Protect Your business from Kneber-style botnets

The Kneber botnet is a relatively small threat as botnets go, and could be guarded against using simple security fundamentals

A report from security research firm NetWitness about a malicious botnet dubbed Kneber has been the focus of a fair amount of media attention, but mostly sensationalism that misses the real point.

Yes, the Kneber botnet consists of nearly 75,000 computers. Yes, systems at roughly 2,500 different companies around the world have been infiltrated. Yes, government agencies have had data compromised. Sadly, that is just "a day in the life". There is nothing spectacular about those figures.

Some media reports are even comparing the Kneber botnet to the massive threat of last year's Conficker worm and the associated Downadup botnet. There really is no comparison--Kneber is a drop in the bucket compared to Conficker.

The number of computers compromised by Conficker was in the millions--significantly higher than the meager 75,000 impacted by Kneber. Elias Levy, senior director for Symantec Security Response explained in an e-mail to me "The Kneber-Zeus malware can be considered as an ant compared to Godzilla, when put against Conficker/Downadup."

However, Levy also recognizes that the real threat of Conficker was never really exploited, and that this much smaller botnet does account for more damage in terms of compromised information. "As far as security implications are concerned, we never really saw the Downadup network utilized for anything. It caused a lot of destruction and problems across the globe, but it never delivered any payload. Kneber on the other hand, however small it may be in size, seems to have stolen personal information which is destructive in some sense."

Levy also took issue with the media categorization of Kneber as a new threat in his e-mail. "Kneber, in reality, is not a new threat at all, but is simply a pseudonym for the infamous and well-known Zeus Trojan. The name Kneber simply refers to a particular group, or herd, of zombie computers, a.k.a. bots, being controlled by one owner. The actual Trojan itself is the same Trojan.Zbot, which also goes by the name Zeus, which has been being observed, analyzed and protected against for some time now."

Joris Evers, a security specialist for McAfee, also e-mailed me and noted "In the world of cybersecurity the "Kneber" botnet is, unfortunately, just another botnet. With 75,000 infected machines, Kneber is not even that big. There are much larger botnets. Kneber is based on the "Zeus" Trojan--malware known to security companies. In our recently released Q4 2009 Threats Report we found that in the last three months of 2009 just under four million newly infected machines joined botnets."

Symantec's Levy explains "Though it is true that this Kneber string of the overall Zeus botnet is fairly large, it does not involve any new malicious threats. Thus, computer users with up-to -date security software should already be protected from this threat."

Evers echoed that basic sentiment, pointing out "Additionally, users should keep the standard rules of PC security in mind--keep your software and operating system up to date, run a complete and up-to-date suite of security software, including a firewall and antimalware detection and don't click on suspicious links in e-mail, instant messages or those that arrive via social media."

The news part of this story isn't really the expanse of the Kneber botnet, or even the sensitive information it appears to have compromised. Sadly, the real story is how or why 2,500 organizations around the world, including government agencies, have such weak security that they allowed 75,000 PC's to be compromised by a relatively archaic threat for which detection and protection have existed for over a year.

It's not the first time, and unfortunately it won't be the last. When the SQL Slammer worm hit in January of 2003, it crippled the Internet around the globe in under thirty minutes--exploiting a flaw in Microsoft SQL Server that Microsoft had issued a patch to fix months prior. The spread of Conficker last year is another example of a malware threat exploiting a vulnerability that Microsoft had already issued a patch for.

Kneber is nothing. It is barely worth mentioning. What is worth mentioning again, and again, and again, is the importance of applying patches and updates in a timely manner, employing anti-malware security software and keeping it up to date to detect current threats, and continuing to educate users to not click on links or open attachments in messages.

Maybe, someday that message will sink in. I won't hold my breath.

Tags Knebermcafeebotnetconficker

Recommended

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?