Text 14095, 76 rader
Skriven 2006-11-18 16:06:40 av mike (1:379/45)
Ärende: 'Pump-and-Dump' Spam Surge Linked to Russian Bot Herders
================================================================
From: mike <mike@barkto.com>


http://www.eweek.com/article2/0,1895,2060235,00.asp

===
The recent surge in e-mail spam hawking penny stocks and penis enlargement
pills is the handiwork of Russian hackers running a botnet powered by tens of
thousands of hijacked computers.

Internet security researchers and law enforcement authorities have traced the
operation to a well-organized hacking gang controlling a 70,000-strong
peer-to-peer botnet seeded with the SpamThru Trojan.

According to Joe Stewart, senior security researcher at SecureWorks, in
Atlanta, the gang functions with a level of sophistication rarely seen in the
hacking underworld.

For starters, the Trojan comes with its own anti-virus scanner—a pirated copy
of Kaspersky's security software—that removes competing malware files from the
hijacked machine. Once a Windows machine is infected, it becomes a peer in a
peer-to-peer botnet controlled by a central server. If the control server is
disabled by botnet hunters, the spammer simply has to control a single peer to
retain control of all the bots and send instructions on the location of a new
control server.


The bots are segmented into different server ports, determined by the variant
of the Trojan installed, and further segmented into peer groups of no more than
512 bots. This allows the hackers to keep the overhead involved in exchanging
information about other peers to a minimum, Stewart explained.

Click here to read more about a malicious Trojan that comes with its own
anti-virus scanner.

Stewart, a reverse engineering expert with expertise in deconstructing malware
samples, gained access to files from a SpamThru control server and found
evidence that the attackers are meticulous about keeping statistics on bot
infections around the world.

For example, the SpamThru controller keeps statistics on the country of origin
of all bots in the botnet. In all, computers in 166 countries are part of the
botnet, with the United States accounting for more than half of the infections.

The botnet stats tracker even logs the version of Windows the infected client
is running, down to the service pack level. One chart commandeered by Stewart
showed that Windows XP SP2 (Service Pack 2) machines dominate the makeup of the
botnet, a clear sign that the latest version of Microsoft's operating system is
falling prey to attacks.

Another sign of the complexity of the operation, Stewart found, was a database
hacking component that signaled the ability of the spammers to target its
pump-and-dump scams to victims most likely to be associated with stock trading.

Click here to read more about the industry's struggles to cope with the botnet
scourge.

Stewart said about 20 small investment and financial news sites have been
breached for the express purpose of downloading user databases with e-mail
addresses matched to names and other site registration data. On the bot
herder's control server, Stewart found a MySQL database dump of e-mail
addresses associated with an online shop.

"They're breaking into sites that are somewhat related to the stock market and
stealing e-mail address from those databases. The thinking is, if they get an
e-mail address for someone reading stock market and investment news, that's a
perfect target for these penny stock scams," Stewart said in an interview with
eWEEK.

Next Page: Evading spam filters....
===

 /m

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)