Doombot Worm Spreads via Phishing Model Attack

Doombot.k comes with IRC bot capabilities and spreads via massmailing. Once inside the computer, the worm runs in the background, acting as aBackdoor Server that provides access to the victimÂ's PC via IRC channels, for theremote attacker. The smart worm also lowers the security level of the computer, andchanges entries in the Windows HOSTS files in order to block websites of AntiViruscompanies.

For its spreading routine, the worm steals email IDs from the victimÂ's address book and starts sending itself as .pif, .scr, .exe, .cmd and bat attachments. The mostinteresting aspect noted here is that it spoofs the domain name of the sender to thesame domain of the harvested email address. For example, if the worm steals an emailaddress  john@xyz.comÂ', it will fake the senderÂ's id as  abuse@xyz.comÂ', or security@xyz.comÂ' and will send it to JohnÂ's mail address. In the internal emailsystem of enterprises, this can wreck havoc by spreading fast to infect the entirenetwork.

The subject line of the email is picked from a list that includes various titleslike- Account AlertÂ',  Important NotificationÂ',  Members SupportÂ',  Notice ofaccount limitationÂ', and  Security measuresÂ'.

The body of the message too is chosen from a list of five options. One of themthreatens the user that if the user doesnÂ't follow the link and confirm theauthenticity of the account, it will be terminated. It directs you to two links, oneof which throws up an error page and the other, the Doombot Worm in  PifÂ' format.

In the last few months, MicroWorld has detected a large number of Trojans and Wormsthat can create bots out of user PCs. Botnets are formed by a network of suchcomputers taken over by hackers, to launch, direct and manage fraudulent activities,online crimes and malicious attacks. The security firm that produces the worldÂ'smost advanced security software solutions, reported a three fold increase in thenumber of bots across the globe in the year 2005, compared to 2004.

 This is a fine instance of what we call as the Convergence of Online Crimes, saysGovind Rammurthy, CEO, MicroWorld Technologies.  YouÂ've got an attack that resemblesphishing, which spreads an email worm that eventually creates large botnets, to beused as hotbeds of online crimes. It clearly indicates that in the dark under-bellyof Internet, criminals are connecting, grouping and organizing all sorts ofmalicious activities with clear financial and informational motives.Â

MicroWorld:MicroW orld (www.mwti.net ) is the developer of the world's first Real-TimeAnti-Virus and Content Security software eScan for desktops and servers. Itscommunication security software, MailScan is the first comprehensive e-mail scannerfor your SMTP/POP3 Mail Server. MicroWorld Winsock Layer (MWL) is the revolutionarytechnology underlying these products, powering them to several certifications andawards by some of the most prestigious testing bodies, notable among them beingVirus Bulletin, Checkmark, TUCOWS, Red Hat Ready, and Novell Ready. Combining theirpowerful scanner with MWL technology, MicroWorld solutions provide a Real-TimeProactive security for your systems. For network security of enterprises, eConcealFirewall is the latest powerful offering from MicroWorld.

To learn more, kindly visit http://www.mwti.net

Source: Express-Press-Release.com

Get RSS updates on latest computer technology and software related press releases Subscribe to this feed!  

You are welcome to include these headlines in your own pages. If you want to find out how to parse this RSS file please read our tutorial How to parse RSS feeds with PHP.