Rustock goes down (again); if this keeps occurring I’ll be out of a job
If you haven’t heard it yet, Rustock, the world’s biggest botnet, stopped sending spam yesterday, Wed, March 16. I guess they forgot to beware the ides of March:
The Register reports the following:
Spam volumes shrank on Wednesday after the prolific Rustock botnet fell silent, reportedly as a result of a takedown action. Rustock, which is made up of a network of compromised (malware-infected) Windows PCs, turns an illicit income for its unknown controllers by being the biggest single source of global spam. The botnet is particularly active in advertising unlicensed net pharmacies, or at least it was until Wednesday afternoon, when its junk mail deluge ran dry.
Security blogger Bryan Krebs, who broke the story of the sudden drop-off, suggests the respite of spam from Rustock is the possible result of a takedown action against the zombie network's command and control system. "Dozens of internet servers used to coordinate these spam campaigns ceased operating, apparently almost simultaneously," he writes. "Such an action suggests that anti-spam activists have succeeded in executing possibly the largest botnet takedown in the history of the internet."
Spam from Rustock previously fell away to almost nothing over the Christmas and New Year holiday before returning in mid-January, possibly as the result of a temporary break by the botherders controlling the network, so it would be unwise to write up Rustock's obituary just yet. Even if Rustock is properly dead, the business of using junk mail messages to spamvertise sites offered unlicensed pharmaceuticals is simply too lucrative to disappear anytime soon. Economic logic dictates that someone will move in and pick up the slack.
Krebs’s original post is here. PC Mag says much the same thing.
This isn’t the first time that Rustock disappeared. As alluded to above, Rustock left over the holidays and appeared to try its hand at click-fraud but returned in mid-January and again started cranking out the spam. So as the writer says it would be premature to declare victory over Rustock just yet. From my perspective, there are a couple of possibilities of what happened:
This is a co-ordinated takedown between security researchers to infiltrate and shut down the C&C centers of Rustock. In the article, researchers confirm that they aren’t seeing any C&C activity of botnet operators. If so, then this would be the largest and most complex takedown to date since Rustock has a complicated infrastructure and going after it would require a months-long effort between people working in a number of organizations. I actually have my suspicions of who it could be but I really don’t have any more insight or information than anyone else at this point.
This is the same thing as before. The Rustock operators are shifting their efforts from spamming to something else and have gone away from one type of abuse and entering another form. They’re not gone, they’re just doing things that anti-spam security researchers aren’t tracking.
Something happened to the operators of Rustock. Perhaps they were arrested by police somewhere in eastern Europe (I don’t know if they are in eastern Europe or Russia but it would fit the pattern of what we know), perhaps they were in a car accident, or perhaps their mob bosses are cracking down hard on them for some other reason. Or perhaps they are going on vacation somewhere. In any case, if the cable of operators is small, then if something happened to them that would account for the lack of activity.
For the time being, we’ll need to remain skeptical that Rustock is gone for good. I think we’ll need at least a month to make a pronouncement and even then we will need to confirm that it hasn’t moved onto some other type of online fraud.