Rustock Botnet: Dead Or Just Reloading?

Reports indicate that the massive drop in spam levels are linked to the sudden disappearance of the Rustock botnet. However, recent history suggests the interruption may only be temporary.

Spamhaus’s Composite Spam Blocklist (CBL) claims that dozens of Rustock’s internet servers, which for years have been pumping spam messages and slinging faux pharmaceutical ads, stopped operating Wednesday morning in near simultaneity.

While there's agreement that Rustock is offline - at least for now- its not clear if the interrpution in spam is the result of a take-down or of Rustock reloading.

CBL’s data suggests that Rustock’s spam levels have been surging and plummeting on a daily basis. At times, the botnet accounted for as much as 75 percent of global spam, only to drop back to zero percent the next day. Such has been the case for the last week, for every significant peak, the following day brings subsequent drop to zero percent of global levels, only to rise and fall again. That was the case in December, 2010, when Rustock disappeared for a period of time, only to re-emerge.

Thus far, Rustock interruptions have been sporadic and short-lived, creating a statistical ebb and flow where its volume has hit and hovered around zero, but never staying there for any significant period of time. Not so with the latest interruption in service, which shows Rustock flat lining since 10:54 am EST Wednesday.

Rustock has been the leading source of spam for some time, generating between 50% and 70% of worldwide spam volumes. While no firm data is available on the numbers of e-mail messages sent out through Rustock, the number is likely to be staggering, which is impressive considering Threatpost reported yesterday that the relatively smaller Pushdo botnet has generated some 1.7 trillion spam messages.

This, despite efforts to limit the impact of botnets by using blacklists to block traffic from infected systems.

[ThreatPost]

Notorious spamming botnet Rustock shuttered

IDG News Service - A large network of hacked computers called Rustock, which was responsible for a great volume of spam, has shut down, perhaps as a result of another coordinated take down by security researchers.

Rustock's inactivity, first reported by security writer Brian Krebs on his blog, started on Wednesday when analysts noted that its command-and-control servers were offline.

Richard D.G. Cox, the CIO for the spam-tracking organization Spamhaus, said on Thursday morning that he was waiting for more information from U.S.-based colleagues about why Rustock is not working.

He noted that while it is possible that Rustock's decline is the result of another joint action by the security community, it could be that Rustock's operators are just reorganizing, since the botnet has slowed down before, he said.

"We are aware something is happening," Cox said.

The security company M86 wrote on its blog that Rustock completely stopped spamming, and its command-and-control servers would not respond.

"It is unclear yet who or what caused the shutdown," wrote Phil Hay, an analyst with M86. "It's also possible it has been abandoned. Over the past three years, Rustock has been responsible for a huge amount of spam, at times representing half of all spam caught in our spam traps."

Hay said that Rustock's spam output dropped after the closure of Spamit.com, a Russian website for e-mail spam affiliates linked to GlavMed, which ran the "Canadian Pharmacy" pharmaceutical spam campaigns.

Several botnets -- Pushdo, Waledac and Bredolab -- have come into the crosshairs of security analysts and law enforcement. Microsoft marshalled a group of security researchers that attacked Waledac in February 2010.

Waledac used a complicated peer-to-peer communication system, but researchers were able to disrupt it and take control of some 60,000 computers. Microsoft also went to court to shut down domains used by the botnet to communicate. But botnets are difficult to completely stop, and there are signs that Waledac has come back.

Last October, the Dutch High Tech Crime Team along with other organizations shut down 143 servers used to control Bredolab, which sent an estimated 3.6 billion e-mails a day. Armenian authorities, acting on a request from Dutch police, arrested a 27-year-old man accused of being Bredolab's controller.

Botnets manage to come back from shutdowns as code is modified by hackers and more computers become infected.

"Previous attempts at botnet shutdowns have tended to be short lived as the botnet herders simply regroup and start again," Hay wrote. "It's too early to say bye bye Rustock, but the thought is certainly nice."

[ComputerWorld]

Rustock Botnet is the Biggest Spammer

Rustock is today the largest and most productive spam botnet in the world, as was reported at the RSA Conference 2011 in San Francisco.

The Rustock botnet (founded around 2006) consists of an estimated 250,000 computers, and the size of Rustock is related to the constantly evolving technologies.

Joe Stewart, Director of Malware Research at Dell SecureWorks Counter Threat Unit, said that Rustock occupies the first position due to the fact that developers are constantly creating and updating source code which makes many antiviruses fail to detect the malware.

The interesting point is that most criminals are not looking to have large sized bot networks anymore, instead they try to have a smaller number of zombies in order to avoid being detected by major ISP’s. Rustock has employed other novel tactics to stay under-the-radar:

• Samples with active control servers have been observed waiting for up to five days before spamming

• Rustock control servers run a TOR exit node, likely in an attempt to avoid disconnection by network administrators who might think the abuse is originating elsewhere

• Rustock uses the HTTP protocol for communication with the controller, but disguises the requests as if they are online forum posts with encrypted content

• In an attempt to frustrate takedowns, hostnames associated with the Rustock HTTP communication do not map directly to the IP address of a Rustock controller; instead, the IP address listed in a DNS is passed through a custom algorithm to find the true IP address to communicate with

In second place we find Cutwail botnet with 100,000 bots, followed by Lethic with 75,000 bots; Grum has 65,000 bots; Festi has 60,000 bots, and Maazben has 30,000 bots. The remaining spam botnets have 5,000 to 30,000 bots and include Asprox, Fuflo, Waledac, Fivetoon / DMSSpammer, Xarvester, Bobax, Gheg and Bagle.

Botnets can even be rented, and now they have new and attractive targets including smart phones and mobile devices.

It is clear that even if we use innovative solutions and latest security techniques to prevent breaches and criminal communications, botnets will continue to dominate the cyber threat landscape

[InfoSecIsland]

7-fold increase in botnet victims

Botnets claimed more than seven times as many victims in 2010 in banking credential theft and other criminal activities than in the previous year, according to a report issued by a firm that tracks the large networks of infected machines.

The increase was largely down to improvements in DIY botnet construction kits, which allow criminals to construct new networks quickly and easily, and as a result six of the ten biggest botnets of 2010 did not exist 12 months earlier.

Newer infection technology that targets a drive's master boot record has also aided the growth.

In the run up to Christmas unique botnet victims were up 654 percent compared to the begininning of the year.

Read the full article on The Register: http://www.theregister.co.uk/2011/02/16/botnet_increases/