We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
 
74,944 News Articles

Pushdo Botnet targetting more than 300 websites

PayPal, FBI and Twitter affected

More than 300 websites are being pestered by infected computers that are part of the Pushdo botnet, according to security researchers.

The US Federal Bureau of Investigation, Twitter and PayPal are among the sites being hit, although it doesn't appear the attacks are designed to knock the sites offline, said Steven Adair, of The Shadowserver Foundation, a group that tracks botnets.

Shadowserver was tipped off to the Pushdo issue by Joe Stewart, director of malware analysis at vendor SecureWorks.

Pushdo, which is also known as Pandex or Cutwail, has been around for about three years, according to a report from Trend Micro.

Computers infected with Pushdo are used to send out spam, but the malware is capable of downloading other harmful code to a computer.

Pusho appears to have been recently updated to cause computers infected with it to make SSL (Secure Sockets Layer) connections to various websites. SSL is an encrypted protocol used to protect information exchanged.

The bots start to create an SSL connection and then disconnect, a process that is repeated, Adair said.

Serving up SSL connections puts more of a burden on a website than HTTP connections, Adair said, but the traffic has been so sporadic that some large websites didn't even notice.

"Despite how noisy it is, the traffic is still too infrequent and not large enough to really be seen as what we would think is an intentional DDOS attack," Adair said.

"Much smaller botnets are capable of generating far more traffic and causing more of an impact to websites than what is being done with Pushdo."

The traffic, however, is significant and results in large websites getting millions of hits across hundreds of thousands of IP (Internet Protocol) addresses.

"This might be a big deal if you're used to only getting a few hundred or thousands of hits a day or you don't have unlimited bandwidth," Adair said on Shadowserver's blog.

One option for websites is to change their IP addresses, but that may only be a temporary fix.

"We have also had numerous people write in offering assistance and feedback on ways to slow or stop these attacks," Adair said.

"We hope to put out an updated post that can help our system administrators associated with these websites soon."

See also: ISPs hold key to killing spam botnets


IDG UK Sites

Samsung Galaxy Note 4 release date, price and specs 2014

IDG UK Sites

iOS 8 features wishlist: the changes iPhone and iPad users want in Apple's iOS 8

IDG UK Sites

25 Years of the World Wide Web: Happy Birthday, Intenet

IDG UK Sites

Developers get access to more Sony camera features