Feeds

Hackers plot to create massive botnet

It's raining malware

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Computer Associates has warned of a co-ordinated malware attack (CMA) described as among the most sophisticated yet unleashed on the net. The attack involves three different Trojans – Glieder, Fantibag and Mitglieder – in a co-ordinated assault designed to establish a huge botnet under the control of hackers. CA reckons that access to the compromised PCs is for sale on a black market, at prices as low as five cents per PC.

CA security researchers reckon the three items of malware have been combined to maximise the potency of the overall assault. The elements of the attack include:

  • Glieder-AK: the "infantry element" of the malware attack infects systems, open up backdoors that exploited by the follow-on Trojans. On 1 June, 2005, eight new Glieder variants appeared in rapid succession and quickly spread. "The apparent objective is to get to as many victims as fast as possible with a lightweight piece of malware," CA said.
  • The Fantibag Trojan further disables the security features of compromised systems. It exploits networking features of target systems to prevent those systems from being able to communicate with anti-virus firms or with Microsoft’s Windows update site, so isolating infected systems.
  • The Mitglieder Trojan opens a backdoor on a compromised system, leaving them under the control of hackers.

"The co-ordination between the Glieders and Fantibag Trojans can have a potentially devastating effect on desktop systems. This phenomenon is indicative of how malware is becoming increasingly sophisticated and more directly linked to criminal endeavours," said Simon Perry, CA's VP of security strategy, EMEA.

MyTob 'dumbs down' virus creation

Confusingly, the Glieders and Fantibag Trojans are both known as Bagle downloader variants by other anti-virus vendors. Altogether it’s been an exceptionally busy week for new computer viruses. As well as the attack described by CA numerous new versions of the MyTob worm have also been produced. These variants typically pose as warnings from sys admins about the misuse of a potential victim's email account with Subject lines such as "*DETECTED* Online User Violation, Your Email Account is Suspended For Security Reasons and Account Alert."

When an infected attachment is launched, MyTob-CM (the most common of this week's variants) attempts to turn off security applications. It also attempts to open a backdoor on infected Windows PC, allowing hackers to exploit compromised systems. Anti-virus firm Sophos reckons the creators of MyTob appear to be a group of virus writers called Hellbot. Carole Theriault, security consultant at Sophos, said similarities in code point to possible links between the authors of MyTob and the long running MyDoom series of worms.

What makes MyTob stand out as a trend is less the number of recorded infections, which are relatively low, than how rapidly it is propagating, according to Trend Micro. The Japanese ant-virus firm has identified 125 new variants spotted in less than three months. "MyTob appears to have been made even easier to implement and vary. This has been a honey pot for lesser skilled programmers - script kiddies - to make their own variants, contributing to the rapid growth rate of MyTob variants in the wild," it said.

One variant, MyTob-AR, seen earlier this week added spyware and adware to infected computers. This malware can be used to track usage including keystrokes and could be used to steal valuable personal information such as passwords, a worrying development in the evolution of the malware family.

It almost goes without saying but all the MyTob variants, along with the Bagle downloaders, infects only Windows PCs. Apple, Linux and those few souls out there still running OS/2 are all immune, as usual. Standard defence precautions against viral attacks apply in defending against the various new Windows worms and Trojans released this week. Windows users need to apply the latest security patches, update anti-virus tools and to resist the temptation to open suspicious-looking emails. Applying a personal firewall wouldn't go amiss either. ®

related stories

Blank virus blanks email
Window of exposure lets viruses run rampant
Trojan attack takes files hostage
Sober worm tops May viral charts

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Seattle children’s accelerates Citrix login times by 500% with cross-tier insight
Seattle Children’s is a leading research hospital with a large and growing Citrix XenDesktop deployment. See how they used ExtraHop to accelerate launch times.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.