Security vendor Symantec has disrupted part of the ZeroAccess botnet, freeing 500,000 of the 1.9 million infected computers from the malicious network’s control. Symantec researchers took advantage of an undisclosed flaw in the network’s peer-to-peer updating to poison 256 peer computers that were part of the botnet. The researchers then injected their own IP addresses into the botnet to gain control of them. They tried to wrest control of ZeroAccess’ entire command-and-control mechanism. However, because the botnet distributes its instructions peer to peer, rather than via centralized servers, this frustrated the researchers’ attempts. In addition, the botmasters subsequently updated the malware they use to control computers to eliminate the vulnerabilities that Symantec exploited. The company is working to free victimized computers that don’t have the update. Symantec researchers call ZeroAccess “one of the most menacing botnets in current circulation.” The botnet operators use the computers they control to distribute malware, and commit advertising fraud, specifically click fraud, and online currency fraud through using the compromised computers for Bitcoin mining. The advertising fraud alone reportedly nets about $700,000 per year from roughly 1,000 clicks/day per computer. (BBC)(Computerworld)(Ars Technica)
Sunday, November 10, 2013
Wednesday, May 22, 2013
Security-Application Update Disables Computers Worldwide
A faulty update from security vendor Malwarebytes issued Tuesday afternoon reportedly left users worldwide without computer access after the software disabled essential, legitimate Windows components after identifying them as malware. The problem was created by a faulty update definition that marked Windows.dll and .exe files as malware. Malwarebytes said it took the update off its servers as soon as it realized there was a problem, which occurred within eight minutes of deployment. The company said in a blog post that it is re-evaluating its update policy to prevent this from occurring again. The ongoing fight against new and fast moving cyberthreats and the need to update applications makes faulty updates a “constant danger,”, said Rik Ferguson, global vice president of security research at security vendor Trend Micro. (SlashDot)(V3.co.uk)(Malwarebytes)
