News: Rise of the Botnets
639389
The first half of 2004 saw a huge increase in zombie PCs. Also called bots, their average numbers monitored by security firm Symantec rose between January and June from under 2,000 to more than 30,000 per day - peaking at 75,000 on one day.
522625
Nasty squall New features of botnets created by the infamous Storm Worm allow denial of service attacks to be launched against security defenders that attempt to interrupt its operation.â¦
111159
The botnet deluge is providing -- what else? -- business opportunities for a handful of firms who think they're got what it takes to fight back the onslaught.
562118
In the first column of this year, I discussed computer security outlook and hopes for 2008. I forecast more of the same that we saw in 2007: more spam, more malware, more bad guys basically owning the Internet and our connected computers. I don't see any trends or new leaders with significant power to change the status quo.
465970
Tool kits spark explosion in malicious code base, says Symantec One weekend in June, a little-known Trojan downloader made a major debut on the international malware stage after it managed to burrow its way into more than 10,000 websites in just 72 hours. Infected sites - including one connected to rock musician Bon Jovi and another that raises money for charity work of the late Mother Teresa - suddenly became the agents of Russian crime gang, as they pushed malware on unsuspecting visitors.â¦
541256
The numbers of malicious programs circulating online is reaching 'epidemic' levels, say experts.
737700
Semi-organized people just as dangerous as botnets In late April, a Russian-speaking blogger upset with recent events in Estonia posted a series of dispatches calling on like-minded people to attack government servers in that country.â¦
176286
Servers that managed global internet traffic have been subjected to a concerted attack by hackers.
747275
(InfoWorld) - Trend Micro announced a new service to help large organizations and Internet service providers (ISPs) fight networks of zombie machines, known as "botnets." The new service, dubbed InterCloud, was announced Monday and is intended to help organizations fight botnets, fast-changing networks of rogue computers that are used in denial of service (DOS) attacks, spam campaigns, identity theft, and other malicious acts. The new service uses behavioral analysis technology, developed by Trend, and known as Behavioral Analysis Security Engine (BASE) to spot and isolate bot machines on managed networks, according to Paul Moriarty, director of product development for Internet Content Security at Trend. BASE analyzes application and network infrastructure data, such as DNS queries and Border Gateway Protocol (BGP) routing tables. The engine can spot behavior indicative of bots, such as an abnormal series of DNS queries. The service also uses data from Trend's global network of researchers and customers to provide intelligence on new or evolving bot activity. The company's Bot Identification Team identify and monitor bot activity globally, Trend said. InterCloud relies, in part, on a new, hardened and revamped DNS server that allows Trend to aggregate suspicious data and report on host systems that may be infected with bot programs, Moriarty said. "We can take a day's worth of DNS logs and tell them how many spambots or zombies they have. That's a capability that most IPSes lack," he said. InterCloud customers can remediate infected systems by denying them access to the network, or by quarantining them and pushing out necessary updates or scanning and disinfecting them, said Dave Rand, CTO of Trend's Internet Content Security group.  The InterCloud service includes a Web-based management portal for viewing and reporting on bot activity and managing security policies, Trend said. Botnets are one of the fastest growing and most dangerous online threats, said Rand. On any day, Trend tracks millions of infected systems that have been joined to one of a number of global bot networks. But bot infections can also jump up, depending on the availability of easy to exploit security holes, such as the recent VML vulnerability in Microsoft's Internet Explorer browser, or the Windows Server Service vulnerability that was disclosed by Microsoft in August. Trend identified more than 250,000 new bots each day for the two days after an exploit was developed for the Server Service hole, which Microsoft patched withÂ  MS06-040. Typically, the company might identify 250,000 new bots over the course of a month, Moriarty said. Trend researchers are also spotting many more targeted attacks, in which bots are being written for specific purposes, such as culling sensitive information from the targeted network, then forwarding it back to a command and control server, usually in a foreign country. Many of those appear aimed at identity theft, or espionage against the U.S. government or government contractors.Â  Few enterprise security products can scale to support hundreds of thousands or millions of hosts, which means that ISPs and very large organizations often rely on internal security teams and products to manage security. However, those company-focused teams lack the broad perspective that companies with global research operations and a global customer base can muster, Moriarty said. InterCloud, which will be licensed by the seat, will offer ISPs the prospect of turning security into a profit center, by focusing attention on the relatively small number of infected systems, then targeting their owners with software, such at Trend's Web-based HouseCall antivirus scanner, that can clean their system and keep it from becoming reinfected. ISPs could then get a share of any software sales made through that channel, Moriarty said. Trend Micro will feature InterCloud Security Service and the BASE technology at DEMOfall '06 this week in San Diego.Â ADVERTISEMENTMAKE SOA REAL WITH IBM WEBSPHERE PODCASTStreamline processes and maximize efficiency within a proven service oriented architecture. Take back control of your business processes with IBM WebSphere.
195292
an IBM security report finds malware is increasing in volume and sophistication this year.
828
The next big use for iRobot's bots: patrolling international borders.
172825
Huge crowds in social networking sites draw money-minded malware authors.
420249
TomTom ships viruses on its nav devices; Net pioneer predicts big botnet surge.
143995
A sophisticated hacking scheme seen early last year appears to be affecting an increasing number of Web servers.
205321
Reports suggest phishing gangs are turning to automatic tools to mount more attacks than ever.
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
200884
More than 30,000 PCs per day are being recruited into secret networks that spread spam and viruses, a study shows. Six months ago only 2,000 Windows machines per day were being recruited into these so-called bot nets.