Wazoo Posted October 26, 2008 Share Posted October 26, 2008 Undead spam After laying low for the better part of a year, the Warezov botnet is back - with some new tricks up its sleeve. In the past week, trojan horse programs that install the Warezov bot have been spotted on websites offering free MP3 downloads, according to Joe Stewart, director of malware research at security provider SecureWorks. The attacks are a big change for Warezov, which burst on the scene in 2006 with malware attacks spread in email attachments. The new methodology is an acknowledgment of the futility of email attacks given the difficulty of sneaking malicious payloads past today's email filters. Stewart says Warezov is more of a payload delivery system than an actual bot. It is in essence a backdoor that installs any software its operator wants. In recent times, the payload of choice is a fast-flux hosting platform that turns compromised PCs into servers that host spoof sites used in phishing campaigns. Fast-flux networks are much harder to shut down because there's no central channel to defeat. If a single node hosting, say, a fraudulent Bank of America website is taken down, there are still thousands of other infected machines ready to take its place. In the case of Warezov, the malware installs two separate components: a reverse HTTP proxy that serves content from an obscured master server and a DNS server that has been modified from ISC BIND. The DNS server acts as a slave that gets zone updates from the master. ....... Warezov suddenly came out of hibernation. Oddly enough, Stewart says, it was using Microsoft's Hotmail service. Each bot was given a list of usernames and passwords, and each username sent only a few emails in order to bypass restrictions on the number of emails that a single account holder can send in a set period of time. Warezov isn't the only piece of malware using webmail to send spam. Malware known alternately as Wopla or Hotlan does the same thing. Link to comment Share on other sites More sharing options...
This topic is now archived and is closed to further replies.