Asia's Source for Enterprise Network Knowledge

Monday, April 24th, 2017

Information security management

Protect your business from Kneber-style botnets

A report from security research firm NetWitness about a malicious botnet dubbed Kneber has been the focus of a fair amount of media attention, but mostly sensationalism that misses the real point.
 
Yes, the Kneber botnet consists of nearly 75,000 computers. Yes, systems at roughly 2,500 different companies around the world have been infiltrated. Yes, government agencies have had data compromised. Sadly, that is just "a day in the life". There is nothing spectacular about those figures.
 
Some media reports are even comparing the Kneber botnet to the massive threat of last year's Conficker worm and the associated Downadup botnet. There really is no comparison--Kneber is a drop in the bucket compared to Conficker. 


 
The number of computers compromised by Conficker was in the millions--significantly higher than the meager 75,000 impacted by Kneber. Elias Levy, senior director for Symantec Security Response explained in an e-mail to me "The Kneber-Zeus malware can be considered as an ant compared to Godzilla, when put against Conficker/Downadup."
 
However, Levy also recognizes that the real threat of Conficker was never really exploited, and that this much smaller botnet does account for more damage in terms of compromised information. "As far as security implications are concerned, we never really saw the Downadup network utilized for anything. It caused a lot of destruction and problems across the globe, but it never delivered any payload. Kneber on the other hand, however small it may be in size, seems to have stolen personal information which is destructive in some sense."


 
Levy also took issue with the media categorization of Kneber as a new threat in his e-mail. "Kneber, in reality, is not a new threat at all, but is simply a pseudonym for the infamous and well-known Zeus Trojan. The name Kneber simply refers to a particular group, or herd, of zombie computers, a.k.a. bots, being controlled by one owner. The actual Trojan itself is the same Trojan.Zbot, which also goes by the name Zeus, which has been being observed, analyzed and protected against for some time now."


 
Joris Evers, a security specialist for McAfee, also e-mailed me and noted "In the world of cybersecurity the "Kneber" botnet is, unfortunately, just another botnet. With 75,000 infected machines, Kneber is not even that big. There are much larger botnets. Kneber is based on the "Zeus" Trojan--malware known to security companies. In our recently released Q4 2009 Threats Report we found that in the last three months of 2009 just under four million newly infected machines joined botnets."
 
Symantec's Levy explains "Though it is true that this Kneber string of the overall Zeus botnet is fairly large, it does not involve any new malicious threats. Thus, computer users with up-to -date security software should already be protected from this threat."