glue.com
Fibrous Tissue Cultures (FTC) Ltd.
(Interesting aside: if you Google "ligament businesses" the first hit is a page called "Business Representation (Greek Ligament Service)". Those cl
Re:We don't need no stinking backups... (Score:4, Funny)
Re: (Score:2, Funny)
AAHHAAAHH!!! My ham string!!! Make the burning stop!!!
Did you mean: Spam string?
Re: (Score:2)
Did you mean: Spam string?
Ok how about "AAHHAAHH!!! My spam string!!! Make the flaming stop!!!
A McColo with Fries (Score:5, Funny)
Some Idiots (Score:5, Insightful)
Re:Some Idiots (Score:4, Informative)
Re:Some Idiots (Score:4, Insightful)
Is this because some idiot(s) let McColo get back online for a number of hours, or was that fallback already in place before the McColo initial shut down?
I would be inclined to believe it to be more of the latter than the former. Why wouldn't the authors of the botnet software want to write something in to allow for the creation of a new botnet control system? These guys aren't idiots, as much as we might like to wish they were. They know that it takes time to amass a botnet, so I would expect they included some way to bring back the botnet, should they get caught somewhere.
need to be talking to each other when they blacklist a site
I might be missing something here, but I rather doubt that botnet control comes down to a specific site anywhere. Didn't they just say that the botnet is now controlled from a different country than before? I'm not sure that any amount of activities from major ISP's would be able to be both tolerable to users and capable of restricting the botnets.
Re: (Score:2)
one rogue provider doesn't undermine the good efforts of all the rest.
This sort of resilience was the whole point of the internet anyway. Of course, it was never supposed to be used for "Evil" (tm).
Re: (Score:2)
OK now... (Score:5, Insightful)
Re: (Score:3, Insightful)
How is this surprising to anyone? Do you not understand this is a business, illegal or otherwise? Do you not think cocaine smugglers have backup plans too?
They missed the chance (Score:4, Insightful)
Re: (Score:2)
I was thinking about that.
It would be neat if the bot writers included an uninstall commmand; then you could hijack the server domain, inject the command, and the network would vaporize itself.
But of course they don't do that, and they probably know how to write code that isn't vulnerable to external exploits, so you have to go in through a trusted channel on each infected host. Which is what Microsoft's malware thing does.
And they do that whether the command system is up or down.
What Microsoft needs to do
Re:They missed the chance (Score:5, Informative)
Srizbi will, in fact, accept an uninstall command from a bogus C&C server.
Lots of stuff about Srizbi [fireeye.com]
In the course of invesigating Srizbi, researchers had 250,000 bots under their control for a span of a few days. Sending the uninstall command was one of several ways they could have crippled this small portion of Srizbi. But honestly, no citizen has the legal authority to make changes to hundreds of thousands of other people's PCs. Maybe if some law enforcement agencies would get involved, that would be nice. Or at least give blanket immunity to researchers who would do so.
Re: (Score:2)
Wish my employer took catastrophe planning this (Score:2)
seriously... :-(
Soft on terrorism (Score:4, Informative)
So where are the US antiterrorism people? This is an attack on US assets by foreign nationals. We have a whole Department of Homeland Security. They had a good computer security guy in charge of dealing with such attacks, Amit Yoran, and he quit in 2004 [computerworld.com], fed up because DHS didn't really want to deal with real problems. His replacement was a career lobbyist [dhs.gov]. Really. "He served as Director of 3Com Corporation's Government Relations Office in Washington, DC where he was responsible for all aspects of the company's strategic public policy formulation and advocacy." That's America's first line of defense against cyberterrorism.
The FBI has an antiterrorism operation. What are they doing? What they say they're doing is working to "strengthen and support our top operational priorities: counterterrorism, counterintelligence, cyber, and major criminal programs." [fbi.gov] What they're actually doing is flying around the FBI director in the private jet purchased with antiterrorism funds. [wordpress.com]
FBI testimony before Congress, 2001 [fbi.gov]: "The FBI believes cyber-terrorism, the use of cyber-tools to shut down, degrade, or deny critical national infrastructures, such as energy, transportation, communications, or government services, for the purpose of coercing or intimidating a government or civilian population, is clearly an emerging threat for which its must develop prevention, deterrence, and response capabilities."
FBI testimony before Congress, 2004 [fbi.gov]: " In the event of a cyberterrorist attack, the FBI will conduct an intense post-incident investigation to determine the source including the motive and purpose of the attack."
So where's the action?
Heads need to roll at DHS and the FBI.
Re: (Score:2)
They're busy watching Kazaa for pr0n doctors.
Re: (Score:2)
Re: (Score:3, Interesting)
Tens of millions of American computers are under the direct control of hostile foreign interests. At any moment, they can be ordered to do anything by those interests, including erasing files, sending financial information, or attacking infrastructure sites. That's a much bigger threat than some guys mouthing off in a bar in Miami about blowing up some building [cnn.com], which got the FBI's full attention.
Re: (Score:2, Interesting)
Or simply killing all those whose machines are infected? And if you think that any of those is acceptable then you surely won't have any objection if/when other nations start behaving that way in your country, will you? I know where most of my spam originates.
I have no problem with the infected machines being killed off, regardless of where the attacker that killed the machine is located or who the attacker is. Just leave some indication of why the machine was killed so I can point to it when charging the customer for re-installing their OS and recovering whatever of their files that you are kind enough to leave for them. A nice little README.txt file explaining "Your machine was a spam spewing zombie in the <botnet name> botnet." will be sufficient.
Disaster Recovery (Score:2)
Once again we have proof of the value of a disaster recovery plan.
I would have thought a money mill like that would use an Active/Active failover rather than a cold standby site, but I suppose they have to consider risks versus costs like anybody.
how come you say for sure they're in Estonia? (Score:2, Interesting)
(H|Cr)ack attack (Score:4, Interesting)
What I wonder is, why don't some of those white/grey/black hat hackers out there don't try to hijack the botnets, spammers, or the control servers of the spammers and shut that shit down. I'm sure it would be challenging and billions would approve.
The way I see it, spam is a distributed problem that ignores virtually any boundary you can think of, so the solution must be equally pervasive and distributed. Such as an equally (dis)organized group of spammer-attackers. Sure some innocents will probably get nailed, but ain't war hell?
Re: (Score:3, Interesting)
Money was involved... (Score:3, Informative)
Re: (Score:3, Insightful)
Re:Money was involved... (Score:5, Informative)
Blue Frog? (Score:2)
Does anyone remember Blue Frog? That was actually [i]working[/i]. Nothing before or since has been anything but a mosquito bite to spammers.
There was an open source version, Okopipi, in the works for a very brief moment. I think the forum is probably full of weeds and spam now.
Re:Blue Frog? (Score:4, Interesting)
As far as I can see the only real solution to spam is intelligent filtering, which Google leads the way on: it's got to the point where if a spam mail gets through, I open it it up and have a good look at it to see how the heck it got through.
Re: (Score:2)
problem with blue frog was that, while it did work, it leeched other people's bandwidth to perform dDoS with.
You're wrong.
the bluefrog client submitted one complaint report for each relevant spam that client's machine received. If you didn't receive that spam and forward it to Blue Frog, your box wouldn't send out anything. Likewise, no one else's box would send out complaints for spam that you received.
Some could describe it as a ddos, but blue frog actually throttled itself to keep from knocking people off the internet. Complaints were sent out gradually over a couple of days, rather than having all the clien
No wonder! (Score:2)
That explains why I got higher spam in my inboxes over the last two days. Ugh! :(
Why is this still going on? (Score:2, Interesting)
It's pretty obvious to me that it's trivially simple to watch one of these bots cycle through its algorithm, then when it gets a working server site, you trace to that site and find who's running it and cut their balls off as well as their network access. Then watch it happen again, and so on.
That would be a lot smarter than paying tens of thousands of dollars for randomly-generated domain names.
Why are spam-fighters so intent on doing the dumb thing instead of the right thing?
Re: (Score:3, Interesting)
Stupid question (Score:2)
I'm a non-(computer) geek.
Can somebody explain to me how I can tell if my computer is infected by a bot?
Is there something that will tell me what's running in the background, so I can identify a bot spewing out spam from my system?
(Yes, I promise to learn linux.)
Re: (Score:2)
Update (Score:5, Informative)
The Estonia based Command and Control servers have been kicked offline.
Only one server is still online, based in Frankfurt, Germany; name registered through the Cayman Islands.
This is not the server that's hard-coded in to the new Srizbi patch, just one of the backup servers supplying it.
source [fireeye.com]
In related news ... (Score:5, Funny)
Re: (Score:2)
This is organized crime after all.
Re:Aim for the head ... (Score:5, Funny)
You don't have much experience battling hydras, do you?
Re: (Score:2)
No, but I hear a wall of Fire can be helpful.
Re: (Score:2, Funny)
Nice troll.
I think it might be more accurate to say if only they had a strategy.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I always had ~1200 mails in my gmail spam folder (ie: spam received in the last 30 days)
(until today, at least,) it has been shrinking in the last two weeks, and has (atm) 950 mail... I'll let the party begin again, and see if this number goes up again.
Write back when it has over 8100 in it (since Sun, Oct 19, 2008). The price of having the same email address for over 12 years: average of roughly 9 messages per hour that land in the spam folder. Short term average (just today) is about the same... 9 to 10 per hour.
If we would have somehow guessed the onslaught of junk email we'd have to endure back then, mailing lists and the like would have been set up differently back then.
Marc
Re: (Score:3, Interesting)
Because Srizbi has an algorithm that generates new pseudo-random domain names based on the current date. If the hard-coded C&C server ever goes down, the bot herder can calculate what domain names Srizbi will be looking to in the near future, and register them to reclaim the botnet (and push an update that changes the hard-coded server)
Technical Details of Srizbis domain generation algorithm [fireeye.com]