Close
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity
    • IT Management
    • Networking

    Spammers Stay Busy Despite Pushdo Botnet Hit

    By
    Brian Prince
    -
    September 1, 2010
    Share
    Facebook
    Twitter
    Linkedin

      From the shutdown of McColo to last week’s disruption of the Pushdo botnet, spammers have continually found ways to stay in business.

      Nearly 20 of the 30 command and control (CnC) servers associated with Pushdo were taken offline last week due to efforts by security vendor LastLine. The servers were supported by eight hosting providers, some of which did not respond to the vendor’s requests for action.

      According to Thorsten Holz, senior threat analyst with LastLine, the goal of the company’s research was not to completely take down the botnet, but to gain insight into Pushdo’s CnC infrastructure. At full strength, the botnet was believed to be responsible for between 7 and 10 percent of all spam.

      “We worked with different hosting providers and [got] a quick response from many of them, but unfortunately not all providers reacted on our abuse requests,” he said. “Especially the hosting providers from China did not react at all, which is kind of disappointing.

      “Better cooperation and coordination would help in the future; we are in the process of building better relationships with more hosting providers,” Holz added.

      While roughly two-thirds of Pushdo’s servers were knocked offline, spam from the botnet is recovering, according to M86 Security. In addition, Matt Sergeant, senior anti-spam technologist with Symantec Hosted Services, said overall spam levels today stand relatively unchanged.

      “Considering the fact that the entire botnet was not taken down thanks to these bulletproof hosting companies, it appears that the botnet was still able to operate and create a good deal of traffic,” said Fred Touchette, senior security analyst at AppRiver. “Virus levels are down overall on the other hand, but not much, and it’s unclear whether or not this is due to the takedown efforts.”

      In order for a botnet shutdown to be effective, all CnC servers have to be taken down simultaneously, said Gunter Ollmann, vice president of research at Damballa.

      “If even one single CnC server is left up, the botnet will still be operational,” Ollmann said. “Then, once the botnet operator has spun up some of his spare or reserve CnC servers, he simply pushes a configuration file update down to all the victim computers within the botnet with the list of the new CnC servers. The only other way to permanently shut down a botnet is to locate and remove the operators themselves-but even this has problems as evidenced in the almost comic way in which the botnet operators behind the Mariposa botnet were able to resume control [temporarily] after being arrested.”

      In response to the takedown, Touchette expects those in control of Pushdo will continue to spread their control servers across various countries and hosting companies to guarantee uptime.

      “They may even begin to develop new code for their botnets which change the way they can communicate with each other in order to protect their numbers,” he said. “Something like a peer-to-peer communication between the bots themselves would eliminate the need for centralized command and control servers.”

      The list of command and control servers is not static, added Ollmann, and can be dynamically changed at any time.

      “Most botnet operators factor in a certain degree of attrition to their CnC infrastructure and are therefore experienced in quickly spinning up new and additional CnC servers rapidly,” he said.

      Brian Prince

      MOST POPULAR ARTICLES

      Big Data and Analytics

      Alteryx’s Suresh Vittal on the Democratization of...

      James Maguire - May 31, 2022 0
      I spoke with Suresh Vittal, Chief Product Officer at Alteryx, about the industry mega-shift toward making data analytics tools accessible to a company’s complete...
      Read more
      Cybersecurity

      Visa’s Michael Jabbara on Cybersecurity and Digital...

      James Maguire - May 17, 2022 0
      I spoke with Michael Jabbara, VP and Global Head of Fraud Services at Visa, about the cybersecurity technology used to ensure the safe transfer...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Applications

      Cisco’s Thimaya Subaiya on Customer Experience in...

      James Maguire - May 10, 2022 0
      I spoke with Thimaya Subaiya, SVP and GM of Global Customer Experience at Cisco, about the factors that create good customer experience – and...
      Read more
      Big Data and Analytics

      GoodData CEO Roman Stanek on Business Intelligence...

      James Maguire - May 4, 2022 0
      I spoke with Roman Stanek, CEO of GoodData, about business intelligence, data as a service, and the frustration that many executives have with data...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×