How To Fight The Zeus Botnet In Your Enterprise

When NetWitness uncovered the now-notorious Kneber botnet, the culprit of attack had a familiar name – Zeus.

The Zeus Trojan, also known as Zbot, is one of the most popular pieces of malware on the market, selling for a few hundred dollars to several thousand. In the case of Kneber, the Trojan made its way from hacker forums to enterprise networks, eventually becoming the building block of a roughly 75,000-strong botnet, leaving administrators with the task of figuring out how the malware penetrated their networks and what to do.

Typically, Zeus targets banking credentials. In addition, it sometimes injects HTML into pages rendered by the browser so as to create bogus login pages for online banking sites to get its hands on personal information. In the case of Kneber, the botnet was observed stealing 68,000 user credentials for everything from Facebook to web-based email, as well as 2,000 SSL certificate files and other data. Zeus’ purveyors, it seems, stay busy – in a report in August, Symantec said it had uncovered more than 70,000 unique variants of the Zeus binary during the past year.

“Zeus, while old and detected by many signatures, is popular because it’s good at what it does (steal credentials to financial web sites), it’s configurable, easy to use, the authors keep updating it, and old versions are usually available for free,” said Elias Levy, senior director of Symantec Security Response. “While many security products detect its many variants, its popularity (among) attackers ensures large numbers of people are infected by it.”

Zeus is known to spread via drive-by downloads and other methods, such as a recent attack detailed here by Websense. Blocking the Trojan with signatures and traditional heuristics can be difficult, as attackers have access to a large number of packers that help them disguise malicious code, noted Toralv Dirro, security strategist at McAfee Labs.

“They just pack their Trojan, check it against current AV (anti-virus), pack it again, until they know none of the products detect it with signatures when they release it,” he said.

“To dodge system security software there are two steps,” Dirro continued. “The first is to evade detection when you start sending out a Trojan, which is done with the help of packers. The second is to prevent AV software from updating, sometimes fully disabling it. Usage of rootkit technologies to remain invisible for the user and common system tools are used in addition.”

For users, making sure anti-virus protections are up-to-date offers an obvious layer of protection. Still, a sample study of 10,000 consumer PCs in September 2009 by researchers at Trusteer uncovered 55 percent (PDF) of the computers with Zeus had up-to-date anti-virus, while the remainder either had no anti-virus or it was out-of-date.

As for other measures, Dirro suggested enterprises limit user rights so that malware can do less damage in the event it compromises a system, and Levy advised businesses educate their users about social engineering and make sure the most current security patches are deployed.

Even with these protections in place however, few would argue any practical security approach is truly foolproof. For that reason, in the event of a compromise, it is important organisations know what steps to take as they investigate and remediate machines.

“Evidentiary collection is a vital component of any malware remediation campaign, not just for establishing culpability but also for managing potential claims or issues insurance carriers and building defenses against future attack, said Erik Laykin, co-leader of Duff & Phelps’ Global Electronic Discovery and Investigations Practice. “A proper internal investigation should be commenced under the direction of counsel which may include a mapping of the various systems and devices on the network and interviews of victims or other parties of interest that maintained access or controlled key systems which have been affected.”

“Residual and supporting utility data should be identified and preserved early in the process including backup tapes, email communications between the parties of interest and log files of various systems which may have recorded activity such as web server logs, router logs and IDS logs, surveillance camera recordings and access point logs,” Laykin continued. “Often these logs are quickly overwritten due to their size thus they should be focused on early.”

The best advice for a system known to be infected with a Trojan is to replace it with another machine/disk or reimage it because it is impossible to know what modifications to a system a cyber-criminal may have made through the Trojan or what else may have been installed, Dirro said.

“In corporate environments there usually is a process for imaging machines that is faster and thus cheaper than an attempt to clean the machine,” he said. “This may not be practical if it is concerning a large number of machines that have been hit. In that case test removal on single systems and, if there are problems, work with your AV vendor to get a solution before attempting to clean hundreds of machines.”