Malware increasingly uses peer-to-peer communications, researchers say

The number of P-to-P malware samples surged during the past year, researchers from Damballa said

The number of malware samples that use P-to-P (peer-to-peer) communications has increased fivefold during the past 12 months, according to researchers from security firm Damballa.

The largest contributors to this increase are advanced threats like ZeroAccess, Zeus version 3 and TDL4, said Stephen Newman, vice president of products at Damballa. However, there are also other malware families that adopted P-to-P as a command-and-control (C&C) channel recently, he said.

"The use of P-to-P in advanced malware threats has been around for quite some time, but we've never really seen it take the hold that we've started to see now," Newman said. The reason why this is happening now has to do with cybercriminals' desire for resiliency in the face of takedown efforts that can disrupt centralized C&C infrastructures, he said.

Botnet masters stand to lose access to thousands or millions of infected computers if their control servers are shut down, so they're looking into decentralized P-to-P communications, where botnet clients can relay commands to one another, as a resilience technique along with other methods like the use of domain name generation algorithms (DGAs), he said.

Another benefit for attackers is that malicious P-to-P traffic is hard to detect and block at the network level by using traditional approaches that rely on lists of known IP addresses and hosts associated with C&C servers.

TDL4 is probably the most prevalent malware family that uses P-to-P communications, said John Jerrim, senior research scientist at Damballa. However, TDL4's P-to-P communication channel is only used as backup in case no C&C server can be reached by using a domain generation algorithm, he said.

TDL4 is best known for being highly persistent and hard to remove from computers because it infects the Master Boot Record (MBR), a special section of the hard drive that contains code executed during the boot process before the operating system starts. The threat is primarily used to distribute other malware as part of pay-per-install schemes and cybercriminal affiliate programs.

Zeus version 3, which is also known as GameOver, is a Trojan program that steals online banking credentials and other financial data. Unlike TDL4, Zeus v3 uses P-to-P as its primary C&C channel and falls back to using a DGA when the malware cannot reach any peer from the P-to-P network.

ZeroAccess is a particularly interesting threat because it only uses P-to-P communication for command-and-control purposes. The threat is distributed with the help of Web exploit toolkits like Blackhole, Neosploit and Sweet Orange, and is primarily used for click fraud and Bitcoin mining.

Damballa released a report about the use of P-to-P communications in ZeroAccess, Zeus v3 and TDL4 on Tuesday. The company also added the capability to detect this type of malicious traffic to its Failsafe network security appliance for enterprises.

Researchers from the Institute for Internet Security in Germany, VU University in Amsterdam and security providers Dell SecureWorks and Crowdstrike recently published a report on the resilience of peer-to-peer botnets.

"Our evaluation has shown weaknesses which could be used to disrupt the Kelihos and ZeroAccess botnets," they said in their report. "However, we have also shown that the Zeus and Sality botnets are highly resilient to sinkholing attacks, the currently most used class of disruptive attacks against P2P botnets."

The researchers concluded that finding alternative mitigation methods against P-to-P botnets is "urgently needed."

Join the CSO newsletter!

Error: Please check your email address.

Tags CrowdStrikeDell SecureWorkssecurityDamballamalware

More about DellNewmanOrangeSecureWorks

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts