Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/5/2010
06:20 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researchers Infiltrate Storm Botnet Successor

Going undercover in Waledac botnet, European researchers discover it's much bigger than they thought

In an undercover mission to learn more about the size and scope of the son of the infamous Storm botnet, Waledac, German researchers have discovered the spamming botnet is much bigger and more efficient than previously thought.

The University of Mannheim and University of Vienna team boldly infiltrated the Waledac botnet from Aug. 6 through Sept. 1 of last year using a cloned Waledac bot they built and code-named "Walowdac." The phony bot injected the IP addresses of the researchers' analysis systems into the botnet, and the researchers were able to collect detailed data on the botnet and its inner workings. They found Waledac runs a minimum of 55,000 bots a day, with a total of 390,000 bots -- much larger than previous estimates of 20,000 or so bots.

The researchers also were able to measure success rates of various spam campaigns launched by Waledac, and were able to observe up close Waledac's newer features, such as the ability to steal credentials from bot-infected machines. Their clone did not do any spamming, however. "We used an implementation of the bot that speaks all of the protocols and communicates like a bot would do. We had full control over it, and it didn't send any spam...it just participated in the communications," says Thorsten Holz, one of the researchers.

The clone appeared to Waledac as one of its "repeaters" -- the nodes that sit between the infected spamming bots and the back-end servers. Getting into the botnet at that level gave the researchers a more accurate accounting of the botnet. "We were able to get an overview of what bots are out there, how many there are, [and other details]," Holz says.

Waledac has been a popular subject for researchers to study during the past year: Researchers from Symantec, Trend Micro, and ESET, for instance, have also done intensive studies of the botnet. But the University of Mannheim researchers took a more aggressive approach in their experiment. Waledac came on the scene more than a year ago after the notorious Storm botnet, which had ballooned into one of the biggest botnets ever, suddenly disappeared off the grid in 2008. It re-emerged as Waledac, with new malware and a more sustainable architecture.

The German researchers, who also include Ben Stock, Jan Gobel, Markus Engelberth, and Felix C. Freiling, calculated from their research that Waledac could theoretically send more than 1.5 billion spam messages a day. But that's actually a conservative estimate, they said in their report (PDF) on the experiment. "However, this also is only valid for 10,000 bots each hour with our monitoring showing up to 30,000 bots per hour during the daytime. Thus, this number might very well be tripled," the report says.

Waledac changes up its malware variants about every two weeks, the researchers observed, and the U.S. is home to the majority of the bots and repeaters, with 17.34 percent of the spamming bots and 19.5 percent of the repeaters. And around 90 percent of the Waledac bots were 32-bit XP machines.

The researchers were also able to get counts of information-stealing activity by Waledac. In addition, Holz says Waledac steals SMTP server credentials, so it can spam using those servers, and also FTP user credentials, so it can log into FTP servers. "They are also stealing these FTP credentials to log into FTP servers and search for HTML pages to inject iFrames [into]," Holz says. "This is part of the propagation mechanism of Waledac."

Pierre-Marc Bureau, a senior researcher with ESET who has studied Waledac and collaborated with Holz and his team, says he thinks Waledac's operators are gearing up for more than just spamming. "Waledac has been stealing information from infected machines, such as credentials for Websites and email addresses to spam to," Bureau says. "But it's also stealing information from infected machines, mostly for propagating and sending spam. But when you have a user list from a Website, you can do anything you want with it...you can sell it to someone else."

Bureau says he thinks Waledac's operators are gathering this stolen information to set up operations other than their bread-and-butter spamming roots. "In general, Waledac is a complete operation aimed at sending spam. But I think they are already prepared to diversify their activities...there's more money to be made in other areas," he says.

Meanwhile, the German researchers' undercover operation in Waledac had a few glitches, too: Waledac's operators were able to detect the German researchers' IP address range from the University of Mannheim and filtered them, knocking them off. "So we changed our IP range" and got back into the botnet, Holz says.

And the researchers knew they were at risk of Waledac's operators waging a distributed denial-of-service (DDoS) attack on the University of Mannheim's network, where the IP addresses initially resided. "The main threat to us was DDoS," Holz says. "In the past, we had some incidents where people were DDoSing our servers since we were also running honeypots on those IP addresses."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15505
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2020-15506
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15507
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to read files on the system via unspecified vectors.
CVE-2020-15096
PUBLISHED: 2020-07-07
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affecte...
CVE-2020-4075
PUBLISHED: 2020-07-07
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not ...