Computer Associates warns of massive botnet attack
Sunday, June 5, 2005
Computer Associates are warning of a current three pronged, co-ordinated malware attack on computers that are using Microsoft Windows and are connected to the Internet. The attack involves the use of three different Trojan horses called Glieder, Fantibag and Mitglieder. The goal is to create a botnet consisting of a large number of compromised computers. Access to this group of compromised machines will then be available on a black market, at prices as low as five cents per machine.
- Win32.Glieder.AK: The first of the three, this Trojan horse attempts to de-activate an extensive list of security/antivirus related processes and services running on the target computer. It also attempts to lower security settings in order to facilitate easier access for subsequent Trojan horses.
- Fantibag: This second Trojan horse creates filters on the target machine in order to prevent access to a large number of antivirus companies' Web sites. Thus, not only is the target computer now well and truly compromised, but an average Windows user will be completely unable to remove these violations of their system.
- Mitgleider: Once the first two Trojan horses have largely eliminated any possibility that the target will be able to defend itself, this one finishes the job. It opens port 38884 and configures it to act as a SOCKS 4 proxy, but the compromised system can now also be commanded to do the following:-
- Changing the backdoor port number
- Updating the trojan
- Downloading and execute files
- Uninstalling the trojan
- Initiating an SMTP server on TCP port 25, which can be used to relay spam.
- Executing files on the infected computer
- Downloading and executing files via an URL
It should be noted that these Trojan horses only affect the Microsoft Windows family of operating systems. No other operating systems (such as Linux and Apple's OS X) are vulnerable. In order to prevent infection, Windows users are advised to ensure that they have the latest operating system patches from Microsoft, that their chosen antivirus software is up to date, and that they are using firewall software where appropriate.
Sources
- John Leyden. "'Hackers plot to create massive botnet'" — The Register, June 3, 2005
- Zonk. "CA Warns Of Massive Botnet Attack" — Slashdot, June 3, 2005
- Computer Associates Security Advisor. "Computer Associates Virus Information Centre" — Computer Associates, June 1, 2005
The text of this article has been released into the public domain. In the event that this is not legally possible, this article may be used for any purpose, without any condition, unless such conditions are required by law. This applies worldwide. Copyright terms on images, however, may vary, so please check individual image pages prior to duplication. Please note that this only applies to Wikinews content created prior to September 25, 2005. All content created after that date is released under a Creative Commons license which is mentioned at the bottom of each article. This is currently the Creative Commons Attribution 2.5 License. |