Researchers have uncovered a sophisticated and decentralized botnet that combines encryption and rootkit capabilities to make it practically invisible to infected machines.
The TDL-4 bootkit infects the master boot record on a computer so that it can launch before the operating system even starts, making it invisible to the operating system and antivirus software, Sergey Golovanov, a malware researcher at Kaspersky Lab, wrote June 27 on the SecureList blog. While MBR-malware is nothing new, TDL-4 has a number of unique capabilities, including an encryption algorithm that hides the botnet's communications from network traffic analysis tools.
A variant of TDSS, which has been around since 2008, TDL-4 appears to be an upgrade of the previous version TDL-3. The botnet's command-and-control servers can communicate with its army using an encrypted method to hide what it's doing from network monitors. The customized encryption algorithm appears to use the domain names of the C&C servers as the encryption keys, according to Golovanov's analysis.
TDL-4 "is one of the most technologically sophisticated and most complex to analyze malware," Golovanov wrote.
Unlike Rustock, Coreflood or a number of other botnets, TDL-4 doesn't rely overmuch on centralized C&C servers to pass instructions to its zombie army. The zombies can also pass along instructions to other machines using a public Kad peer-to-peer network if the servers are for some reason unavailable, creating a "decentralized server-less botnet," said Golovanov.
TDL is often found on adult content sites, bootleg Websites, and video and file storage services, according to Golovanov. Once a computer is infected with TLD-4, the malware downloads and installs other malicious software such as adware and spambots and hides those from security software as well.
Since TDL-4 loads when the computer is booting, before the operating system launches and lives in the master boot record on the hard drive, it's difficult for antivirus software to detect the malware. In the first three months of 2011, it infected 4,524,488 computers around the world. Approximately a third of them are based in the United States.
"Nothing is impossible. But they can definitely try to make it very hard," Roel Schouwenberg, senior antivirus researcher at Kasperksy Lab, told eWEEK. The malware also has low-level access to the system since it loads before the operating system, he said.
There appears to be no infected machines in Russia. This may be because the affiliate programs don't get paid for infecting computers located in Russia, according to Golovanov. There are nearly 60 C&C servers around the world, but the IP addresses appear to be "constantly changing," Golovanov said.
In order to ensure that the botnet owners don't lose control of the zombies to a competing botnet, the rootkit has its own version of an antivirus program to scan for other types of malware that may be downloaded to the computer. It can detect and delete about 20 of the most prolific packages, including Gbot and Zeus.
"The owners of TDL are essentially trying to create an 'indestructible' botnet that is protected against attacks, competitors and antivirus companies," Golovanov wrote.
Nothing is ever indestructible in the security world, but the botnet's level of complexity and sophistication assures the botnet owners a profitable operation for now while security vendors try to figure out a defense. An affiliate can earn anywhere from $20 to $200 for every 1,000 machines it helps infect with TDL, according to Golovanov.
Cyber-criminals are also offering a $100-a-month service to create proxy servers using infected machines, along with a Firefox add-on to make it easy to toggle between proxies within the browser.
Other features include a driver to run on 64-bit systems and a module to fraudulently manipulate advertising systems and search engines using fake click and traffic techniques.
Proving that even cyber-criminals can make mistakes, Kaspersky researchers found bugs in the code, allowing them access to three different MySQL databases located in Moldova, Lithuania, and the U.S. to determine how many machines had been infected. The bugs are also helping researchers investigate the creators.
By 
- 
