Kneber just another botnet?

Network World - The Kneber botnet, so christened by security firm NetWitness in describing it to the press, is nothing new and there are many other botnets like it out there, according to a number of other security firms.

[See also from Network World: The Kneber botnet revealed]

Kneber is described as a botnet command-and-control system based on the ZeuS Trojan, a well-know type of malware capable of stealing financial data and login credentials. According to NetWitness, the firm discovered Kneber in January while deploying its network security equipment for a customer, and estimates the botnet has infiltrated "75,000 systems in 2,500 organizations around the world." Other security vendors say expect to find another 100 or more ZeuS-based botnets just like it if you go looking.

Many commend NetWitness for uncovering the server cache of information containing stolen password, login and Web browser information related to the Kneber botnet. But there are probably many more Kneber-like botnets out there today, say some, and because Kneber uses the older version of ZeuS, it doesn't even represent the worst it could do.

What NetWitness uncovered in Kneber with 75GB of information on 75,000 compromised machines over 90 days "is above the median size of a data cache," says Don Jackson, security researcher at SecureWorks, noting most botnet caches his firms has uncovered tend to run 10GB of data for about 23,000 compromised user computers.

But Kneber, he notes, is based on the older 1.2 version of ZeuS now given away for free and is not usually considered what would be used by a "professional high-dollar operator" who would make a lot of effort to hide behind proxies. "If you wanted to go hunting for these things, you could find them every month," he noted.

The most recent version of ZeuS, version 1.3, which was first seen in November of last year, costs thousands, with even a single module costing $10,000 in criminal circles, according to SecureWorks, which is expected to issue an in-depth report about ZeuS 1.3 next Monday. The new version of ZeuS is so deadly, it rips through unauthorized online wire transfers once it gets hold in an infected machine -- and more.

Anyone investing in ZeuS 1.3 is likely to take a lot of trouble to successfully hide the botnet, Jackson notes.

The problem is that Kneber-like botnets are a dime a dozen and certainly nothing new, according to other security firms.

"We're tracking, at any time, about 100 unique ZeuS botnets," says Marc Maiffret, chief security architect at FireEye. "There are constantly-changing variants of it." This is this is one reason it has a chance to evade signature-based malware defenses. But Maiffret also says that he'd characterize a ZeuS botnet controlling 75,000 systems as being of mid to high size.

Originally published on www.networkworld.com. Click here to read the original story.