[ insider_reports_insider ]
Damballa Responds To Kraken Criticisms
David Utter
Staff Writer
2008-04-10
 Insider Reports RSS Feed
Security researchers at Damballa who discussed a big new botnet received lots of pushback from the security community.
 | | Damballa Responds To Kraken Criticisms |  |
When Damballa's Paul Royal discussed the size and scope of Kraken, he said it exceeded the size of the Storm botnet. Many took this surprising assessment with a dose of skepticism; Damballa received significant challenges to their research.
"There are many detection names for "Kraken"; Oderoor, Bobax, Agent, and many more," security vendor F-Secure said. "We believe that there is a single group of people behind Kraken, updating their malware as time goes by. It's not new, it's just a new generation of something older."
Brian Krebs at the Washington Post said on Security Fix that Damballa managed to achieve its count of Kraken botnetted machines by serving as a host for a number of them in a kind of honeypot environment. Royal told Krebs the machines controlled by Damballa only receive Kraken traffic when bots try to connect to them, and there is no outgoing traffic.
Accusations that Damballa, a startup based in Atlanta with founder ties to Georgia Tech, simply repackaged Bobax to make a splash at RSA 2008 stung the new company. Royal responded to the suggestions with a response Damballa published yesterday.
Damballa believes Kraken and Bobax likely share some kind of common author or group connection. The two botnets operate similarly; Damballa's side by side comparison makes Kraken look like an evolved form of Bobax.
Royal's RSA talk also zapped the antivirus industry by claiming 80 percent of comuters with AV solutions don't detect Kraken. Krebs noted more recent results from testing at VirusTotal.com that put the number of AV solutions detecting Kraken at 50 percent.
Damballa appears to have a history of hyping their claims; doing so in front of the RSA audience was a particularly brassy move. Though they raise genuine concerns about Internet security and AV effectiveness, the method to do so leaves a lot to be desired.
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
