Cloud

1/10/2018
05:03 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

AWS, Google Cloud Popular Home for Botnet Controllers

The number of command-and-control listings increase 32% in 2017, with more botnet controllers hosted in the cloud.

Botnet controllers increased by 32% in 2017, and more cybercriminals are taking advantage of legitimate cloud providers like Amazon and Google to host them, researchers report.

The team at Spamhaus Malware Labs this week published its 2017 Botnet Threat Report, which digs into the numbers and trends behind botnet threats encountered throughout the year. In 2017, the company identified and issued Spamhaus Block List (SBL) listings for more than 9,500 botnet command-and-control (C&C) servers on 1,122 different networks. SBL refers to a database of IP addresses from which the organization doesn't recommend accepting mail.

As a means to control malware-infected machines and exfiltrate data, C&C servers play a critical role in operations to distribute spam, ransomware, and banking Trojans, launch DDoS attacks, and mine cryptocurrencies like Bitcoin. Nearly every 7th SBL listing was for a botnet controller.

Most (68%) of the controllers discovered in 2017 were hosted on servers ordered by attackers for the sole purpose of hosting botnet controllers. These servers are put on Spamhaus' Botnet Controller List, which helps networks avoid traffic to/from botnets -- because none of these IP addresses host legitimate services, they can be directly blocked on corporate networks without affecting real traffic. Spamhaus blacklisted an average of 600-700 servers per month in 2017.

Lawrence Orans, research vice president at Gartner with a focus on network security, says when it comes to botnets, most businesses are concerned about DDoS attacks.

"A shift in botnet activity came in the end of 2016, in September and October, with the emergence of the Mirai botnet and how that was used in a high-profile DDoS attack," he explains. DDoSes remain the biggest botnet-related threat corporations face, and they should have mitigation capabilities in place from a service provider or content delivery network.

According to Spamhaus research, a standout trend from 2017 is the marked increase of botnet controllers hosted on legitimate cloud services. Most are on Amazon Web Services: Amazon alone hosted 303 C&C servers in 2017 compared with 36 in 2016. However, analysis from earlier this year found Google's cloud platform Compute Engine is also hosting more botnets.

Orans says this isn't necessarily a "game-changing shift" given many modern security tools are designed to detect callbacks to C&C servers. Detection wouldn't be affected regardless of server location, he says.

Spamhaus notes some cloud providers have begun to deal with the problem of fake sign-ups, but others still struggle with the issue. Major cloud providers are "overwhelmed" by the large amount of fraudulent sign-ups on their networks in 2017, researchers explain.

Fraudulent sign-ups are one part of the growing botnet problem. Compromised servers and websites are another. It's tough for ISPs or hosting providers to prevent compromise because servers and websites are mostly under customer control and many run outdated software. Cybercriminals can easily scan the Internet for these; open-source content management systems like WordPress, Drupal, Joomla, and Typo3 are all popular targets, Spamhaus reports.

Most malware associated with botnet controllers detected in 2017 were banking Trojans, particularly Chthonic, Gozi, Heodo, TrickBot, Dridex, Worm.Ramnit, AZORult, and PandaZeuS. Droppers/credential stealers were also common: Downloader.Pony, Loki, Smoke Loader, and Neutrino. Criminals also often distributed IoT malware, ransomware, and backdoors.

Spamhaus anticipates the growth of IoT threats will likely continue in 2018, and Orans agrees.

"For example, many home appliances lag in security protection, so they can be easily compromised by malware and become part of a botnet," he says. "This is what we saw with the Mirai botnet in 2016."

Further, Orans emphasizes the importance of knowing how to respond if your business is targeted with a DDoS attack. "Who's going to interface with the public? Who's going to interface with executives? You should have a playbook in place for a botnet-generated DDoS attack," he says.

The person who interfaces with the board, and the public, following an attack will depend on the company's size. Generally the person who speaks with the public will not be the security leader, Orans explains, but a communications professional or public relations representative.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: In Russia, application hangs YOU!
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...
CVE-2018-16515
PUBLISHED: 2018-09-18
Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
CVE-2018-16794
PUBLISHED: 2018-09-18
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.