Botnet revelation shows darker underbelly of malware

Kneber was built using a well-established toolkit for aggregating botnets called ZeuS that has been around for years

Information gathered about a newly discovered botnet called Kneber indicates that multiple infections by different malware on the same host could work together as a sophisticated mechanism to give all the malware a better survival rate.

The sheer size of the Kneber botnet -- 74,000 compromised computers in 2,400 different companies -- attracted most of the attention when Kneber was revealed Thursday. But how it interacts with other malware networks suggests a symbiotic relationship that ultimately makes each botnet more resistant to being dismantled, says Alex Cox, the senior consultant in the research department at NetWitness who discovered Kneber.

Kneber was built using a well-established toolkit for aggregating botnets called ZeuS that has been around for years. Kneber is an example of just one botnet built with the toolkit, but because Cox captured 75GB of log data from the command-and-control server, he was able to examine detailed characteristics of the computers ZeuS took over.

What he found is that more than half the 74,000 compromised computers -- bots -- within Kneber were also found infected with other malware that uses a different command-and-control structure. If one of the criminal networks were disabled, the other could be used to build it up again,

"At the very least, two separate botnet families with different [command-and-control] infrastructures can provide fault tolerance and recoverability in the event that one [command-and-control] mechanism is taken down by security efforts," he says in his written analysis of the Kneber botnet.

In this case, more than half the machines that made up the botnet were infected with both ZeuS, which steals user data, and Waledac, a spamming malware that uses peer-to-peer mechanisms to spread more infections, he says. He can't conclude for sure that they're working together in this case, but the presence of both introduces an interesting possibility: If the ZeuS command-and-control infrastructure is cut down, the owner of the ZeuS botnet could go to the person running the Waledac botnet and pay for it to push a ZeuS upgrade that brings the ZeuS bots back online reporting to a new server, he says.

Alternatively, a single group could run both the ZeuS and Waledac botnets and push the upgrade itself. "From a disaster-recovery perspective, it makes sense," Cox says.

The Kneber server log contained individuals' passwords to sites including Facebook and Yahoo as well as a slew of financial sites including CitiBank, Wells Fargo, PayPal, Citizens Bank and HSBC Bank, according to Cox's report on Kneber.

Cox discovered Kneber Jan. 26 while working at a NetWitness customer site. He found a machine infected with ZeuS that was downloading other malware executables. He traced the traffic back to a ZeuS command-and-control server in Germany, where he was able to grab a month's worth of the server's log data. He won't say he accomplished these actions.

The botnet got its name from hilarykneber@yahoo.com, the registrant listed for the original domain used to pull together various components of the botnet. That same registrant has been associated with seeking other malware including PDF and Flash exploits as well as Trojan installs.

The same registrant is also listed on multiple Web sites seeking money mules -- people who accept illegal transfers of money into their bank accounts and forward them to other bank accounts in an effort to make the funds unrecoverable by the actual owners.

Kneber has been active since March 25, 2009, and most of the sites associated with its activities are in China, according to their underlying IP addresses, NetWitness says. About 17% of these sites are in the United States.

Cox also links Kneber to a phishing attack against U.S. government agencies that sends e-mails apparently from the National Security Agency that urges recipients to click on links that download the malware.

He gives significance to the fact that one of the things Kneber harvests is social networking usernames and passwords. These can be used to get into social networking accounts where they can post links to infected sites. Social network friends are more likely to trust these links because they seem to be posted by people they trust.

Social network accounts can also be mined for personal data that can be useful in further compromising individuals' financial accounts. For example, if social networking accounts yield mothers' maiden names, they might be used to reset passwords of bank accounts, giving attackers a way to get in and transfer money out.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags securitybotnetsKneber botnet

Struggling for Christmas presents this year? Check out our Christmas Gift Guide for some top tech suggestions and more.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?