Rustock Botnet.

Rustock Botnet, which specialized in sending junk mail or SPAM mails adverts for sites that sell unlicensed pharmaceutical drugs, was responsible for sending an estimated 39 per cent of global spam in circulation last year, according to Symantec.

Read More

Teqila Botnet

A new type of attack included a name of a girl that will steal banking or financial information.It comes in many ways by clicking on a website that contains the information about the four-year-old girl, Paulette Gebara Farah, who was later found dead in her own bedroom, through messenger, via USB devices.

Read More

Types of Botnet Attacks

Bot net is a like a robot that sends some codes to remote user as requested by him. It first scans the computer or network for different vulnerabilities and it will use different types of attack . And we have seen what

• Denial-of-service attacks where multiple systems autonomously access a single Internet system or service in a way that appears legitimate, but much more frequently than normal use and cause the system to become busy.
• Adware exists to advertise some commercial entity actively and without the user's permission or awareness, for example by replacing banner ads on web pages with those of another content provider.
• Spyware is software which sends information to its creators about a user's activities – typically passwords, credit card numbers and other information that can be sold on the black market. Compromised machines that are located within a corporate network can be worth more to the bot herder, as they can often gain access to confidential information held within that company. There have been several targeted attacks on large corporations with the aim of stealing sensitive information, one such example is the Aurora botnet.
• E-mail spam are e-mail messages disguised as messages from people, but are either advertising, annoying, or malicious in nature.
• Click fraud is the user's computer visiting websites without the user's awareness to create false web traffic for the purpose of personal or commercial gain.
• Access number replacements are where the botnet operator replaces the access numbers of a group of dial-up bots to that of a victim's phone number. Given enough bots partake in this attack, the victim is consistently bombarded with phone calls attempting to connect to the internet. Having very little to defend against this attack, most are forced into changing their phone numbers.
• Fast flux is a DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts acting as proxies.

Measures to prevent it:

• The most serious preventive measures utilize rate-based intrusion prevention systems implemented with specialized hardware.
• Removing services that provide reference points to botnets can cripple an entire botnet.
• Updating the Operating system that will avoid or fill all the vulnerabilities will also prevent botnets.
• You may go to opt for products like Norton Anti-Bot and other products given by different anti-virus companies will help in removing the botnets.

Read More

Botnet

A botnet is a collection of software agents, or robots, that run autonomously and automatically. It also refers to a network of computers using distributed computing software. A computer "robot" or "bot" that serves the wishes of some master spam or virus originator. The main motive behind these botnets is financial gain along with recognition. Botnets have become a significant part of the Internet, albeit increasingly hidden. Due to most conventional IRC networks taking measures and blocking access to previously-hosted botnets, controllers must now find their own servers. Sometimes a controller will hide an IRC server installation on an educational or corporate site where high-speed connections can support a large number of other bots.

Read More

Botnet named Chuck Norris

There is another botnet that has attacked the web with the name of Chuck Norris-famous karate fighter. WORM_IRCBOT.ABJ may be downloaded from remote site(s) by other malware or by an unknowing user when visiting a malicious Web site. It takes advantage of the MS03-039 Buffer Overrun vulnerability. In RPC(Remote Procedure Call)SS Service vulnerability to propagate copies of itself across networks. This vulnerability systems users running Microsoft Windows NT, 2000, XP and Server 2003 platform. It tries to access a vulnerable network share by guessing usernames and passwords of password-protected systems via brute force attack.

RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly access services on another computer which itself has come from an open software foundation RPC protocol with microsoft added extensions.

 There are three newly identified vulnerabilities in the part of RPCSS Service that deals with RPC messages for Distributed Component Object Model (DCOM) activation.
It could result in denial of Primary service and  automatic random code execution on user's PC which are a result of incorrect handling of malformed messages. These particular vulnerabilities affect the Distributed Component Object Model (DCOM) interface within the RPCSS Service which handles DCOM object activation requests that are sent from one machine to another.

An attacker who successfully exploited these vulnerabilities could be able to run code with Local System privileges on an affected system, or could cause the RPCSS Service to fail. The attacker could then be able to take any action on the system, including installing programs, viewing, changing or deleting data, or creating new accounts with full privileges.

It drops copies of itself to vulnerable network shares.
It connects to IRC server to take commands from a remote user.
Steals Online Banking Information of the users and Activation keys of popular Game applications.

Read More