RSA - Top botnets control 1M hijacked computers

They can dump more than 100B spam messages on users daily

Storm is a shadow of its former self, Kraken is just another name for Bobax and the biggest botnet goes by the mouthful of "Srizbi," a noted botnet researcher said Wednesday as he released the results of his census of the various armies of hacked computers that spew spam.

Joe Stewart, director of malware research at SecureWorks, presented his survey at the RSA Conference, which opened Monday in San Francisco. The survey ranked the top 11 botnets that send spam; by extrapolating their size, Stewart estimated the bots on his list control just over a million machines and are capable of flooding the Internet with more than 100 billion spam messages every day.

The botnet at the top of the chart is Srizbi. According to Stewart, this botnet -- which also goes by the names "Cbeplay" and "Exchanger" -- has an estimated 315,000 bots and can blast out 60 billion messages a day.

While it may not have gotten the publicity that Storm has during the last year, it's built around a much more substantial collection of hijacked computers, said Stewart. In comparison, Storm's botnet counts just 85,000 machines, only 35,000 of which are set up to send spam. Storm, in fact, is No. 5 on Stewart's list.

"Storm is pretty insignificant at this point," said Stewart. "It got all this attention, so Microsoft added it to its malicious software detection tool [in September 2007], and that's removed hundreds of thousands of compromised PCs from the botnet."

The second-largest botnet is "Bobax," which boasts an estimated 185,000 hacked systems in its collection. Able to spam approximately nine billion messages a day, Bobax has been around for some time, but recently has been in the news again, albeit under one of its several aliases.

Other researchers, notably those at a security start-up called Damballa, have been trumpeting a botnet dubbed "Kraken" -- sometimes spelled "Kracken" -- that they claim controls more then 400,000 computers. Stewart and others at SecureWorks believe Damballa has simply rebranded the older Bobax, which has several other nicknames besides Kraken, including "Bobic," "Oderoor," "Cotmonger" and Hacktool.Spammer."

That mix-up over names is just one of the problems that Stewart hoped his research would solve, or at least reduce. "I've been covering botnets for a long time," he said, "and there's a lot of confusion about what botnets belong to what malware family. I want to try to shine some light on what malware belongs to what botnet, and what each botnet's doing."

To try to bring some organization to competing claims, often contradictory, of which botnets are on the rise and which on the skids, Stewart first "fingerprinted" each botnet. "There are enough differences to the SMTP 'fingerprints' for each botnet that we could separate them pretty accurately," he said.

Individual bots implement the SMTP (Simply Mail Transfer Protocol) with minor variations, Stewart said. By developing network-based signatures, he was able to differentiate the collections.

He also estimated the size of each botnet by taking a one-day spam traffic sample from that bot -- the sample derived from SecureWorks' client base -- and then using probabilistic counting methods, extrapolated to come up with a botnet total. Stewart said that past data collected from control server logs confirmed this estimating technique as "fairly accurate."

The whole idea, he added, was to make it easier for everyone to keep track of the most dangerous botnets. "I hope this lets other researchers classify and track botnets better," said Stewart. "Bobax, for instance, flew under the radar for over two years because of confusion. It was still around, but [anti-virus] vendors stopped recognizing [the malware]."

End users should get something out of his work, too. "I think it matters a lot to end users what a botnet's called. They go to look for information, perhaps after they've been infected, and all they have is that it's 'agentxyz.'" But unless everyone is one the same page, that "agentxyz" may simply be a new alias. "Then they'd find hardly any information on what it is or what data it may be after. They won't have a clear picture.

"I hope this trickles down to end users," Stewart concluded.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?