New botnet resurrects Storm's Valentine's Day ruse
It's the third year running that malware has duped users with spam love
Computerworld - Spam trumpeting the power of love is nothing more than an old trick dressed up in new clothes, more evidence that the backers of the Waledec bot Trojan are the same bunch that hammered users last year with Storm, security companies are warning.
Multiple security vendors, including MX Logic Inc., Trend Micro Inc. and Panda Security, have issued alerts about new Valentine-themed spam campaigns that try to dupe users into installing the Waledec bot.
Subject lines for the spam, said Sam Masiello, vice president of information security at MX Logic, are "short and sweet," and include "Me and You," "In Your Arms" and "With all my love." Users who browse to the link embedded in the spam reach a site with a dozen hearts, any one of which will download an executable file when clicked.
Masiello first noted the campaign last Thursday, but other researchers, including those at Trend Micro and Panda, picked up on the trend yesterday. Both Masiello and Florabel Baetiong, an anti-spam research engineer at Trend Micro, noted the similarity between the recent infection attempt and Valentine's Day scams launched last year by hackers controlling Storm, another bot Trojan that has since fallen into disuse, possibly because the crew responsible surrendered to heavy pressure by security experts.
"Clearly the old Storm folks are working as hard as they can to build up their new botnet and are following the old tried-and-true methods of centering their social engineering tactics around holiday themes," said Masiello in a post to the MX Logic blog.
"But it still impresses me that tactics like this continue to work and be so effective, despite how many times it gets recycled," Masiello said in an interview today.
Storm used Valentine's Day spam in both 2007 and 2008 to hijack PCs.
Most researchers have come around to the idea that Waledec is, in fact, the new Storm. Joe Stewart, an expert on botnets -- Storm, in particular -- was confident that the group that backed Storm essentially rewrote its code to come up with Waledec. "If it's not the same people, they would have had to study Storm intensively to match the functionality," Stewart said in an interview recently. "It's so similar that it's unlikely to be a different group."
Waledec has been busy of late. The malware first began infecting systems just before Christmas, when it used phony holiday greetings and e-cards as bait, another 2008 Storm tactic. Last week, it surfaced again, this time hitchhiking on a spam run that claimed then President-elect Barack Obama would not take the oath of office on Jan. 20.
Although the Waledec botnet remains relatively small -- Stewart put it at just 10,000 machines -- it's growing at "an alarming rate," according to e-mail security company MessageLabs Ltd. In a report on botnets that it released on Monday (download PDF), MessageLabs speculated that the botnet owners are "focusing on growing and developing this new botnet, rather than sending spam through it at this stage."
Masiello said that messages designed to plant Waledec were running at a volume of about 4,000-5,000 per hour, down from approximately 12,000 per hour last Friday, and had been holding steady for the last 48 hours. "I'd agree with MessageLabs," said Masiello today. "It does look like they are in the process of building up the botnet." MX Logic has not seen any evidence that the Waledec botnet is, in turn, sending spam of its own.
Several botnets that were heavily disrupted by the takedown of California-based hosting company McColo Corp. are in the same condition, Masiello added. After suffering losses when McColo -- which had hosted command-and-control servers for several botnets, including one dubbed "Srizbi" and another called "Rustock" -- was yanked off the Internet, they have spent the last several months adding new PCs to their collection.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts