Feeds

Imperfect Storm aids spammers

Anti-spam sites under spam fire

Top 5 reasons to deploy VMware with Tegile

For 24 hours in mid-January, stock-fraud investigation site StockPatrol disappeared from the internet, overwhelmed by a massive flood of web requests coming from thousands of sources.

The attack came after the site wrote a handful of reports investigating and condemning the practice of pump-and-dump stock spam campaigns. No fewer than three botnets targeted StockPatrol, as well as another anti-spam site, and at least five command-and-control servers associated with a different virus, Warezov, according to an analysis released last week.

"StockPatrol.com was the victim of a cyberspace assault that evidently was calculated to disable our site and make our reports inaccessible," read a statement posted on 17 January. "In this instance the attack was massive."

At the heart of the attack was a single program designed specifically to co-opt victims' computers to aid in sending stock-touting email messages and to participate in denial-of-service attacks - Storm Worm. The program appeared on 19 January and compromised systems by luring their users into opening the attachments of messages with subject lines regarding current news events - including violent storms in Europe. Because the program does not propagate on its own, the name adopted from its subject lines is a misnomer - the Storm Worm is actually a Trojan horse.

The program highlights a number of changes in the techniques used by criminal internet groups. The Storm Worm spreads in fairly large, but controlled, bursts of email through previously compromised computers. Each burst typically sends out a custom variant, causing headaches for anti-virus makers. (More on this in part two of this series.)

"The outbreak occurred in smaller waves, much in the same way the Warezov virus appeared," said Paul Wood, senior analyst with MessageLabs. "Each of the waves appears with a dozen different variants of the virus. They don't just carry on and on. They are spammed out, then they wait a bit because the antivirus companies create signatures, and then they spam out a new set of variants."

At one point, the creators of the Storm program sent out a new set of variants daily, forcing anti-virus firms into a running battle to protect their users.

"Every day, it has been a new set of subject lines and new tactics to get people to open these," Allysa Myers, virus research engineer for security software maker McAfee, said in late January. "They have had mass seedings of new variants every day this week."

Highlighting another trend, botnets created with the program use peer-to-peer communication to make shutting down the illicit networks much more difficult. Typically, botnets last no more than a day after their command-and-control server is identified. The peer-to-peer component of the Storm Worm enables its botnets to reconstitute themselves after the central server is taken down.

"In the traditional botnet, if you cut off the head, you kill the beast," said Dean Turner, senior manager of development for security firm Symantec, the owner of SecurityFocus. "We speculate that, as more command-and-control servers get identified by ISPs, you will see more and more of these botnets go to peer-to-peer."

Remote control for virtualized desktops

More from The Register

next story
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Mozilla, EFF, Cisco back free-as-in-FREE-BEER SSL cert authority
Let’s Encrypt to give HTTPS-everywhere a boost in 2015
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
Got an iPhone or iPad? LOOK OUT for MASQUE-D INTRUDERS
UNjailbroken iOS 7, 8 open to evil, says secbiz FireEye
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Simplify SSL certificate management across the enterprise
Simple steps to take control of SSL across the enterprise, and recommendations for a management platform for full visibility and single-point of control for these Certificates.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.