Botnet Analytics Blog

We have been observing that “busting botnet-herders” is really happening these days starting with the past few incidents, although we need to think about the big picture & behind the scenes. These are the questions that arise after we see such incidents:

• Are these guys [who get arrested] the real guys behind the scene? Or are these guys Public Representatives for those botnets?
• What are the botnet-herders doing next, to prevent from being caught?
• There is an interference/intersection between underground & intelligence groups. How do the intelligence agencies deal with such issues?
• Technology wise, how are they modifying the following to stay current in evasion techniques:
  • Payloads
  • Propagation
  • Algorithm
  • Implementation
  • DDNS
  • and other stuff
• The so called “Top botnets” takes the best from each botnet and implements them. Does this make it complicated to detect & prevent it from happening?
• Antivirus Engines or Security tools can detect only on “Infection Vector” to begin with. Some AV’s quarantine them and some don’t, but later it might catch on Botnet Activity to known hostile IPs or domains. Does this mean that:
  • the users should reimage the host[industry best standards], as soon as they see traffic to possible hostile IPs?
  • the users should consider any Trojan or Backdoor activity as possible botnet command & control activity, as it could possibly lead to them?
  • the users should reimage the host for every malware triggered on the host?
• Botnet herders code their botnets to spread through the following vectors. Does this help them in expand their zombie networks really fast?
  • Phished websites
  • Malware sites
  • Hosed Webservers
  • DNS Poisoning
  • Client-side attacks
• What could the next generation botnets do?
• Is commercializing of botnets anticipated? If the answer is “Yes”, does law enforcement have any response to it.
• Do the courts all around the world realize that they should modify/work on their law to ensure that these botnet herders get punished, no matter what part of the world they are residing in. Classic example is, “Mariposa” botnet guys were arrested at Spain, even though Spain is lenient in various other aspects of infoSec.
• Will the  botnet herders mix botnets with real world issues like how phishing guys do:
  • SEO Poisoning
  • Deceptive linking
  • Pharming
  • and other techniques

Hope this helped in opening your eyes to think more into botnets & its herders. Thank you for choosing Botnet Analytics!

The past few years has been a big boom in the botnet world. Botnet herders [a.k.a. the creators of botnet] are commercializing botnets by showing how powerful their botnets are than existing botnets. Some of them are good at one thing, while certain others are good at other stuff. Some of them have been listed below:

• Infection Vector
• Propogation
• Payload
• Acquiring Zombies
• DDNS
• Simple Lifecycle
• Easy to communicate
• and more

Some of the famous botnets & botnet apps has been commercialized in recent days, although law enforcement is trying to bring such entities down. One of the most famous one is “Mariposa” botnet. Defense Intelligence was solely working on researching Mariposa and creating sinkholes to prevent users from communicating with the Zombie network or from being hosed. Though a user would be infected with infection vector of a botnet such as a Trojan, user would be taken to specific IPs or domains that would then push out the malicious code that makes them a part of Zombie network. This is where sinkholes help in protecting users from going to the real IP that holds the malicious code, and also to help such security organizations to detect the victims of this attack.

I am not sure, but the following site looks like a commercialized version of Mariposa to me:

They call their product as “Butterfly Flooder” and here is the list of Features that they have proposed:

Domains Per Host indicates 1000′s of hosts on the same IP[67.43.3.69].

• Is Mariposa still up & Running and do we still see traffic to newer Mariposa compromised hosts? The answer is “YES”.
• Have the arrest of those 3 guys changed anything relating to the working of Mariposa? The answer is “Not Really!”.
• What are the various justifications for the current situation:
  • Could be that the botnets are modularized and sold to many places.
  • Open-source botnets make it harder for security community.
  • Your Botnet is My Botnet concept of Torpig makes it harder.
  • Metamorphic & Polymorphic code makes it harder to prevent research against botnets.
  • Competition in the botnet community: “Mine is better & bigger than yours”.
  • Commercializing Botnets to the Underground community to help them knock off more systems.
• Why would they do it open-source when they can commercialize it? Botnet modules can be taken by someone else and improvised to their situations or to their creativity, when the modules are open source. Someone always see’s what someone else doesn’t. Botnet community is using this mentality in a way to make their botnets stronger, grow bigger & difficult to detect and prevent.

We are not sure about Butterfly networks or who is behind it, but their website & content looks too Spooky to make a mention over this blog. If you guys from Butterfly networks feel that this isn’t true, kindly shoot us an email to contact.fingers@gmail.com and we will retract the post. Also, give a possible explaination as to how commercializing your UDP flood services would help anyone. Pentesters should also know their testing limits. Botnets getting sold to Pentesters is not going to help them test if their customer’s are protected against botnets. It might infact compromise their customers & make them part of the Zombie networks.

Hoping that this post was helpful in opening your eyes. Thank you for choosing Botnet Analytics!