Slashdot Mirror
Gameover ZeuS Re-Emerges As Fast-Fluxing Botnet
New submitter tylke (621801) writes: "Brian Krebs is reporting that the Gameover ZeuS botnet recently taken down by the U.S. Justice Department in June has re-emerged. The new variant of the Trojan is "stripped of the P2P code, and relies instead on an approach known as fast-flux hosting," a kind of round-robin technique that lets botnets hide phishing and malware delivery sites behind a network of compromised systems. Krebs says, "[T]his variant also includes a 'domain name generation algorithm' or DGA, which is a failsafe mechanism that can be invoked if the botnet’s normal communications system fails. The DGA creates a constantly-changing list of domain names each week (gibberish domains that are essentially long jumbles of letters).
In the event that systems infected with the malware can’t reach the fast-flux servers for new updates, the code instructs the botted systems to seek out active domains from the list specified in the DGA. All the botmasters need to do in this case to regain control over his crime machine is register just one of those domains and place the update instructions there." (Disclosure: I work for Malcovery Security, the company credited with identifying the new variant.)
Well, as long as they don't go eyeliner...
Or, worse, guyliner.
Lost at C:>. Found at C.
The article linked to Wikipedia on what Fast Flux was:
The basic idea behind Fast flux is to have numerous IP addresses associated with a single fully qualified domain name, where the IP addresses are swapped in and out with extremely high frequency, through changing DNS records.
In case anyone else didn't know that was Fast flux was.
You can't, but in order to regain control, all they need to do is successfully register ONE of them so when the botnet swarm tries to phone home it finds that one and they are back in business. Based on the summary, each week it tries a different list of random domain names so they can keep trying, week after week, until they succeed. I am also presuming these domains are spread across multiple TLD so it isn't just a matter of having the registrar for .com or .org block them. They would also need to get all the country TLD registrars to block the list as well.
Of course linux is targeted. There are large numbers of linux servers, with fast processors and very fast high capacity network connections. Making matters worse, because they often to run important services, people may be slower to upgrade packages/kernels.
I don't know about this particular botnet, but it's been a long time since saying "I don't run windows" counted as a security strategy.
When a botnet uses a DGA (Domain Generation Algorithm) it is usually for the purpose of reconnecting "lost bots" or to avoid the need to have a hard-coded Command & Control server address. But in this case, the original GameOver Zeus can't be recaptured because all of the domains that can be generated by the GOZ DGA have been "locked up" by the FBI's case. The Temporary Restraining Orders (TRO) that were issued prevented any ICANN Registrar from registering any domain that would be used in the "near future" by the DGA. (By understanding the DGA you can feed it future dates so it can spit out the domains it will use later - at least many weeks worth of domains were included in the court order.) The problem was that some of the original GOZ DGA domains were ".ru" and you can imagine that the Department of Justice really can't give orders about what happens with ".ru" domains. The TRO handled that aspect by ordering the largest ISPs in the US to forbid any of their customer computers from being able to talk to those domains. Some of this was handled by routing DNS requests for these domains to .gov controlled computers while others were handled by ISPs and security companies monitoring for traffic trying to reach those domains and issuing information back to the customers to help them get their machines cleaned up.
(If you really want the geeky legal stuff, I wrote much more about that here: http://garwarner.blogspot.com/... )
Anyway, all of that to say, the *NEW* GOZ has a DIFFERENT DGA, but the *ORIGINAL* GOZ bots don't use that DGA, so there is very little chance of a reconnection. While Malcovery did prove that at least 5 of the 1,000 domains generated by the NEW DGA were ALSO on the old DGA, those domains are "locked up" as above and can't be used.
We've already had good response from the security community with people beginning to "sink hole" some of the newGOZ DGA domains to identify what level of infection there may be already and to work hard on terminating the handful of domains the criminals have registered from that list so far.
I hope that answered your question ... I suppose the better answer might have been "No."
Gary Warner (full-disclosure - a Malcovery employee)