Botnet revelation shows darker underbelly of malware

Kneber was built using a well-established toolkit for aggregating botnets called ZeuS that has been around for years

Information gathered about a newly discovered botnet called Kneber indicates that multiple infections by different malware on the same host could work together as a sophisticated mechanism to give all the malware a better survival rate.

The sheer size of the Kneber botnet -- 74,000 compromised computers in 2,400 different companies -- attracted most of the attention when Kneber was revealed Thursday. But how it interacts with other malware networks suggests a symbiotic relationship that ultimately makes each botnet more resistant to being dismantled, says Alex Cox, the senior consultant in the research department at NetWitness who discovered Kneber.

Kneber was built using a well-established toolkit for aggregating botnets called ZeuS that has been around for years. Kneber is an example of just one botnet built with the toolkit, but because Cox captured 75GB of log data from the command-and-control server, he was able to examine detailed characteristics of the computers ZeuS took over.

What he found is that more than half the 74,000 compromised computers -- bots -- within Kneber were also found infected with other malware that uses a different command-and-control structure. If one of the criminal networks were disabled, the other could be used to build it up again,

"At the very least, two separate botnet families with different [command-and-control] infrastructures can provide fault tolerance and recoverability in the event that one [command-and-control] mechanism is taken down by security efforts," he says in his written analysis of the Kneber botnet.

In this case, more than half the machines that made up the botnet were infected with both ZeuS, which steals user data, and Waledac, a spamming malware that uses peer-to-peer mechanisms to spread more infections, he says. He can't conclude for sure that they're working together in this case, but the presence of both introduces an interesting possibility: If the ZeuS command-and-control infrastructure is cut down, the owner of the ZeuS botnet could go to the person running the Waledac botnet and pay for it to push a ZeuS upgrade that brings the ZeuS bots back online reporting to a new server, he says.

Alternatively, a single group could run both the ZeuS and Waledac botnets and push the upgrade itself. "From a disaster-recovery perspective, it makes sense," Cox says.

The Kneber server log contained individuals' passwords to sites including Facebook and Yahoo as well as a slew of financial sites including CitiBank, Wells Fargo, PayPal, Citizens Bank and HSBC Bank, according to Cox's report on Kneber.

Cox discovered Kneber Jan. 26 while working at a NetWitness customer site. He found a machine infected with ZeuS that was downloading other malware executables. He traced the traffic back to a ZeuS command-and-control server in Germany, where he was able to grab a month's worth of the server's log data. He won't say he accomplished these actions.

The botnet got its name from, the registrant listed for the original domain used to pull together various components of the botnet. That same registrant has been associated with seeking other malware including PDF and Flash exploits as well as Trojan installs.

The same registrant is also listed on multiple Web sites seeking money mules -- people who accept illegal transfers of money into their bank accounts and forward them to other bank accounts in an effort to make the funds unrecoverable by the actual owners.

Kneber has been active since March 25, 2009, and most of the sites associated with its activities are in China, according to their underlying IP addresses, NetWitness says. About 17% of these sites are in the United States.

Cox also links Kneber to a phishing attack against U.S. government agencies that sends e-mails apparently from the National Security Agency that urges recipients to click on links that download the malware.

He gives significance to the fact that one of the things Kneber harvests is social networking usernames and passwords. These can be used to get into social networking accounts where they can post links to infected sites. Social network friends are more likely to trust these links because they seem to be posted by people they trust.

Social network accounts can also be mined for personal data that can be useful in further compromising individuals' financial accounts. For example, if social networking accounts yield mothers' maiden names, they might be used to reset passwords of bank accounts, giving attackers a way to get in and transfer money out.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitybotnetsKneber botnet

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?