Vulnerabilities / Threats
8/30/2010
01:52 PM
50%
50%

Pushdo Botnet Crippled Via Coordinated Takedown

Security researchers have pushed large parts of the spam maker offline, but it may not decrease overall crimeware levels.

8 Strategic Security Survey: Global Threat, Local Pain
(click image for larger view)
Strategic Security Survey: Global Threat, Local Pain
Has the Pushdo botnet been put out of commission?

On Friday, the lead security researcher at M86 Security Labs, Phil Hay, said in a blog post that "the usual torrent of spam from the Pushdo -- or Cutwail -- botnet had turned into a dribble" after making its presence more than known throughout August, and well before.

Indeed, the Pushdo botnet has regularly distributed massive quantities of spam, including malicious PDFs. Earlier this year, for example, the botnet's pushing of extreme volumes of junk data created a virtual denial of service attack against hundreds of websites, including domains operated by the CIA, FBI, Google, Microsoft, and Mozilla.

Now, however, security researchers have struck back.

According to a blog post by Thorsten Holz at cybercrime intelligence service LastLine, "in the last couple of days, we examined in detail the infrastructure behind Pushdo/Cutwail and also worked on taking down the relevant servers."

"We identified a total of 30 servers used as part of the Pushdo/Cutwail infrastructure, located at eight different hosting providers all over the world," said Holz. "We contacted all hosting providers and worked with them on taking down the machines, which lead to the take-down of almost 20 servers. Unfortunately, not all providers were responsive and thus several command & control servers are still online at this point."

Still, the takedowns have resulted in infected machines not being able to find Pushdo command-and-control servers, meaning that the effort is having a demonstrable effect, as M86 confirmed. Furthermore, several of the holdout service providers are in discussions with LastLine to remove the offending Pushdo servers. "We decided not to publish this list for now to give these hosting provides another chance to act," said Holz.

Unfortunately, however, even Pushdo's apparent demise doesn't presage the end of botnet spam as we know it. "Previous experience has taught us that these botnet takedowns are short lived," said Hay at M86 Security Labs. "Disabling control servers does not incapacitate the people behind the botnet. It is highly likely they'll be back before long with new control servers, and bots to do their spamming. In the meantime, we can enjoy a few days with less spam about."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4467
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.

CVE-2014-4476
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4477
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4479
Published: 2015-01-30
WebKit, as used in Apple iOS before 8.1.3; Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3; and Apple TV before 7.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulner...

CVE-2014-4480
Published: 2015-01-30
Directory traversal vulnerability in afc in AppleFileConduit in Apple iOS before 8.1.3 and Apple TV before 7.0.3 allows attackers to access unintended filesystem locations by creating a symlink.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.