The cybercriminal gang that operated the recently disabled Kelihos botnet has already begun building a new botnet with the help of a Facebook worm, according to security researchers from Seculert.
Security experts from Kaspersky Lab, CrowdStrike, Dell SecureWorks and the Honeynet Project, announced that they took control of the 110,000 PC-strong Kelihos botnet earlier this week.
The researchers used a method called sinkholing, which involves infiltrating the botnet’s peer-to-peer (P2P) network with rogue clients and tricking the other peers to report back to command and control servers under their control.
However, one day after the successful sinkholing operation was announced, malware experts from security firm Seculert reported that the Kelihos gang had already started building a new botnet.
The Kelihos gang pays the creators of a Facebook worm to install their Trojan horse on already infected computers. That worm has compromised over 70,000 Facebook accounts so far and is currently distributing a new version of the Kelihos Trojan, Seculert security researchers said yesterday.
However, the Kelihos gang can also leverage the Facebook worm to regain control of the Kelihos bots sinkholed by Kaspersky and its partners, since the worm is still installed on those machines. All it needs to do in order to bypass the sinkhole is pay the worm’s operators to reinfect those computers with the new Kelihos version, Seculert’s chief technology officer Aviv Raff said.
Sinkholing alone does not result in the complete takedown of botnets, because it doesn’t impact the cybercriminals that operate them or their distribution infrastructure, said Gunter Ollmann, vice president of research at security company Damballa.
“If you’re going to take down a botnet you have to take out the criminals at the top. It’s the only way,” Ollmann said. “In the case of P2P-based botnets, there’s very little infrastructure you can get your hands on – and you’ll probably end up having to issue commands to botnet victim devices – which is fraught with legal and ethical problems.”
Ollmann believes that a similar group of researchers will probably attempt to sinkhole the new Kelihos botnet in the future. He said that cybercriminals can easily escape from this virtual game of Whac-A-Mole by implementing domain generation algorithms as a backup strategy for updating their botnets.
View full post on National Cyber Security » Computer Hacking
