Symantec Takes Down Mega Botnet

ZeroAccess, one of the largest-known botnets in existence today with more than 1.9 million computers in its network, is becoming a big problem for security teams. The botnet relies on peer-to-peer (P2P) and command-and-control (C&C) communications architecture to give it a high degree of availability and redundancy.

Symantec just took it down.

Given its construction and behavior, Symantec reports that ZeroAccess appears to be primarily designed to deliver payloads to infected computers. In a ZeroAccess botnet, the productive activity -- from an attacker's point of view -- is performed by the payloads downloaded to compromised computers, which boil down to two basic types, both aimed at revenue generating activities.

"One type of payload we've seen is the click fraud Trojan," Symantec wrote in a blog post. "The Trojan downloads online advertisements onto the computer and then generates artificial clicks on the ads as if they were generated by legitimate users. These false clicks count for pay-outs in pay-per-click (PPC) affiliate schemes."

Proactive and Realistic

Ken Pickering, director of engineering at CORE Security, told us botnets are fairly common and can be largely financially successful for their owners -- and that's part of the reason criminals continue to innovate around their C&C elements and the malware used to grow them.

"The real interesting part of the botnet is how it distributes tasks to the slave machines it controls. The malware itself is usually fairly straightforward, but it's the obfuscation techniques used to conceal the control servers and the actions the botnet owners take to avoid being shutdown that's the real trick," Pickering said.

"I think Symantec's attack was proactive and a realistic response to this fairly large cybercrime industry. There's not a whole lot of other ways to combat these guys. But, realistically, disabling the botnet only puts a temporary financial speed bump for these guys....

Comments are closed.