Blog

I am sure If historians ever write about botnet take downs, they wont forget to mention the pushdo botnet. It's the third time in last two years or so that there has been an attempt to take down this botnet. The first attempt was back in Nov 2008 when the McColo ISP shutdown crippled Pushdo along with other spam botnets like Srizbi and Rustock. The second attempt was earlier this year when FireEye got a hold of some of the Pushdo CnC servers. This was so unexpected for the bot masters that they abandoned all other servers and went completely silent for few weeks . Now approximately six months after FireEye's shutdown attempt, researchers from LastLine put together another effort to shutdown Pushdo CnCs.  LastLine identified around 30 or so active CnC servers and sent abuse notifications to the hosting providers.  According to their earlier disclosure most of the CnCs are dead at the moment resulting in a sudden drop in spam associated with this botnet.

This was a great news and but left me with some unanswered questions. The original disclosure by LastLine used the word Pushdo/Cutwail botnet.  Some readers will already know that Pushdo is a general purpose dropper which usually is seen downloading a spam botnet called Cutwail. These two different malware/botnets have been seen together so many times that people have almost started using these two names interchangeably. This confusion led me to ask:

1. Was this take down targeting Pushdo, Cutwail, or both botnets?

2. Which variant of the Pushdo botnet was taken down. Pushdo over the years has changed its CnC communication at least 3 times so it was a very valid question. 

Here are the four variants  I am talking about:

Pushdo.A = The very first variant which used to communicate through HTTP. The CnC protocol was all about a simple http GET request with all the information communicated in the form of URI parameters.

Pushdp.B = Pushdo.b changed its HTTP GET request structure, and started transmitting all the information obfuscated.  

Pushdo.C = Started using port 443 with a junk ssl header. To hide its actual CnC it also started doing random connection attempts to lots of legitimate web sites. This move was so confusing that some people named it as Pushdo DDOSing. This was a reaction to FireEye's take down attempt earlier this year.

Pushdo.D  = Started using TCP port 80 and a new custom obfuscated protocol on top of it.

3. So which version of Cutwail was targeted here?  It's a general perception in the research community that Cutwail is always a bi-product of the Pushdo botnet.  According to my research, this is not always the case. There are few Cutwail variants which have also been seen living independent of Pushdo and most probably are controlled by different cyber criminals.  There was one variant which was spread by Trojan.Exchanger. It's another interesting story how I came to this conclusion, and I will talk about this in some future post.

Finding myself confused with these questions, I tried to dig through the limited information available and came to this conclusion. This take down attempt targeted Pushdo D variant and its sub download Cutwail. 

After identifying the botnets in question it was very easy for me to go through my botlab logs and try to find leftover command and control servers. There was no doubt that many of the CnC servers were null routed. But as mentioned by LastLine, there were still some servers which were acitve and serving contents. 

At the time of writing this article i.e. Aug 27, 2010 10:00 PM Pacific , these servers were found to be alive.

Sr.	IP	ISP/Hosting provider	Geo Location	Botnet
1	58.221.46.172	CHINANET JIANGSU PROVINCE NETWORK	China	Pushdo.D
2	58.221.46.171	CHINANET JIANGSU PROVINCE NETWORK	China	Pushdo.D
3	212.95.32.15	NETDIREKT E.K	Germany	Pushdo.D
4	61.158.167.52	CHINA UNICOM HENAN PROVINCE NETWORK	China	Pushdo.D
5	60.191.254.235	JINHUA TELECOM CO. LTD NETWORK MANAGEMENT ASSERT CENTER IDC	China	Pushdo.D
6	64.120.179.82	NETWORK OPERATIONS CENTER INC	USA	Pushdo.D
7	212.117.161.188	ROOT SA	LUXEMBOURG	Pushdo.D
8	95.168.181.236	RUSTELEKOM LLC	RUSSIA	Cutwail
9	67.215.233.58	SECURED PRIVATE NETWORK	USA	Cutwail
10	184.82.87.194	NETWORK OPERATIONS CENTER INC	USA	Cutwail

One can see that there are a total of 10 servers which I found to be alive.  Please note there that LastLine has not yet revealed the identity of most of the CnC servers (except for those visible in Anubis resorts) so I don't know if above CnCs match with their list or not.  The above list of live CnCs is painting a pessimistic picture.  Out of 10 servers, 4 are in China, 3 in USA, 1 in each of Germany, Russia and Luxembourg. In the past I have been involved in the take down of botnets like Srizbi, Rustock, Ozdok and Pushdo.  Based on my experience I can tell you that forcing non US data centers to take actions against abuse notification is very difficult, especially for countries like China and Russia.

Pushdo.D (or even most of the older variants) don't use DNS to locate their CnC servers. Instead they use straight IPs hard coded inside their binaries.  Even if one of the CnC servers in the list is responsive, there is always a chance that the bot herders might be able to drop an updated version pointing to some new servers.  The same holds for Cutwail but in my opinion, in this case Cutwail CnC servers don't matter a lot. If Pushdo is able to communicate to its CnCs it can always download an updated Cutwail version.  Although taking down Cutwail's CnCs would have an immediate short term effect on spam levels. 

Now an important question, will Pushdo be able to recover from this damage?  Before I try to answer this difficult question let's recall how other botnets including Pushdo have reacted to a shutdown attempt in past.

 Srizbi 

After McColo's shutdown, bot herders waited for a few days and then started upgrading their zombies across the globe.  Updated malware started pointing to new data centers in Estonia.  FireEye chased them even there and worked with Estonian ISPs to shutdown new cncs as well.  The bot masters gave up and never again tried to recover. Srizbi is a dead botnet now.

Rustock

Like Srizbi it also waited for a few days before an update attempt. FireEye was keeping a close eye on them and was able to disrupt this update attempt.  Rustock was only able to recover partially.  Details are here and here.  After sometime new samples were seen using a slightly different CnC protocol.  Right now Rustock is the world's biggest SPAM botnet and has re-claimed its old position.

Ozdok

After its take down by FireEye back in 2009, Ozdok did not try to re-claim its old zombie base at all, instead leaving the past behind and hunting for new machines to infect. At the moment Ozdok is still alive but not as strong as it used to be.

Pushdo

After the shutdown attempt by FireEye earlier this year. Pushdo.B abandoned its old zombie base forever. After some time new variants C and D where seen in circulation.  

Keeping all these factors in mind I can speculate that we most probably won't see the bot masters doing a desperate attempt to move to new CnCs.  There is no rush as Pushdo backup servers are still up and running. They will likely wait for a while until things calm down. In the meantime they will try to find new CnC servers aiming for a silent update of infected systems.  The success or failure of this recovery attempt (if any) will depend on the community's follow up after this shutdown attempt.  Pushdo's backup servers are still alive so we need to keep an eye on Pushdo for some time like we did back in past when Rustock and Srizbi tried to escape.  

Before I end this article, I'll present some related information.

Pushdo.C is still fully active and I am not seeing any of its CnCs affected by this shutdown attempt.

LastLine also shared some of the Anubus reports as part of their initial disclosure. One of the anubus reports had something very interesting.  In that report the samples submitted was not Pushdo but instead Butterfly/Palevo which was downloading Pushdo.  My initial speculation that this Butterfly/Palevo would be part of a pay per install network proved to be right when in I ran this sample (0651e3369f0949ca31f5012a4e4441ef) again in my lab. This time instead of downloading Pushdo, it downloaded Kraken 2.0 (another famous spam bot).

 
 

It's very likely that Pushdo, after this third shutdown attempt, would start following a Koobface like CnC architecture.  Koobface mostly uses compromised legitimate web servers as the front end CnCs keeping minimal dedicated servers as a backup, located in countries like China and Russia. That's the main reason that so far no real attempt has been made to shut down it.  As a matter of fact, the concept of keeping some backup servers outside US can also been seen even now from above list, where most of the Pushdo CnCs left alive are outside USA.

If you are wondering how the use of a huge number of compromised CnC servers can make the shutdown process difficult, see the chart below which is taken from my last article.

Update: Sun, Aug 29 1:00 PM.

Cutwail sample running in my lab has just started receiving new spam templates from CnC 184.82.87.194. Here is one sample spam message recorded by my  local spam trap.

 

Unfortunately attempt to shutdown Pushdo merely suspended its spam for two days. Backup CnCs really saved him this time.

Atif Mushtaq @ FireEye Malware Intelligence Lab

Detailed Questions/Comments : research SHIFT-2 fireeye DOT COM