Protect Your business from Kneber-style botnets

The Kneber botnet is a relatively small threat as botnets go, and could be guarded against using simple security fundamentals

A report from security research firm NetWitness about a malicious botnet dubbed Kneber has been the focus of a fair amount of media attention, but mostly sensationalism that misses the real point.

Yes, the Kneber botnet consists of nearly 75,000 computers. Yes, systems at roughly 2,500 different companies around the world have been infiltrated. Yes, government agencies have had data compromised. Sadly, that is just "a day in the life". There is nothing spectacular about those figures.

Some media reports are even comparing the Kneber botnet to the massive threat of last year's Conficker worm and the associated Downadup botnet. There really is no comparison--Kneber is a drop in the bucket compared to Conficker.

The number of computers compromised by Conficker was in the millions--significantly higher than the meager 75,000 impacted by Kneber. Elias Levy, senior director for Symantec Security Response explained in an e-mail to me "The Kneber-Zeus malware can be considered as an ant compared to Godzilla, when put against Conficker/Downadup."

However, Levy also recognizes that the real threat of Conficker was never really exploited, and that this much smaller botnet does account for more damage in terms of compromised information. "As far as security implications are concerned, we never really saw the Downadup network utilized for anything. It caused a lot of destruction and problems across the globe, but it never delivered any payload. Kneber on the other hand, however small it may be in size, seems to have stolen personal information which is destructive in some sense."

Levy also took issue with the media categorization of Kneber as a new threat in his e-mail. "Kneber, in reality, is not a new threat at all, but is simply a pseudonym for the infamous and well-known Zeus Trojan. The name Kneber simply refers to a particular group, or herd, of zombie computers, a.k.a. bots, being controlled by one owner. The actual Trojan itself is the same Trojan.Zbot, which also goes by the name Zeus, which has been being observed, analyzed and protected against for some time now."

Joris Evers, a security specialist for McAfee, also e-mailed me and noted "In the world of cybersecurity the "Kneber" botnet is, unfortunately, just another botnet. With 75,000 infected machines, Kneber is not even that big. There are much larger botnets. Kneber is based on the "Zeus" Trojan--malware known to security companies. In our recently released Q4 2009 Threats Report we found that in the last three months of 2009 just under four million newly infected machines joined botnets."

Symantec's Levy explains "Though it is true that this Kneber string of the overall Zeus botnet is fairly large, it does not involve any new malicious threats. Thus, computer users with up-to -date security software should already be protected from this threat."

Evers echoed that basic sentiment, pointing out "Additionally, users should keep the standard rules of PC security in mind--keep your software and operating system up to date, run a complete and up-to-date suite of security software, including a firewall and antimalware detection and don't click on suspicious links in e-mail, instant messages or those that arrive via social media."

The news part of this story isn't really the expanse of the Kneber botnet, or even the sensitive information it appears to have compromised. Sadly, the real story is how or why 2,500 organizations around the world, including government agencies, have such weak security that they allowed 75,000 PC's to be compromised by a relatively archaic threat for which detection and protection have existed for over a year.

It's not the first time, and unfortunately it won't be the last. When the SQL Slammer worm hit in January of 2003, it crippled the Internet around the globe in under thirty minutes--exploiting a flaw in Microsoft SQL Server that Microsoft had issued a patch to fix months prior. The spread of Conficker last year is another example of a malware threat exploiting a vulnerability that Microsoft had already issued a patch for.

Kneber is nothing. It is barely worth mentioning. What is worth mentioning again, and again, and again, is the importance of applying patches and updates in a timely manner, employing anti-malware security software and keeping it up to date to detect current threats, and continuing to educate users to not click on links or open attachments in messages.

Maybe, someday that message will sink in. I won't hold my breath.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Knebermcafeeconfickerbotnet

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?