Kneber just another botnet?
Some experts say it's nothing new and there are many other botnets like it out there
Network World - The Kneber botnet, so christened by security firm NetWitness in describing it to the press, is nothing new and there are many other botnets like it out there, according to a number of other security firms.
[See also from Network World: The Kneber botnet revealed]
Kneber is described as a botnet command-and-control system based on the ZeuS Trojan, a well-know type of malware capable of stealing financial data and login credentials. According to NetWitness, the firm discovered Kneber in January while deploying its network security equipment for a customer, and estimates the botnet has infiltrated "75,000 systems in 2,500 organizations around the world." Other security vendors say expect to find another 100 or more ZeuS-based botnets just like it if you go looking.
Many commend NetWitness for uncovering the server cache of information containing stolen password, login and Web browser information related to the Kneber botnet. But there are probably many more Kneber-like botnets out there today, say some, and because Kneber uses the older version of ZeuS, it doesn't even represent the worst it could do.
What NetWitness uncovered in Kneber with 75GB of information on 75,000 compromised machines over 90 days "is above the median size of a data cache," says Don Jackson, security researcher at SecureWorks, noting most botnet caches his firms has uncovered tend to run 10GB of data for about 23,000 compromised user computers.
But Kneber, he notes, is based on the older 1.2 version of ZeuS now given away for free and is not usually considered what would be used by a "professional high-dollar operator" who would make a lot of effort to hide behind proxies. "If you wanted to go hunting for these things, you could find them every month," he noted.
The most recent version of ZeuS, version 1.3, which was first seen in November of last year, costs thousands, with even a single module costing $10,000 in criminal circles, according to SecureWorks, which is expected to issue an in-depth report about ZeuS 1.3 next Monday. The new version of ZeuS is so deadly, it rips through unauthorized online wire transfers once it gets hold in an infected machine -- and more.
Anyone investing in ZeuS 1.3 is likely to take a lot of trouble to successfully hide the botnet, Jackson notes.
The problem is that Kneber-like botnets are a dime a dozen and certainly nothing new, according to other security firms.
"We're tracking, at any time, about 100 unique ZeuS botnets," says Marc Maiffret, chief security architect at FireEye. "There are constantly-changing variants of it." This is this is one reason it has a chance to evade signature-based malware defenses. But Maiffret also says that he'd characterize a ZeuS botnet controlling 75,000 systems as being of mid to high size.
- Feds declare big win over Cryptolocker ransomware
- Hackers hit more businesses through remote access accounts
- P.F. Chang's post-breach move to manual processing is telling
- Microsoft withholds monster IE update from Windows 8.1 dawdlers
- In baffling move, TrueCrypt open-source crypto project shuts down
- 'Oleg Pliss' hack makes for a perfect teachable IT moment
- Give IE the heave-ho until Microsoft patches zero-day
- Hackers find first post-retirement Windows XP-related vulnerability
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Ponemon 2014 SSH Security Vulnerability Report According to research by the Ponemon Institute, 3 out of 4 enterprises have no security controls in place for SSH which leaves organizations...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!