Slashdot Mirror
Botnet Targets Web Sites With Junk SSL Connections
angry tapir writes "More than 300 Web sites are being pestered by infected computers that are part of the Pushdo botnet. The FBI, Twitter, and PayPal are among the sites being hit, although it doesn't appear the attacks are designed to knock the sites offline. Pushdo appears to have been recently updated to cause computers infected with it to make SSL connections to various Web sites — the bots start to create an SSL connection, disconnect, and then repeat." SecureWorks's Joe Stewart theorizes that this behavior is designed to obscure Pushdo's command and control in a flurry of bogus SSL traffic.
Probably one of a few things
1) They are looking for a particular vuln to make their bot bigger.
2) They are just testing a DOS.
3) They are actually conducting a DOS.
4) They are trying to make some sort of name for themselves.
5) Combination of the above.
My money is mostly on 1, and some sort of bug in the program causing it to spam the same boxes over and over.
Do they realise that SSL traffic causes a higher load on the server than a regular request? This would be an indication it is trying to bring the site down.
I don't see how sending packets to 'major websites' disguises the real communications in any way. Just filter those requests. The more 'major' the web site for the garbaage packets, the easier it is to distinguish them from the real packets.
I.O.U One Sig.
"Site owners "would just see weird connections that don't seem to make sense," he said. "They look like they're trying to start an SSL handshake, but it comes in malformed and doesn't ever send anything after that first handshake attempt."" Is it possible that they've found a flaw in a specific Systems handling of SSL and are trying to see if the flaw exists elsewhere in an attempt to produce an exploit? I'm not really a security guy, but it seems like they're up to something specific. Otherwise why use SSL exclusively? wouldn't they want to diversify their requests?
I don't think the point is for denial of service. If all the nodes on the botnet send out requests that are indistinguishable from a command from the botnet controller it makes for a nice cloaking shield for the command center.
Not really.
I've had to parse logs for similar things. Thousands of requests hit a particular exploitable web page, but only one or two IP's are sending further information. It's easy to trim it down the list of candidates, and find who the real problem is.
That's what the feds do in any investigation. They have a broad list of suspects. They eliminate folks until they have their persons of interest, and then down to the guy who they'll be convicting.
Serious? Seriousness is well above my pay grade.
Why is this such a good solution? Have people forgotten how to parse logs? Shouldn't be that difficult to differentiate a connect/disconnect from a connect, send real data, disconnect.
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
most Slashdotters have fairly lax moral standards. Especially when it comes to computers.
Yes, essentially we are all evil . . . now where's that kitten? Er, sorry, I meant robotic, remote-controllable kitten with embedded linux firmware!?
is that because the antivirus program makes the computer crawl to a halt so the bot program has no CPU resources left to run?
Obfuscation isn't good security. But, as any politician will tell you, it's excellent defense.
I tend to agree with you that this sort of thing should still be relatively easy to pickup in logs - on proxies as well as the border routers. A lot of people are probably forgetting that SSL through proxies still needs a CONNECT originserver:443 HTTP/1.x request, which gets logged, even if all of the traffic is encrypted on the tunnel after that.
SSL/TLS at it's core generates "session keys" for communication; a string of random characters. It's possible they're trying to deplete the SSL servers of true entropy for some undisclosed attack; PRNG, for example.
I Browse at +4 Flamebait
Open Source Sysadmin
Some of the malware I've encountered lately (I've got one system unusable until I get around to reinstalling the OS) is very sophisticated indeed. I would admire the designers, if I didn't so badly want them dead.
Does anybody else miss script kiddies?
Dude, like maybe it doesn't NEED to send anything.
Maybe like, the connections themselves ARE the data.
Whoooaaa.
What desktop Operating System does this Pushdo botnet require to operate ?
"Once executed the malware first tests to see if it's currently running as the hardcoded value "rs32net.exe" in the system folder (C:\Windows\System32 by default)"
I don't get it. Could someone please explain this to me?
If they're trying to disguise their traffic to the command-and-control center, how does this help? If you get a lot of malformed requests from a particular host, then if you're an investigator, it's like the infected computers are advertising themselves as zombies. And if they're sending these requests to major web sites, how does this disguise the requests they're making to the (presumably non-major website) control center? Couldn't you just say, "Well, this computer made 300 malformed SSL requests to Facebook, Twitter, et cetera, and one malformed request to , let's find that guy!"
I'm seriously confused.
I don't believe in time. It's a grand conspiracy designed to sell watches.
Moral standards? What are those? God, I hate obscure standards!!
Oh, wait - didn't Microsoft Embrace, Extend, and Extinguish moral standards years back? It's hard to remember . . .
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
the problem is that it takes so much CPU load and time for training and in addition what to do with the false positives?
According to our graphs, our targeted frontend is taking the drone's trashy SSL requests like a champ (reverse-proxies are humming as expected, no inordinate load, etc).
You too can see if you are on the hitlist: http://www.shadowserver.org/wiki/pmwiki.php/Calendar/20100129
Apple, Customs and Excise UK Inland Revenue. Greater Manchester Police. My friend is a dev and net admin at PayPal/Ebay and although he shall remain nameless for his privacy. In his own words bunch of lazy fat cat bastards. Sorry for swearing, but he has been a guru in IT for the past 30 years and a top programmer. He said he is trying to undo and secure systems where security is very lax indeed and said it is like banging his head against a brick wall with some very senior management.
All cows eat grass!