American and German researchers who infiltrated and crippled one of the world’s biggest spam-producing networks last summer have released a formal paper on the experience, and the numbers are staggering.
The Pushdo/Cutwail “botnet” sent out 1.7 trillion e-mails over 15 months (about 113 billion per month), had 100,000 enslaved “bots” around the world and had about 30 command-and-control servers in
Europe, North America and Russia.
Its Russian cybercriminal operators bought and sold e-mail addresses by the million and compromised PCs by the thousand, with lower prices for less-desirable countries and volume purchases.
[Read the original research paper here (PDF).]
"The interesting things were just the amount of spam that they were sending and how they operate like a professional business, with detailed statistics and error reporting,” Brett Stone-Gross, one of the researchers and a doctoral candidate at the University of California, Santa Barbara, told Kaspersky Lab’s ThreatPost blog. “This is a real business."
The 16 Pushdo/Cutwail servers that the researchers were able to access contained 2.35 terabytes of data, 24 databases full of details about operations and billions of target e-mail addresses.
The researchers estimate that the botnet’s operators have earned between $1.7 million and $4.2 million since June 2009.
Even one sub-botnet — Pushdo/Cutwail was divided into several domains, each under the control of one gang member — was able to pump out 87.7 billion e-mails in the four weeks between July 30 and August 25, 2010.
"I was most surprised by the sheer number of e-mails sent by this one botnet," another researcher, Thorsten Holz of Ruhr-University Bochum in Germany and Lastline, Inc., in Santa Barbara, told UBM TechWeb’s Dark Reading blog. "It turns out this one botnet sent out billions of spam messages."
Symantec Labs estimated last year that 89 percent of all e-mails are spam.
Takedown
The research team got service providers to pull the plug last summer on about 20 of Pushdo/Cutwail’s 30 command-and-control servers. (The other service providers refused.) The botnet was crippled for several months.
Botnets are illicit networks of computers that have been enslaved by malware, which burrows deep into their operating systems and opens “backdoors” that allow control by remote operators, or “bot herders.”
Malware infection usually happens when a user opens a compromised e-mail attachment (a Trojan) or visits a compromised website (a drive-by download).
The bots, ordinary machines scattered across the globe whose users have no idea they are infected, are used to send out spam touting Viagra and pornography, phishing e-mails and Trojans to harvest more bots.
Almost 40 percent of Pushto/Cutwail’s bots were in India, Holz and his colleagues found. Other countries’ shares were far lower; Australia came in second, comprising 9 percent of the compromised PCs.
Holz and his colleagues also got an archived copy of Spamdot.biz, an online forum used by botnet operators for communication and trade, which provided a fascinating look into the world of mid-level cybercriminals.
More than 90 percent of the posts on Spamdot.biz were in Russian, and less than 9 percent in English. It had nearly 2,000 registered members, who had to be recommended by at least two other existing members to be accepted.
E-mail addresses were bought and sold in blocks of a million, with prices ranging from $25 to $50 per block depending on geographical location, status (free Web-based e-mail services such as Gmail or Hotmail were cheaper) and volume.
Specialized groups sold services, such as infecting new batches of computers with the client’s malware. These sold in blocks of 1,000, with prices ranging from $13 for Asian computers to $125 for PCs based in the United States.
Top-notch software
The software used by the Pushdo/Cutwail botnet was remarkably sophisticated. Each server running Cutwail, the spam engine, constantly tested its messages against a built-in copy of the SpamAssassin e-mail filter.
Pushdo, the Trojan used for command and control, used a proprietary, and often encrypted, communications protocol to direct its bots.
Despite the technological efforts and the sheer volume of spam sent out, only 30 percent of Pushdo/Cutwail’s e-mails ever reached their target servers, the researchers estimate. Half went to invalid addresses, and nearly 17 percent were blacklisted.
"That's quite a big loss," Holz told DarkReading. "And even if the mail is received by the targeted mail server, with filtering and SpamAssassin a large chunk of that 30 percent gets filtered and doesn't necessarily reach the inbox of the user."
Still, having all this information isn’t much of a victory in the fight against spammers.
Pushdo/Cutwail has been rebuilt since last summer and is now back up to its pre-takedown size of about 100,000 bots. It’s the second-largest botnet in the world; the Rustock botnet has an estimated 250,000 enslaved PCs.
How can you prevent your computer from being enslaved by a botnet? No method is foolproof, but your odds of infection drop dramatically if you do two things: Don’t open any unrequested e-mail attachments, even those from friends; and install and constantly update and run anti-virus software, even if you’re using a Mac.
Using a Mac instead of a Windows PC also does help, at least for now. Macs are not immune from infection and a few Mac Trojans have been found in the wild, but Apple’s PC market share is still so small that most cybercriminals don’t bother writing malware for it.
[SecurityNewsDaily]
Showing posts with label antivirus. Show all posts
Showing posts with label antivirus. Show all posts
Sunday, 20 March 2011
How antivirus and antispyware help keep malware at bay
When it comes to creating Internet security threats, malware writers are masters of disguise and manipulation. They are constantly evolving their tactics to find new ways to trick PC users, steal their information, cause them financial harm.
Unfortunately, even if you're careful to avoid questionable websites and delete spam email immediately, viruses and spyware can still find you – and infiltrate your system without your knowledge.
Just a few of the activities that allow these forms of malware to find their victims include:
If you're not sure whether your computer is infected with malware, Webroot suggests you keep your eyes peeled for these symptoms:
Unfortunately, even if you're careful to avoid questionable websites and delete spam email immediately, viruses and spyware can still find you – and infiltrate your system without your knowledge.
Just a few of the activities that allow these forms of malware to find their victims include:
- Sharing music, files or photos with other users
- Downloading free games, toolbars, media players and other system utilities
- Installing mainstream software applications without fully reading license agreements
- Visiting media-supported websites that utilize tracking cookies.
If you're not sure whether your computer is infected with malware, Webroot suggests you keep your eyes peeled for these symptoms:
- Sluggish performance
- Increased number of pop-ups
- New toolbars you can't delete
- Unexplained changes to homepage settings
- Puzzling search results
- Frequent computer crashes.
Wednesday, 9 March 2011
Five Apple Security Myths — and the Disturbing Truths
"I just got a Mac,” think many first-time Apple customers. “I'll never have to worry about a virus again."
So it would seem to many longtime PC users, plagued by virus, e-mail and phishing attacks that require constant vigilance and the installation of often pricey security software. They rarely, if ever, hear their Mac-using friends complaining about the same problems.
But even though it’s true that Macintosh computers, iPhones, iPods and iPads (the latter three of which run Apple’s iOS mobile operating system) are subject to far fewer attacks than their Windows (or Android) counterparts, Apple products are definitely not immune to security flaws.
In fact, as Apple’s market shares increase, so do the chances of malware being written specifically for the company’s devices.
Virgin territory
Apple software is actually ripe for attack. At the 2010 “Pwn2Own” hacking contest, held every March at the CanSecWest security conference in Vancouver, Apple’s Mac OS X, the Safari Web browser and an iPhone 3GS were all exploited with surprising ease, falling quicker than their Windows-based competitors.
The overconfidence many Apple users feel about their gadgets may come from the company itself, said Alex Horan, director of product management at Boston-based Core Security.
“On its website, Apple states that: ‘Mac OS X doesn’t get PC viruses. And its built-in defenses help keep you safe from other malware without the hassle of constant alerts and sweeps,” Horan said.
But it’s a false comparison.
“Traditionally the only reason we haven’t seen a lot of news about viruses and worms targeting Mac systems is because we haven’t seen as many Mac systems in use,” Horan explained.
“The reality today remains that if I want to write some code that will attempt to control the maximum number of systems, then I need to have that code target the most common systems out there [Windows]. But as the number of Mac system grows, so will the attention of the attackers.”
Horan’s colleague at Core Security, Vice President of Security Awareness and Government Affairs Tom Kellermann, added a warning.
“Over the past few years, we’ve seen multiple exploits that have proven that this perception around Apple security is truly misguided,” Kellerman said. “Those people who believe that they are fundamentally more secure simply because they use Apple products will likely someday learn to regret it.”
Five hard lessons
With that in mind, here are five Apple security myths — and the brutal truth behind each:
Myth: I don't need antivirus and spam protection because I work on a Mac.
Truth: The Mac OS X operating system is targeted less frequently by malware only because it’s not as widespread as Windows. It’s no more secure than any other operating system, said Sorin Mustaca, data security expert at Germany-based Avira.
As for phishing attacks, said Mustaca, “the biggest problem in this case is not the computer itself, but rather it's the user.”
Myth: I can't be infected by any malicious software because I get my applications exclusively from the iTunes App Store.
Truth: “We've seen a couple of times already that the App Store is not such a secure fortress as one might have hoped,” said Mustaca. “It is extremely difficult to check every single application that is inserted there.”
Myth: Mac OS X is inherently more secure than Windows.
Truth: Apple’s brand-new products are being hacked almost immediately upon arrival. For example, “jailbreaking” your iPhone is as easy as browsing to a specific website.
“For a while, it was easier to write exploits for Mac OS X systems than it was for Windows, but now they're relatively equal,” said Core Security technical specialist Dan Crowley. “Bugs seem to be just as easy — if not easier — to find in Mac OS versus Windows.”
Myth: Apple's Safari browser is more secure than Microsoft's Internet Explorer.
Truth: Safari had more than twice the number of reported vulnerabilities in 2009 (94) than did Internet Explorer (41), according to Symantec's Global Internet Security Threat Report.
Myth: iPad users are not susceptible to the same sorts of attacks that Windows users experience.
Truth: According to Anup Ghosh, founder and chief scientist of Fairfax, Va.-based Invincea, Apple released the iOS 3.2.2 software update for the iPad specifically to fix a critical vulnerability in Adobe Reader that can be exploited by malicious PDF files.
So what can you do to make your Apple device more secure? First of all, never open an e-mail attachment you’re not expecting, even if it’s from someone you know.
Always check the URL — the long string of characters that begins with “http” — in your browser address window when surfing the Web, even on an iPhone or iPod Touch. Be very careful about using free Wi-Fi hotspots in coffeeshops, libraries or airports — it’s safer to just use your cellular carrier’s data service.
There isn’t any third-party security software for iOS devices as of yet, but a few Mac OS X applications are available, such as Sophos Anti-Virus for Mac Home Edition (free), BitDefender Antivirus 2011 for Mac (starting at $40 per year), Intego Virus Barrier X6 ($50 per year, two users) and various Norton products (starting at $50 per year).
[SecurityNewsDaily]
So it would seem to many longtime PC users, plagued by virus, e-mail and phishing attacks that require constant vigilance and the installation of often pricey security software. They rarely, if ever, hear their Mac-using friends complaining about the same problems.
In fact, as Apple’s market shares increase, so do the chances of malware being written specifically for the company’s devices.
Virgin territory
Apple software is actually ripe for attack. At the 2010 “Pwn2Own” hacking contest, held every March at the CanSecWest security conference in Vancouver, Apple’s Mac OS X, the Safari Web browser and an iPhone 3GS were all exploited with surprising ease, falling quicker than their Windows-based competitors.
The overconfidence many Apple users feel about their gadgets may come from the company itself, said Alex Horan, director of product management at Boston-based Core Security.
“On its website, Apple states that: ‘Mac OS X doesn’t get PC viruses. And its built-in defenses help keep you safe from other malware without the hassle of constant alerts and sweeps,” Horan said.
But it’s a false comparison.
“Traditionally the only reason we haven’t seen a lot of news about viruses and worms targeting Mac systems is because we haven’t seen as many Mac systems in use,” Horan explained.
“The reality today remains that if I want to write some code that will attempt to control the maximum number of systems, then I need to have that code target the most common systems out there [Windows]. But as the number of Mac system grows, so will the attention of the attackers.”
Horan’s colleague at Core Security, Vice President of Security Awareness and Government Affairs Tom Kellermann, added a warning.
“Over the past few years, we’ve seen multiple exploits that have proven that this perception around Apple security is truly misguided,” Kellerman said. “Those people who believe that they are fundamentally more secure simply because they use Apple products will likely someday learn to regret it.”
Five hard lessons
With that in mind, here are five Apple security myths — and the brutal truth behind each:
Myth: I don't need antivirus and spam protection because I work on a Mac.
Truth: The Mac OS X operating system is targeted less frequently by malware only because it’s not as widespread as Windows. It’s no more secure than any other operating system, said Sorin Mustaca, data security expert at Germany-based Avira.
As for phishing attacks, said Mustaca, “the biggest problem in this case is not the computer itself, but rather it's the user.”
Myth: I can't be infected by any malicious software because I get my applications exclusively from the iTunes App Store.
Truth: “We've seen a couple of times already that the App Store is not such a secure fortress as one might have hoped,” said Mustaca. “It is extremely difficult to check every single application that is inserted there.”
Myth: Mac OS X is inherently more secure than Windows.
Truth: Apple’s brand-new products are being hacked almost immediately upon arrival. For example, “jailbreaking” your iPhone is as easy as browsing to a specific website.
“For a while, it was easier to write exploits for Mac OS X systems than it was for Windows, but now they're relatively equal,” said Core Security technical specialist Dan Crowley. “Bugs seem to be just as easy — if not easier — to find in Mac OS versus Windows.”
Myth: Apple's Safari browser is more secure than Microsoft's Internet Explorer.
Truth: Safari had more than twice the number of reported vulnerabilities in 2009 (94) than did Internet Explorer (41), according to Symantec's Global Internet Security Threat Report.
Myth: iPad users are not susceptible to the same sorts of attacks that Windows users experience.
Truth: According to Anup Ghosh, founder and chief scientist of Fairfax, Va.-based Invincea, Apple released the iOS 3.2.2 software update for the iPad specifically to fix a critical vulnerability in Adobe Reader that can be exploited by malicious PDF files.
So what can you do to make your Apple device more secure? First of all, never open an e-mail attachment you’re not expecting, even if it’s from someone you know.
Always check the URL — the long string of characters that begins with “http” — in your browser address window when surfing the Web, even on an iPhone or iPod Touch. Be very careful about using free Wi-Fi hotspots in coffeeshops, libraries or airports — it’s safer to just use your cellular carrier’s data service.
There isn’t any third-party security software for iOS devices as of yet, but a few Mac OS X applications are available, such as Sophos Anti-Virus for Mac Home Edition (free), BitDefender Antivirus 2011 for Mac (starting at $40 per year), Intego Virus Barrier X6 ($50 per year, two users) and various Norton products (starting at $50 per year).
[SecurityNewsDaily]
Subscribe to:
Posts (Atom)