Botnets

[impar]

Greetings!

***- According to Sergeant, there are about two million computers in the botnet sending spam e-mail "on any given day." Worse yet, he estimates that the botnet is only operating at 10% of its capacity, and he suspects it could count as many as 50 million compromised PCs. He adds, "If you calculate pure theoretical throughput, then I'm sure the botnet has more capacity than IBM's BlueGene."


***- Botnet attack targeting eBay and its users, compromising accounts
...
The latest attack is targeting eBay members and stealing their online identities using multi-stage attacks in order to perpetuate fraud. It was first identified by researcher Ofer Elzam, who works for the firm Aladdin Knowledge Systems, Ltd. Ars had a chance to talk to Mr. Elzam recently, and he explained how the fraudsters, which he believes may have started as early as mid-August, did their dastardly work.

[impar]

Greetings!

Spammers launch denial of service attacks against antispam sites

Antispam community sites that help combat phishing scams and spam are being targeted with denial of service attacks by malware botnets presumably operated by spammers. The trend was reported last week by antispam site SpamNation.

[impar]

Greetings!

Storm worm going out with a bang, mounts DDoS attacks against researchers

When we last wrote about the Storm Worm in September, Heise Security had noted that the growing botnet had not yet been used for much, but could be a threat in the future. "[A]lthough the network has so far been primarily used to send spam, it could also be used for DDoS attacks on businesses or even countries," said Heise. Since then, Heise's prediction has come true; the worm now attacks those who publish new information on the inner workings of the worm. Researchers are allegedly "running scared" from the worm, which seemingly has a sentient ability to detect and attack whoever threatens it.

Movie material?

[Blakhart]

Yeah, I can see Keanu Reeves in the staring role.

[powerarmour]

[impar]

Greetings!

Storm Worm delivering coal this Christmas

The Storm Worm debuted early in 2007, and has been causing headaches for consumers, IT managers, and ISPs ever since. More recently, the total number of infected systems has been waning, partly thanks to an updated version of Microsoft's Malicious Software Removal Tool. Other antivirus updates and general consumer awareness have cut Storm's total botnet to a fraction of what it was. Someone—presumably the worm's authors—has taken exception to that fact, and unleashed a fresh wave of Storm attacks aimed at capitalizing on the Christmas season.

[impar]

Greetings!

Six botnets churning out 85 percent of all spam

[impar]

Greetings!

Florida botnet herder sheared by cops, faces 10 years in pen

Most 21-year-olds in the US are either off at college enjoying their newfound freedom to drink themselves into a stupor, or already throwing themselves into the workforce (possibly also drinking themselves into a stupor). But 21-year-old Robert Matthew Bentley instead faces jail time and up to $250,000 in fines after pleading guilty for installing adware on "hundreds of computers" across Europe.

[impar]

Greetings!

There's a new botnet worm on the loose
...
Kraken hides by using a combination of ploys, including changing its binary code regularly and morphing itself so that it evades static pattern matching.

Paul Royal, principal researcher at Dambala said, "It's easy to trace but slow to get antivirus coverage. [That] seems to imply [the authors] have a good understanding of how AV tools operate and how to evade them."

The Kraken vector is encrypted and appears to the user as an image file. When the user attempts to view the image, the malware decrypts itself and infects the machine. Like Storm, the Kraken botnet is redundant, adaptive and resiliant.

So far Kraken is mostly being employed for the usual spamming schemes. Its bots are busy demons, each spewing out up to 500,000 spam emails per day.

[impar]

Greetings!

New Kraken worm evading harpoons of antivirus programs

Researchers at Damballa Solutions have uncovered evidence of a powerful new botnet they've nicknamed Kracken. The company estimates that Kraken has infected 400,000 systems, which would make it twice the size of Storm during that botnet's hayday. (The final size of Storm's botnet is disputed; Damballa estimates Storm infected up to 200,000 machines).