Hackers plot to create massive botnet

[Menydh]

Hackers plot to create massive botnet

The Register
(via SecurityFocus)
June 3, 2005

Computer Associates has warned of a co-ordinated malware attack (CMA) described as among the most sophisticated yet unleashed on the net. The attack involves three different Trojans – Glieder, Fantibag and Mitglieder – in a co-ordinated assault designed to establish a huge botnet under the control of hackers. CA reckons that access to the compromised PCs is for sale on a black market, at prices as low as five cents per PC.

CA security researchers reckon the three items of malware have been combined to maximise the potency of the overall assault. The elements of the attack include:

* Glieder-AK: the "infantry element" of the malware attack infects systems, open up backdoors that exploited by the follow-on Trojans. On 1 June, 2005, eight new Glieder variants appeared in rapid succession and quickly spread. "The apparent objective is to get to as many victims as fast as possible with a lightweight piece of malware," CA said.

* The Fantibag Trojan further disables the security features of compromised systems. It exploits networking features of target systems to prevent those systems from being able to communicate with anti-virus firms or with Microsoft’s Windows update site, so isolating infected systems.

* The Mitglieder Trojan opens a backdoor on a compromised system, leaving them under the control of hackers.

"The co-ordination between the Glieders and Fantibag Trojans can have a potentially devastating effect on desktop systems. This phenomenon is indicative of how malware is becoming increasingly sophisticated and more directly linked to criminal endeavours," said Simon Perry, CA's VP of security strategy, EMEA.

MyTob 'dumbs down' virus creation

Confusingly, the Glieders and Fantibag Trojans are both known as Bagle downloader variants by other anti-virus vendors. Altogether it’s been an exceptionally busy week for new computer viruses. As well as the attack described by CA numerous new versions of the MyTob worm have also been produced. These variants typically pose as warnings from sys admins about the misuse of a potential victim's email account with Subject lines such as "*DETECTED* Online User Violation, Your Email Account is Suspended For Security Reasons and Account Alert."

When an infected attachment is launched, MyTob-CM (the most common of this week's variants) attempts to turn off security applications. It also attempts to open a backdoor on infected Windows PC, allowing hackers to exploit compromised systems. Anti-virus firm Sophos reckons the creators of MyTob appear to be a group of virus writers called Hellbot. Carole Theriault, security consultant at Sophos, said similarities in code point to possible links between the authors of MyTob and the long running MyDoom series of worms.

What makes MyTob stand out as a trend is less the number of recorded infections, which are relatively low, than how rapidly it is propagating, according to Trend Micro. The Japanese ant-virus firm has identified 125 new variants spotted in less than three months. "MyTob appears to have been made even easier to implement and vary. This has been a honey pot for lesser skilled programmers - script kiddies - to make their own variants, contributing to the rapid growth rate of MyTob variants in the wild," it said.

One variant, MyTob-AR, seen earlier this week added spyware and adware to infected computers. This malware can be used to track usage including keystrokes and could be used to steal valuable personal information such as passwords, a worrying development in the evolution of the malware family.

It almost goes without saying but all the MyTob variants, along with the Bagle downloaders, infects only Windows PCs. Apple, Linux and those few souls out there still running OS/2 are all immune, as usual. Standard defence precautions against viral attacks apply in defending against the various new Windows worms and Trojans released this week. Windows users need to apply the latest security patches, update anti-virus tools and to resist the temptation to open suspicious-looking emails. Applying a personal firewall wouldn't go amiss either. ®


[source]