Hosting firm takedown bags 500,000 bots

Infected PCs still operational but unable to receive instructions from malware after shutdown of rogue ISP McColo.

The shutdown last week of a US-based Web hosting company crippled more than 500,000 bots, or compromised computers, which no longer are able to receive commands from criminals, a security researcher said Tuesday.

Although the infected PCs are still operational, the previously-planted malware that tells them what to do cannot receive instructions because of the shutdown last week of McColo Corp.

"Half a million bots are either offline or not communicating" with their command-and-control servers, estimated Joe Stewart, director of malware research at SecureWorks.

The California firm was disconnected from the Internet by its upstream service providers at the urging of researchers who believed the company's servers hosted a staggering amount of cybercriminal activity, including the command-and-control servers of some of the planet's biggest botnets. Those collections of infected PCs were responsible for as much as 75% of the spam sent worldwide; when McColo went dark, spam volumes dropped by more than 40 percent in a matter of hours.

The McColo takedown resulted in a record number of bots being severed from their hacker controllers by any single event, Stewart said. He compared it to last September, when Microsoft's anti-malware utility, the Malicious Software Removal Tool (MSRT), purged nearly 300,000 infected PCs of the infamous Storm Trojan.

"That had a good impact, but it didn't stop the flow of spam globally," Stewart said of the MSRT takedown. "It didn't make a difference to other botnets that were still spamming away."

Knocking McColo offline, on the other hand, disrupted at least two major botnets -- "Rustock" and "Srizbi" -- said Stewart, and caused spam to plummet around the globe.

Stewart, a leading authority on botnets, estimated the strength of the top 11 botnets last April. Srizbi, at 315,000 bots, was No. 1 in his census, while Rustock, at 150,000, was in the No. 3 spot.

Rustock's handlers, said Stewart, may never recover control of their bots. "It does look like they're lost to them," he said, noting that those bots lack a failsafe for reconnecting with a command-and-control server if it does dark, as happened when McColo's plug was pulled.

But while Rustock's bots may be orphaned, there's a chance the Srizbi's bots can be brought back under control. "When Srizbi bots can't connect, as a backup they're coded to try other domain names," to search for new command-and-control servers, said Stewart. Those domains, however, were recently registered, perhaps pre-emptively by a security researcher who had rooted through the Srizbi code.

"They're not receiving new instructions," Stewart said. That would indicate that a third-party -- someone who didn't have the Srizbi source code, and thus a way to figure out the protocols for sending new orders to the disconnected bots -- may have snatched up the domain names.

It may be the case, though, that Srizbi's creators thought of that, and that any fall-back domain names are not hard-coded into the bot but are generated using an algorithm of some sort. "If Srizbi is programming intelligently enough so it not only says, 'I'm going to try some new domain names,' but also 'if that new server is not sending valid data, then generate another domain name,' maybe they can be recovered," Stewart speculated.

Also helping Srizbi in the wake of the takedown, Stewart added, is that it used a more compartmentalized structure -- it's essentially a collection of smaller botnets that at some levels are shared -- which in turn meant that not all its command-and-control servers were hosted by McColo.

And not all botnets have been affected equally, Stewart said. "Bobax and Cutwail, they're still spamming," he said. In his April estimate, Bobax was No. 2 out of the 11 botnets, accounting for approximately 185,000 PCs, while Cutwail was No. 4, with 125,000 bots.

Worse, even if the Rustock and Srizbi bots have been permanently cut off from their criminal overlords, it doesn't mean the end of those botnets. It's all too easy for criminals to buy compromised computers from others, or simply seed their malware in a major campaign to infect new systems.

"I'm sure they'll be back," said Stewart.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags botnets

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

Logitech Ultimate Ears Wonderboom Bluetooth Speaker

Learn more >

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?