|
Botnet sends fake SSL pings to CIA, PayPal, others |
|
|
|
Source: CNET - Posted by Alex
|
In attempt to hide the location of its command-and-control server, the Pushdo botnet has been instructing its infected zombie computers to send fake SSL (Secure Sockets Layer) connections to major Web sites, a botnet expert said on Monday.
The strange traffic targeting the Web sites--including sites for the CIA, FBI, PayPal, Yahoo, and Twitter, according to a list at the Shadow Server Foundation--was not enough to cause any outages or slowdowns, said Joe Stewart, director of malware research at SecureWorks.
Site owners "would just see weird connections that don't seem to make sense," he said. "They look like they're trying to start an SSL handshake, but it comes in malformed and doesn't ever send anything after that first handshake attempt."
SSL is a protocol used to encrypt communications between computers for things like e-commerce and online banking.
Basically, Pushdo is using a fake SSL header in the communications sent from the infected zombies to its own command and control server, according to Stewart. "It's trying to hide itself a bit better...to make it appear on a casual inspection that it might be SSL traffic," he said.
In addition, sending a flurry of connections to legitimate Web sites could be designed to make sure the command and control server doesn't stand out, he said.
Read this full article at CNET
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
