Botnet targets major Web sites with junk SSL connection

The aim of the odd attack is unknown but it's not knocking the sites offline, the Shadowserver Foundation says

More than 300 Web sites are being pestered by infected computers that are part of the Pushdo botnet, according to security researchers.

The U.S. Federal Bureau of Investigation, Twitter and PayPal are among the sites being hit, although it doesn't appear the attacks are designed to knock the sites offline, said Steven Adair, of The Shadowserver Foundation, a group that tracks botnets.

Shadowserver was tipped off to the Pushdo issue by Joe Stewart, director of malware analysis at vendor SecureWorks.

Pushdo, which is also known as Pandex or Cutwail, has been around for about three years, according to a report (PDF) from Trend Micro. Computers infected with Pushdo are used to send out spam, but the malware is capable of downloading other harmful code to a computer.

Pusho appears to have been recently updated to cause computers infected with it to make SSL (Secure Sockets Layer) connections to various Web sites. SSL is an encrypted protocol used to protect information exchanged.

The bots start to create an SSL connection and then disconnect, a process that is repeated, Adair said. Serving up SSL connections puts more of a burden on a Web site than HTTP connections, Adair said, but the traffic has been so sporadic that some large Web sites didn't even notice.

"Despite how noisy it is, the traffic is still too infrequent and not large enough to really be seen as what we would think is an intentional DDOS attack," Adair said in an e-mail exchange. "Much smaller botnets are capable of generating far more traffic and causing more of an impact to Web sites than what is being done with Pushdo."

The traffic, however, is significant and results in large Web sites getting millions of hits across hundreds of thousands of IP (Internet Protocol) addresses.

"This might be a big deal if you're used to only getting a few hundred or thousands of hits a day or you don't have unlimited bandwidth," Adair wrote on Shadowserver's blog.

One option for Web sites is to change their IP addresses, but that may only be a temporary fix. "We have also had numerous people write in offering assistance and feedback on ways to slow or stop these attacks," Adair said.

"We hope to put out an updated post that can help our system administrators associated with these Web sites soon."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitybotnetsSSLtrend micropushdoShadowserver Foundation

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?