A Bigger Botnet

[phernandez]

New Massive Botnet Twice the Size of Storm - Dark Reading

Weighs in at 400,000 bots. Nice knowing you, Storm...

The so-called Kraken botnet has been spotted in at least 50 Fortune 500 companies and is undetectable in over 80 percent of machines running antivirus software. Kraken appears to be evading detection by a combination of clever obfuscation techniques, including regularly updating its binary code and structuring the code in such a way that hinders any static analysis, says Paul Royal, principal researcher at Damballa.

"It's easy to trace but slow to get antivirus coverage. It seems to imply [the creators] have a good understanding of how AV tools operate and how to evade them," Royal says.

[via Slashdot]

[JPnyc]

Great. Just what we needed. We need to start executing the few authors of such things that we catch.

[nihil]

To be honest with you guys, I say it is time to follow the money, and £$%^%^&*&^.... "entrapment".

Hell, if I have a nuke, I have something illegal, so who should care how the FEDs found out?............. it is illegal "per se", so you don't need any of that "law & order" TV crap............. just shoot the bastards..... or as second prize, "rendition" them .............. there is a kitty litter tray in my garage

[brokencrow]

So, it IS detectable in 20% of infected machines?!

What AV apps are picking it up? How else is it being
detected? I'm curious...

[JPnyc]

I agree. I'm not concerned with the rights of criminals, it's the erroneously suspected innocents whose rights concern me.

[MrLinus]

I wonder if the IDes are picking up the activity?

[morganlefay]

I have been trying to find info on how this is detected.....

anyone have any links as what type of traffic to look for



MLF

> found this http://isc.sans.org/diary.html?storyid=4256

[thehorse13]

"Somehow, this thing is evading the canonical defense techniques that the enterprises use," such as intrusion detection systems and intrusion prevention systems, he said. "It should be caught by IDSes, IPSes and firewalls and it's not."

First of all, I'd like to formally say, "I told you so." LOL. All of these products are useless in today's threat landscape.

Second, the reason these things aren't catching the traffic is because it's inserted into "normal" traffic streams via customized protocol sets developed by the developer(s). Is anyone truly surprised by this?

Morganlefay, see here:
http://isc.sans.org/diary.html?storyid=4256&rss

While no headers are available (yet) you can look for this 8 byte payload data string which is reported to be fixed (perhaps a session string) for this bot:

4d f4 d5 17 dc 04 c1 2e

Of course this will be process intensive at large organizations. I've currently setup a packet filter rule looking for the above string. Nothing has come across my drag net....yet.

Or you can grab some rules that others have written here:
http://doc.emergingthreats.net/bin/view/Main/OdeRoor

--TH13