Malware

Microsoft’s Computer Online Forensic Evidence Extractor (COFEE) has made it into the hands of pirates, and their virtual ships are distributing it. The COFEE application lets officers grab data from password-protected or encrypted sources. That means you can now break the law twice over: download the software and then use it to steal information from other people’s computers.

Guest editorial by Gunter OllmannBotnets come in all shapes and sizes and if you can’t find one that fits your unique purposes off-the-rack, it’s trivial to create a custom one using a do-it-yourself construction kit – which helps to explain the diversity we’re seeing within the enterprise. In general though, enterprise-targeted botnets tend to be a different breed – make use of enterprise-specific functionality (e.g. being proxy aware and exploiting vulnerabilities over the network that would be blocked by perimeter firewalls) – and their objectives tend to be more “refined” and clearly criminal.

The security industry lacks a uniform way to title botnets, and the
result is sometimes a long list of names for the same botnet that are
used by different antivirus vendors and that can be confusing to
customers. As it stands now, the infamous Conficker is also known as Downup, Downadup and Kido. The Srizbi botnet is also called Cbeplay and Exchanger. Kracken is also the botnet Bobax.

The latest MySpace attack tries to lure recipients into giving up their
MySpace credentials, and then attempts to trick victims into installing
password-stealing malicious software. Attackers began blasting out the junk e-mails early Monday, according to researchers at the University of Alabama, Birmingham, Researchers at the school so far have tracked more than 30 Web site names associated with this attack, each beginning with “accounts.myspace.com” and ending in a United Kingdom country code domain (.uk). Read the full article. [Washington Post] 

Arbor Networks researcher Jose Nazario has spotted a malicious Google AppEngine application being used to control a botnet of infected computers. The Google App Engine is feeding URLs to the zombies (hijacked machines) for them to download, Nazario explained.  Read the full blog post [arbornetworks.com]

The botnet problem has reached epidemic levels in recent months, with the continued growth of large-scale botnets, as well as the identification of smaller, more targeted networks around the world. But researchers have been taking steps to disrupt botnets of late, with some notable successes, as the recent takedown of the Mega-D botnet shows.

Could hackers get into the computer systems that run crucial elements of the world’s infrastructure, such as the power grids, water works or even a nation’s military arsenal? Watch the CBS News 60 Minutes segment.

Read the transcript.