A report from security research firm NetWitness about a malicious botnet dubbed Kneber has been the focus of a fair amount of media attention, but mostly sensationalism that misses the real point.
Yes, the Kneber botnet consists of nearly 75,000 computers. Yes, systems at roughly 2,500 different companies around the world have been infiltrated. Yes, government agencies have had data compromised. Sadly, that is just "a day in the life". There is nothing spectacular about those figures.
Some media reports are even comparing the Kneber botnet to the massive threat of last year's Conficker worm and the associated Downadup botnet. There really is no comparison--Kneber is a drop in the bucket compared to Conficker.
The number of computers compromised by Conficker was in the millions--significantly higher than the meager 75,000 impacted by Kneber. Elias Levy, senior director for Symantec Security Response explained in an e-mail to me "The Kneber-Zeus malware can be considered as an ant compared to Godzilla, when put against Conficker/Downadup."
However, Levy also recognizes that the real threat of Conficker was never really exploited, and that this much smaller botnet does account for more damage in terms of compromised information. "As far as security implications are concerned, we never really saw the Downadup network utilized for anything. It caused a lot of destruction and problems across the globe, but it never delivered any payload. Kneber on the other hand, however small it may be in size, seems to have stolen personal information which is destructive in some sense."
Levy also took issue with the media categorization of Kneber as a new threat in his e-mail. "Kneber, in reality, is not a new threat at all, but is simply a pseudonym for the infamous and well-known Zeus Trojan. The name Kneber simply refers to a particular group, or herd, of zombie computers, a.k.a. bots, being controlled by one owner. The actual Trojan itself is the same Trojan.Zbot, which also goes by the name Zeus, which has been being observed, analyzed and protected against for some time now."
Joris Evers, a security specialist for McAfee, also e-mailed me and noted "In the world of cybersecurity the "Kneber" botnet is, unfortunately, just another botnet. With 75,000 infected machines, Kneber is not even that big. There are much larger botnets. Kneber is based on the "Zeus" Trojan--malware known to security companies. In our recently released Q4 2009 Threats Report we found that in the last three months of 2009 just under four million newly infected machines joined botnets."
Symantec's Levy explains "Though it is true that this Kneber string of the overall Zeus botnet is fairly large, it does not involve any new malicious threats. Thus, computer users with up-to -date security software should already be protected from this threat."
Evers echoed that basic sentiment, pointing out "Additionally, users should keep the standard rules of PC security in mind--keep your software and operating system up to date, run a complete and up-to-date suite of security software, including a firewall and antimalware detection and don't click on suspicious links in e-mail, instant messages or those that arrive via social media."
The news part of this story isn't really the expanse of the Kneber botnet, or even the sensitive information it appears to have compromised. Sadly, the real story is how or why 2,500 organizations around the world, including government agencies, have such weak security that they allowed 75,000 PC's to be compromised by a relatively archaic threat for which detection and protection have existed for over a year.
It's not the first time, and unfortunately it won't be the last. When the SQL Slammer worm hit in January of 2003, it crippled the Internet around the globe in under thirty minutes--exploiting a flaw in Microsoft SQL Server that Microsoft had issued a patch to fix months prior. The spread of Conficker last year is another example of a malware threat exploiting a vulnerability that Microsoft had already issued a patch for.
Kneber is nothing. It is barely worth mentioning. What is worth mentioning again, and again, and again, is the importance of applying patches and updates in a timely manner, employing anti-malware security software and keeping it up to date to detect current threats, and continuing to educate users to not click on links or open attachments in messages.
Maybe, someday that message will sink in. I won't hold my breath.