Vulnerabilities / Threats
8/30/2010
01:52 PM
50%
50%

Pushdo Botnet Crippled Via Coordinated Takedown

Security researchers have pushed large parts of the spam maker offline, but it may not decrease overall crimeware levels.

8 Strategic Security Survey: Global Threat, Local Pain
(click image for larger view)
Strategic Security Survey: Global Threat, Local Pain
Has the Pushdo botnet been put out of commission?

On Friday, the lead security researcher at M86 Security Labs, Phil Hay, said in a blog post that "the usual torrent of spam from the Pushdo -- or Cutwail -- botnet had turned into a dribble" after making its presence more than known throughout August, and well before.

Indeed, the Pushdo botnet has regularly distributed massive quantities of spam, including malicious PDFs. Earlier this year, for example, the botnet's pushing of extreme volumes of junk data created a virtual denial of service attack against hundreds of websites, including domains operated by the CIA, FBI, Google, Microsoft, and Mozilla.

Now, however, security researchers have struck back.

According to a blog post by Thorsten Holz at cybercrime intelligence service LastLine, "in the last couple of days, we examined in detail the infrastructure behind Pushdo/Cutwail and also worked on taking down the relevant servers."

"We identified a total of 30 servers used as part of the Pushdo/Cutwail infrastructure, located at eight different hosting providers all over the world," said Holz. "We contacted all hosting providers and worked with them on taking down the machines, which lead to the take-down of almost 20 servers. Unfortunately, not all providers were responsive and thus several command & control servers are still online at this point."

Still, the takedowns have resulted in infected machines not being able to find Pushdo command-and-control servers, meaning that the effort is having a demonstrable effect, as M86 confirmed. Furthermore, several of the holdout service providers are in discussions with LastLine to remove the offending Pushdo servers. "We decided not to publish this list for now to give these hosting provides another chance to act," said Holz.

Unfortunately, however, even Pushdo's apparent demise doesn't presage the end of botnet spam as we know it. "Previous experience has taught us that these botnet takedowns are short lived," said Hay at M86 Security Labs. "Disabling control servers does not incapacitate the people behind the botnet. It is highly likely they'll be back before long with new control servers, and bots to do their spamming. In the meantime, we can enjoy a few days with less spam about."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4231
Published: 2015-07-03
The Python interpreter in Cisco NX-OS 6.2(8a) on Nexus 7000 devices allows local users to bypass intended access restrictions and delete an arbitrary VDC's files by leveraging administrative privileges in one VDC, aka Bug ID CSCur08416.

CVE-2015-4232
Published: 2015-07-03
Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.

CVE-2015-4234
Published: 2015-07-03
Cisco NX-OS 6.0(2) and 6.2(2) on Nexus devices has an improper OS configuration, which allows local users to obtain root access via unspecified input to the Python interpreter, aka Bug IDs CSCun02887, CSCur00115, and CSCur00127.

CVE-2015-4237
Published: 2015-07-03
The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv0...

CVE-2015-4239
Published: 2015-07-03
Cisco Adaptive Security Appliance (ASA) Software 9.3(2.243) and 100.13(0.21) allows remote attackers to cause a denial of service (device reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCus84220.

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report