Storm Botnet Gets Profiled at Web Site
237409
Storm, now a large remotely controlled botnet, is getting a graphic profile on a Web site set up to track it.
737263
This paper discusses the use of NetFlow, a traffic profile monitoring technology available on many routers, for use in the early detection of worms, spammers, and other abnormal network activity in large enterprise networks and service providers. Part 2 of 2.
522625
Nasty squall New features of botnets created by the infamous Storm Worm allow denial of service attacks to be launched against security defenders that attempt to interrupt its operation.â¦
755872
(InfoWorld) - During the past two years, security experts and software vendors have downplayed the threat of so-called worm viruses, but new evidence suggests that the attacks are still as dangerous, if not more so, than ever. While the enormous mass-mailing worm viruses of years past -- such as the well-known MyDoom, Sobig, and Slammer attacks -- that were aimed at crippling IT infrastructure have all but disappeared, smaller outbreaks that aim to load financially-motivated malware onto end users' computers -- such as the recent Storm Worm -- will continue to menace the Internet, according to researchers. Consensus opinion among security experts has been that as businesses and consumers improved their desktop security tools and computing habits, it became harder for malware writers to lure the same volumes of people with worms. This trend pushed the attackers away from creation of the self-propagating threats and further into financially-motivated crimeware, market watchers observed. However, the continued spread and modification of Storm Worm, which first surfaced in mid-Jan. 2007, could illustrate an emerging breed of the attacks that is likely to trouble users in years to come. On Feb. 27, workers at security software maker Secure Computing released details of a newly-emerging variant of Storm Worm that adds a Web-based social engineering component to the attack's more traditional e-mail and IM delivery models. According to San Jose-based Secure, the new version of Storm Worm sits on an infected computer and waits for a user to post a message to a Webmail system or online bulletin board site, and then adds a link to those communications that sends anyone who clicks on the URL to a malware-laden Web page. Threats that sit on the Storm-generated sites include variants of the attack itself, along with a range of crimeware programs aimed to steal sensitive personal or financial information. Viruses like Storm, which can also be classified as a Trojan rootkit, reflect the manner in which attackers will leverage the time-honored worm platform to pass along their latest work, said Dmitri Alperovitch, principal research scientist at Secure. "We're not discounting the threat from targeted financial attacks, but those tend to take a lot of work to pull off, as the attacker must do recon on the organization or user and put a good deal of effort into each target," Alperovitch said. "The payback on those attacks is probably greater, but these types of worms like the new variants of Storm can pay for themselves pretty quickly; there's little doubt we'll see more designed in this manner." In addition to using the worm approach to distribute cutting-edge malware, the Storm variations have adopted a number of other characteristics typically associated with newer attacks. The threat code itself is being changed at a rapid pace to avoid detection by antivirus systems, according to the Secure researcher, and is using an ever-changing list of URLs and IP addresses to deliver its payload and fly under the radar. The swiftly-changing profile of Storm Worm will make it hard for traditional security products to keep up with such threats, he said. "With this added technique of constant morphing and many new variants, I can't imagine how signature-based based technologies will ever cope with this sort of thing -- people truly need behavior-based tools to stop them," said Alperovitch. "We haven't seen the mass mailing, mass targeting worms that were big in the past, and Storm is not mass targeting compared to some of those, but the Web component will allow it to propagate much faster, so we'll have to keep a close eye on it." Anti-virus software makers agreed that traditional signature-based tools alone will not suffice to stop the new breed of worm, but they said that the attacks can be thwarted using a combination of those products and newer behavior-based systems. Officials at AV market leader Symantec, based in Cupertino, Calif., said that they view Storm as more of a Trojan than a worm, based on the fact that its spread is relying on social engineering methods versus automated propagation. Either way, users should rely on a defense-in-depth security strategy to protect themselves from either form of attack, according to Dave Cole, director of Symantec's Security Response team. "The major threat of today isn't the worm of yesteryear, but really the Trojan attack as the designers are using really sophisticated social engineering to trick people into downloading," Cole said. "The classical worms are still out there, we still see a ton, but the reality is they are not infecting nearly as many people because of the defenses out there; these new ones are a bigger threat." While behavior-based tools such as IDSes may represent the most effective form of defense against the rapidly-changing worm threats of today, users should still employ signature-based anti-virus applications to protect against anything that sneaks through those filters, according to the Symantec researcher. Dan Hubbard, vice president of security research at San Diego-based Websense, said that much as with every other breed of malware, worms will be increasingly laced together with different types of attacks to help increase their reach and destruction. He said worms won't likely become the leading virus format again anytime soon, according to the expert, but they will remain on malware artists' palettes as yet another option when they are creating their latest work. "At a macro level, e-mail only worms have become less frequent, but their use in combination with other attacks is getting more sophisticated and will likely continue to appear," Hubbard said. "Automation will be used to deliver new variants even faster than ever, and they will be self-updating and self-modifying; this is part of the overall increase we're seeing in the variety of ways that people are being infected over the Web."
481357
(InfoWorld) - With tropical storm Ernesto now blowing off the coast of Florida, Internet security experts are warning that fraudsters may be hard at work claiming Ernesto-related Web site domains. On Tuesday, 18 domains related to the storm became live, said Johannes Ullrich, chief research officer at the SANS Institute. They include such names as Ernestoinsurance.com, Ernestomoney.com, and Ernestodamage.com. Ullrich's Web posting on this topic can beÂ found here. Scammers began cashing inÂ on natural disasters in a widespread way following the December 2004 earthquake and Tsunamis that killed hundreds of thousands in southeast Asia, Ullrich said. Last year there wereÂ reports of large-scale fraudÂ in the weeks after Hurricane Katrina devastated New Orleans and parts of the U.S. Gulf Coast. In September, the U.S. Federal Bureau of Investigation warned that more than half of the Hurricane Katrina aid sites that it had reviewed were registered to people outside of the U.S. and likely to be fraudulent. SANS saw about 1,000 Katrina-related domains registered in the wake of Hurricane Katrina, Ullrich said. The majority of these domains were set up for what he called "domain parking," an attempt to make money by placing ads on a Web site that surfers seem likely to stumble upon. Ernestoinsurance.com, for example was registered by Julian Luby a graduate student in Portland, Oregon, who said he registered between 30 and 50 Ernesto-related domains, beginning Sunday. Luby registered the domains for the dual purposes of providing information on the storm and raising money for a group of social networking sites he is developing. Luby, who also registered the Ernestomoney.com and Ernestodamage.com sites, has listed many of his domains for sale, asking from $400 to $1,000 per domain. He is also maintaining a blog of Ernesto-related news on some of the sites. On one day shortly after Hurricane Katrina made landfall, more than 400 Katrina-related domains were registered. Ultimately dozens of the sites proved to be fraudulent, and Ullrich is worried that this pattern may repeat itself with Ernesto. However, it seems unlikely that Ernesto will attract the attention of Katrina, which was one of the worst natural disasters in U.S. history. By Tuesday, the National Hurricane Center had downgraded Ernesto from hurricane to Tropical storm. "It doesn't look like Ernesto will amount to much, so I don't think we'll see much in terms of domain fraud," Ullrich said. But this is a pattern he expects scammers to repeat as other storms form during this 2006 hurricane season. "Basically they're waiting for the right hurricane to come around," he said. In any case, anyone looking to register Ernesto domain names may already be late to the game. The U.S. National Weather Service publishes its list of hurricane names years in advance, and many scammers have pre-registered their fraudulent sites, according to Rich Miller, an analyst with Web site tracking service Netcraft Ltd. "A lot of the premium names are long gone," he said. That list of National Weather Service's list of Hurricane names can beÂ found here.
542387
The sophisticated worm, known as W32.pipeline, is setting up a botnet and propagates when an AIM user clicks on a Web link apparently sent from someone in their buddy list.
586598
Prosecution on ice The creators of the Storm Worm botnet are known to US authorities but a lack of co-operation from their counterparts in St. Petersburg, Russia, is preventing action being taken.â¦
451868
The growing use of Web feed readers and the proliferation of content aggregation sites are giving hackers an easy way to deliver malware to users' computers, security analysts warn.
688678
Targeted phishing attacks aiming to plant malware on corporate networks are going out to companies that have posted job openings on CareerBuilder.com, according to reports from one affected party.
245354
Don't download it - as if you needed to be told... There's a new version of the Storm Trojan on the loose, disguised as an e-postcard but actually recruiting zombies for a botnet, according to the SANS Institute's Internet Storm Centre.â¦
392900
Spammers are suspected of hacking into and downing Lycosâs anti-spam Web site just hours after it went live. The Web site is currently inaccessible and could also be the victim of a DDoS attack.
640197
A clever Windows virus called Bofra has started circulating on the net.
691662
A Valentine&#39;s themed outbreak of the Storm worm has been detected. Malicious e-mails are being received across the globe -- they contain a Web link, which directs users to a Web site where they can supposedly download a Valentine&#39;s card, but in fact are infected with&#160;the Storm bug.&#160;The virus mirrors the fake Christmas and New Year messages seen in previous months.According to Greg Day, security analyst at McAfee, the virus will try to steal personal information from your PC, bring down its security defenses and use your PC to send out millions of junk e-mails.&quot;There are about 10 million PCs worldwide infected with the Storm worm. These threats have suddenly spiked from 0 percent of all spam e-mails to 1.5 percent and they are continuing to rise as we draw closer to Valentine&#39;s Day and more people are fooled into downloading the malicious file,&quot; he commented.&quot;With all the hype that surrounds Valentine&#39;s Day, it was only to be expected that they (the people behind Storm) would use a similar tactic and exploit people&#39;s eagerness to receive Valentine&#39;s cards,&quot; added Diego d&#39;Ambra of e-mail security company&#160;SoftScan.PC Advisor is an InfoWorld affiliate.
105425
Marks host malware Booby-trapped web pages are growing at an alarming rate with unsuspecting firms acting for nurseries for botnet farmers, according to a new study.â¦
96436
Lycos vigilante attack on spammers has been hit by a vigilante attack. Spammers are suspected.
272778
As the United States' presidential candidates pinball their way across New Hampshire on the day of the state's closely watched primary elections, a new form of grassroots activism appears to be taking root across the Atlantic, in Eastern Europe, that melds dirty pool tactics with the cutting edge of malware technology.Researchers with carrier security specialists Arbor Networks claim that they recently discovered several additional incidents of botnet-driven DOS attacks that were tied to political issues. Danny McPherson, chief research officer at Arbor, will report his group's findings to the assembled computer security and law enforcement experts at next week's Department of Defense Cyber-crime conference in St. Louis.Since April 2007, when a campaign of targeted denial-of-service (DOS) attacks against Web sites controlled by the prime minister of Estonia and several regional banks were carried out with crushing results -- crippling the URLs for a period of several days -- experts have wondered aloud to what extent politics played a hand in the scheme.At the time, press reports and IT security experts speculated that tension between Estonia and Russia -- sparked by Estonia's decision to move a Soviet-era World War II memorial of a bronze soldier -- may have motivated the coordinated DOS attacks. With a number of well-known malware distribution and botnet control networks based out of the region, experts speculated that Russian hackers, either on their own or at the behest of a paying customer, took out the Estonian sites to display their displeasure with the statue's removal.Now new evidence has been discovered that indicates the same sort of political activism believed to have driven the 2007 Estonian Web site attacks not only exists but is becoming more popular."We spent some time after the Estonia attacks looking into this part of the world, and we've found evidence of other politically motivated botnet DOS attacks," said Jose Nazario, senior software engineer at Arbor. "It's hard to tell who is responsible for these campaigns, but they definitely appear to be tied to some recent Russian and Ukrainian elections."According to Nazario, who is known as an expert tracker of botnets -- the armies of malware-infected computers that can be controlled remotely to be used for everything from DOS campaigns to the distribution of spam -- two elections in particular appear to have drawn activity similar to the Estonia incidents.In one instance, Nazario said his team uncovered a botnet-driven DOS threat carried out against several Web sites controlled by Viktor Yanukovych, the recently defeated Ukranian prime minister, during his re-election campaign.In another incident, Nazario said that his team was able to discover a DOS campaign aimed at sites controlled by the "Other Russia" political party led by one-time 2008 Russian presidential candidate Garry Kasparov, who is more widely known as one of the greatest chess players of all time.During each of the individual attacks, banks of botnet-infected computers successfully took the candidates' sites down for several days before they were restored, according to Arbor.Additionally, Nazario said the botnets used in both sets of attacks represent the cutting-edge of the increasingly popular and sophisticated malware sub-genre.Rather than using IRC relays to communicate with each other like most traditional botnets, the politically driven threats utilized Web-based requests to speak to each other -- a much harder form of traffic to differentiate from legitimate network throughput, Nazario said.The same advanced botnets are currently being used to distribute malware and spam, but the systems also appear to have been specifically designed to help their controllers carry out different types of distributed DOS attacks, he said.Nazario said the botnets being used in Russia and the Ukraine closely resembled the zombie PC armies that have been used in years past to attack anti-spam efforts such as Spamhaus and CastleCops -- both of which have previously been targeted successfully and had their sites temporarily taken offline.The activity could also suggest that the systems are being rented out by their creators to other people for the purpose of executing their own threats -- or being built through botnet toolkit technologies being developed in the region, the expert said.Whether or not botnet activism will wash ashore in the U.S. any time soon remains unclear, but it seems apparent the trend is taking off across the pond.Nazario said it remains hard to tell if the botnet campaign tactic has become a weapon of official political entities, or merely a tool of groups acting independently to promote some cause or belief, but lean towards the latter scenario."We don't know who is behind any of this activity, and we don't want to speculate, but you have to ask yourself, is this directed by someone higher in the political organizations, or is it merely somebody who is acting as a lone vigilante?" Nazario said. "It could be that this is something that is being carried out by a handful of individuals that have some sort of belief or disagreement to promote, or it could of course represent something bigger."
181199
Interesting tidbit that was Slashdotted earlier - Netcraft has released an anti-phishing toolbar that leverages the enormous database of web sites the organization manages.