Kneber botnet hit 374 U.S. firms, gov't agencies
Rival cyber gangs may be teaming up in cyberattacks, says NetWitness
Computerworld - Of the nearly 2,500 companies worldwide that have been affected by the Kneber botnet, 374 of them are U.S.-based organizations, according to NetWitness Corp., the company that uncovered the botnet attack last month.
The list of compromised entities in the U.S includes Fortune 500 companies, local, state and federal government agencies, energy companies, ISPs and educational institutions. A total of nearly 75,000 computers worldwide are believed to have been compromised by the botnet, according to NetWitness.
A 75GB cache of stolen data shows that the botnet, which is a variant of Zeus, has been used to steal a wide range of information, including tens of thousands of login credentials -- mainly for financial accounts. The recovered data appears to be one month's worth of information from the botnet's command-and-control servers NetWitness said.
In addition to banking information, the Kneber bot also appears to be designed to harvest other kinds of information, suggesting that Zeus is being put to broader uses than just stealing banking credentials.
NetWitness has so far refused to identify the companies whose machines have been compromised in the worldwide attack. But the Wall Street Journal listed Merck & Co., Cardinal Health Inc., Paramount Pictures and Juniper Networks Inc. as four companies that had been affected.
Alex Cox, the principal analyst at NetWitness who discovered the Kneber bot, said today that not all of the companies affected by it were victims of a targeted attack. In some cases, enterprise systems were compromised as a result of drive-by downloads; in other cases, companies appear to have been targeted by spear-phishing campaigns designed to get individuals to open e-mails with malicious links and attachments.
That suggests that the botnet is being used by multiple groups with different objectives in mind, Cox said.
The data uncovered by NetWitness involved Kneber botnet activity between December 2009 and last month and shows that, in many cases, systems were compromised via a since-patched vulnerability affecting Adobe's PDF reader, Cox said.
Cox also noted that the Kneber botnet appears to have been designed to be more resilient to takedown attempts. More than half the machines infected with Kneber are also infected with a peer-to-peer bot called Waledac. While it is not unusual for compromised systems to have multiple strains of malware, in this case the Kneber bot appears to be actively logging Waledac activity and actually downloading Waledac to machines it has infected, Cox said.
"Either the Zeus guys are the same guys that are running Waledac, or there is some inter-gang cooperation going on," he said.
The effort to have two different bots, each with its own command-and-control infrastructure, running on one system is significant, Cox said. "If I take down the command-and-control structure of Zeus, Waledac is still running so I can use it to push Zeus back" onto infected systems, he said. "At the very least, two separate botnet families with different [command-and-control] structures can provide fault tolerance and recoverability in the event that one mechanism is taken down by security efforts," Cox said in a report detailing the Kneber botnet.
An analysis of IP addresses, domains and registration information shows that the servers being used to serve up Kneber-related malware are globally dispersed, Cox said. While many of the servers appear to be based in China, some are located in the Ukraine, Korea, Panama and the U.S.
Meanwhile, the registration information for the domain from which NetWitness recovered the stolen data cache includes an e-mail address that is associated with money-mule recruitment activity. The registrant contact is listed as having a street address in Virginia.
Money mules are people who are used (often without their knowledge) by cybercriminals to accept and launder stolen money.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- Feds declare big win over Cryptolocker ransomware
- Hackers hit more businesses through remote access accounts
- P.F. Chang's post-breach move to manual processing is telling
- Microsoft withholds monster IE update from Windows 8.1 dawdlers
- In baffling move, TrueCrypt open-source crypto project shuts down
- 'Oleg Pliss' hack makes for a perfect teachable IT moment
- Give IE the heave-ho until Microsoft patches zero-day
- Hackers find first post-retirement Windows XP-related vulnerability
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
Read more about Security in Computerworld's Security Topic Center.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!