Vulnerabilities / Threats
01:52 PM

Pushdo Botnet Crippled Via Coordinated Takedown

Security researchers have pushed large parts of the spam maker offline, but it may not decrease overall crimeware levels.

8 Strategic Security Survey: Global Threat, Local Pain
(click image for larger view)
Strategic Security Survey: Global Threat, Local Pain
Has the Pushdo botnet been put out of commission?

On Friday, the lead security researcher at M86 Security Labs, Phil Hay, said in a blog post that "the usual torrent of spam from the Pushdo -- or Cutwail -- botnet had turned into a dribble" after making its presence more than known throughout August, and well before.

Indeed, the Pushdo botnet has regularly distributed massive quantities of spam, including malicious PDFs. Earlier this year, for example, the botnet's pushing of extreme volumes of junk data created a virtual denial of service attack against hundreds of websites, including domains operated by the CIA, FBI, Google, Microsoft, and Mozilla.

Now, however, security researchers have struck back.

According to a blog post by Thorsten Holz at cybercrime intelligence service LastLine, "in the last couple of days, we examined in detail the infrastructure behind Pushdo/Cutwail and also worked on taking down the relevant servers."

"We identified a total of 30 servers used as part of the Pushdo/Cutwail infrastructure, located at eight different hosting providers all over the world," said Holz. "We contacted all hosting providers and worked with them on taking down the machines, which lead to the take-down of almost 20 servers. Unfortunately, not all providers were responsive and thus several command & control servers are still online at this point."

Still, the takedowns have resulted in infected machines not being able to find Pushdo command-and-control servers, meaning that the effort is having a demonstrable effect, as M86 confirmed. Furthermore, several of the holdout service providers are in discussions with LastLine to remove the offending Pushdo servers. "We decided not to publish this list for now to give these hosting provides another chance to act," said Holz.

Unfortunately, however, even Pushdo's apparent demise doesn't presage the end of botnet spam as we know it. "Previous experience has taught us that these botnet takedowns are short lived," said Hay at M86 Security Labs. "Disabling control servers does not incapacitate the people behind the botnet. It is highly likely they'll be back before long with new control servers, and bots to do their spamming. In the meantime, we can enjoy a few days with less spam about."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-12
vpxd in VMware vCenter Server 5.0 before u3e, 5.1 before u3, and 5.5 before u2 allows remote attackers to cause a denial of service via a long heartbeat message.

Published: 2015-10-12
The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.

Published: 2015-10-12
Cisco Unified Computing System (UCS) B Blade Server Software 2.2.x before 2.2.6 allows local users to cause a denial of service (host OS or BMC hang) by sending crafted packets over the Inter-IC (I2C) bus, aka Bug ID CSCuq77241.

Published: 2015-10-12
The process-management implementation in Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows local users to gain privileges by terminating a supervised process and then triggering the restart of a process by the root account, aka Bug ID CSCuv12272.

Published: 2015-10-12
HP 3PAR Service Processor SP 4.2.0.GA-29 (GA) SPOCC, SP 4.3.0.GA-17 (GA) SPOCC, and SP 4.3.0-GA-24 (MU1) SPOCC allows remote authenticated users to obtain sensitive information via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.