Vulnerabilities / Threats

1/5/2010
06:20 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researchers Infiltrate Storm Botnet Successor

Going undercover in Waledac botnet, European researchers discover it's much bigger than they thought

In an undercover mission to learn more about the size and scope of the son of the infamous Storm botnet, Waledac, German researchers have discovered the spamming botnet is much bigger and more efficient than previously thought.

The University of Mannheim and University of Vienna team boldly infiltrated the Waledac botnet from Aug. 6 through Sept. 1 of last year using a cloned Waledac bot they built and code-named "Walowdac." The phony bot injected the IP addresses of the researchers' analysis systems into the botnet, and the researchers were able to collect detailed data on the botnet and its inner workings. They found Waledac runs a minimum of 55,000 bots a day, with a total of 390,000 bots -- much larger than previous estimates of 20,000 or so bots.

The researchers also were able to measure success rates of various spam campaigns launched by Waledac, and were able to observe up close Waledac's newer features, such as the ability to steal credentials from bot-infected machines. Their clone did not do any spamming, however. "We used an implementation of the bot that speaks all of the protocols and communicates like a bot would do. We had full control over it, and it didn't send any spam...it just participated in the communications," says Thorsten Holz, one of the researchers.

The clone appeared to Waledac as one of its "repeaters" -- the nodes that sit between the infected spamming bots and the back-end servers. Getting into the botnet at that level gave the researchers a more accurate accounting of the botnet. "We were able to get an overview of what bots are out there, how many there are, [and other details]," Holz says.

Waledac has been a popular subject for researchers to study during the past year: Researchers from Symantec, Trend Micro, and ESET, for instance, have also done intensive studies of the botnet. But the University of Mannheim researchers took a more aggressive approach in their experiment. Waledac came on the scene more than a year ago after the notorious Storm botnet, which had ballooned into one of the biggest botnets ever, suddenly disappeared off the grid in 2008. It re-emerged as Waledac, with new malware and a more sustainable architecture.

The German researchers, who also include Ben Stock, Jan Gobel, Markus Engelberth, and Felix C. Freiling, calculated from their research that Waledac could theoretically send more than 1.5 billion spam messages a day. But that's actually a conservative estimate, they said in their report (PDF) on the experiment. "However, this also is only valid for 10,000 bots each hour with our monitoring showing up to 30,000 bots per hour during the daytime. Thus, this number might very well be tripled," the report says.

Waledac changes up its malware variants about every two weeks, the researchers observed, and the U.S. is home to the majority of the bots and repeaters, with 17.34 percent of the spamming bots and 19.5 percent of the repeaters. And around 90 percent of the Waledac bots were 32-bit XP machines.

The researchers were also able to get counts of information-stealing activity by Waledac. In addition, Holz says Waledac steals SMTP server credentials, so it can spam using those servers, and also FTP user credentials, so it can log into FTP servers. "They are also stealing these FTP credentials to log into FTP servers and search for HTML pages to inject iFrames [into]," Holz says. "This is part of the propagation mechanism of Waledac."

Pierre-Marc Bureau, a senior researcher with ESET who has studied Waledac and collaborated with Holz and his team, says he thinks Waledac's operators are gearing up for more than just spamming. "Waledac has been stealing information from infected machines, such as credentials for Websites and email addresses to spam to," Bureau says. "But it's also stealing information from infected machines, mostly for propagating and sending spam. But when you have a user list from a Website, you can do anything you want with it...you can sell it to someone else."

Bureau says he thinks Waledac's operators are gathering this stolen information to set up operations other than their bread-and-butter spamming roots. "In general, Waledac is a complete operation aimed at sending spam. But I think they are already prepared to diversify their activities...there's more money to be made in other areas," he says.

Meanwhile, the German researchers' undercover operation in Waledac had a few glitches, too: Waledac's operators were able to detect the German researchers' IP address range from the University of Mannheim and filtered them, knocking them off. "So we changed our IP range" and got back into the botnet, Holz says.

And the researchers knew they were at risk of Waledac's operators waging a distributed denial-of-service (DDoS) attack on the University of Mannheim's network, where the IP addresses initially resided. "The main threat to us was DDoS," Holz says. "In the past, we had some incidents where people were DDoSing our servers since we were also running honeypots on those IP addresses."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.