McColo Hosting Provider Goes Offline With Around 500,000 Bots But Resurrects Few Days Later To Allow Miscreants To Reorganize
The shutdown last week of a U.S.-based Web hosting company crippled more than 500,000 bots, or compromised computers, which are no longer able to receive commands from criminals. Although the infected PCs are still operational, the previously-planted malware that tells them what to do can’t receive instructions because of the shutdown last week of McColo Corp.
“Half a million bots are either offline or not communicating” with their command-and-control servers, estimated Joe Stewart, director of malware research at SecureWorks Inc. Knocking McColo offline disrupted at least two major botnets, “Rustock” and “Srizbi”, and caused spam to plummet around the globe. A leading authority on botnets estimated the strength of the top 11 botnets last April. Srizbi, at 315,000 bots, was No. 1 in it’s list, while Rustock, at 150,000, was in the No. 3 spot.
McColo was disconnected from the Internet by its upstream service providers at the urging of researchers who believed the company’s servers hosted a staggering amount of cybercriminal activity, including the command-and-control servers of some of the planet’s biggest botnets. Those collections of infected PCs were responsible for as much as 75% of the spam sent worldwide. When McColo went dark, spam volumes dropped by more than 40% in a matter of hours.
McColo briefly returned from the dead over the weekend so it could hand-off command and control channels to a new source, security researchers said. The rogue network provider regained connectivity for about 12 hours on Saturday by making use of a backup arrangement it had with Swedish internet service provider TeliaSonera. During that time, McColo was observed pushing as much as 15MB of data per second to servers located in Russia, according to Paul Ferguson, a security researcher for anti-virus software maker Trend Micro.
The brief resurrection allowed miscreants who rely on McColo to update a portion of the massive botnets they use to push spam and malware. Researchers from FireEye saw PCs infected by the Rustock botnet being updated so they’d report to a new server located at abilena.podolsk-mo.ru for instructions. That means the sharp drop in spam levels reported immediately after McColo’s demise isn’t likely to last.
It’s going to take a little while before we probably see the spam levels go back up again, at least from those botnets. Because McColo was cut off so quickly after regaining connectivity, botnet operators were probably not able to update as many nodes as hoped. Rustock is capable of sending 30 billion spam messages per day, according to researchers from anti-virus provider Sophos, which also witnessed the Rustock transition.
The arrangement between the McColo and Telia had been in place for more than a year, according to an individual at Giglinx, a California-based reseller of wholesale bandwidth that brokered the deal. The IP address used to reconnect McColo had been allocated to the “CWIE Holding Company,” which claimed to process credit cards. Telia quickly pulled the plug once researchers learned it was linked to McColo.
It was more than a mere coincidence that McColo waited until Saturday, more than four days after being disconnected, to use its backup link with Telia.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.