Rustock Botnet: Dead Or Just Reloading?

Reports indicate that the massive drop in spam levels are linked to the sudden disappearance of the Rustock botnet. However, recent history suggests the interruption may only be temporary.

Spamhaus’s Composite Spam Blocklist (CBL) claims that dozens of Rustock’s internet servers, which for years have been pumping spam messages and slinging faux pharmaceutical ads, stopped operating Wednesday morning in near simultaneity.

While there's agreement that Rustock is offline - at least for now- its not clear if the interrpution in spam is the result of a take-down or of Rustock reloading.

CBL’s data suggests that Rustock’s spam levels have been surging and plummeting on a daily basis. At times, the botnet accounted for as much as 75 percent of global spam, only to drop back to zero percent the next day. Such has been the case for the last week, for every significant peak, the following day brings subsequent drop to zero percent of global levels, only to rise and fall again. That was the case in December, 2010, when Rustock disappeared for a period of time, only to re-emerge.

Thus far, Rustock interruptions have been sporadic and short-lived, creating a statistical ebb and flow where its volume has hit and hovered around zero, but never staying there for any significant period of time. Not so with the latest interruption in service, which shows Rustock flat lining since 10:54 am EST Wednesday.

Rustock has been the leading source of spam for some time, generating between 50% and 70% of worldwide spam volumes. While no firm data is available on the numbers of e-mail messages sent out through Rustock, the number is likely to be staggering, which is impressive considering Threatpost reported yesterday that the relatively smaller Pushdo botnet has generated some 1.7 trillion spam messages.

This, despite efforts to limit the impact of botnets by using blacklists to block traffic from infected systems.

[ThreatPost]

Inside the Cybercrime Underworld: 100 Billion Spam E-Mails a Month

American and German researchers who infiltrated and crippled one of the world’s biggest spam-producing networks last summer have released a formal paper on the experience, and the numbers are staggering.

The Pushdo/Cutwail “botnet” sent out 1.7 trillion e-mails over 15 months (about 113 billion per month), had 100,000 enslaved “bots” around the world and had about 30 command-and-control servers in

Europe, North America and Russia.

Its Russian cybercriminal operators bought and sold e-mail addresses by the million and compromised PCs by the thousand, with lower prices for less-desirable countries and volume purchases.

[Read the original research paper here (PDF).]

"The interesting things were just the amount of spam that they were sending and how they operate like a professional business, with detailed statistics and error reporting,” Brett Stone-Gross, one of the researchers and a doctoral candidate at the University of California, Santa Barbara, told Kaspersky Lab’s ThreatPost blog. “This is a real business."

The 16 Pushdo/Cutwail servers that the researchers were able to access contained 2.35 terabytes of data, 24 databases full of details about operations and billions of target e-mail addresses.

The researchers estimate that the botnet’s operators have earned between $1.7 million and $4.2 million since June 2009.

Even one sub-botnet — Pushdo/Cutwail was divided into several domains, each under the control of one gang member — was able to pump out 87.7 billion e-mails in the four weeks between July 30 and August 25, 2010.

"I was most surprised by the sheer number of e-mails sent by this one botnet," another researcher, Thorsten Holz of Ruhr-University Bochum in Germany and Lastline, Inc., in Santa Barbara, told UBM TechWeb’s Dark Reading blog. "It turns out this one botnet sent out billions of spam messages."

Symantec Labs estimated last year that 89 percent of all e-mails are spam.


Takedown

The research team got service providers to pull the plug last summer on about 20 of Pushdo/Cutwail’s 30 command-and-control servers. (The other service providers refused.) The botnet was crippled for several months.

Botnets are illicit networks of computers that have been enslaved by malware, which burrows deep into their operating systems and opens “backdoors” that allow control by remote operators, or “bot herders.”
Malware infection usually happens when a user opens a compromised e-mail attachment (a Trojan) or visits a compromised website (a drive-by download).

The bots, ordinary machines scattered across the globe whose users have no idea they are infected, are used to send out spam touting Viagra and pornography, phishing e-mails and Trojans to harvest more bots.

Almost 40 percent of Pushto/Cutwail’s bots were in India, Holz and his colleagues found. Other countries’ shares were far lower; Australia came in second, comprising 9 percent of the compromised PCs.

Holz and his colleagues also got an archived copy of Spamdot.biz, an online forum used by botnet operators for communication and trade, which provided a fascinating look into the world of mid-level cybercriminals.

More than 90 percent of the posts on Spamdot.biz were in Russian, and less than 9 percent in English. It had nearly 2,000 registered members, who had to be recommended by at least two other existing members to be accepted.

E-mail addresses were bought and sold in blocks of a million, with prices ranging from $25 to $50 per block depending on geographical location, status (free Web-based e-mail services such as Gmail or Hotmail were cheaper) and volume.

Specialized groups sold services, such as infecting new batches of computers with the client’s malware. These sold in blocks of 1,000, with prices ranging from $13 for Asian computers to $125 for PCs based in the United States.


Top-notch software

The software used by the Pushdo/Cutwail botnet was remarkably sophisticated. Each server running Cutwail, the spam engine, constantly tested its messages against a built-in copy of the SpamAssassin e-mail filter.

Pushdo, the Trojan used for command and control, used a proprietary, and often encrypted, communications protocol to direct its bots.

Despite the technological efforts and the sheer volume of spam sent out, only 30 percent of Pushdo/Cutwail’s e-mails ever reached their target servers, the researchers estimate. Half went to invalid addresses, and nearly 17 percent were blacklisted.

"That's quite a big loss," Holz told DarkReading. "And even if the mail is received by the targeted mail server, with filtering and SpamAssassin a large chunk of that 30 percent gets filtered and doesn't necessarily reach the inbox of the user."

Still, having all this information isn’t much of a victory in the fight against spammers.

Pushdo/Cutwail has been rebuilt since last summer and is now back up to its pre-takedown size of about 100,000 bots. It’s the second-largest botnet in the world; the Rustock botnet has an estimated 250,000 enslaved PCs.

How can you prevent your computer from being enslaved by a botnet? No method is foolproof, but your odds of infection drop dramatically if you do two things: Don’t open any unrequested e-mail attachments, even those from friends; and install and constantly update and run anti-virus software, even if you’re using a Mac.

Using a Mac instead of a Windows PC also does help, at least for now. Macs are not immune from infection and a few Mac Trojans have been found in the wild, but Apple’s PC market share is still so small that most cybercriminals don’t bother writing malware for it.

[SecurityNewsDaily]

Notorious spamming botnet Rustock shuttered

IDG News Service - A large network of hacked computers called Rustock, which was responsible for a great volume of spam, has shut down, perhaps as a result of another coordinated take down by security researchers.

Rustock's inactivity, first reported by security writer Brian Krebs on his blog, started on Wednesday when analysts noted that its command-and-control servers were offline.

Richard D.G. Cox, the CIO for the spam-tracking organization Spamhaus, said on Thursday morning that he was waiting for more information from U.S.-based colleagues about why Rustock is not working.

He noted that while it is possible that Rustock's decline is the result of another joint action by the security community, it could be that Rustock's operators are just reorganizing, since the botnet has slowed down before, he said.

"We are aware something is happening," Cox said.

The security company M86 wrote on its blog that Rustock completely stopped spamming, and its command-and-control servers would not respond.

"It is unclear yet who or what caused the shutdown," wrote Phil Hay, an analyst with M86. "It's also possible it has been abandoned. Over the past three years, Rustock has been responsible for a huge amount of spam, at times representing half of all spam caught in our spam traps."

Hay said that Rustock's spam output dropped after the closure of Spamit.com, a Russian website for e-mail spam affiliates linked to GlavMed, which ran the "Canadian Pharmacy" pharmaceutical spam campaigns.

Several botnets -- Pushdo, Waledac and Bredolab -- have come into the crosshairs of security analysts and law enforcement. Microsoft marshalled a group of security researchers that attacked Waledac in February 2010.

Waledac used a complicated peer-to-peer communication system, but researchers were able to disrupt it and take control of some 60,000 computers. Microsoft also went to court to shut down domains used by the botnet to communicate. But botnets are difficult to completely stop, and there are signs that Waledac has come back.

Last October, the Dutch High Tech Crime Team along with other organizations shut down 143 servers used to control Bredolab, which sent an estimated 3.6 billion e-mails a day. Armenian authorities, acting on a request from Dutch police, arrested a 27-year-old man accused of being Bredolab's controller.

Botnets manage to come back from shutdowns as code is modified by hackers and more computers become infected.

"Previous attempts at botnet shutdowns have tended to be short lived as the botnet herders simply regroup and start again," Hay wrote. "It's too early to say bye bye Rustock, but the thought is certainly nice."

[ComputerWorld]

Cyber crime economy – the Spammer side

Not just the people infecting PCs with malware want to earn money – the spammers want their share, too. The most obvious way to earn money for them is of course when people buy the advertised products – fake Viagra, watches, pirated software and so on. But for the spammers there are also affiliate programmes which generate revenue for them.

The affiliate programmes the spammers use work by redirecting traffic to their website; they pay money for visitors redirected to them. It is not the first time that we see this happening as we’ve seen spam for Google Adwords and a “business” model similar to this one, but the whole deal has to be really worth the trouble in order to go and use this method of producing traffic.

The emails the spammers sent this time use social engineering tactics to create psychological pressure and make the recipients click the link.



To be honest, I clicked on that URL (in a VM) concerned that it might drop a Trojan or perform some malicious action. To my surprise, it did not. It opened an intermediate website instead – which is a URL shortener that opened yet another site.



The last website opened was Amazon.de (.de and not .com) and not a random page, but a page advertising an iPhone 3GS sold by Notebook.de.



I don’t know if there is a connection between the spam campaign and the website Notebook.de (which to my knowledge is a clean and respected website).

How this business works gets clear when visiting the URL shortener itself: Register a shortened website and get paid for visitors. But how does the business model work in this case? Well, if you look at the screenshot, you can see a big yellow button with words “SKIP AD”. If you click there, you are redirected to some survey websites which make money with the user’s feedback.



What you can also see is that if you want your website advertised you pay $ 5 for 10.000 visitors. Let’s make a basic ROI calculation for the owners of the URL shortener: According to the text in the blue rectangle, $ 4 are paid for 1000 visitors. Thus for $ 5 the “customer” needs to redirect 1250 visitors.

According to the URL Shortener’s advertisement, they get paid $ 5 for 10.000 visitors but they pay $ 5 for 1250 visitors. This doesn’t sound very smart for a business as obviously they pay more money than they get.

Is the spammer smarter than the company behind the URL shortener? Assuming the spammer gets $ 5 for 1250 visits, and only 1 of 100 recipients of the email clicks onto the link in the mail (or the other 99 emails were blocked), he would have to send 125.000 emails in order to get paid $ 5. Among security experts it is assumed that spammers pay between $ 0.0001 and $ 0.001 (0.01 – 0.1 cents) per email sent.

Thus the spammer would need to pay between $ 1.25 and $ 12.50 to send this amount of emails. So the return of investment is only positive when the cost of sending a spam mail is low (around $ 0.0001 / email).

I don’t know how the spammers really end up, but since we received this email in our inboxes I assume that the ROI is positive for both, the spammers and for the URL shortener service.

I have a problem with this kind of advertisement-links – there is not much to block! I mean, we can’t block bit.ly, we can’t block the URL shortener which pays the $ 4 for 1000 visitors, and we definitely can’t block amazon.de. All I could do was to report the bit.ly shortcut from the email to bit.ly and hope it will be blocked soon. Fortunately, the spam email itself is quite easy to block because it is being sent to 395 recipients at once in a mass mailing action. However, Gmail’s spam filter wasn’t able to stop it – but Avira Antispam marked it immediately with spam level “Very High”.

[ComputerSecurityArticles]

Sloppy spelling scuppers DHL malware spam attack

Thank heavens for the poor education of cybercriminals!

If they had paid more attention to spelling and grammar at school (rather than mugging younger kids for their dinner money and inflicting chinese burns behind the bicycle sheds) then maybe some of their scams would be harder to spot.

Take this malware campaign that we are seeing being spammed out right now, for instance.

Subject: DHL notification
Message body:
Dear customer.
The parcel was send your home address.
And it will arrice within 7 bussness day.
More information and the tracking number
are attached in document below.
Thank you.
2011 DHL International GmbH. All rights reserverd.

The email doesn't really come from DHL, of course. This is just the latest in a long line of instances where cybercriminals have distributed malware attacks posing as communications from a delivery firm such as UPS or FedEx.

But take a closer look. There are 37 words in the body of that message, four of which are spelt incorrectly. That's an almost 11% failure rate!

If the spelling mistakes and lack of professionalism weren't enough to get your security sixth sense jangling, then hopefully your anti-virus would have identitifed that the attached DHL_document.zip file contains malware.

Sophos products detect the ZIP file proactively as Mal/BredoZp-B, and its Trojan horse contents as Troj/Agent-QQG.

I, for one, vote against improving the grammar and spelling of cybercriminals. We can't rely on every malicious hacker being a poor communicator, but it certainly can help the general public identify when a message should be treated with suspicion.

[NakedSecurity]

Facebook app pages serve up Javascript and Acai Berry spam

There’s a nasty round of Facebook app pages dabbling in Javascript shenanigans to spam Acai Berry diet pages on your profile walls. Simply visiting these pages while logged in is enough to post some spam, most of the pages involved promising (surprise, surprise) a video to watch:


Click to Enlarge

If you try to navigate away from the above app page, a message will pop up claiming you’re about to “corrupt the Flash install”. Total nonsense, but it’s just enough to result in something like the below being posted to your profile:


Click to Enlarge

“I am living proof that this works”, claims the “facebook sponsored weight loss product”. No sign of anyone yelling “Beefcake, Beefcake” but let’s dispense with the South Park references and see where the spam link leads to:


Click to Enlarge

Oh look, a fake news site touting logos from various news sources. Needless to say, you don’t want to be handing over any money for the above. Though the code in the below screenshot may look like a load of tech related jibber-jabber, you can still see many pieces of text used for the various spam messages:

Click to Enlarge

Spam messages will also be sent out in both wall postings and facebook chat that look like this:
“Hey, What the hell are you doing in this video? Is this dancing or what?? Bahahah”

You can see that in the above screenshot, too (look near the bottom of the code). If you don’t want to strain your eyes, here it is in action:



There appears to be one main domain for this, franebook(dot)com (although it’s currently serving up 404 errors) and many of the related application pages also appear to have been taken down by facebook. apps(dot)facebook(dot)com/bergamoleyra/ and apps(dot)facebook(dot)com/hellenismkpmga/ are both giving “page not found” messages, although there seems to be a number of app pages still live and redirecting to the Acai berry spam sites.

As always, be careful what you’re clicking on in facebook – random messages promising junk will usually give you just that (and perhaps a little more besides).

[ComputerSecurityArticles]

Rustock Botnet is the Biggest Spammer

Rustock is today the largest and most productive spam botnet in the world, as was reported at the RSA Conference 2011 in San Francisco.

The Rustock botnet (founded around 2006) consists of an estimated 250,000 computers, and the size of Rustock is related to the constantly evolving technologies.

Joe Stewart, Director of Malware Research at Dell SecureWorks Counter Threat Unit, said that Rustock occupies the first position due to the fact that developers are constantly creating and updating source code which makes many antiviruses fail to detect the malware.

The interesting point is that most criminals are not looking to have large sized bot networks anymore, instead they try to have a smaller number of zombies in order to avoid being detected by major ISP’s. Rustock has employed other novel tactics to stay under-the-radar:

• Samples with active control servers have been observed waiting for up to five days before spamming

• Rustock control servers run a TOR exit node, likely in an attempt to avoid disconnection by network administrators who might think the abuse is originating elsewhere

• Rustock uses the HTTP protocol for communication with the controller, but disguises the requests as if they are online forum posts with encrypted content

• In an attempt to frustrate takedowns, hostnames associated with the Rustock HTTP communication do not map directly to the IP address of a Rustock controller; instead, the IP address listed in a DNS is passed through a custom algorithm to find the true IP address to communicate with

In second place we find Cutwail botnet with 100,000 bots, followed by Lethic with 75,000 bots; Grum has 65,000 bots; Festi has 60,000 bots, and Maazben has 30,000 bots. The remaining spam botnets have 5,000 to 30,000 bots and include Asprox, Fuflo, Waledac, Fivetoon / DMSSpammer, Xarvester, Bobax, Gheg and Bagle.

Botnets can even be rented, and now they have new and attractive targets including smart phones and mobile devices.

It is clear that even if we use innovative solutions and latest security techniques to prevent breaches and criminal communications, botnets will continue to dominate the cyber threat landscape

[InfoSecIsland]

The Spam King is free again, claims his spamming days are over

Robert Soloway, one of the most prolific spammers whose activities earned him the nickname Spam King, has been released from prison after a little less than 4 years inside.



He is allowed to go back online, but according to his plea deal, probation officers will monitor his e-mail correspondence and which websites he visits for the next three years.

“If I send out spam e-mails, that’s a violation of my probation. End of story,” he said to Wired. “I’m being very careful. If I send out an e-mail, I’m not even going probably to CC it. I’ll send a unique e-mail to each person.”

After and estimated 10 trillion spam e-mails sent doing his "career", teaching other people to spam, selling spam packages and using botnets to spread the e-mails - and living the good life during all that time - he now lives in a modest studio apartment in Seattle and works in a print shop.

He says he learned the lesson and now wants to help businesses and consumers avoid spam. “I don’t expect anyone to trust anything I say until they see me making good,” he declared. "I would like to assist in some way by basically revealing what went on inside the cybercrime industry."

[Net-Security]

E-mail spam drops by half, search malware on the rise

Attackers are making a shift from using e-mail spam to more aggressively targeting the Internet, according to Barracuda Network.



E-mail spam dropped by half during 2010, while search engine malware doubled and the Twitter crime Rate increased 20 percent, signifying a concentrated focus on the more lucrative social networks and search engines as attack vectors.


“Attackers focus on where they can get the most eyeballs and profit, and today that means social networks and search engines,” said Dr. Paul Judge, chief research officer at Barracuda Networks. “As a community we often point to the need for user education as the missing component; however, the levels of social engineering involved in today's attacks suggest that we must continue to elevate our technological approaches. The research community must continue to build innovative defenses and the industry must make efforts to increase the deployment rates of those defenses.”

[net-security]

Finally got that iPad? Facebook users hit by ‘via mobile web’ spam

We’re seeing a growing number of Facebook accounts that appear to have been compromised by spammers, with messages posted claiming that the user has received a free Apple iPad.

Messages include:

Finally got my iPad from that site!
5 days ago I signed up at [LINK] as a tester and today I got my iPad. All you need to do is to tell them your opinion about iPad and you can keep it forever. You should hurry since i highly doubt this is gonna last forever.

or

I finally got that ipad I ordered at [LINK] as a product reviewer and today received it in my mailbox. All you need to do is tell the site your opinion about ipad and then u can keep it forever. You should be quick because I doubt this will last forever.

As the world is widely anticipating that Apple will announce the iPad 2 in San Francisco today, it’s likely that there are plenty of people who would be interested in testing the popular tablet computer – especially if there is the possibility of receiving a free one!

Clicking on the links, however, is unlikely to bring you to a genuine webpage offering you a free iPad. Instead, when I tried the links, I was taken to a site asking me to hand over my credentials to an affiliate rewards program, giving me the “opportunity” to earn extra cash by taking surveys.

In other words, these messages are spam – and were not posted knowingly by the owners of the affected Facebook accounts.

What’s interesting about the messages is that many of them appear to have been posted via the mobile version of Facebook’s website (marked as “via mobile web”), that is most often used when people access the site via their cellphones.

It isn’t clear to me whether these accounts have fallen victim to phishing attacks, or if a specific weakness is being exploited in Facebook’s mobile interface, but it would seem to me to be sensible for affected users to scan their computers for security problems and change their Facebook passwords.

In addition, make sure that your privacy settings are properly secured by checking out our best practices for better privacy and security on Facebook guide.

Make sure that you keep informed about the latest scams spreading fast across Facebook, and other internet attacks. Join the Sophos page on Facebook, where over 60,000 people regularly share information on threats and discuss the latest security news.

[NakedSecurity] via [hackinthebox]