Anti-spam sites under spam fire
For 24 hours in mid-January, stock-fraud investigation site StockPatrol disappeared from the internet, overwhelmed by a massive flood of web requests coming from thousands of sources.
The attack came after the site wrote a handful of reports investigating and condemning the practice of pump-and-dump stock spam campaigns. No fewer than three botnets targeted StockPatrol, as well as another anti-spam site, and at least five command-and-control servers associated with a different virus, Warezov, according to an analysis released last week.
"StockPatrol.com was the victim of a cyberspace assault that evidently was calculated to disable our site and make our reports inaccessible," read
a statement posted on 17 January. "In this instance the attack was massive."
At the heart of the attack was a single program designed specifically to co-opt victims' computers to aid in sending stock-touting email messages and to participate in denial-of-service attacks - Storm Worm. The program appeared on 19 January and compromised systems by luring their users into opening the attachments of messages with subject lines regarding current news events - including violent storms in Europe. Because the program does not propagate on its own, the name adopted from its subject lines is a misnomer - the Storm Worm is actually a Trojan horse.
The program highlights a number of changes in the techniques used by criminal internet groups. The Storm Worm spreads in fairly large, but controlled, bursts of email through previously compromised computers. Each burst typically sends out a custom variant, causing headaches for anti-virus makers. (More on this in part two of this series.)
"The outbreak occurred in smaller waves, much in the same way the Warezov virus appeared," said Paul Wood, senior analyst with MessageLabs. "Each of the waves appears with a dozen different variants of the virus. They don't just carry on and on. They are spammed out, then they wait a bit because the antivirus companies create signatures, and then they spam out a new set of variants."
At one point, the creators of the Storm program sent out a new set of variants daily, forcing anti-virus firms into a running battle to protect their users.
"Every day, it has been a new set of subject lines and new tactics to get people to open these," Allysa Myers, virus research engineer for security software maker McAfee, said in late January. "They have had mass seedings of new variants every day this week."
Highlighting another trend, botnets created with the program use peer-to-peer communication to make shutting down the illicit networks much more difficult. Typically, botnets last
no more than a day after their command-and-control server is identified. The peer-to-peer component of the Storm Worm enables its botnets to reconstitute themselves after the central server is taken down.
"In the traditional botnet, if you cut off the head, you kill the beast," said Dean Turner, senior manager of development for security firm Symantec, the owner of SecurityFocus. "We speculate that, as more command-and-control servers get identified by ISPs, you will see more and more of these botnets go to peer-to-peer.
1/2
Threaded Mode
