Analytics

6/11/2008
02:10 AM
50%
50%

Researchers Link Storm Botnet to Illegal Pharmaceutical Sales

Prescription drug spammers are bankrolling botnet's growth, IronPort study says

Botnets are hopped up on Viagra.

That's the conclusion of a new report being issued by researchers at IronPort, Cisco Systems's email security unit, who have identified a link between originators of malware, such as the Storm botnet, and illegal pharmaceutical supply chain businesses that recruit the botnets to send spam promoting Viagra and many other prescription drugs on their Websites.

By converting spam into high-value pharmaceutical purchases, IronPort says, these supply chain enterprises allow the "monetization" of spamming botnets, providing an enormous profit motivation for botnet attacks.

"Our previous research revealed an extremely sophisticated supply chain behind the illegal pharmacy products shipped after orders were placed on botnet-spammed Canadian pharmacy Websites. But the relationship between the technology-focused botnet masters and the global supply chain organizations was murky until now," said Patrick Peterson, vice president of technology at IronPort and a Cisco fellow.

"Our research has revealed a smoking gun that shows that Storm and other botnet spam generates commissionable orders, which are then fulfilled by the supply chains, generating revenue in excess of $150 million per year."

In fact, the "Canadian Pharmacy" Website, which many Storm emails promote, is estimated to have sales of $150 million per year by itself, the report says. The site offers a customer service phone number that goes into voice mail and buyers usually do receive the drugs -- but the shipments include counterfeit pharmaceuticals from China and India, rather than brand-name drugs from Canada, IronPort says.

IronPort's research revealed that more than 80 percent of Storm botnet spam advertises online pharmacy brands. This spam is sent by millions of consumers' PCs, which have been infected by the Storm worm via a multitude of sophisticated social engineering tricks and Web-based exploits. Further investigation revealed that spam templates, "spamvertized" URLs, Website designs, credit card processing, product fulfillment, and customer support were being provided by a Russian criminal organization that operates in conjunction with Storm, IronPort says.

This criminal organization recruits botnet spamming partners to advertise their illegal pharmacy Websites, which receive a 40 percent commission on sales orders. The organization offers fulfillment of the pharmaceutical product orders, credit card processing, and customer support services.

However, IronPort-sponsored pharmacological testing revealed that two thirds of the shipments contained the active ingredient but were not the correct dosage, while the others were placebos. As a result, consumers take a significant risk of ingesting an uncontrolled substance from overseas distributors, the researchers say.

The report offers a broad look at Storm and its evolution, including some of the latest tricks used to recruit bots. Storm increasingly is using a captcha-breaking method that enables it to create free Webmail accounts that can be used to promulgate spam, IronPort says. The botnet is also using Google exploits and iFrame injection attacks, as has been previously reported. (See Sophos: Iframe Worm No. 1 in December.)

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • IronPort Systems

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    White House Cybersecurity Strategy at a Crossroads
    Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
    The Fundamental Flaw in Security Awareness Programs
    Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win a Starbucks Card! Click Here
    Latest Comment: This comment is waiting for review by our moderators.
    Current Issue
    Flash Poll
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2018-5065
    PUBLISHED: 2018-07-20
    Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
    CVE-2018-5066
    PUBLISHED: 2018-07-20
    Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
    CVE-2018-5067
    PUBLISHED: 2018-07-20
    Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
    CVE-2018-5068
    PUBLISHED: 2018-07-20
    Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
    CVE-2018-5069
    PUBLISHED: 2018-07-20
    Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.