 Fake
e-card spam rises. 07/08/2007 |
Security researchers
are reporting a sharp increase in the number of machines infected by the
Storm Worm, prompting speculation that its authors, who so far have
limited their activities to spam, intend to use it for more destructive
purposes, such as launching massive denial of service attacks.
In June and July
1.7m unique hosts carrying the Storm Worm were counted, compared with just
2,817 from January to May.
Many email users
will be familiar with Storm, whose most recent spam messages bear subjects
such as "You've received a greeting e-card from a worshipper." Once
recipients follow the link and install the malicious code, they become
part of the same network as the original sender and either churn out the
same e-card messages or spam containing PDF files that tout penny stocks.
The spike in the
number of infected machines is leading to speculation that the people
maintaining the Storm network are aspiring to greater things and to create
a virtually unstoppable DDoS network which could be leased out to hackers
so they can launch a massive attack on a large company or entire country.
Little is know about
the people connected with Storm. Individuals have not yet identified
themselves on underground forums where cyber criminals advertise their
products and services as being affiliated with the network.
The Storm Worm got
its name after malware-laced mass emails that first spread in January
promised information about winter storms that ravaged Northern Europe.
Since then, the email topics have changed many times, demonstrating a
strong ability in its authors to trick recipients into clicking through so
they become infected.
Storm Worm combines
this social-engineering savvy with a technical prowess that relies on
peer-to-peer technology for updates rather than a centralized command and
control channel on an internet relay chat network. And therein lies the
secret to Storm's resiliency.
Storm infections can
also be extremely hard to detect and remove because they frequently alter
executables that get loaded during startup, rather than relying on
traditional, and better understood, techniques of modifying the startup
registry. For example, recent variants of the Storm Worm, which also goes
by the name of W32/Newar, "parasitically infect" tcpip.sys files. Newar
authors have seen this tactic used by others and have started to
incorporate it themselves.
Source: The
Register
|
 |
|
|
|
|
CONTACT
US
]
