RSA If you're looking for a good reason why security professionals might want to pool their research about botnets and other cyber threats, look no further than findings released earlier this week about a botnet dubbed Kraken.
Zombie hunters at Damballa said they were tracking a new bot army that claimed more than 400,000 infected machines and had managed to infiltrate at least 50 networks belonging to Fortune 500 companies. The malware at the heart of Kraken, as they dubbed the botnet, was undetected on 80 percent of computers running anti-virus protection.
The thing is, other researchers say Kraken isn't new at all. According to Joe Stewart, a cyber gumshoe at SecureWorks, the reported bot army is actually one that goes by the name Bobax and is one of the oldest known botnets used for spamming. Damballa researchers respectfully reject this contention, saying Kraken bots use fundamentally different means to connect to command and control channels, where they receive their spamming instructions.
The mix-up is understandable, given the way malware is spread. Distributors frequently infect a PC with multiple bots at the same time, and often use vastly different variants, all making identification difficult. Complicating matters, competing botnet operators frequently appropriate snippets of code belonging to their competitors.
In a report issued Wednesday, Stewart has stepped forward to share data on what he says are the 10 biggest spam bots, complete with the strings that other researchers can use to identify a given network. It's by no means complete, but with contributions from others, it could grow into a resource that advances the collective knowledge of one of the biggest threats menacing the net.
"We all as an industry need to share information better among ourselves," Stewart says. "We each have a small scope of view of the activity and that's why we all need to get together and share it and magnify our view."
Agree to disagree
In an interview at the RSA conference in San Francisco, Stewart said he has no doubt Kraken and Bobax are one in the same. How does he know? He says each botnet displays idiosyncrasies when sending large volumes of spam, and that the pattern in this case is identical.
But Bill Guerry, vice president of product management at Damballa, said he has no doubt Kraken is distinctly different. Its bots connect to command and control channels using encrypted transmission control protocol (TCP) and user datagram protocol (UDP) over port 447. Bobax, by contrast, uses unencrypted hyper text transport protocol (HTTP) over port 80.
"I can appreciate why people are saying it's the same thing," said Guerry, who is also attending the RSA conference. "But when you look at the fact that it's a completely different C&C, that's just overwhelming evidence and irrefutable evidence that it's a new and distinct bot army."
The differences don't end there. A few months ago, Damballa issued a report that said Bobax was largely dormant, after being taken over by Storm, which according to some estimates, was believed to be one of the largest known botnets. Stewart says Bobax is the second biggest spam bot, with 185,000 spam-capable bots and a capacity to blast out more than 9 billion pieces of junk mail per day. (The actually number of spam sent is much lower.)
He counts Srizbi as the biggest spam botnet, with about 315,000 infected machines. Rustock and Cutwail and Storm are third, fourth and fifth, with 150,000 zombies and 125,000 zombies and 85,000 zombies respectively.
One reason for the discrepancies is that Stewart's report counts only the number of bots that are capable of sending spam. Another is that botnet counts ebb and flow wildly. The biggest botnet three months ago very well not be the biggest one now.
All of which is more fodder for Stewart's argument that researchers should share their findings in a more thorough and methodical way. That way, they can receive the peer review they deserve (and customers and reporters won't be left wondering who's right and who's wrong).
Guerry says Damballa is game. It's in the process of posting more granular data about Kraken to its website now.
"We're looking to put out more information so people can see more than just raw data," he said. "What we want to do is post more of our analysis of what we did on our website so that it's a little more transparent." ®