Vulnerabilities / Threats

1/5/2010
06:20 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researchers Infiltrate Storm Botnet Successor

Going undercover in Waledac botnet, European researchers discover it's much bigger than they thought

In an undercover mission to learn more about the size and scope of the son of the infamous Storm botnet, Waledac, German researchers have discovered the spamming botnet is much bigger and more efficient than previously thought.

The University of Mannheim and University of Vienna team boldly infiltrated the Waledac botnet from Aug. 6 through Sept. 1 of last year using a cloned Waledac bot they built and code-named "Walowdac." The phony bot injected the IP addresses of the researchers' analysis systems into the botnet, and the researchers were able to collect detailed data on the botnet and its inner workings. They found Waledac runs a minimum of 55,000 bots a day, with a total of 390,000 bots -- much larger than previous estimates of 20,000 or so bots.

The researchers also were able to measure success rates of various spam campaigns launched by Waledac, and were able to observe up close Waledac's newer features, such as the ability to steal credentials from bot-infected machines. Their clone did not do any spamming, however. "We used an implementation of the bot that speaks all of the protocols and communicates like a bot would do. We had full control over it, and it didn't send any spam...it just participated in the communications," says Thorsten Holz, one of the researchers.

The clone appeared to Waledac as one of its "repeaters" -- the nodes that sit between the infected spamming bots and the back-end servers. Getting into the botnet at that level gave the researchers a more accurate accounting of the botnet. "We were able to get an overview of what bots are out there, how many there are, [and other details]," Holz says.

Waledac has been a popular subject for researchers to study during the past year: Researchers from Symantec, Trend Micro, and ESET, for instance, have also done intensive studies of the botnet. But the University of Mannheim researchers took a more aggressive approach in their experiment. Waledac came on the scene more than a year ago after the notorious Storm botnet, which had ballooned into one of the biggest botnets ever, suddenly disappeared off the grid in 2008. It re-emerged as Waledac, with new malware and a more sustainable architecture.

The German researchers, who also include Ben Stock, Jan Gobel, Markus Engelberth, and Felix C. Freiling, calculated from their research that Waledac could theoretically send more than 1.5 billion spam messages a day. But that's actually a conservative estimate, they said in their report (PDF) on the experiment. "However, this also is only valid for 10,000 bots each hour with our monitoring showing up to 30,000 bots per hour during the daytime. Thus, this number might very well be tripled," the report says.

Waledac changes up its malware variants about every two weeks, the researchers observed, and the U.S. is home to the majority of the bots and repeaters, with 17.34 percent of the spamming bots and 19.5 percent of the repeaters. And around 90 percent of the Waledac bots were 32-bit XP machines.

The researchers were also able to get counts of information-stealing activity by Waledac. In addition, Holz says Waledac steals SMTP server credentials, so it can spam using those servers, and also FTP user credentials, so it can log into FTP servers. "They are also stealing these FTP credentials to log into FTP servers and search for HTML pages to inject iFrames [into]," Holz says. "This is part of the propagation mechanism of Waledac."

Pierre-Marc Bureau, a senior researcher with ESET who has studied Waledac and collaborated with Holz and his team, says he thinks Waledac's operators are gearing up for more than just spamming. "Waledac has been stealing information from infected machines, such as credentials for Websites and email addresses to spam to," Bureau says. "But it's also stealing information from infected machines, mostly for propagating and sending spam. But when you have a user list from a Website, you can do anything you want with it...you can sell it to someone else."

Bureau says he thinks Waledac's operators are gathering this stolen information to set up operations other than their bread-and-butter spamming roots. "In general, Waledac is a complete operation aimed at sending spam. But I think they are already prepared to diversify their activities...there's more money to be made in other areas," he says.

Meanwhile, the German researchers' undercover operation in Waledac had a few glitches, too: Waledac's operators were able to detect the German researchers' IP address range from the University of Mannheim and filtered them, knocking them off. "So we changed our IP range" and got back into the botnet, Holz says.

And the researchers knew they were at risk of Waledac's operators waging a distributed denial-of-service (DDoS) attack on the University of Mannheim's network, where the IP addresses initially resided. "The main threat to us was DDoS," Holz says. "In the past, we had some incidents where people were DDoSing our servers since we were also running honeypots on those IP addresses."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.