Researchers Hijack a Drive-By Botnet Technology Review (10/02/09) Lemos, Robert
as it appeared in the October 5, 2009 edition of ACM TechNews.
A recent University of California at Santa Barbara (UCSB) study examined the damaging effects of the computer-infecting Mebroot botnet. The Mebroot botnet network corrupts normal Web sites and redirects their visitors to a domain that tries to infect their computers with malware. Once infected, the computers can be controlled by Mebroot programmers. The Mebroot botnet is difficult to track because programmers change the domain name daily using three Javascript algorithms similar to one used by the computer worm Conficker. Two of the algorithms use the day's date as a variable, but the third uses characters from the day's most popular key word search on Twitter. This is difficult for antivirus programmers to predict, making it harder to protect computers from invasion. "It is definitely one of the most advanced and professional botnets out there," says F-Secure's Kimmo Kasslin. UCSB researchers tried to use the algorithms against the Mebroot programmers, predicting upcoming domain names and booking them ahead of time, but the attackers responded by reserving the names more quickly. The researchers found that almost 70 percent of visitors to dangerous Mebroot domains were exposed to about 40 different methods of infection. About 35 percent were exposed to the six vulnerabilities that Mebroot uses. Study author and UCSB computer scientist Giovanni Vigna says that computer users need to update their antivirus software more frequently to avoid infection. View Full Article
