August 30, 2005 (Computerworld) --
The expanding investigation into this month's Zotob worm outbreak is uncovering evidence of the growing nexus between worm writers and gangs looking to profit from cybercrime, according to security experts. The FBI today confirmed that Turkish law enforcement officials are investigating 16 more suspects in connection with the Zotob worm and its variants. This follows last Thursday's arrests of Farid Essebar, an 18-year-old Moroccan believed to have been responsible for writing the Zotob and Mytob worms, and Atilla Ekici, a 21-year-old man from Turkey who apparently financed the effort (see "Moroccan, Turk arrested over worm outbreak"). According to an FBI spokesman, the 16 individuals now being investigated are not believed to have any direct links to the actual creation and dissemination of the worms that hit several large organizations two weeks ago. Rather, "it looks more like they are associated with a credit card theft ring" possibly linked to the worms, he said. The news is further evidence of the growing alliance between hackers and those seeking to profit from cybercrime, said Graham Cluley, a senior technology consultant at antivirus firm Sophos PLC. "It is certainly something that we thought has been happening for some time," Cluley said. "What you are likely to see here over the next few days is the unravelling of an entire identity fraud gang." According to Cluley, Sophos researchers have discovered that at least 20 other worms and viruses -- including multiple versions of Zotob and Mytob and a version of last year's prolific Mydoom worm -- were created by Essebar. All of these worms and viruses include the Diabl0 handle that Essebar used as a code name, he said. Malware such as Zotob and Mytob are used by hackers to download so-called bot programs that allow remote servers to take control of compromised systems and steal information from them. The communication between an infected system and remote server is often done using the Internet Relay Chat (IRC) messaging protocol. Mytob variants created by Diabl0 communicated with a server apparently owned by a group called the 0x90-team whose Web site discussed hacker exploits and credit card fraud, said Ken Dunham, a senior engineer at VeriSign iDefense Intelligence in Reston, Va. The site, which is registered to an individual in Paris, runs several online forums on how to make money by selling, buying and trading such information, he said. Diabl0 had his own private directory on the Web server hosting the site, which he used to download the various variants of Mytob and other worms that he created, Dunham said. According to one source who asked not to be named, the server belonging to the 0x90-team
Moving to Windows Vista: The Promise, The Reality View this exclusive webcast today! Go to the webcast
Managing Mobile Data with Endpoint Security for Laptops
Download this white paper now, compliments of Computerworld and Absolute Software. (Source: Absolute Software) A NetworkWorld survey of IT professionals found that only 1 in 100 employees consistently follow data security policy. This paper outlines endpoint security for laptops that restricts data access beyond encryption to safeguard against insider threats and user error.Read this whitepaper to learn lessons from recent data breaches, limitations of traditional data security, and how to remotely wipe out data and monitor computers that go off the network. Download this executive briefing
Record Capacity for Microsoft® Exchange 2007 With VMware and IBM System x3850 M2
Download this white paper today! (Source: VMware) The more that e-mail becomes an entrenched IT infrastructure application, the more that messaging administrators face numerous--sometimes conflicting--demands in the categories of availability, flexibility and cost. Employing a virtual solution can help avoid expensive over-provisioning of server computing resources, while improving management and disaster recovery. And ultimately, it can more than double the number of supportable Exchange 2007 users, as compared to a non-virtualized environment. This whitepaper explains how to break down the scalability barrier and respond faster to your mail system needs. Download this white paper
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
XenServer FREE trial
Citrix XenServer is the simplest and most effective way to virtualize and provision servers. XenServer combines comprehensive server virtualization capabilities with unparalleled scalability, performance, economics, and ease-of-use. Based on the open source Xen hypervisor, XenServer delivers fast performance, easy management, and advanced features such as live migration.
See your link here
Subscribe to
Computerworld 
or
Other Spam, Malware and Vulnerabilities Stories
Moving to Windows Vista: The Promise, The Reality
Download this white paper now, compliments of Computerworld and Absolute Software. 
Download this white paper today!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
Computerworld