Storm e-card malware keeps on coming
No end to flood of fake friendly greetings.
A further wave of e-cards carrying links to 'Storm' malware (various labelled Nuwar, Peacomm, Dorf, Zhelatin) has
been hitting inboxes around the world all this week, with no signs of any letup in the deluge.
The latest barrage carry a simple message, using spoofed source addresses and claiming to originate from a friend,
colleague or family member. The plain text mails carry a link to a 'greeting' left at a site whose name is selected
from a long list of likely titles for such greetings systems, usually also including copyright information matching
the selected site title. Following the link leads to one of the same botnet of compromised systems which have been
spamming out the mails, hosting a site using exploits to attempt a drive-by download or, if visited by systems
lacking the required vulnerabilities, simply presenting a link to download the executable.
The trojans are regularly repacked at the server side to minimise detection by anti-malware products, with tens of
thousands of unique variants being spotted by analysis labs. Malware watchers have speculated that as many as
250,000 zombie systems may be hosting the attack sites, making blocking the source domains a similarly enormous
task, while spam counters at Sophos have
reported seeing 9 million
greetings card spams in a 48-hour period.
On the McAfee Avert Labs blog this week, Dmitri Gryaznov details his home-brewed system for keeping up with
the constant changes in source and content,
here, while Alyssa
Myers speculates about the impact of the series of spam campaigns on the genuine greetings card industry,
here.
Some more details of the latest techniques are at F-Secure,
here.
The potential of the 'Storm' botnet for launching
major DDoS attacks has also resurfaced. A group of security admins in the world
of academia, thought to be at particular risk at this time of year as large numbers of new students take up new
accounts on university networks, has been warned of a risk of attacks from the Storm cloud, after probing infected
machines for related vulnerabilities was seen to bring on attacks on the scanning system. The warning, issued
by the REN-ISAC collaborative research group, is
here.
17 August 2007
Tags:
ddos, exploit, malware, spam, storm, trojan, vulnerability.
del.icio.us 
digg this
