Russian Security Firm Dr. Web States Symantec and Kaspersky Numbers were Inaccurate
In an updated status report from the Russian security firm that first discovered the Flashback trojan (Dr. Web) it is being said that recent findings disagree with the statements that both Symantec
and Kaspersky Labs
released. Dr. Web’s status report is warning the public that the number of machines affected by the malware is not declining as many are stating.
After citing data from its analysis of the largest Mac botnet to date, Dr. Web states that around 560,000 computers are still affected, which is quite the contradiction to the 30,000 number recently provided by the well-known security companies, Symantec and Kaspersky. It is being said that the data from the larger companies’ servers were likely inaccurate due to Flashback’s use of complex domain name creation techniques and a unique TCP connection operation that effectively masks bots from command and control servers.
According to the Russian security firm: "BackDoor.Flashback.39 uses a sophisticated routine to generate control server names: a larger part of the domain names is generated using parameters embedded in the malware resources, others are created using the current date. The Trojan sends consecutive queries to servers according to its pre-defined priorities."
Upon the early discovery of the malware, Dr. Web registered for the main domains used as Flashback command servers while other security firms most likely use “hijacked servers” that are in this case less reliable. The report explains that Flashback’s mode of operation allows its network of bots to go largely unnoticed by the hijacked servers which could be the reason for the reported numbers of affected machines. "On April 16th additional domains whose names are generated using the current date were registered. Since these domain names are used by all BackDoor.Flashback.39 variants, registration of additional control server names has allowed to more accurately calculate the number of bots on the malicious network, which is indicated on the graph."
The company continues to notes that the trojan send requests to a server run by an unidentified third party, which in turn communicates with the bots but fails to close the TCP connection. This action is critical to researchers as it puts the bots in standby mode, which means they don’t communicate with other command servers monitored by information security specialists.
As of right now, both Symantec and Kaspersky have not responded to the new report and continue to reflect a “very low” threat level from the Flashback trojan on their respective websites.
Source: Dr. Web