...from:
http://computerworld.com/action/article.do?command=viewArticleBasic&article…
Spam levels climb as criminals replace crippled botnets
Four weeks after McColo takedown, spam back to 63% of earlier volume
By Gregg Keizer
December 9, 2008 (Computerworld) Four weeks after spam levels
plummeted when a rogue hosting company was yanked off the Internet,
junk mail volumes are again up, a researcher said today.
According to IronPort Systems Inc., spam volumes have partially
recovered since the Nov. 11 takedown of McColo Corp., the California
hosting firm that was pulled off the Web by its upstream service
providers after security researchers presented them with overwhelming
evidence that it was harboring a wide range of criminal activity.
Among McColo's clients: cybercriminal groups that ran some of the
biggest spam-spewing and malware-spreading botnets in the world.
Yesterday, approximately 94.6 billion spam messages were sent
worldwide, said IronPort, which estimated today's volume at 96.8
billion. Those numbers were 62% and 63%, respectively, of the 153
billion spam messages sent four weeks ago, the dayMcColo went offline.
Immediately after the takedown, spam levels dropped to 64.1 billion,
just 42% of the pre-McColo volume.
Spam's resurgence comes courtesy of several botnets -- some well-
known, some not -- that were largely unaffected by McColo's
disappearance, said Joe Stewart, director of malware research
atSecureWorks Inc.
First of all, reports that the "Srizbi" and "Rustock" botnets have
beenresurrected are "mostly untrue," said Joe Stewart. "These botnets
are not monolithic, especially Srizbi, which is in the hands of a lot
of people. Each has a couple of variants [of the bot Trojan], and
maybe a few thousand bots. Some have regained control of their
botnets, some have not."
In fact, Srizbi and Rustock -- which were the world's largest and
third-largest botnets, respectively, before Nov. 11 -- have
effectively faded into the background. "It's looking like these botnet
spam providers have had their customers jump ship," said Stewart.
Other botnets have stepped up to take their place.
"Mega-D has come back to its original strength," Stewart said,
referring to another botnet that had been controlled by McColo-hosted
servers. "Cutwail is running strong, and so is Kraken. Botnets that
weren't badly affected [by McColo going offline] seem to have picked
up customers."
Other researchers have recently reported Mega-D's restoration. London-
based Marshal8e6, for example, said yesterday that Mega-D's
controllers have set up new command servers, re-established links with
their compromised PCs and have resumed spamming.
The criminals who ran Srizbi and Rustock have had far less success,
said SecureWorks' Stewart. "Everyone fully expected Srizbi to come
back," he noted, although that's not happened. Srizbi's controllers
were stymied for a while by FireEye Inc., which for a time was
registering the domain names the bots would use to reconnect with new
command servers. FireEye, however, was unable to finance the tactic
indefinitely, and stopped.
"We're seeing Srizbi bots that are asking for [routing] domain names
that aren't registered to anyone," said Stewart. He was unable to
explain why the hackers had walked away from their botnets, but
speculated that it was a business decision.
"The longer they left it, the more the botnet diminished," he said,
noting that botnets continually lose machines as PCs are cleaned of
the malware or taken out of service and replaced by new systems. "They
have to make a decision, is it worth it to regain control or just
build a new botnet?"
In the meantime, once-smaller players have grown in size as spammers
turned to new providers. "Xarvester is one that has seemed to pick up
a lot of traffic," said Stewart. "It's somewhere between Mega-D and
Cutwail in size, so it's moved into the top three with at least
130,000 bots."
Xarvester and another botnet, which Stewart has dubbed "Gahg," are
spamming some of the same types of messages that once came from bots
controlled by Srizbi's and Rustock's herders, he added.
"There aren't any new botnets, not so far," Stewart continued. But he
warned that the criminals responsible for Srizbi and Rustock could
very well be working on new malware and spreading it on vulnerable
PCs. "That could be one reason why they haven't restored the [downed]
bots, they could be in development right now."
= - = - = - =
...from:
http://www.computerworld.com/action/article.do?command=viewArticleBasic&art…
Massive botnet returns from the dead, starts spamming
Criminals regain control after security firm stops preemptively
registering routing domains
By Gregg Keizer
November 26, 2008 (Computerworld) A big spam-spewing botnet shut down
two weeks ago has been resurrected, security researchers said today,
and is again under the control of criminals.
The "Srizbi" botnet returned from the dead late Tuesday, said Fengmin
Gong, chief security content officer at FireEye Inc., when the
infected PCs were able to successfully reconnect with new command-and-
control servers, which are now based in Estonia.
Srizbi was knocked out more than two weeks ago when McColo Corp., a
hosting company that had been accused of harboring a wide range of
criminal activities, was yanked off the Internet by its upstream
service providers. With McColo down, PCs infected with Srizbi and
other bot Trojan horses were unable to communicate with their command
servers, which had been hosted by McColo. As a result, spam
levelsdropped precipitously.
But as other researchers noted last week, Srizbi had a fallback
strategy. In the end, that strategy paid off for the criminals who
control the botnet.
According to Gong, when Srizbi bots were unable to connect with the
command-and-control servers hosted by McColo, they tried to connect
with new servers via domains that were generated on the fly by an
internal algorithm. FireEye reverse-engineered Srizbi, rooted out that
algorithm and used it to predict, then preemptively register, several
hundred of the possible routing domains.
The domain names, said Gong, were generated on a three-day cycle, and
for a while, FireEye was able to keep up -- and effectively block
Srizbi's handlers from regaining control.
"We have registered a couple hundred domains," Gong said, "but we made
the decision that we cannot afford to spend so much money to keep
registering so many [domain] names."
Once FireEye stopped preempting Srizbi's makers, the latter swooped in
and registered the five domains in the next cycle. Those domains, in
turn, pointed Srizbi bots to the new command-and-control servers,
which then immediately updated the infected machines to a new version
of the malware.
"Once each bot was updated, the next command was to send spam," said
Gong, who noted that the first campaign used a template targeting
Russian speakers.
The updated Srizbi includes hard-coded references to the Estonian
command-and-control servers, but Gong was unaware of any current
attempt to convince the firm now hosting those servers to yank them
off the Web.
In the meantime, FireEye is working with several other companies --
including VeriSign Inc., Microsoft Corp. and Network Solutions Inc., a
domain registrar -- on ways to reach the more than 100,000 users whose
PCs FireEye has identified as infected with Srizbi.
Discussions about how to best handle any future McColo-Srizbi
situation are also ongoing, Gong said. "We're trying to find a
solution, and talking about ideas of how they can help fund efforts
for some period of time to [preemptively] register domains," he said.
"Right now, though, we have this window of opportunity to help clean
all those [100,000] machines," Gong said. "Registering those domains
was just a way to buy us time. We have to reach those machines to
clean them up."
Although some message security companies said yesterday that spam
volumes had climbed back from post-McColo troughs, Gong was hesitant
to finger Srizbi's return as the reason. "Srizbi may have
contributed," he said, "but Rustock is also back."
Rustock, another botnet whose command-and-control servers were hosted
by McColo, was partially restored when a Swedish Internet provider
briefly stepped in 11 days ago to reconnect McColo to the Web. Even
though McColo's connection was quickly severed by TeliaSonera after it
received complaints, Rustock's controllers had enough time to instruct
some of the bots to look to a Russian-hosted server for commands.
