Feeds

Imperfect Storm aids spammers

Anti-spam sites under spam fire

Intelligent flash storage arrays

For 24 hours in mid-January, stock-fraud investigation site StockPatrol disappeared from the internet, overwhelmed by a massive flood of web requests coming from thousands of sources.

The attack came after the site wrote a handful of reports investigating and condemning the practice of pump-and-dump stock spam campaigns. No fewer than three botnets targeted StockPatrol, as well as another anti-spam site, and at least five command-and-control servers associated with a different virus, Warezov, according to an analysis released last week.

"StockPatrol.com was the victim of a cyberspace assault that evidently was calculated to disable our site and make our reports inaccessible," read a statement posted on 17 January. "In this instance the attack was massive."

At the heart of the attack was a single program designed specifically to co-opt victims' computers to aid in sending stock-touting email messages and to participate in denial-of-service attacks - Storm Worm. The program appeared on 19 January and compromised systems by luring their users into opening the attachments of messages with subject lines regarding current news events - including violent storms in Europe. Because the program does not propagate on its own, the name adopted from its subject lines is a misnomer - the Storm Worm is actually a Trojan horse.

The program highlights a number of changes in the techniques used by criminal internet groups. The Storm Worm spreads in fairly large, but controlled, bursts of email through previously compromised computers. Each burst typically sends out a custom variant, causing headaches for anti-virus makers. (More on this in part two of this series.)

"The outbreak occurred in smaller waves, much in the same way the Warezov virus appeared," said Paul Wood, senior analyst with MessageLabs. "Each of the waves appears with a dozen different variants of the virus. They don't just carry on and on. They are spammed out, then they wait a bit because the antivirus companies create signatures, and then they spam out a new set of variants."

At one point, the creators of the Storm program sent out a new set of variants daily, forcing anti-virus firms into a running battle to protect their users.

"Every day, it has been a new set of subject lines and new tactics to get people to open these," Allysa Myers, virus research engineer for security software maker McAfee, said in late January. "They have had mass seedings of new variants every day this week."

Highlighting another trend, botnets created with the program use peer-to-peer communication to make shutting down the illicit networks much more difficult. Typically, botnets last no more than a day after their command-and-control server is identified. The peer-to-peer component of the Storm Worm enables its botnets to reconstitute themselves after the central server is taken down.

"In the traditional botnet, if you cut off the head, you kill the beast," said Dean Turner, senior manager of development for security firm Symantec, the owner of SecurityFocus. "We speculate that, as more command-and-control servers get identified by ISPs, you will see more and more of these botnets go to peer-to-peer."

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.