Dubbed Gameover ZeuS, this P2P botnet is "a private build" based on older ZeuS source code for committing , says Brett Stone-Gross, senior researcher at Dell SecureWorks, which today published a report analyzing the botnet first spotted in January. But instead of the typical ZeuS centralized command-and-control , "it turns into a P2P network," he says. A P2P botnet has a lot of defensive advantages in escaping shutdown by authorities, because "in P2P, there's no central point to go after."
IN THE NEWS:
Stone-Gross said Dell SecureWorks found out a lot about Gameover ZeuS by "crawling the peers," and found evidence of 678,000 infected PCs. "It's probably the largest banking Trojan today," he says. It's all run as a private operation, probably from Russia and Ukraine, and it doesn't appear that the P2P ZeuS code is being sold online as a kit to other cybercriminals.
The gang behind this P2P ZeuS botnet relies on the Cutwail spam botnet to "send massive amounts of email that impersonate well-known brand names including online retailers, cellular phone companies, social networking sites, and financial institutions," according to the SecureWorks report. There's typically what's called the "pony" loader involved that "attempts to download the P2P ZeuS binaries from three hardcoded compromised web servers," the report adds.
In some ways, the P2P version of the ZeuS Trojan is much like its predecessors, capturing information from a victim by means of keystroke logging, form grabbing and credential scraping. "Moreover, ZeuS provides the ability to modify the HTML of a target website, and/or inject additional form fields to dupe a victim into entering sensitive information, a process known as web injects." The P2P ZeuS supports both IPv4 and addresses.
"The P2P ZeuS crew digitally signs the configurations and binaries to prevent attackers from pushing arbitrary versions of these files," the report says. "In addition, some of the P2P control messages (e.g., that set up the HTTP proxy nodes are signed to prevent poisoning)."
The P2P ZeuS botnet has infected hundreds of thousands of PCs in 226 countries, with the U.S., Germany and Italy the hardest hit, according to the report. The botnet steals by accessing bank accounts and making unauthorized large Automated Clearinghouse (ACH) and wire transfers to what are called "money mules," who works as accomplices.
The P2P design of Gameover ZeuS is going to make taking it down very hard, says Stone-Gross. That's become evident with what was hoped to be a successful , which researchers worked together to poison, but now shows clear signs of returning. Stone-Gross also notes was able to effect a take-down of more commonplace ZeuS and SpyEye servers for financial crime in March because the .
Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security. Twitter: @MessmerE. Email: emessmer@nww.com.
in Network World's Wide Area Network section.