Feeds

Imperfect Storm aids spammers

Anti-spam sites under spam fire

SANS - Survey on application security programs

For 24 hours in mid-January, stock-fraud investigation site StockPatrol disappeared from the internet, overwhelmed by a massive flood of web requests coming from thousands of sources.

The attack came after the site wrote a handful of reports investigating and condemning the practice of pump-and-dump stock spam campaigns. No fewer than three botnets targeted StockPatrol, as well as another anti-spam site, and at least five command-and-control servers associated with a different virus, Warezov, according to an analysis released last week.

"StockPatrol.com was the victim of a cyberspace assault that evidently was calculated to disable our site and make our reports inaccessible," read a statement posted on 17 January. "In this instance the attack was massive."

At the heart of the attack was a single program designed specifically to co-opt victims' computers to aid in sending stock-touting email messages and to participate in denial-of-service attacks - Storm Worm. The program appeared on 19 January and compromised systems by luring their users into opening the attachments of messages with subject lines regarding current news events - including violent storms in Europe. Because the program does not propagate on its own, the name adopted from its subject lines is a misnomer - the Storm Worm is actually a Trojan horse.

The program highlights a number of changes in the techniques used by criminal internet groups. The Storm Worm spreads in fairly large, but controlled, bursts of email through previously compromised computers. Each burst typically sends out a custom variant, causing headaches for anti-virus makers. (More on this in part two of this series.)

"The outbreak occurred in smaller waves, much in the same way the Warezov virus appeared," said Paul Wood, senior analyst with MessageLabs. "Each of the waves appears with a dozen different variants of the virus. They don't just carry on and on. They are spammed out, then they wait a bit because the antivirus companies create signatures, and then they spam out a new set of variants."

At one point, the creators of the Storm program sent out a new set of variants daily, forcing anti-virus firms into a running battle to protect their users.

"Every day, it has been a new set of subject lines and new tactics to get people to open these," Allysa Myers, virus research engineer for security software maker McAfee, said in late January. "They have had mass seedings of new variants every day this week."

Highlighting another trend, botnets created with the program use peer-to-peer communication to make shutting down the illicit networks much more difficult. Typically, botnets last no more than a day after their command-and-control server is identified. The peer-to-peer component of the Storm Worm enables its botnets to reconstitute themselves after the central server is taken down.

"In the traditional botnet, if you cut off the head, you kill the beast," said Dean Turner, senior manager of development for security firm Symantec, the owner of SecurityFocus. "We speculate that, as more command-and-control servers get identified by ISPs, you will see more and more of these botnets go to peer-to-peer."

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.