Spambot infected more than 10,000 service providers in three days, M86 study says

Dark Reading Staff, Dark Reading

July 15, 2010

1 Min Read

The botnet Asprox, long known for its spamming capabilities, resurged last month, according to a new first-half lab report by M86 Security.

Asprox, which also uses SQL injection techniques to infect vulnerable application service provider (ASP) sites on a large scale, showed a large spike in activity in June, infecting more than 10,000 ASPs in a three-day period, M86 says. The bot downloads instructions, which include target ASP websites, and then performs an SQL injection attack that attempts to poison data in the underlying SQL database serving the site.

Interestingly, the botnet used a simple Google search to seek out additional vulnerable ASP sites, M86 says.

Asprox is typical of the new breed of combined attacks that grew significantly in the first half of 2010, according to the report, which outlines a number of trends in spam and malware.

"Traditional methods [of attack], such as spambots and dynamic code obfuscation, are still very much in use," said Bradley Anstis, vice president of technology strategy at M86 Security. "However, the first half of 2010 has also seen the emergence of new, advanced methods -- as seen in the new combined attacks. Cybercriminals continue to try and outsmart even the latest Internet security protection mechanisms."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights