Vulnerabilities / Threats
8/30/2010
01:52 PM
Connect Directly
RSS
E-Mail
50%
50%

Pushdo Botnet Crippled Via Coordinated Takedown

Security researchers have pushed large parts of the spam maker offline, but it may not decrease overall crimeware levels.

8 Strategic Security Survey: Global Threat, Local Pain
(click image for larger view)
Strategic Security Survey: Global Threat, Local Pain
Has the Pushdo botnet been put out of commission?

On Friday, the lead security researcher at M86 Security Labs, Phil Hay, said in a blog post that "the usual torrent of spam from the Pushdo -- or Cutwail -- botnet had turned into a dribble" after making its presence more than known throughout August, and well before.

Indeed, the Pushdo botnet has regularly distributed massive quantities of spam, including malicious PDFs. Earlier this year, for example, the botnet's pushing of extreme volumes of junk data created a virtual denial of service attack against hundreds of websites, including domains operated by the CIA, FBI, Google, Microsoft, and Mozilla.

Now, however, security researchers have struck back.

According to a blog post by Thorsten Holz at cybercrime intelligence service LastLine, "in the last couple of days, we examined in detail the infrastructure behind Pushdo/Cutwail and also worked on taking down the relevant servers."

"We identified a total of 30 servers used as part of the Pushdo/Cutwail infrastructure, located at eight different hosting providers all over the world," said Holz. "We contacted all hosting providers and worked with them on taking down the machines, which lead to the take-down of almost 20 servers. Unfortunately, not all providers were responsive and thus several command & control servers are still online at this point."

Still, the takedowns have resulted in infected machines not being able to find Pushdo command-and-control servers, meaning that the effort is having a demonstrable effect, as M86 confirmed. Furthermore, several of the holdout service providers are in discussions with LastLine to remove the offending Pushdo servers. "We decided not to publish this list for now to give these hosting provides another chance to act," said Holz.

Unfortunately, however, even Pushdo's apparent demise doesn't presage the end of botnet spam as we know it. "Previous experience has taught us that these botnet takedowns are short lived," said Hay at M86 Security Labs. "Disabling control servers does not incapacitate the people behind the botnet. It is highly likely they'll be back before long with new control servers, and bots to do their spamming. In the meantime, we can enjoy a few days with less spam about."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0985
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.

CVE-2014-0986
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.

CVE-2014-0987
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.

CVE-2014-0988
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.

CVE-2014-0989
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.

Best of the Web
Dark Reading Radio