Dodgy ISP McColo briefly comes online, updates botnet
When it went offline, analysts found that spam levels dropped by up to 75%
IDG News Service - An ISP associated with online crime and child pornography briefly came back online over the weekend before being cut off again, according to security vendors.
After complaints, TeliaSonera quickly moved to cut off McColo again, Thomas wrote. But the brief renewal in connectivity did allow cybercriminals running botnets out of McColo's networks to take steps to preserve their operations.
McColo has been identified as hosting the command-and-control servers for no less than five large botnets that are responsible for the majority of the world's spam. When McColo dropped offline, analysts found that spam levels dropped up to 75%.
Spam takes a heavy toll on IT infrastructure, consuming bandwidth and potentially exposing users to malicious software.
When McColo came back online, it appeared that the hackers who controlled the command-and-control servers for a botnet called Rustock moved the controls for that botnet to a data center in Russia, according to the blog for security vendor FireEye.
"We believe that the Rustock controllers don't expect McColo to be very stable in the near future, so they are hedging their bets and moving the C&Cs to a different provider," according to FireEye.
PCs infected with malicious software that enables them to be part of the Rustock botnet were also at least partially updated. The update would allow the computers to report to the new Russian command-and-control server to receive orders.
Since McColo was online for only a short period, "there's no way that the whole botnet was updated, but no doubt they got a good-sized piece," FireEye said.
Security analysts have predicted that spam levels will rise again as hackers who used McColo move their operations to other ISPs that are willing to protect spammers and other criminal enterprises, such as those who sells bogus security software or pharmaceuticals.
"Rustock is estimated to be capable of sending 30 billion spams per day," Thomas wrote. "How big an increase we'll see depends largely on the number of zombie PCs the botnet's controller was able to reach during McColo's temporary resurrection."
- Massive botnet returns from the dead, starts spamming
- Spam levels fluctuate as crooks try to revive botnets
- Spam is silenced, but where are the feds?
- Dodgy ISP McColo briefly comes online, updates botnet
- McColo shutdown forces botnets to relocate
- Hosting firm takedown bags 500,000 bots
- Spam plummets after Calif. hosting service shuttered
- McColo takedown: Internet vigilantism or online Neighborhood Watch?
- IT Blogwatch: McColo is McShut McDown
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!