Protect Your business from Kneber-style botnets

The Kneber botnet is a relatively small threat as botnets go, and could be guarded against using simple security fundamentals

A report from security research firm NetWitness about a malicious botnet dubbed Kneber has been the focus of a fair amount of media attention, but mostly sensationalism that misses the real point.

Yes, the Kneber botnet consists of nearly 75,000 computers. Yes, systems at roughly 2,500 different companies around the world have been infiltrated. Yes, government agencies have had data compromised. Sadly, that is just "a day in the life". There is nothing spectacular about those figures.

Some media reports are even comparing the Kneber botnet to the massive threat of last year's Conficker worm and the associated Downadup botnet. There really is no comparison--Kneber is a drop in the bucket compared to Conficker.

The number of computers compromised by Conficker was in the millions--significantly higher than the meager 75,000 impacted by Kneber. Elias Levy, senior director for Symantec Security Response explained in an e-mail to me "The Kneber-Zeus malware can be considered as an ant compared to Godzilla, when put against Conficker/Downadup."

However, Levy also recognizes that the real threat of Conficker was never really exploited, and that this much smaller botnet does account for more damage in terms of compromised information. "As far as security implications are concerned, we never really saw the Downadup network utilized for anything. It caused a lot of destruction and problems across the globe, but it never delivered any payload. Kneber on the other hand, however small it may be in size, seems to have stolen personal information which is destructive in some sense."

Levy also took issue with the media categorization of Kneber as a new threat in his e-mail. "Kneber, in reality, is not a new threat at all, but is simply a pseudonym for the infamous and well-known Zeus Trojan. The name Kneber simply refers to a particular group, or herd, of zombie computers, a.k.a. bots, being controlled by one owner. The actual Trojan itself is the same Trojan.Zbot, which also goes by the name Zeus, which has been being observed, analyzed and protected against for some time now."

Joris Evers, a security specialist for McAfee, also e-mailed me and noted "In the world of cybersecurity the "Kneber" botnet is, unfortunately, just another botnet. With 75,000 infected machines, Kneber is not even that big. There are much larger botnets. Kneber is based on the "Zeus" Trojan--malware known to security companies. In our recently released Q4 2009 Threats Report we found that in the last three months of 2009 just under four million newly infected machines joined botnets."

Symantec's Levy explains "Though it is true that this Kneber string of the overall Zeus botnet is fairly large, it does not involve any new malicious threats. Thus, computer users with up-to -date security software should already be protected from this threat."

Evers echoed that basic sentiment, pointing out "Additionally, users should keep the standard rules of PC security in mind--keep your software and operating system up to date, run a complete and up-to-date suite of security software, including a firewall and antimalware detection and don't click on suspicious links in e-mail, instant messages or those that arrive via social media."

The news part of this story isn't really the expanse of the Kneber botnet, or even the sensitive information it appears to have compromised. Sadly, the real story is how or why 2,500 organizations around the world, including government agencies, have such weak security that they allowed 75,000 PC's to be compromised by a relatively archaic threat for which detection and protection have existed for over a year.

It's not the first time, and unfortunately it won't be the last. When the SQL Slammer worm hit in January of 2003, it crippled the Internet around the globe in under thirty minutes--exploiting a flaw in Microsoft SQL Server that Microsoft had issued a patch to fix months prior. The spread of Conficker last year is another example of a malware threat exploiting a vulnerability that Microsoft had already issued a patch for.

Kneber is nothing. It is barely worth mentioning. What is worth mentioning again, and again, and again, is the importance of applying patches and updates in a timely manner, employing anti-malware security software and keeping it up to date to detect current threats, and continuing to educate users to not click on links or open attachments in messages.

Maybe, someday that message will sink in. I won't hold my breath.

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Knebermcafeeconfickerbotnet

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?