Phishers now leasing the Storm worm botnet
172876
Domains of several new phishing sites are cropping up with known Storm worm domains. F-Secure researchers think phishers are leasing parts of the larger botnet.
755872
(InfoWorld) - During the past two years, security experts and software vendors have downplayed the threat of so-called worm viruses, but new evidence suggests that the attacks are still as dangerous, if not more so, than ever. While the enormous mass-mailing worm viruses of years past -- such as the well-known MyDoom, Sobig, and Slammer attacks -- that were aimed at crippling IT infrastructure have all but disappeared, smaller outbreaks that aim to load financially-motivated malware onto end users' computers -- such as the recent Storm Worm -- will continue to menace the Internet, according to researchers. Consensus opinion among security experts has been that as businesses and consumers improved their desktop security tools and computing habits, it became harder for malware writers to lure the same volumes of people with worms. This trend pushed the attackers away from creation of the self-propagating threats and further into financially-motivated crimeware, market watchers observed. However, the continued spread and modification of Storm Worm, which first surfaced in mid-Jan. 2007, could illustrate an emerging breed of the attacks that is likely to trouble users in years to come. On Feb. 27, workers at security software maker Secure Computing released details of a newly-emerging variant of Storm Worm that adds a Web-based social engineering component to the attack's more traditional e-mail and IM delivery models. According to San Jose-based Secure, the new version of Storm Worm sits on an infected computer and waits for a user to post a message to a Webmail system or online bulletin board site, and then adds a link to those communications that sends anyone who clicks on the URL to a malware-laden Web page. Threats that sit on the Storm-generated sites include variants of the attack itself, along with a range of crimeware programs aimed to steal sensitive personal or financial information. Viruses like Storm, which can also be classified as a Trojan rootkit, reflect the manner in which attackers will leverage the time-honored worm platform to pass along their latest work, said Dmitri Alperovitch, principal research scientist at Secure. "We're not discounting the threat from targeted financial attacks, but those tend to take a lot of work to pull off, as the attacker must do recon on the organization or user and put a good deal of effort into each target," Alperovitch said. "The payback on those attacks is probably greater, but these types of worms like the new variants of Storm can pay for themselves pretty quickly; there's little doubt we'll see more designed in this manner." In addition to using the worm approach to distribute cutting-edge malware, the Storm variations have adopted a number of other characteristics typically associated with newer attacks. The threat code itself is being changed at a rapid pace to avoid detection by antivirus systems, according to the Secure researcher, and is using an ever-changing list of URLs and IP addresses to deliver its payload and fly under the radar. The swiftly-changing profile of Storm Worm will make it hard for traditional security products to keep up with such threats, he said. "With this added technique of constant morphing and many new variants, I can't imagine how signature-based based technologies will ever cope with this sort of thing -- people truly need behavior-based tools to stop them," said Alperovitch. "We haven't seen the mass mailing, mass targeting worms that were big in the past, and Storm is not mass targeting compared to some of those, but the Web component will allow it to propagate much faster, so we'll have to keep a close eye on it." Anti-virus software makers agreed that traditional signature-based tools alone will not suffice to stop the new breed of worm, but they said that the attacks can be thwarted using a combination of those products and newer behavior-based systems. Officials at AV market leader Symantec, based in Cupertino, Calif., said that they view Storm as more of a Trojan than a worm, based on the fact that its spread is relying on social engineering methods versus automated propagation. Either way, users should rely on a defense-in-depth security strategy to protect themselves from either form of attack, according to Dave Cole, director of Symantec's Security Response team. "The major threat of today isn't the worm of yesteryear, but really the Trojan attack as the designers are using really sophisticated social engineering to trick people into downloading," Cole said. "The classical worms are still out there, we still see a ton, but the reality is they are not infecting nearly as many people because of the defenses out there; these new ones are a bigger threat." While behavior-based tools such as IDSes may represent the most effective form of defense against the rapidly-changing worm threats of today, users should still employ signature-based anti-virus applications to protect against anything that sneaks through those filters, according to the Symantec researcher. Dan Hubbard, vice president of security research at San Diego-based Websense, said that much as with every other breed of malware, worms will be increasingly laced together with different types of attacks to help increase their reach and destruction. He said worms won't likely become the leading virus format again anytime soon, according to the expert, but they will remain on malware artists' palettes as yet another option when they are creating their latest work. "At a macro level, e-mail only worms have become less frequent, but their use in combination with other attacks is getting more sophisticated and will likely continue to appear," Hubbard said. "Automation will be used to deliver new variants even faster than ever, and they will be self-updating and self-modifying; this is part of the overall increase we're seeing in the variety of ways that people are being infected over the Web."
691662
A Valentine&#39;s themed outbreak of the Storm worm has been detected. Malicious e-mails are being received across the globe -- they contain a Web link, which directs users to a Web site where they can supposedly download a Valentine&#39;s card, but in fact are infected with&#160;the Storm bug.&#160;The virus mirrors the fake Christmas and New Year messages seen in previous months.According to Greg Day, security analyst at McAfee, the virus will try to steal personal information from your PC, bring down its security defenses and use your PC to send out millions of junk e-mails.&quot;There are about 10 million PCs worldwide infected with the Storm worm. These threats have suddenly spiked from 0 percent of all spam e-mails to 1.5 percent and they are continuing to rise as we draw closer to Valentine&#39;s Day and more people are fooled into downloading the malicious file,&quot; he commented.&quot;With all the hype that surrounds Valentine&#39;s Day, it was only to be expected that they (the people behind Storm) would use a similar tactic and exploit people&#39;s eagerness to receive Valentine&#39;s cards,&quot; added Diego d&#39;Ambra of e-mail security company&#160;SoftScan.PC Advisor is an InfoWorld affiliate.
658952
If malware were insects, botnets would be termites -- they burrow in behind the walls of your security perimeter, lie dormant for a period of time, then attack.
520488
The Storm Worm botnet network may be shrinking in size, but it managed to send out 15 million annoying audio spam messages in October.
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
30667
Many unhappy returns Thursday marked the first anniversary of the infamous Storm Worm. Created by a Russian-based criminal network, the malware rapidly infected millions of PCs in Europe and North America and continues to be a problem.â¦
237409
Storm, now a large remotely controlled botnet, is getting a graphic profile on a Web site set up to track it.
328333
A new Trojan program is targeting unwitting users' bank data by intercepting account information before it is encrypted and sending it to a central attacker database.
116243
Is your computer part of a bot army, infiltrating systems and spreading spam?
36812
In a twist, security researchers have discovered a group of hackers who are exploiting a new category of victims -- aspiring Internet scammers.A Moroccan group called &quot;Mr. Brain&quot; is offering free phishing kits on a Web site hosted in France, said Paul Mutton, Internet services developer at Netcraft, a security company in Bath, England.The software packages make it easy to quickly set up a fraudulent Web site mimicking a known brand in order to trick people into divulging credit card details or bank account numbers. Templates for spam e-mail are also included, targeting brands such as Bank of America, eBay, PayPal, and HSBC.Mr. Brain&#39;s Web site lists the kits and what kind of details each one is capable of collecting, such as usernames, passwords or Social Security numbers. Netcraft posted screenshots on its Web site.But what the aspiring scammer doesn&#39;t know is that the phishing kits are designed to send any sensitive information that&#39;s collected back to e-mail accounts controlled by Mr. Brain, Mutton said.&quot;Obviously, that&#39;s why they are offering this stuff for free,&quot; Mutton said. &quot;I was impressed by it.&quot;Mr. Brain hides the special e-mail function in a blend of PHP scripts, one of which is encrypted, Mutton said. Just in case someone decrypts it, Mr. Brain has written at the top of the file &quot;Don&#39;t need to change anything here. Created by Mr. Brain Morocco Team.&quot;The scheme seems to be targeted at new phishers, Mutton said. Mr. Brain benefits since other wannabe scammers shoulder the cost and risk of finding an ISP (Internet Service Provider) to host the phishing site, Mutton said.&quot;Essentially, they&#39;re exploiting all these novice phishers -- basically getting them to do all the hard work,&quot; Mutton said.It&#39;s difficult to tell without further research how many of the free phishing kits linked with this latest scam are live on the Internet, but Mutton said Netcraft noticed one earlier this month targeting Bank of America.&quot;Clearly, these are actively being used in phishing attacks,&quot; Mutton said.
273824
Virus writers have grafted a network sniffer into the latest variant of the SDBot worm series. So far there are no reports of SDBot-UH in the wild but the inclusion of selective network sniffing along with
443528
The Storm Worm has infected so many machines that it's now one of the most powerful supercomputers.
206847
A newly identified malicious program not only messes up its victims' computers, it taunts them too.
518928
The criminals behind the Storm botnet waited until the last minute, but they&#39;ve finally started delivering unwanted Christmas presents.Starting Monday, Storm-infected machines began sending out Christmas-themed spam in yet another attempt to trick victims into downloading malicious software. In this case, the site is named Merrychristmasdude.com, and the malware is a variation of the Storm Trojan horse program that has been plaguing systems around the world since January.The e-mails contain titles such as &quot;Find Some Christmas Tail,&quot; &quot;Warm Up this Christmas&quot; and &quot;Mrs. Clause Is Out Tonight!&quot;One message reads &quot;Yo, I am pretty sure this is up your alley, from the things you have told me before. This will be the best 2 min you spend this holiday. hehe.&quot;Once the user clicks on the link to Merrychristmasdude.com, he is taken to a Christmas-themed Web site with photos of scantily clad women and offered a free download. That download is a malicious program, called Email-Worm.Win32.Zhelatin.pd by F-Secure, that connects to a P-to-P (peer-to-peer) network and begins downloading even more malware.Storm&#39;s creators have built up networks of infected PCs -- called botnets -- over the past year by using a combination of sophisticated hacking tricks to avoid detection and by spamming potential victims with clever and timely e-mail messages. The network is called Storm because its original messages offered victims video of the deadly storms that battered Europe a year ago, but has also perfected the tactic of sending out holiday-themed messages.Security experts estimate that the&#160;Storm has infected more than 15 million computers over the past year, although the current size of the network is much smaller than that.This latest variant is being blocked by some antivirus vendors, including Kaspersky, Microsoft and Symantec, according to a technical write-up of the Christmas outbreak.The SANS Internet Storm Center recommends that administrators block Web and e-mail access to the Merrychristmasdude.com domain.
469986
The Bagle worm shifts shape to outsmart antivirus software. Plus: Media player patches and Feds' fraud crackdown.
417532
A Republican Party Web site has been hacked, and for some time it spread a variation of the long-running Storm Trojan horse to vulnerable visitors.