Russian hosting network running a protection racket, researcher says
688883
The notorious Russian Business Network is running a protection racket that extorts up to $2,000 a month "protective Web services" from borderline sites, a researcher alleged today.
218321
Super Bowl host sites can infect visitors with malware.
734520
Hackers may have targeted DNS servers that form the backbone of the Internet--but no damage was done, experts believe.
465970
Tool kits spark explosion in malicious code base, says Symantec One weekend in June, a little-known Trojan downloader made a major debut on the international malware stage after it managed to burrow its way into more than 10,000 websites in just 72 hours. Infected sites - including one connected to rock musician Bon Jovi and another that raises money for charity work of the late Mother Teresa - suddenly became the agents of Russian crime gang, as they pushed malware on unsuspecting visitors.â¦
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
526012
Criminals controlling millions of PCs could threaten the internet, experts at the World Economic Forum warn.
689321
Russian antivirus expert says claims in the media of an "electronic Jihad" were taken out of context.
88443
A study by Google's team of anti-malware researchers finds that Web sites running Microsoft's IIS Web server software are twice as likely to be hosting malicious code as Web sites hosted by other servers.
632824
The Russian Business Network, a notorious hacker gang, is responsible for ongoing spam attacks using malicious PDF files.
238990
Researchers see a rise in malware that sends spam recipients to DNS servers controlled by phishers.
647793
(InfoWorld) - If hijacked sites and hosting companies that fail to police malware distribution sources represent two of the most serious threats to Internet security, there may be hope for improvement, according to researchers working with Harvard Law School's StopBadware.org. After publishing a list of rogue Web site hosting companies and launching a campaign to label every malicious site they can find on the Internet, an effort that has filtered out over 600,000 nefarious applications thus far, the StopBadware team says that people are responding.Â  The project currently counts less than 250,000 Web sites that it classifies as distributors of programs that qualify as badware -- any application that either tries to hide itself or any of its intentions, based on the parameters of the effort. StopBadware also announced that Internet mainstays Paypal and VeriSign have joined its influential cast of sponsors, which includes Google. By inserting warnings into Google's search results that steer end-users away from malware and adware sources, while communicating with those responsible for creating or handing out the suspicious programs, progress is being made, according to StopBadware's lead researchers. "The interstitials delivered with Google search results are working, and we've been able to communicate with a lot of Webmasters. It's having a neighborhood effect," said Prof. John Palfrey, executive director of Harvard Law School's Berkman Center for the Internet and Society. "We're reaching out to hosting companies and Webmasters and filtering the complaints where it seems useful, and we've seen many people change their behavior." In addition to all the people who have no idea that their sites are being used to pass out malicious programs and those who misunderstand the nature of the applications they're distributing, StopBadware researchers say that even those who create many of the programs are engaging in the give and take. For those who can be reached, the debate over whether or not a particular program qualifies as badware typically can be resolved, with very few of those who agree to modify their applications going on to repeat their behavior, said Jason Callina, one of the StopBadware researchers. "We're seeing a low recurrence of people coming back on the lists once we've gone through the testing and communications process. People are actually helping each other move off the lists," Callina said. "When there's ever any serious disagreement, it's always an argument of our definition of spyware versus theirs." Most Webmasters complain about the interstitials on Google -- which they are notified of 24 hours in advance and given the opportunity to appeal. But the immediate drop in search-driven traffic that the warnings produce quickly convinces people to either take any questionable applications offline or kill their sites altogether, Callina said. Meanwhile, StopBadware's list of hosting companies responsible for supporting the largest number of malware sites resulted in at least one leading culprit -- iPower Technologies --Â  changing its ways, while two others have disappeared completely. Others have also begun to modify their behavior, Palfrey said. "The best measure of our success is when any of these companies change their business process and we're seeing them adjusting," said Palfrey. "At the same time, we're trying to enable [end users] to make better choices with their using habits." So many of the people who end up on StopBadware's list need help understanding what it is that they're doing wrong that the team feels its ability to mete out advice is being overwhelmed, he said. At the same time, StopBadware admits that sophisticated hackers are still advancing their efforts at an alarming pace and the organization can't keep up with the ever-growing volume of online malware programs. In addition to tracking down the programs, StopBadware is also charting regional trends, and the researchers contend that a growing number of suspicious applications are originating in China. The level of interaction between malware authors in the region and their Western counterparts is also becoming more prevalent, with a fair share of distribution still emanating from former Soviet-bloc regions as well, the team said. The key for legitimate businesses to steer clear of the entire problem is to be careful with the companies they partner with, said Palfrey, who served as host of an Anti-Spyware Coalition conference held at Harvard in June. The security consortium is backed by influential industry players including AOL, Dell, Google, McAfee, Microsoft, and Yahoo. "The biggest concern for legitimate businesses at this point is related primarily to software bundling," said Palfrey. "There's often a complicated chain between the original purveyor of a program and the consumer, so companies need to be explicit about what they would qualify for badware-type behavior themselves and hold their partners to that."
719798
(InfoWorld) - Researchers in the U.S. say they've successfully shown how attackers could compromise a network designed to make itÂ harder to trace Internet surfersÂ and the Web sites they are viewing. The researchers, from the University of Colorado in Boulder, focused their efforts on The Onion Router (Tor) network. Tor software enables the creation of networks of servers that can send traffic over many different routes, masking its original source. The network offers users a greater degree of anonymity, since Web sites record the IP (Internet protocol) address of visiting machine, which could be linked to an individual user. Tor's creators say they were aware of the research, but using the network is still effective. The researchers, who consulted Tor project officials during their work, wrote on their Web site that they still feel it's the "most secure and usable privacy-enhancing system available." But the paper outlines the privacy concerns that could arise from using the techniques. "For example, law enforcement officers might use our techniques to cheaply and realistically track online predators," according to the paper. "The RIAA (Recording Industry Association of America) and other organizations might use our techniques to link Web or torrent requests to their corresponding requesters." For the experiment, the researchers constructed their own isolated Tor network using 66 servers. They placed malicious servers within the network that were designed to draw a substantial portion of routing requests by misrepresenting their bandwidth capability. Then the researchers used an algorithm to link the "path" of a Web site request. More than 46 percent of the time, the paths could be calculated, revealing the source of the traffic, the paper said. But several attacks against Tor have been developed, wrote Shava Nerad, Tor's executive director, on the project's blog. "We have never seen such an attack 'in the wild,' and we think it no more likely that this paper would make such an attack easier or more likely than it was a few years ago when another version of it was documented," Nerad wrote. The Tor platform has been incorporated into applications such as Torpark, a browser based on Firefox that causes a computer's IP address to appear to regularly change. Â
521524
A 21-year-old security researcher in Sweden who collected thousands of e-mails and passwords blamed administrators for not using encryption to shield their Internet traffic.
441266
(InfoWorld) - A Russian computer security expert predicts that terrorists could seek to target the country's critical infrastructure through electronic warfare, a strategy that could raise the stakes in how Russia handles computer crime. While terrorists aren't believed to currently have the know-how to disrupt critical infrastructure, it would be "very dangerous" if they start learning, said Valery Vasenin, head of the Computer Security Department at the Institute for Information Security Problems (IISP) at Moscow State University. "I think the phenomenon of terrorism will go in this direction," Vasenin said in an interview at his office. "This is probably the most important problem for the coming years." Russia's energy grid is a possible target, which could cause widespread blackouts. The air transportation or fuel distribution systems are other possible targets, Vasenin said. Russia has experienced chilling episodes of terrorism. In September 2004, 331 people, more than half of whom were children, were killed when Chechen separatists stormed a school in Beslan. In October 2002, Chechen rebels took 850 people hostage in a Moscow theater; 117 died after Russian forces used a poisonous gas before entering the premises. No major cyberterrorism incident in Russia has been recorded. However, the country's infrastructure is becoming more networked and less isolated than before, which could make it more vulnerable to cyberattacks, Vasenin said. "Russia, at the moment, is average in terms of computer security, like the rest of the world," Vasenin said. In the 1990s, the Internet in Russia was still viewed as something of a domain for academics, Vasenin said. But the rapid change of technology and emergence of threats has led to greater attention to security issues, he said. Moscow State University's IISP was established in 2004 to study network security, the psychology of human behavior and the Internet, along with computer forensics and judicial issues. Russia lacks laws that clearly define computer crime, he said, making it difficult for Internal Affairs Ministry agents to investigate and bring cases. IISP is studying other countries' computer crime laws and formulating recommendations. "They [the Internal Affairs Ministry] are somewhat unarmed," Vasenin said. "We understand we [Russia] have these problems related to legislation, just as there are worldwide problems." Through June, Russia recorded 8,400 computer-related crimes, according to figures released by the Internal Affairs Ministry in October. Forty-three percent of the cases were related to online auction fraud, with the remainder comprising information theft, unauthorized access, child pornography violations and others, the ministry said. Boris Miroshnikov, who heads the cybercrime department in Russia's Internal Affairs Ministry, has called for more trained experts to handle criminal cases that often cross international borders. Miroshnikov's comments at a cybersecurity conference were published earlier this year by Moscow State University. "Do we have today a school of experts in the field of cybercrimes?" Miroshnikov told conference participants. "Unfortunately, I do not think so." (Pavel Kupriyanov of Computerworld Russia contributed to this report.) Â
38008
Vulnerabilities could allow attackers to gain remote control of a system, security company says.
484935
InfoWorld - Researchers in the U.S. say they&#39;ve successfully shown how attackers could compromise a network designed to make it&#160;harder to trace Internet surfers&#160;and the Web sites they are viewing.
272778
As the United States' presidential candidates pinball their way across New Hampshire on the day of the state's closely watched primary elections, a new form of grassroots activism appears to be taking root across the Atlantic, in Eastern Europe, that melds dirty pool tactics with the cutting edge of malware technology.Researchers with carrier security specialists Arbor Networks claim that they recently discovered several additional incidents of botnet-driven DOS attacks that were tied to political issues. Danny McPherson, chief research officer at Arbor, will report his group's findings to the assembled computer security and law enforcement experts at next week's Department of Defense Cyber-crime conference in St. Louis.Since April 2007, when a campaign of targeted denial-of-service (DOS) attacks against Web sites controlled by the prime minister of Estonia and several regional banks were carried out with crushing results -- crippling the URLs for a period of several days -- experts have wondered aloud to what extent politics played a hand in the scheme.At the time, press reports and IT security experts speculated that tension between Estonia and Russia -- sparked by Estonia's decision to move a Soviet-era World War II memorial of a bronze soldier -- may have motivated the coordinated DOS attacks. With a number of well-known malware distribution and botnet control networks based out of the region, experts speculated that Russian hackers, either on their own or at the behest of a paying customer, took out the Estonian sites to display their displeasure with the statue's removal.Now new evidence has been discovered that indicates the same sort of political activism believed to have driven the 2007 Estonian Web site attacks not only exists but is becoming more popular."We spent some time after the Estonia attacks looking into this part of the world, and we've found evidence of other politically motivated botnet DOS attacks," said Jose Nazario, senior software engineer at Arbor. "It's hard to tell who is responsible for these campaigns, but they definitely appear to be tied to some recent Russian and Ukrainian elections."According to Nazario, who is known as an expert tracker of botnets -- the armies of malware-infected computers that can be controlled remotely to be used for everything from DOS campaigns to the distribution of spam -- two elections in particular appear to have drawn activity similar to the Estonia incidents.In one instance, Nazario said his team uncovered a botnet-driven DOS threat carried out against several Web sites controlled by Viktor Yanukovych, the recently defeated Ukranian prime minister, during his re-election campaign.In another incident, Nazario said that his team was able to discover a DOS campaign aimed at sites controlled by the "Other Russia" political party led by one-time 2008 Russian presidential candidate Garry Kasparov, who is more widely known as one of the greatest chess players of all time.During each of the individual attacks, banks of botnet-infected computers successfully took the candidates' sites down for several days before they were restored, according to Arbor.Additionally, Nazario said the botnets used in both sets of attacks represent the cutting-edge of the increasingly popular and sophisticated malware sub-genre.Rather than using IRC relays to communicate with each other like most traditional botnets, the politically driven threats utilized Web-based requests to speak to each other -- a much harder form of traffic to differentiate from legitimate network throughput, Nazario said.The same advanced botnets are currently being used to distribute malware and spam, but the systems also appear to have been specifically designed to help their controllers carry out different types of distributed DOS attacks, he said.Nazario said the botnets being used in Russia and the Ukraine closely resembled the zombie PC armies that have been used in years past to attack anti-spam efforts such as Spamhaus and CastleCops -- both of which have previously been targeted successfully and had their sites temporarily taken offline.The activity could also suggest that the systems are being rented out by their creators to other people for the purpose of executing their own threats -- or being built through botnet toolkit technologies being developed in the region, the expert said.Whether or not botnet activism will wash ashore in the U.S. any time soon remains unclear, but it seems apparent the trend is taking off across the pond.Nazario said it remains hard to tell if the botnet campaign tactic has become a weapon of official political entities, or merely a tool of groups acting independently to promote some cause or belief, but lean towards the latter scenario."We don't know who is behind any of this activity, and we don't want to speculate, but you have to ask yourself, is this directed by someone higher in the political organizations, or is it merely somebody who is acting as a lone vigilante?" Nazario said. "It could be that this is something that is being carried out by a handful of individuals that have some sort of belief or disagreement to promote, or it could of course represent something bigger."