11/27/2008

Massive botnet returns from the dead, starts spamming

Filed under: — Aviran Mordo

A big spam-spewing botnet shut down two weeks ago has been resurrected, security researchers said today, and is again under the control of criminals.

The “Srizbi” botnet returned from the dead late Tuesday, said Fengmin Gong, chief security content officer at FireEye Inc., when the infected PCs were able to successfully reconnect with new command-and-control servers, which are now based in Estonia.

Srizbi was knocked out more than two weeks ago when McColo Corp., a hosting company that had been accused of harboring a wide range of criminal activities, was yanked off the Internet by its upstream service providers. With McColo down, PCs infected with Srizbi and other bot Trojan horses were unable to communicate with their command servers, which had been hosted by McColo. As a result, spam levels dropped precipitously.

But as other researchers noted last week, Srizbi had a fallback strategy. In the end, that strategy paid off for the criminals who control the botnet.

According to Gong, when Srizbi bots were unable to connect with the command-and-control servers hosted by McColo, they tried to connect with new servers via domains that were generated on the fly by an internal algorithm. FireEye reverse-engineered Srizbi, rooted out that algorithm and used it to predict, then preemptively register, several hundred of the possible routing domains.

The domain names, said Gong, were generated on a three-day cycle, and for a while, FireEye was able to keep up — and effectively block Srizbi’s handlers from regaining control.

“We have registered a couple hundred domains,” Gong said, “but we made the decision that we cannot afford to spend so much money to keep registering so many [domain] names.”

Once FireEye stopped preempting Srizbi’s makers, the latter swooped in and registered the five domains in the next cycle. Those domains, in turn, pointed Srizbi bots to the new command-and-control servers, which then immediately updated the infected machines to a new version of the malware.

“Once each bot was updated, the next command was to send spam,” said Gong, who noted that the first campaign used a template targeting Russian speakers.

Sling.com like video site Hulu with a twist

Filed under: — Aviran Mordo

Since its launch in March, video-streaming site Hulu has become a popular place to catch TV shows, video clips and movies for free on the Web.

Apparently, the folks behind Hulu - which is a joint venture between General Electric Co.’s NBC Universal and News Corp. - aren’t the only ones that think this is a good idea.

This week, Sling Media, which makes the Slingbox device that lets you watch your home TV remotely, rolled out a “beta” version of its own video-streaming site, Sling.com. Owing to deals with Hulu and a number of the same partners that Hulu has, Sling.com has much of the same content. But there is one neat twist: if you have a Slingbox device, which lets you control and watch your TV from any Mac- or Windows-based computer equipped with high-speed Internet access, you can also use the site to control your Slingbox.

Woman cleared of felonies in MySpace suicide case

Filed under: — Aviran Mordo

A suburban mother who prosecutors say drove a love-struck 13-year-old girl to suicide by tormenting her with a fake MySpace persona was acquitted on Wednesday of the most serious charges against her.

Lori Drew was found guilty of three misdemeanor counts in the high-profile case, which made worldwide headlines and prompted calls for social networking sites like MySpace to crack down on such activities.

She was cleared of three felonies by the U.S. District Court jury, which deadlocked on a fourth count of conspiracy.

Drew, who created the fake profile after her daughter and neighbor Megan Meier had a falling out, showed no reaction as the verdicts were read and declined to answer questions from reporters as she left the courtroom.

The Missouri woman will face a sentence ranging from probation to three years behind bars for the misdemeanor convictions. She could have been sent to federal prison for up to 20 years if she had been convicted on the felony charges.

Powered by WordPress