Slashdot Mirror
Gameover ZeuS Re-Emerges As Fast-Fluxing Botnet
New submitter tylke (621801) writes: "Brian Krebs is reporting that the Gameover ZeuS botnet recently taken down by the U.S. Justice Department in June has re-emerged. The new variant of the Trojan is "stripped of the P2P code, and relies instead on an approach known as fast-flux hosting," a kind of round-robin technique that lets botnets hide phishing and malware delivery sites behind a network of compromised systems. Krebs says, "[T]his variant also includes a 'domain name generation algorithm' or DGA, which is a failsafe mechanism that can be invoked if the botnet’s normal communications system fails. The DGA creates a constantly-changing list of domain names each week (gibberish domains that are essentially long jumbles of letters).
In the event that systems infected with the malware can’t reach the fast-flux servers for new updates, the code instructs the botted systems to seek out active domains from the list specified in the DGA. All the botmasters need to do in this case to regain control over his crime machine is register just one of those domains and place the update instructions there." (Disclosure: I work for Malcovery Security, the company credited with identifying the new variant.)
'fast fluxing' is the result of zombiefied router storms gone rouge.
The article from Brian Krebs seems to indicate that this new variant of Gameover can interface with the old one somehow, and be used to recover all of the infected computers that were part of the original Gameover botnet. Is this true, or is this an attempt to re-build the Gameover Zeus botnet from scratch?
They just need to register ONE of them to reestablish contact. They might even be able to use "domain tasting" to register a bunch and then cancel within 5 days.
The article linked to Wikipedia on what Fast Flux was:
The basic idea behind Fast flux is to have numerous IP addresses associated with a single fully qualified domain name, where the IP addresses are swapped in and out with extremely high frequency, through changing DNS records.
In case anyone else didn't know that was Fast flux was.
You can't, but in order to regain control, all they need to do is successfully register ONE of them so when the botnet swarm tries to phone home it finds that one and they are back in business. Based on the summary, each week it tries a different list of random domain names so they can keep trying, week after week, until they succeed. I am also presuming these domains are spread across multiple TLD so it isn't just a matter of having the registrar for .com or .org block them. They would also need to get all the country TLD registrars to block the list as well.
I stopped paying attention to botnet stories a few years ago. Are botnets still always on Windows or do Unix users (Mac, Linux) have to worry too? If it's still all Windows then I'm going to stop paying attention again.
all 42 horcruxes
This botnet, like the one the malware based on, is Windows only. The botnet that was used to seed this one is also Windows only.
There have been two botnets that kinda-sorta might be interesting to Linux and Mac users. In one, if you used a Windows desktop to ssh to a Linux server, the infected Windows machine could reveal the user name and password that you used from Windows. In the other, some idiots left the default admin user name and passwords on their routers, some of which run Linux. Surprisingly, if the bad guy knows your username and password, that's a bad thing no matter what operating system you use.
> suggests that using a VM obtains a measure of safety.
You can make it almost perfectly secure by mounting Documents from another disk or image and marking the operating system VM read-only, or snapshotted so it reverts state on reboot.
Toggle it read-write while you update the OS or install new software.
Domain tasting is no longer possible - ICANN started charging 25 cents per domain registration years ago to counteract domain squatting where they'd register a bunch of domains, see if they make money, and return them if they don't.
By charging 25 cents always, it seems to have cut down the practice immensely because you need to register thousands of domains at a time, and that costs real scratch.
Peanuts compared to the revenue. We're talking millions here.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Suppose you have nastyshit.exe in your documents folder. How is it going to get executed? At boot, by a registry entry? Nope, because all the boot stuff, including the registry, is read-only. How did it get there in the first place? Not from malware resident on the system, because the system is read-only.
"I'm a big man. Don't fuck with me. I can take out anyone. I am smarter than all."
from an AC.
Ok. You are awesome.
Feel better?
Why is it so hard to only have politicians for a few years, then have them go away?
But what you can not do is state that everyone with an Android phone is a Linux user. Just as people with a smart TV are not Linux users. Trying to equate people with phones to Linux users in order to "Destroy" my point only proves you have no leg to stand on.
So go back into your parents basement and cry.
Why is it so hard to only have politicians for a few years, then have them go away?
Again. People with Android phones are not Linux users. This is proven by the quote you pulled.
Thanks for playing. You lose.
Why is it so hard to only have politicians for a few years, then have them go away?