Botnet

For the past week a massive attack has infected PCs by tricking users into clicking links in fake messages from CNN.com. The attack has shown little sign of ending soon. The links in the spam mails go to sites which tell you to download the Adobe Flash player to watch a movie. What actually happens when you run this file is that a trojan is installed on your computer. The trojan adds your computer to a worldwide Botnet.

The email itself looks like a completely normal message from CNN.com and some of the links in the email also go to CNN. Right now there is a similar attack in progress, although this time MSNBC.com (NBC’s and MSN’s news site) is used to mask the attack. Spam has flowed in since around 11am on Tuesday. The sites, which the spam messages link to, are most likely hijacked ones and the site owners are probably not yet aware that their sites contain malicious code.

Firefox and Internet Explorer 7 now include filters to block sites like these. However, it normally takes several days before a hijacked site has been reported to these filters. Until then, no warning will be displayed when surfing to these sites.

As we reported yesterday we now see a lot of spam messages with subject lines related to current events. Many of these spam messages contain links to sites that installs a trojan which makes your computer to a spam sending monster. The blog I got Spam? reports that the sites (for example a bogus Porntube which is the adult version of Youtube) is hosted on a number of hacked servers. When someone clicks on the link a pop-up is displayed, telling the user to install an Active-X control which installs the trojan that welcomes you to the Storm Worm botnet. This weekend this botnet was responsible for sending over 8 million spam messages in 24 hours.

F-secure also reports about these spam messages on their blog.

CBC News reports that the Quebec provincial police have dismantled a computer hacking network that targeted unprotected personal computers around the world. These so called botnets are commonly used to perform hacking attacks against other computers and servers. Botnets are also widely used as senders of millions and millions of spam messages. So will this arrest decrease the spam traffic? Read the rest of this entry »