The Kneber botnet, so christened by security firm NetWitness in describing it to the press, is nothing new and there are many other botnets like it out there, according to a number of other security firms.
Kneber is described as a botnet command-and-control system based on the ZeuS Trojan, a well-know type of malware capable of stealing financial data and login credentials. According to NetWitness, the firm discovered Kneber in January while deploying its network security equipment for a customer, and estimates the botnet has infiltrated “75,000 systems in 2,500 organizations around the world.” Other security vendors say expect to find another 100 or more ZeuS-based botnets just like it if you go looking.
Many commend NetWitness for uncovering the server cache of information containing stolen password, login and Web browser information related to the Kneber botnet. But there are probably many more Kneber-like botnets out there today, say some, and because Kneber uses the older version of ZeuS, it doesn't even represent the worst it could do.
What NetWitness uncovered in Kneber with 75GB of information on 75,000 compromised machines over 90 days “is above the median size of a data cache,” says Don Jackson, security researcher at SecureWorks, noting most botnet caches his firms has uncovered tend to run 10GB of data for about 23,000 compromised user computers.
But Kneber, he notes, is based on the older 1.2 version of ZeuS now given away for free and is not usually considered what would be used by a “professional high-dollar operator” who would make a lot of effort to hide behind proxies. “If you wanted to go hunting for these things, you could find them every month,” he noted.
The most recent version of ZeuS, version 1.3, which was first seen in November of last year, costs thousands, with even a single module costing $10,000 in criminal circles, according to SecureWorks, which is expected to issue an in-depth report about ZeuS 1.3 next Monday. The new version of ZeuS is so deadly, it rips through unauthorized online wire transfers once it gets hold in an infected machine — and more.
Anyone investing in ZeuS 1.3 is likely to take a lot of trouble to successfully hide the botnet, Jackson notes.
The problem is that Kneber-like botnets are a dime a dozen and certainly nothing new, according to other security firms.
“We're tracking, at any time, about 100 unique ZeuS botnets,” says Marc Maiffret, chief security architect at FireEye. “There are constantly-changing variants of it.” This is this is one reason it has a chance to evade signature-based malware defenses. But Maiffret also says that he'd characterize a ZeuS botnet controlling 75,000 systems as being of mid to high size.
The ZeuS Trojan “is not a new threat. It's a threat that's been around for a few years,” says Elias Levy, senior technical director of Symantec's security-response group, who characterized the Kneber botnet as of a fairly “normal” size. He says these type of botnet infections typically reach into the tens of thousands and it not's surprising to see hundreds of thousands botnet-controlled machines. But he commends NetWitness for gathering “pretty good intelligence; they got a glimpse of how it worked,” but adds, “but that one botnet, it's not that much different than the many others out there.”
McAfee also piped in, issuing a statement saying, “In the world of cybersecurity, the 'Kneber' botnet is, unfortunately, just another botnet. With 75,000 infected machines, Kneber is not even that big, there are much bigger botnets.”
In describing Kneber, NetWitness noted that several of the infected machines it tracked appeared to also be infected with Waledec, another form of malware-based botnet, which it surmised may be there for purposes of “resilience and survivability” by the criminal attack group. But SecureWorks researcher Don Jackson said he wouldn't be inclined to characterize seeing ZeuS and Waledec on the same machine as necessarily representing something unusual since Waledec is often used as a downloader for ZeuS.
