Mega-D spam botnet targeted by security firm
FireEye contacted ISPs and registrars to help shut down botnet
By Jeremy Kirk | Published: 10:40, 11 November 2009
A computer security company known for battling botnets moved last week to try to shut down a persistent spam player.
FireEye, a California company that makes security appliances, had been tracking a botnet called Mega-D or Ozdok. Mega-D, which is a network of hacked computers, has been responsible for sending more than four percent of the world's spam, according to M86 Security. Many of the computers that make up Mega-D are infected home PCs.
Mega-D is one of several botnets that have implemented advanced technical measures to ensure its owners don't lose control of the hacked PCs. The hackers use command-and-control servers to issue instructions to the zombie PCs, such as when to run a spam campaign.
Related Articles on Techworld
In the case of Mega-D, the hacked PCs will look for certain domain names in order to download instructions, wrote Atiq Mushtaq of FireEye on the company's blog. If those domains aren't active -- they are often shut down by ISPs if they're associated with abuse -- Mega-D machines will look for custom DNS (Domain Name System) servers to find live domains.
If that also fails, Mega-D is programmed to generate a random domain name based on the current date and time, Mushtaq wrote. When the hackers register the domain name, the infected machines can visit there to get new instructions.
Mega-D's mechanisms to ensure it stays alive have made it difficult for security companies. "Unless someone is committed enough to pre-register those domains, the bot herders can always come forward and register those domains and take the botnet control back," Mushtaq wrote.
Last Thursday night, FireEye started its assault, contacting ISPs that had machines acting as command-and-control servers for Mega-D. All but four service providers shut down connections for IP addresses used by Mega-D, Mushtaq wrote. FireEye also contacted the registrars that control domain names used for Mega-D.
As a final measure, FireEye registered the auto-generated domain names that infected Mega-D computers would contact if the machines failed to reach other command-and-control nodes.
Mushtaq wrote on Friday that some 264,784 unique IP (Internet Protocol) addresses had contacted FireEye's "sinkhole" server, or a server set up in order to identify infected PCs.
