Attacks/Breaches
2/1/2010
02:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Botnet Floods Major Websites With Fake SSL Connections

DDoS-like traffic surge against CIA, Chase, Google Chrome, FBI, and others has researchers puzzled by Pushdo botnet's plans

A spamming botnet known for keeping a low profile has been hammering hundreds of Websites -- including the CIA, Chase, Mozilla Labs, Twitter, SANS, Google Chrome, and the FBI -- during the past week with an unusually conspicuous amount of phony traffic that has researchers rushing to analyze its next move.

The Pushdo botnet, a.k.a. "Cutwail" and "Pandex," has been flooding those sites with bogus SSL connections that stop short of requesting anything from the Website. The infected bots begin to initiate an SSL connection with some "junk" traffic and then disconnect, according to The Shadowserver Foundation. Shadowserver and other researchers have been monitoring the activity, which increased traffic by several million hits across several hundred thousand IP addresses, according to Shadowserver.

The botnet hit the ZeusTracker Website, for example, with hundreds of thousands of different IP addresses within a 24-hour period. "This is a lot of bots generating a lot of traffic," blogged Steven Adair, a researcher with Shadowserver. Recent code changes to Pushdo resulted in its bots generating the "junk" SSL connections to the 315 Websites, he said.

So what is Pushdo up to? Joe Stewart, director of malware research for Secureworks, says the botnet is making fake SSL connection attempts: Malformed packets cause the server to return an SSL negotiation error. "By adding the initial header of an SSL conversation, they may be attempting to avoid closer scrutiny by less vigilant inspection devices," Stewart says. "And by sending a flurry of these connections to a number of legit 'decoy' sites, it helps the Pushdo C&C [command and control] traffic blend in and remain undetected in some cases," he says.

It's unclear thus far whether this is a test-run for phony SSL connections gone amuck that ended up exposing this Pushdo traffic, or something else. Stewart says it's possible there could be more to the latest activity, such as the botnet's rotating its target lists. "It's hard to say," he says.

Blending in has traditionally been Pushdo's trademark: Although it's one of the top five spamming botnets, it's also one of the more under-the-radar botnets around. But this latest activity has researchers wondering how this massive surge of traffic, which resembles a distributed denial-of-service (DDoS) attack, would ultimately help its traffic blend in and become less detectable.

Shadowserver says the traffic is technically an attack, even though it doesn't appear to be trying to knock the sites offline like a DDoS does. "We find it hard to believe this much activity would be used to make the bots blend in with normal traffic, but at the same time it doesn't quite look like a DDoS either," Adair says.

Secureworks' Stewart says he has witnessed botnets sending traffic via SSL or port 443, but this phony SSL connection attempt is a first. "The Pushdo C&C protocol now also uses similar packets to encapsulate its encrypted/compressed phone-home requests," he says. "Port 443 is commonly being used to proxy all kinds of non-SSL traffic by legit applications and bots alike, so it stands to reason that a heuristic one might look for suspicious or firewall-policy-violating traffic connections over port 443 that aren't using SSL. "

The surge in traffic from Pushdo could cause problems for Websites with limited bandwidth and that typically get only a few hundred to a few thousand hits daily, Shadowserver says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2130
Published: 2015-03-05
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka B...

CVE-2014-9688
Published: 2015-03-05
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

CVE-2015-0598
Published: 2015-03-05
The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.

CVE-2015-0607
Published: 2015-03-05
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0657
Published: 2015-03-05
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.