Feeds

Imperfect Storm aids spammers

Anti-spam sites under spam fire

Providing a secure and efficient Helpdesk

For 24 hours in mid-January, stock-fraud investigation site StockPatrol disappeared from the internet, overwhelmed by a massive flood of web requests coming from thousands of sources.

The attack came after the site wrote a handful of reports investigating and condemning the practice of pump-and-dump stock spam campaigns. No fewer than three botnets targeted StockPatrol, as well as another anti-spam site, and at least five command-and-control servers associated with a different virus, Warezov, according to an analysis released last week.

"StockPatrol.com was the victim of a cyberspace assault that evidently was calculated to disable our site and make our reports inaccessible," read a statement posted on 17 January. "In this instance the attack was massive."

At the heart of the attack was a single program designed specifically to co-opt victims' computers to aid in sending stock-touting email messages and to participate in denial-of-service attacks - Storm Worm. The program appeared on 19 January and compromised systems by luring their users into opening the attachments of messages with subject lines regarding current news events - including violent storms in Europe. Because the program does not propagate on its own, the name adopted from its subject lines is a misnomer - the Storm Worm is actually a Trojan horse.

The program highlights a number of changes in the techniques used by criminal internet groups. The Storm Worm spreads in fairly large, but controlled, bursts of email through previously compromised computers. Each burst typically sends out a custom variant, causing headaches for anti-virus makers. (More on this in part two of this series.)

"The outbreak occurred in smaller waves, much in the same way the Warezov virus appeared," said Paul Wood, senior analyst with MessageLabs. "Each of the waves appears with a dozen different variants of the virus. They don't just carry on and on. They are spammed out, then they wait a bit because the antivirus companies create signatures, and then they spam out a new set of variants."

At one point, the creators of the Storm program sent out a new set of variants daily, forcing anti-virus firms into a running battle to protect their users.

"Every day, it has been a new set of subject lines and new tactics to get people to open these," Allysa Myers, virus research engineer for security software maker McAfee, said in late January. "They have had mass seedings of new variants every day this week."

Highlighting another trend, botnets created with the program use peer-to-peer communication to make shutting down the illicit networks much more difficult. Typically, botnets last no more than a day after their command-and-control server is identified. The peer-to-peer component of the Storm Worm enables its botnets to reconstitute themselves after the central server is taken down.

"In the traditional botnet, if you cut off the head, you kill the beast," said Dean Turner, senior manager of development for security firm Symantec, the owner of SecurityFocus. "We speculate that, as more command-and-control servers get identified by ISPs, you will see more and more of these botnets go to peer-to-peer."

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.