Feeds

Warezov botnet rises from the grave

Undead spam

Boost IT visibility and business value

After laying low for the better part of a year, the Warezov botnet is back - with some new tricks up its sleeve.

In the past week, trojan horse programs that install the Warezov bot have been spotted on websites offering free MP3 downloads, according to Joe Stewart, director of malware research at security provider SecureWorks. The attacks are a big change for Warezov, which burst on the scene in 2006 with malware attacks spread in email attachments. The new methodology is an acknowledgment of the futility of email attacks given the difficulty of sneaking malicious payloads past today's email filters.

Stewart says Warezov is more of a payload delivery system than an actual bot. It is in essence a backdoor that installs any software its operator wants. In recent times, the payload of choice is a fast-flux hosting platform that turns compromised PCs into servers that host spoof sites used in phishing campaigns. Fast-flux networks are much harder to shut down because there's no central channel to defeat. If a single node hosting, say, a fraudulent Bank of America website is taken down, there are still thousands of other infected machines ready to take its place.

In the case of Warezov, the malware installs two separate components: a reverse HTTP proxy that serves content from an obscured master server and a DNS server that has been modified from ISC BIND. The DNS server acts as a slave that gets zone updates from the master.

The sudden burst of activity from Warezov comes after more than nine months inactivity that began about the time that prolific spammer Alan Ralsky was indicted in a 41-page federal indictment. It's unclear if Ralsky had ties to Warezov or not.

Then last week, Warezov suddenly came out of hibernation. Oddly enough, Stewart says, it was using Microsoft's Hotmail service. Each bot was given a list of usernames and passwords, and each username sent only a few emails in order to bypass restrictions on the number of emails that a single account holder can send in a set period of time. Warezov isn't the only piece of malware using webmail to send spam. Malware known alternately as Wopla or Hotlan does the same thing.

Over the past few months, anti-spam forces have scored several decisive victories in their attempt to shut down prolific senders of unsolicited junk mail. In addition to Ralsky's indictment, Robert Alan Soloway was sentenced to 47 months in prison, and researchers have declared the once-potent Storm botnet all but dead. Finally, on Tuesday, US law enforcement said they shut down one of the biggest spam gangs ever.

Warezov's second coming suggests that there will always be networks ready to step in and fill the void. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?