Storm Botnet May Co-opt Infected PCs
564065
Changes to some variants may mean the Trojan's creators are 'selling' compromised systems to spammers.
375239
Some clever, sexy Christmas-themed spam and a long holiday season helped the criminals behind the notorious&#160;Storm Worm&#160;more than double their network of infected PCs over the past few weeks, security experts say.Storm kicked off its holiday spam-and-malware campaign on the day before Christmas, sending off a flurry of e-mail that invited victims to visit a&#160;Christmas-themed strip show&#160;on Web sites such as Merrychristmasdude.com. Victims who downloaded the strip show found their PCs attacked by malicious software.This site, and about 14 other Storm-related domains, was registered using a Russian domain name registrar called Nic.ru, where staff was largely unavailable during the holidays, according to Richard Cox, the chief information officer with the Spamhaus anti-spam effort.&quot;The trouble was they were quite simply out to Christmas lunch,&quot; Cox said. &quot;And they didn&#39;t get back until Wednesday.&quot;Spamhaus representatives tried to contact the registrar on Dec. 26, but they soon discovered that the company was essentially shut down. Four days later they received an e-mail from a Nic.ru employee saying that they would have to wait until staff returned to work in January before anything could be done, Cox said.Storm&#39;s creators took advantage of another common problem in the domain name registration system. They targeted a registrar that did not have an established policy for taking down malicious domains, so that gave the criminals a little more time to run their scam, Cox said.By Wednesday of this week, Nic.ru had removed the Storm-related domains from its database, knocking the criminal network&#39;s Web sites offline.But now security experts say that Storm has more than doubled in size, adding about 25,000 PCs to a network that had been 20,000 strong.Storm&#39;s creators also changed the configuration of their malware, making it harder for security software to detect it, and this helped inflate the number of infections, Cox said.The Christmas campaign was &quot;pretty effective at growing the botnet,&quot; said Jose Nazario, senior security engineer at Arbor Networks. &quot;The contributing factors there were clearly the successful timing, tied to a major Western holiday, coupled with tweaks to the malware to avoid antivirus detection.&quot;Storm Worm has been attacking computer users since January 2007, when it began tricking victims into downloading malicious software, claiming that it was a video of violent storms that had been ravaging Europe.Since then it has been one of the most virulent sources of malware, although it has shrunk in size as detection methods have improved. Recently the network appears to have begun renting out its infected PCs to phishers, according to some researchers.&quot;Storm is an insidious pest. We&#39;ve learned essentially how to manage it,&quot; said Nazario. But, he added, the success of this Christmas campaign proves that the network can still be a serious threat. &quot;They&#39;re great marketers,&quot; he said.&#160;
711528
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs - it wants to invade their homes too.
564338
A rootkit based on proof-of-concept code presented at 2005's Black Hat conference is currently infecting thousands of Windows-based PCs, and researchers say it's a remarkably sophisticated -- and hard-to-eradicate -- infection.
325622
Security experts are warning PC users to be on guard against viruses masquerading as Valentine's Day messages, which could damage computers.
518928
The criminals behind the Storm botnet waited until the last minute, but they&#39;ve finally started delivering unwanted Christmas presents.Starting Monday, Storm-infected machines began sending out Christmas-themed spam in yet another attempt to trick victims into downloading malicious software. In this case, the site is named Merrychristmasdude.com, and the malware is a variation of the Storm Trojan horse program that has been plaguing systems around the world since January.The e-mails contain titles such as &quot;Find Some Christmas Tail,&quot; &quot;Warm Up this Christmas&quot; and &quot;Mrs. Clause Is Out Tonight!&quot;One message reads &quot;Yo, I am pretty sure this is up your alley, from the things you have told me before. This will be the best 2 min you spend this holiday. hehe.&quot;Once the user clicks on the link to Merrychristmasdude.com, he is taken to a Christmas-themed Web site with photos of scantily clad women and offered a free download. That download is a malicious program, called Email-Worm.Win32.Zhelatin.pd by F-Secure, that connects to a P-to-P (peer-to-peer) network and begins downloading even more malware.Storm&#39;s creators have built up networks of infected PCs -- called botnets -- over the past year by using a combination of sophisticated hacking tricks to avoid detection and by spamming potential victims with clever and timely e-mail messages. The network is called Storm because its original messages offered victims video of the deadly storms that battered Europe a year ago, but has also perfected the tactic of sending out holiday-themed messages.Security experts estimate that the&#160;Storm has infected more than 15 million computers over the past year, although the current size of the network is much smaller than that.This latest variant is being blocked by some antivirus vendors, including Kaspersky, Microsoft and Symantec, according to a technical write-up of the Christmas outbreak.The SANS Internet Storm Center recommends that administrators block Web and e-mail access to the Merrychristmasdude.com domain.
22770
Unpatched Windows machines are vulnerable to latest adware attack
267647
The Banker-AJ trojan has been coded to lie dormant in the background on infected Windows PCs. When users visit legitimate online banking Web sites of certain UK banks, the malicious code is
620258
InfoWorld - Malware-infected botnet PCs have overtaken denial-of-service attacks as the top security issue facing Internet service providers and other Web infrastructure hosting players, according to a new survey of the organizations.
189361
Program isn't entirely benevolent: it also downloads files to infected PCs.
584161
Agency says it may uncover additional incidents in which botnets have been used to facilitate criminal activity.
426063
Universities and schools worst hit University security experts warned administrators on Monday that a bot program has started to spread by exploiting five patched Microsoft vulnerabilities and a six-month-old flaw in Symantec's anti-virus software.â¦
542387
The sophisticated worm, known as W32.pipeline, is setting up a botnet and propagates when an AIM user clicks on a Web link apparently sent from someone in their buddy list.
53629
Clicking the fraudulent update could install malicious code on your desktop.
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
285447
The&#160;Storm Worm&#39;s days may be numbered, according to a University of California researcher.Brandon Enright, a network security analyst at UC San Diego, has been tracking Storm since July and said that, despite the intense publicity that the network of infected computers has received, it&#39;s actually been shrinking steadily and is presently a shadow of its former self. On Saturday, he presented his findings at the Toorcon hacker conference in San Diego.Storm is not really a computer worm. It&#39;s a network of computers that have been infected via malicious e-mail messages, and are centrally controlled via the Overnet P-to-P protocol. Enright said he has developed software that crawls through the Storm network and he thinks that he has a pretty accurate estimate of how big Storm really is.Some estimates have put Storm at 50 million computers, a number that would give its controllers access to more processing power than the world&#39;s most powerful supercomputer. But Enright said that the real story is significantly less terrifying. In July, for example, he said that Storm appeared to have infected about 1.5 million PCs, about 200,000 of which were accessible at any given time.Enright guessed that a total of about 15 million PCs have been infected by Storm in the nine months it has been around, although the vast majority of those have been cleaned up and are no longer part of the Storm network.Since July, it&#39;s been downhill for Storm. That&#39;s when antivirus vendors began stepping up their tracking of Storm variants and got a lot better at identifying and cleaning up infected computers, Enright said.Then on September 11, Microsoft added Storm detection (Microsoft&#39;s name for Storm&#39;s components is Win32/Nuwar) into its Malicious Software Removal tool, which ships with every Windows system. Overnight, Storm infections dropped by another 20 percent.Today, Enright said that Storm is about one-tenth of its former size. His most recent data counts 20,000 infected PCs available at any one time, out of a total network of about 160,000 computers. &quot;The size of the network has been falling pretty rapidly and pretty consistently,&quot; he said.Still, Storm has had a remarkably successful run. It&#39;s called Storm because it first popped up in mid-January in spam e-mails that offered late-breaking information on powerful storms that had been battering Europe. Users who clicked on the &quot;Full Story.exe&quot; or &quot;Video.exe&quot; attachments that accompanied the spam were infected by malicious software, making them part of the Storm network.These machines were then used to send out more spam and launch attacks against other computers. The recent MP3 stock spam that was first spotted earlier this week was sent out by the Storm network, Enright said.Storm was effective because its creators were really good at creating messages that victims would feel compelled to click, Enright said. In its first few days, it managed to infect more than 300,000 computers, making it the worst malware outbreak since 2005. Its creators have since been masters at creating timely messages for their spam and have also had success getting victims to click on fake e-greeting cards.The Storm network itself is constantly changing, and has used a variety of technologies that have made it an interesting phenomenon to study. In addition to the peer to peer network, it has used rootkit software to disguise its presence on the PC and a server-switching technique called &quot;fast-flux,&quot; which makes the Storm servers harder to find on the network.It&#39;s also developed some interesting ways of keeping researchers like Enright at bay. &quot;If you&#39;re a researcher and you hit the pages hosting the malware too much... there is an automated process that automatically launches a denial of service [attack] against you,&quot; he said. This attack, which floods the victim&#39;s computer with a deluge of Internet traffic, knocked part of the UC San Diego network offline when it first struck.Lately Storm has been responsible for a large quantity of &quot;pump and dump&quot; spam, which tries to temporarily boost the price of penny stocks. But one area that does not seem to be of interest to Storm&#39;s creators is identity theft. &quot;Believe it or not, credit card numbers aren&#39;t worth that much money,&quot; Enright said. &quot;It&#39;s much better to make money... via pump and dump.&quot;&#160;
387396
Security experts warn that virus writers could be preparing to create havoc using a bug in the way that Windows handles images.