Botnet targets major Web sites with junk SSL connection

The aim of the odd attack is unknown but it's not knocking the sites offline, the Shadowserver Foundation says

More than 300 Web sites are being pestered by infected computers that are part of the Pushdo botnet, according to security researchers.

The U.S. Federal Bureau of Investigation, Twitter and PayPal are among the sites being hit, although it doesn't appear the attacks are designed to knock the sites offline, said Steven Adair, of The Shadowserver Foundation, a group that tracks botnets.

Shadowserver was tipped off to the Pushdo issue by Joe Stewart, director of malware analysis at vendor SecureWorks.

Pushdo, which is also known as Pandex or Cutwail, has been around for about three years, according to a report (PDF) from Trend Micro. Computers infected with Pushdo are used to send out spam, but the malware is capable of downloading other harmful code to a computer.

Pusho appears to have been recently updated to cause computers infected with it to make SSL (Secure Sockets Layer) connections to various Web sites. SSL is an encrypted protocol used to protect information exchanged.

The bots start to create an SSL connection and then disconnect, a process that is repeated, Adair said. Serving up SSL connections puts more of a burden on a Web site than HTTP connections, Adair said, but the traffic has been so sporadic that some large Web sites didn't even notice.

"Despite how noisy it is, the traffic is still too infrequent and not large enough to really be seen as what we would think is an intentional DDOS attack," Adair said in an e-mail exchange. "Much smaller botnets are capable of generating far more traffic and causing more of an impact to Web sites than what is being done with Pushdo."

The traffic, however, is significant and results in large Web sites getting millions of hits across hundreds of thousands of IP (Internet Protocol) addresses.

"This might be a big deal if you're used to only getting a few hundred or thousands of hits a day or you don't have unlimited bandwidth," Adair wrote on Shadowserver's blog.

One option for Web sites is to change their IP addresses, but that may only be a temporary fix. "We have also had numerous people write in offering assistance and feedback on ways to slow or stop these attacks," Adair said.

"We hope to put out an updated post that can help our system administrators associated with these Web sites soon."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags botnetsSSLtrend micropushdoShadowserver Foundation

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?