Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/29/2012
05:23 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

It's (Already) Baaack: Kelihos Botnet Rebounds With New Variant

Botnet hunters debate whether Kelihos/Hlux operators can reclaim rescued bots

Gunter Ollmann, vice president of research at Damballa, says botnet takedowns are a temporary disruption to the operation -- and when it comes to peer-to-peer networks like Kelihos, there's a legal conundrum.

"Like I've said before, if you're going to take down a botnet you have to take out the criminals at the top. It's the only way. Taking out the infrastructure they depend upon for distributing new infectious material and C&C is a disruption technique -- a delaying tactic if you will, and maybe an evidence building process if you're lucky," Ollmann said in a blog post today. "In the case of P2P-based botnets, there's very little infrastructure you can get your hands on -- and you'll probably end up having to issue commands to botnet victim devices -- which is fraught with legal and ethical problems."

[ Microsoft continued its aggressive legal tear against botnets with a new operation for which the software giant successfully seized some command-and-control (C&C) servers run by cybercriminals using Zeus and its related crimeware. See Microsoft, Financial Partners Seize Servers Used In Zeus Botnets. ]

And even if security vendors are able to successfully knock out a C&C infrastructure, it's meaningless unless they also remove the infection vector, according to Ollmann. "Even if you're lucky enough to be able to take out the C&C infrastructure or mechanism of communication, if you don't take out the infection vector -- the mechanisms of distributing new crimeware variants -- you've achieved very little. As evidenced by the most recent Kelihos botnet takedown attempt, the criminals retained their primary distribution system and are already accumulating thousands of new victims per day with their latest Kelihos-variant campaign," he wrote.

Kaspersky's Preuss, meanwhile, maintains that even a temporary shutdown of a botnet is helpful in the fight against botnets. "It would be naive to believe they would not continue to create new botnets for malicious use. Our sinkholing operations for Hlux A and B have shown that our countermeasure efforts are successful, even if it's just a temporary way to slow the group down," he says.

But the big prize is the bad guys, he notes. "The only way to permanently shut down botnets is to arrest and prosecute the creators and groups operating them. This is a difficult task because security companies encounter different federal policies, jurisdictions, and legal processes in various countries where botnets are located. This causes the law enforcement investigations and legal process to be a long and arduous process," Preuss says. "The only way to accelerate this process is by having more international law passed that supports closer collaboration between cybersecurity professionals, law enforcement, and legal systems."

Meanwhile, Seculert reports that the majority of the infected Facebook users are from Poland and the U.S. -- a trend that was seen with the machines Kaspersky and CrowdStrike grabbed. Some 54 percent of the Facebook infections are in Poland, and 30 percent in the U.S., according to Seculert.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
3/30/2012 | 11:14:48 PM
re: It's (Already) Baaack: Kelihos Botnet Rebounds With New Variant
It's a non-stop game of whack-a-mole. I think it should be expected at this point that botnet operators are going to look for ways to build a more resilient network in light of the success these take downs are having.
Brian Prince, InformationWeek/Dark Reading Comment Moderator
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9008
PUBLISHED: 2020-02-25
Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.
CVE-2020-9018
PUBLISHED: 2020-02-25
LiteCart through 2.2.1 allows admin/?app=users&doc=edit_user CSRF to add a user.
CVE-2020-9019
PUBLISHED: 2020-02-25
The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form, as demonstrated by title and Description.
CVE-2020-9391
PUBLISHED: 2020-02-25
An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been ...
CVE-2020-8793
PUBLISHED: 2020-02-25
OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.