By Kelly Jackson Higgins
April 22, 2009
Researchers have discovered a major botnet operating out of the Ukraine
that has infected 1.9 million machines, including large corporate and
government PCs mainly in the U.S.
The botnet, which appears to be larger than the infamous Storm botnet
was in its heyday, has infected machines from some 77 government-owned
domains -- 51 of which are U.S. government ones, according to Ophir
Shalitin, marketing director of Finjan, which recently found the botnet.
Shalitin says the botnet is controlled by six individuals and is hosted
Aside from its massive size and scope, what is also striking about the
botnet is what its malware can do to an infected machine. The malware
lets an attacker read the victim's email, communicate via HTTP in the
botnet, inject code into other processes, visit Websites without the
user knowing, and register as a background service on the infected
machine, for instance. The bots communicate with their command and
control systems via HTTP.
Botnet expert Joe Stewart says it appears to be similar to other
downloader-type botnets. "It looks a lot like other downloader bots out
there," says Stewart, director of malware research for SecureWorks. "It
has a system for installing other malware and getting paid for it. The
first stage is to get the bot piece onto the machine, and then they get
paid to install other malware."
LayerOne 2009, Information Security for the discerning professional.
May 23-24 2009 @ The Anaheim Marriott in Anaheim, California
Visit http://layerone.info for more information