Skip to main content

Business > News

Tue, 02 Dec 2008 New Windows worm builds massive botnet

Botnet could be 500,000 strong say Trend Micro

Gregg Keizer Computerworld

  • Email to a friend
  • Print this article
  • Bookmark this page
  • RSS feed

The worm exploiting a critical Windows bug that Microsoft patched with an emergency fix in late October is being used to build a new botnet, a security researcher said on Monday.

Ivan Macalintal, a senior research engineer with Trend Micro said that the worm, which his company has dubbed "Downad.a" - it's called "Conficker.a" by Microsoft and "Downadup" by Symantec - is a key component in a new botnet that criminals are creating.

Question of the day!

Mark Hattersley
Editor in Chief

Do you use Adobe Photoshop with a Wacom tablet?

Question of the day!

Do you use Adobe Photoshop with a Wacom tablet?

% of Macworld readers agree with you

Yes
TBC
No
TBC

How does a Wacom tablet improve the Photoshop experience?

124 characters remaining

Follow the conversation at @TabletChat

paintings & illustrations, mostly, which i upload to flickr.RT @fragmentedm

I draw manga/anime characters. I also do graphic design and photography.RT @spialelo

Yes. I usually put them up on my #deviantart account for feedback on how to improve.RT @spialelo

"We think 500,000 is a ball park figure," said Macalintal when asked the size of the new botnet. "That's not as large as some, such as [the] Kraken [botnet], or Storm earlier, but it's still starting to grow."

Last week, Microsoft warned that the worm was behind a spike in exploits of a bug in the Windows Server service, which is used by the operating system to connect to network file and print servers.

Microsoft patched the service with an emergency fix it issued 23 October , shortly after it discovered a small number of infected PCs in Southeast Asia .

New worm global threat

However, the new worm is a global threat, said Macalintal. "This has real potential to do damage," he said. Trend Micro has spotted infected IP addresses on the networks of Internet service providers (ISPs) in the US, China, India, the Middle East, Europe and Latin America.

The worm first appeared about a week and a half ago, and began spreading in earnest just before Thanksgiving, he added.

Macalintal also said that it appears the botnet is being built by a new group of cyber-criminals, not one of the gangs that lost control of compromised computers when McColo, a California hosting company, was yanked off the Internet.

When McColo went offline, crooks lost access to the command-and-control servers which gave marching orders to some of the world's biggest botnets, including "Srizbi" and "Rustock."

One result of the McColo takedown was a temporary slump in spam, some message security vendors said last week that they had seen a sharp increase in spam as the hackers managed to regain control of their botnets.

Security experts, including those at Trend Micro, are coordinating efforts, said Macalintal, to pass along their lists of worm-infected PCs to ISPs, who have been asked to contact the computers' owners and urge them to clean their machines of the worm.

"But that's an uphill climb," admitted Macalintal.

Users who haven't applied the emergency patch - labeled MS08-067 by Microsoft - should do so as soon as possible, Macalintal said.

Get four free Mac programs worth £82 and 40 free prints from Jessops with Macworld print magazine. On sale now! Click here for more information.

Email A Friend

Email this article to a friend or colleague:



PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

<<prev article | back to news index | next article>>

Latest News


More news...