Researchers discover 4.5 million-strong super-botnet

hawki · Jun 29, 2011

TDSS rootkit infects 1.5 million US computers

Techworld | Published: 16:23 GMT, 29 June 11

Millions of PCs around the world appear to have been quietly infected by the dangerous TDSS ‘super-malware’ rootkit as part of a campaign to build a giant new botnet, researchers from security firm Kaspersky Lab have discovered.

Malware and botnets come and go, but TDSS is different. First detected more than three years ago, TDSS (also known as ‘TDL’ and sometimes by its infamous rootkit component, Alureon), it has grown into a multi-faceted malware nexus spinning out ever more complex and dangerous elements as it evolves.

In recent weeks, Kaspersky Lab researchers were able to penetrate three SQL-based command and control (C&C) servers used to control the activities of the malware’s latest version, TDL-4, where they discovered the IP addresses of 4.5 million IP PCs infected by the malware in 2011 alone. Almost 1.5 million of these were in the US.

If active, this number of compromised computers could make it one of the largest botnets in the world, with the US portion alone worth an estimated $250,000 (£155,000) to the underground economy.

The TDL-4 malware has also added technical and economic capabilities to its features list, including some that are out of the ordinary for botnets, the researchers said.

Making use of the malware’s bootkit design – it infects the master boot record of a PC to allow it to load before other programs – it attempts to clean rival malware from an infected PC, searching for an nixing up to 20 different malware types, including Gbot, Zeus and Optima. This stops other programs interfering with its activities as well as hurting their commercial activities.

The researchers noticed a kad.dll component of the infection which appears to allow TDSS/TDL-4 an elaborate C&C channel to control bots using the Kad P2P file exchange network even if the primary encrypted channel has been shut down by rival botnetters or security companies.
Click to expand...

More here: http://news.techworld.com/security/3288748/researchers-discover-45-million-strong-super-botnet/

CloneRanger · Jun 29, 2011

it attempts to clean rival malware from an infected PC, searching for an nixing up to 20 different malware types, including Gbot, Zeus and Optima.
Click to expand...

That "could" save the AV etc vendors a Lot of time in writing Antidotes for ALL 20, if they made use of just the nixing parts of it Maybe they have ?

J_L · Jun 29, 2011

Wow, it's an effective malware cleaner as well.

hawki · Jun 30, 2011

Massive botnet 'indestructible,' say researchers

4.5M-strong botnet 'most sophisticated threat today' to Windows PCs

June 29, 2011 04:19 PM ET

Computerworld - A new and improved botnet that has infected more than four million PCs is "practically indestructible," security researchers say.

"TDL-4," the name for both the bot Trojan that infects machines and the ensuing collection of compromised computers, is "the most sophisticated threat today," said Kaspersky Labs researcher Sergey Golovanov in a detailed analysis Monday.

"[TDL-4] is practically indestructible," Golovanov said.

Others agree.

"I wouldn't say it's perfectly indestructible, but it is pretty much indestructible," said Joe Stewart, director of malware research at Dell SecureWorks and an internationally-known botnet expert, in an interview today. "It does a very good job of maintaining itself."

Golovanov and Stewart based their judgments on a variety of TDL-4's traits, all which make it an extremely tough character to detect, delete, suppress or eradicate.

For one thing, said Golovanov, TDL-4 infects the MBR, or master boot record, of the PC with a rootkit -- malware that hides by subverting the operating system. The master boot record is the first sector -- sector 0 -- of the hard drive, where code is stored to bootstrap the operating system after the computer's BIOS does its start-up checks.

Because TDL-4 installs its rootkit on the MBR, it is invisible to both the operating system and more, importantly, security software designed to sniff out malicious code.

But that's not TDL-4's secret weapon.

What makes the botnet indestructible is the combination of its advanced encryption and the use of a public peer-to-peer (P2P) network for the instructions issued to the malware by command-and-control (C&C) servers.

"The way peer-to-peer is used for TDL-4 will make it extremely hard to take down this botnet," said Roel Schouwenberg, senior malware researcher at Kaspersky, in an email reply Tuesday to follow-up questions. "The TDL guys are doing their utmost not to become the next gang to lose their botnet."
Click to expand...

More here: http://www.computerworld.com/s/article/9218034/Massive_botnet_indestructible_say_researchers

ronjor · Jun 30, 2011

Sorry, but the TDL botnet is not 'indestructible'

By Roger Grimes
Malware and alarmism over its proliferation are nothing new -- and the latest boot-sector rootkit will be cured soon enough
Click to expand...

TechMuncher · Jul 9, 2011

How cute, it infects the MBR...

Rebuild the MBR.

Log in or Sign up

Researchers discover 4.5 million-strong super-botnet

hawki Registered Member

CloneRanger Registered Member

J_L Registered Member

hawki Registered Member

ronjor Global Moderator

TechMuncher Registered Member

Log in or Sign up

Researchers discover 4.5 million-strong super-botnet

hawki Registered Member

CloneRanger Registered Member

J_L Registered Member

hawki Registered Member

ronjor Global Moderator

TechMuncher Registered Member

Useful Searches