
Maybe NOW...
...someone will start to do something concrete, instead of wringing their hands and proposing draconian snooping regimes.
A recently discovered botnet has been caught siphoning ad revenue away from Google, Yahoo! and Bing and funneling it to smaller networks. According to researchers at Click Forensics, computers that are part of the so-called Bahama Botnet are infected with malware that sends them to counterfeit search pages instead of the real …
so all the searches appear to come from 1 IP Address? but google block IP Addresses making too many searches... (not sure about the others, but i assume they do too)
makes it kind of easy to block even if the traffic is below the threshold for automatic blocking - why don't they modify the page on the client instead to avoid that problem?
If you are in a botnet? F'ning windose is downloading an super important patch, i mean update no its adverts! As well as Adobe screwing with my flash environmen. Then I have some dumbass program that thinks it constantly needs updating or outhorizing. I cant tell good communication from bad, or control it. They deserve what happens.
As I understand it, all searches on compromised machines go through the one IP address, but that doesn't mean that that same IP address has to be the one that makes the queries to Google. Could be a multi-homed machine, could use proxies. Could even route the requests back through infected machines, for all that.
Are you even sure, though, that Google actually implements the system you're talking about? How would it handle large networks behind NAT gateways and IP address changes to said gateways?
No they are only controlled via that I.P all searches will still show from individual I.P address's that are already compromised by that bot.
To be honest this isnt anything new, search result hijacking is one of the newer methods of making money as the scareware industry starts losing a bit of steam.
I use a software firewall on My PC. I let nothing out unless I know exactly what it is and why it is connecting. I disable the running of any and all auto-update agents(Except Avast my AV program). I update everything manually from the developers website. More work yes. Secure? I don't know, there are a lot of people out there far smarter than I. At least I give myself the illusion of control and security. As an added measure I will, if I suspect something nefarious, connect my box to the internet via Honeywall and sniff every single packet during start up and the first 5 or so minutes of runtime, I check every IP address windoze connects to and inside each packet that passes that I haven't initiated. I can see the LED's on my switch, any random activity on the port connected to my router also raises my suspicions.
Paranoid maybe... My last infection was the Saddam virus on my Amiga.
Of course I only do this for my XP install. My OpenBSD and Ubuntu machines, up until now, allow me to sleep like a baby. I would expect that to change WHEN Linux becomes the dominant OS.
Oh they do it all right, the company I work for decided to consolidate all it's European proxy traffic through a host in Germany.
Most lunchtimes you get caught by a CAPTCHA, and our internal helpdesk gets hit with calls that the internets are broked.
There is also the constant complaint by the same users that the results page comes up as google.de rather than .com
A Russian operated botnet known as RSOCKS has been shut down by the US Department of Justice acting with law enforcement partners in Germany, the Netherlands and the UK. It is believed to have compromised millions of computers and other devices around the globe.
The RSOCKS botnet functioned as an IP proxy service, but instead of offering legitimate IP addresses leased from internet service providers, it was providing criminals with access to the IP addresses of devices that had been compromised by malware, according to a statement from the US Attorney’s Office in the Southern District of California.
It seems that RSOCKS initially targeted a variety of Internet of Things (IoT) devices, such as industrial control systems, routers, audio/video streaming devices and various internet connected appliances, before expanding into other endpoints such as Android devices and computer systems.
The botnet malware EnemyBot has added exploits to its arsenal, allowing it to infect and spread from enterprise-grade gear.
What's worse, EnemyBot's core source code, minus its exploits, can be found on GitHub, so any miscreant can use the malware to start crafting their own outbreaks of this software nasty.
The group behind EnemyBot is Keksec, a collection of experienced developers, also known as Nero and Freakout, that have been around since 2016 and have launched a number of Linux- and Windows-based bots capable of launching distributed denial-of-service (DDoS) attacks and possibly mining cryptocurrency. Securonix first wrote about EnemyBot in March.
Microsoft has sounded the alarm on DDoS malware called XorDdos that targets Linux endpoints and servers.
The trojan, first discovered in 2014 by security research group MalwareMustDie, was named after its use of XOR-based encryption and the fact that is amasses botnets to carry out distributed denial-of-service attacks. Over the last six months, Microsoft threat researchers say they've witnessed a 254 percent spike in the malware's activity.
"XorDdos depicts the trend of malware increasingly targeting Linux-based operating systems, which are commonly deployed on cloud infrastructures and Internet of Things (IoT) devices," Redmond warned.
Automaker General Motors has confirmed the credential stuffing attack it suffered last month exposed customers' names, personal email addresses, and destination data, as well as usernames and phone numbers for family members tied to customer accounts.
There has been a land rush of sorts among threat groups trying to use the vulnerability discovered in the open-source Spring Framework last month, and now researchers at Trend Micro are saying it's being actively exploited to run the Mirai botnet.
Mirai is a long-running threat that has been around since 2016 and is used to pull smaller networked and Internet of Things (IoT) devices, such as IP cameras and routers, into a botnet that can then be used in such campaigns as distributed denial-of-service (DDoS) and phishing attacks.
The Trend Micro researchers wrote in a post that they observed the bad actors weaponizing and run Mirai malware on vulnerable servers in the Singapore region via the Spring4Shell vulnerability, tracked as CVE-2022-22965.
A prolific threat group known for deploying distributed denial-of-service (DDoS) and cryptomining attacks is running a new botnet that is built using the Linux-based Gafgyt source code along with some code from the Mirai botnet malware.
The group Keksec (also known as Nero and Freakout) is using the fast-evolving Enemybot to target routers from vendors like Seowon Intech and D-Link and is exploiting a remote code execution (RCE) vulnerability (CVE-2022-27226) discovered last month in iRZ mobile routers, according to a report this week by Fortinet's FortiGuard Labs team.
Keksec is using the Enemybot malware as a classic botnet, rolling up compromised Internet of Things (IoT) devices into a larger botnet that can be used to launch DDoS attacks.
Google's bug hunters say they spotted 58 zero-day vulnerabilities being exploited in the wild last year, which is the most-ever recorded since its Project Zero team started analyzing these in mid-2014.
This is more than double the earlier record of 28 zero-day exploits detected in 2015. And miscreants are still using the same old techniques to get away with their mischief.
"With this record number of in-the-wild zero-days to analyze we saw that attacker methodology hasn't actually had to change much from previous years," wrote Google security researcher Maddie Stone in Project Zero's third annual review of exploited programming blunders.
More than a year after essentially being shut down, the notorious Emotet malware operation is showing a strong resurgence.
In a March threat index, Check Point researchers put the Windows software nasty at the top of its list as the most widely deployed malware, menacing or infecting as much as 10 percent of organizations around the globe during the month – a seemingly unbelievable estimate, and apparently double that of February.
Now Kaspersky Labs says a rapidly accelerating and complex spam email campaign is enticing marks with fraudulent messages designed to trick one into unpacking and installing Emotet or Qbot malware that can steal information, collect data on a compromised corporate network, and move laterally through the network and install ransomware or other trojans on networked devices.
Microsoft has announced a months-long effort to take control of 65 domains that the ZLoader criminal botnet gang has been using to spread the remote-control malware and orchestrate infected machines.
The tech giant's Digital Crimes Unit obtained a court order from a US federal judge in Georgia to take down the domains, which are now directed to a Microsoft-controlled sinkhole so they can't be used by the malware's masterminds to communicate with their botnet of commandeered Windows computers.
From what we can tell from the filings submitted by Microsoft to the courts, its justification for the seizure is that ZLoader used the domains to injure the Windows giant as well as residents of the US state and commit computer fraud, infringement of Microsoft trademarks, and other illegal activity. The trademark infringement being that at least one of the domains was used for a website that featured Microsoft trademarks in an attempt to masquerade as a legit Redmond site, and also references in phishing emails to Microsoft-trademarked programs, such as Excel.
The US Justice Department today revealed details of a court-authorized take-down of command-and-control systems the Sandworm cyber-crime ring used to direct network devices infected by its Cyclops Blink malware.
The move follows a joint security alert in February from US and UK law enforcement that warned of WatchGuard firewalls and ASUS routers being compromised to run Cyclops Blink. This botnet malware – technical breakdown here [PDF] – allows the equipment to be remote controlled to carry out attacks on behalf of its masterminds.
Previously, Uncle Sam said the Sandworm crew worked for the Russian Federation's GRU espionage nerve-center, which handles foreign intel operations.
Biting the hand that feeds IT © 1998–2022