Feeds

Hackers plot to create massive botnet

It's raining malware

  • alert
  • submit to reddit

3 Big data security analytics techniques

Computer Associates has warned of a co-ordinated malware attack (CMA) described as among the most sophisticated yet unleashed on the net. The attack involves three different Trojans – Glieder, Fantibag and Mitglieder – in a co-ordinated assault designed to establish a huge botnet under the control of hackers. CA reckons that access to the compromised PCs is for sale on a black market, at prices as low as five cents per PC.

CA security researchers reckon the three items of malware have been combined to maximise the potency of the overall assault. The elements of the attack include:

  • Glieder-AK: the "infantry element" of the malware attack infects systems, open up backdoors that exploited by the follow-on Trojans. On 1 June, 2005, eight new Glieder variants appeared in rapid succession and quickly spread. "The apparent objective is to get to as many victims as fast as possible with a lightweight piece of malware," CA said.
  • The Fantibag Trojan further disables the security features of compromised systems. It exploits networking features of target systems to prevent those systems from being able to communicate with anti-virus firms or with Microsoft’s Windows update site, so isolating infected systems.
  • The Mitglieder Trojan opens a backdoor on a compromised system, leaving them under the control of hackers.

"The co-ordination between the Glieders and Fantibag Trojans can have a potentially devastating effect on desktop systems. This phenomenon is indicative of how malware is becoming increasingly sophisticated and more directly linked to criminal endeavours," said Simon Perry, CA's VP of security strategy, EMEA.

MyTob 'dumbs down' virus creation

Confusingly, the Glieders and Fantibag Trojans are both known as Bagle downloader variants by other anti-virus vendors. Altogether it’s been an exceptionally busy week for new computer viruses. As well as the attack described by CA numerous new versions of the MyTob worm have also been produced. These variants typically pose as warnings from sys admins about the misuse of a potential victim's email account with Subject lines such as "*DETECTED* Online User Violation, Your Email Account is Suspended For Security Reasons and Account Alert."

When an infected attachment is launched, MyTob-CM (the most common of this week's variants) attempts to turn off security applications. It also attempts to open a backdoor on infected Windows PC, allowing hackers to exploit compromised systems. Anti-virus firm Sophos reckons the creators of MyTob appear to be a group of virus writers called Hellbot. Carole Theriault, security consultant at Sophos, said similarities in code point to possible links between the authors of MyTob and the long running MyDoom series of worms.

What makes MyTob stand out as a trend is less the number of recorded infections, which are relatively low, than how rapidly it is propagating, according to Trend Micro. The Japanese ant-virus firm has identified 125 new variants spotted in less than three months. "MyTob appears to have been made even easier to implement and vary. This has been a honey pot for lesser skilled programmers - script kiddies - to make their own variants, contributing to the rapid growth rate of MyTob variants in the wild," it said.

One variant, MyTob-AR, seen earlier this week added spyware and adware to infected computers. This malware can be used to track usage including keystrokes and could be used to steal valuable personal information such as passwords, a worrying development in the evolution of the malware family.

It almost goes without saying but all the MyTob variants, along with the Bagle downloaders, infects only Windows PCs. Apple, Linux and those few souls out there still running OS/2 are all immune, as usual. Standard defence precautions against viral attacks apply in defending against the various new Windows worms and Trojans released this week. Windows users need to apply the latest security patches, update anti-virus tools and to resist the temptation to open suspicious-looking emails. Applying a personal firewall wouldn't go amiss either. ®

related stories

Blank virus blanks email
Window of exposure lets viruses run rampant
Trojan attack takes files hostage
Sober worm tops May viral charts

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.