Feeds

Warezov botnet rises from the grave

Undead spam

Choosing a cloud hosting partner with confidence

After laying low for the better part of a year, the Warezov botnet is back - with some new tricks up its sleeve.

In the past week, trojan horse programs that install the Warezov bot have been spotted on websites offering free MP3 downloads, according to Joe Stewart, director of malware research at security provider SecureWorks. The attacks are a big change for Warezov, which burst on the scene in 2006 with malware attacks spread in email attachments. The new methodology is an acknowledgment of the futility of email attacks given the difficulty of sneaking malicious payloads past today's email filters.

Stewart says Warezov is more of a payload delivery system than an actual bot. It is in essence a backdoor that installs any software its operator wants. In recent times, the payload of choice is a fast-flux hosting platform that turns compromised PCs into servers that host spoof sites used in phishing campaigns. Fast-flux networks are much harder to shut down because there's no central channel to defeat. If a single node hosting, say, a fraudulent Bank of America website is taken down, there are still thousands of other infected machines ready to take its place.

In the case of Warezov, the malware installs two separate components: a reverse HTTP proxy that serves content from an obscured master server and a DNS server that has been modified from ISC BIND. The DNS server acts as a slave that gets zone updates from the master.

The sudden burst of activity from Warezov comes after more than nine months inactivity that began about the time that prolific spammer Alan Ralsky was indicted in a 41-page federal indictment. It's unclear if Ralsky had ties to Warezov or not.

Then last week, Warezov suddenly came out of hibernation. Oddly enough, Stewart says, it was using Microsoft's Hotmail service. Each bot was given a list of usernames and passwords, and each username sent only a few emails in order to bypass restrictions on the number of emails that a single account holder can send in a set period of time. Warezov isn't the only piece of malware using webmail to send spam. Malware known alternately as Wopla or Hotlan does the same thing.

Over the past few months, anti-spam forces have scored several decisive victories in their attempt to shut down prolific senders of unsolicited junk mail. In addition to Ralsky's indictment, Robert Alan Soloway was sentenced to 47 months in prison, and researchers have declared the once-potent Storm botnet all but dead. Finally, on Tuesday, US law enforcement said they shut down one of the biggest spam gangs ever.

Warezov's second coming suggests that there will always be networks ready to step in and fill the void. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.