Vulnerabilities / Threats

2/2/2011
01:46 PM
50%
50%

Waledac Botnet Contains Almost 490,000 Stolen Email Passwords

With numerous real-world credentials built-in, the worm can bypass many spam and security defenses, find security researchers.

Security researchers have cracked the code for version 2 of the Waledac worm, used by attackers to build botnets, and found that it carries numerous credentials that enable it to bypass spam filters and security defenses.

"We found that the botmasters have a tremendous amount of stolen credentials," blogged Brett Stone-Gross, a developer and threat analyst at LastLine, a cybercrime intelligence and network monitoring firm.

For starters, the most recent version of Waledac -- the successor to the Storm worm -- contains 123,920 login credentials for FTP servers, through which Waledac's botmasters -- or rather, their automated attack toolkits, issue instructions to worm-infected (aka zombie) PCs.

Oftentimes, these instructions involve rerouting the browsers of infected machines to Web sites that serve malware or advertisements for discount pharmaceuticals. In January alone, LastLine saw the worm redirecting to nearly 10,000 compromised or malicious Web pages across 222 Web sites.

LastLine also discovered that Waledac contains 489,528 credentials for POP3 email accounts. "These credentials are known to be used for 'high-quality' spam campaigns," Stone-Gross said. "The technique abuses legitimate mail servers by authenticating as the victim through the SMTP-AUTH protocol to send spam messages. This method makes IP-based blacklist filtering considerably more difficult."

In December 2010, the previous version of Waledac went dark for about a week. After its hiatus, the updated version appeared, containing not only the built-in credentials, but also enhanced command-and-control capabilities, including improvements in the proprietary Ad Hoc Network Management Protocol (ANMP) the worm uses to communicate with a "bootstrap server" that issues its instructions.

Although Waledac has been relatively quiet recently, the worm still has cybercrime potential to spare. "The Waledac botnet remains just a shadow of its former self for now, but that's likely to change given the number of compromised accounts that the Waledac crew possesses," said Stone-Gross. As of January 2011, LastLine said that the Waledac botnet appeared to comprise about 12,000 infected machines.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.