FYI...
Botnet floods net with SSH attacks
-
http://www.theregist...r_based_botnet/
Updated - 12 August 2010 - "A server-based botnet that preys on insecure websites is flooding the net with attacks that attempt to guess the login credentials for secure shells protecting Linux boxes, routers, and other network devices. According to multiple security blogs, the bot compromises websites running outdated versions of phpMyAdmin. By exploiting a vulnerability patched in April*,
the bot installs a file called dd_ssh, which trawls the net for devices protected by the SSH protocol... In addition to posing a threat to unpatched websites and SSH-protected devices, the attacks are also creating headaches for large numbers of non-vulnerable sites... this SANS Diary post** reports having success in warding off the attacks with DenyHosts***, an open source script that pools IP blacklists from more than 70,000 users. A better countermeasure still is to configure SSH devices to use a cryptographic key, something that is orders of magnitude harder to brute-force than a simple password..."
*
http://www.debian.or...y/2010/dsa-2034
**
http://isc.sans.edu/...ml?storyid=9370
Last Updated: 2010-08-12 09:31:57 UTC ...(Version: 5)
***
http://denyhosts.sourceforge.net/
___
-
http://www.theregist...attacks_return/
Posted in
Spam, 13 August 2010 - "Updated
Update: Trend Labs has reclassified the malware as a Bredolab variant instead of Waledac. That means the central premise of out original story - that Waladec - is back from the grave - is wrong...
Attacks designed to draft new recruits into the infamous Waledac spambot network are back from the dead, months after the zombie network was effectively decapitated... The Microsoft-led operation was rightly hailed as a big success but did nothing to clean up an estimated 90,000 infected bot clients even though it stemmed the tide of spam from these machines. Left without spam templates or instructions, these machines have remained dormant for months. However, over recent weeks, the botnet is making a comeback of sorts. Spammed messages containing malicious attachment harbouring Waladec agents and disguised as tax invoices or job offers and the like have begun appearing, Trend Micro warns*. The same run of spam messages is also being used to spread fake anti-virus and other scams unrelated to Waledac, and there's no sign that a new command and control structure, much less a fresh round of spamming, has begun..."
*
http://blog.trendmic...ous-attachments
UPDATE: Following deeper analysis of this threat by senior threat researchers, TrendLabs has reclassified the malware used in this attack as a BREDOLAB variant (detected as TROJ_BREDOLAB.JA) instead of WALEDAC. An unfortunate combination of human and machine errors led to the mislabeling of this threat as WALEDAC. Apologies for the confusion...
Aug. 12, 2010 - "... In the past few weeks, there has been something of an increase in the number of spammed messages delivering malicious attachments to users..."
Edited by AplusWebMaster, 13 August 2010 - 02:14 PM.
Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. 
Join 
