Language Selection

English French German Italian Portuguese Spanish

Triple-Barreled Trojan Attack Builds Botnets

Filed under
Security

Anti-virus researchers are sounding the alert for a massive, well-coordinated hacker attack using three different Trojans to hijack PCs and create botnets-for-hire.

The three-pronged attack is being described as "unprecedented" because of the way the Trojans communicate with each other to infect a machine, disable anti-virus software and leave a back door open for future malicious use.

"This is so slick, it's scary," said Roger Thompson, director of malicious content research at Computer Associates International Inc. "It clearly points to a very well-organized group either replenishing existing botnets or creating new ones."

According to Thompson, the wave of attacks start with Win32.Glieder.AK, dubbed Glieder, a Trojan that downloads and executes arbitrary files from a long, hardcoded list of URLs.

Glieder's job is to sneak past anti-virus protection before definition signatures could be created and "seed" the infected machine for future use. At least eight variants of Glieder were unleashed on one day, wreaking havoc across the Internet.

On Windows 2000 and Windows XP machines, Glieder.AK attempts to stop and disable the Internet Connection Firewall and the Security Center service, which was introduced with Windows XP Service Pack 2.

The Trojan then quickly attempts to connect to a list of URLs to download Win32.Fantibag.A (Fantibag) to spawn the second wave of attacks.

With Fantibag on the compromised machine, Thompson said the attackers can ensure that anti-virus and other protection software is shut off. Fantibag exploits networking features to block the infected machine from communicating with anti-virus vendors. The Trojan even blocks access to Microsoft's Windows Update, meaning that victims cannot get help.

Once the shields are down, a third Trojan called Win32.Mitglieder.CT, or Mitglieder, puts the hijacked machine under the complete control of the attacker.

Once the three Trojans are installed, the infected computer becomes part of a botnet and can be used in spam runs, distributed denial-of-service attacks or to log keystrokes and steal sensitive personal information.

A botnet is a collection of compromised machines controlled remotely via IRC (Inter Relay Chat) channels.

According to CA's Thompson, the success of the three-pronged attack could signal the end of signature-based virus protection if Trojans immediately disable all means of protection.

"These guys have worked out that they bypass past signature scanners if they tweak their code and then release it quickly. The idea is to hit hard and spread fast, disarm victims and then exploit them," Thompson said in an interview with Ziff Davis Internet News.

He said he thinks the attack, which used virus code from the Bagle family, is the work of a very small group of organized criminals. "There's no doubt in my mind we are dealing with organized crime. The target is to build a botnet or to add to existing ones. Once the botnets reach a certain mass, they are rented out for malicious use."

Full Story.

More in Tux Machines

Linux Mint 18.1 Is The Best Mint Yet

The hardcore Linux geeks won’t read this article. They’ll skip right past it… They don’t like Linux Mint much. There’s a good reason for them not to; it’s not designed for them. Linux Mint is for folks who want a stable, elegant desktop operating system that they don’t want to have to constantly tinker with. Anyone who is into Linux will find Mint rather boring because it can get as close to the bleeding edge of computer technology. That said, most of those same hardcore geeks will privately tell you that they’ve put Linux Mint on their Mom’s computer and she just loves it. Linux Mint is great for Mom. It’s stable, offers everything she needs and its familiar UI is easy for Windows refugees to figure out. If you think of Arch Linux as a finicky, high-performance sports car then Linux Mint is a reliable station wagon. The kind of car your Mom would drive. Well, I have always liked station wagons myself and if you’ve read this far then I guess you do, too. A ride in a nice station wagon, loaded with creature comforts, cold blowing AC, and a good sound system can be very relaxing, indeed. Read more

Make Gnome 3 more accessible for everyday use

Gnome 3 is a desktop environment that was created to fix a problem that did not exist. Much like PulseAudio, Wayland and Systemd, it's there to give developers a job, while offering no clear benefit over the original problem. The Gnome 2 desktop was fast, lithe, simple, and elegant, and its replacement is none of that. Maybe the presentation layer is a little less busy and you can search a bit more quickly, but that's about as far as the list of advantages goes, which is a pretty grim result for five years of coding. Despite my reservation toward Gnome 3, I still find it to be a little bit more suitable for general consumption than in the past. Some of the silly early decisions have been largely reverted, and a wee bit more sane functionality added. Not enough. Which is why I'd like to take a moment or three to discuss some extra tweaks and changes you should add to this desktop environment to make it palatable. Read more

When to Use Which Debian Linux Repository

Nothing distinguishes the Debian Linux distribution so much as its system of package repositories. Originally organized into Stable, Testing, and Unstable, additional repositories have been added over the years, until today it takes more than a knowledge of a repository's name to understand how to use it efficiently and safely. Debian repositories are installed with a section called main that consists only of free software. However, by editing the file /etc/apt/sources.list, you can add contrib, which contains software that depends on proprietary software, and non-free, which contains proprietary software. Unless you choose to use only free software, contrib and non-free are especially useful for video and wireless drivers. You should also know that the three main repositories are named for characters from the Toy Story movies. Unstable is always called Sid, while the names of Testing and Stable change. When a new version of Debian is released, Testing becomes Stable, and the new version of Testing receives a name. These names are sometimes necessary for enabling a mirror site, but otherwise, ignoring these names gives you one less thing to remember. Read more

Today in Techrights