Zombie builders send out phone texts

CNET News.com ^ | June 23, 2006 | Tom Espiner

[nickcarraway]

Hackers are trying to lure people to a malicious Web site using cell phone text messages, a security company has warned.

The blended attack uses social engineering techniques in its attempt to trick people to the site, security vendor Websense said in an advisory. An SMS text message is sent to the targets' cell phones, thanking them for subscribing to a fictitious dating service. The message states that they will be automatically charged a fee of $2.00 per day via their phone bill, unless their subscription is cancelled online.

The same message has also been sent multiple times to the comments section of numerous bulletin boards, Websense said. The attack began on Thursday in the U.S. and was first detected by Sunbelt Software, a security software vendor, Websense said.

Once victims visit the purported dating site to unsubscribe, they are prompted to download a Trojan horse program. (A Trojan horse is malicious software that disguises itself as another kind of application.) The attackers provide instructions on how to bypass security warnings in Internet Explorer, Websense said.

After the Trojan horse--a variant of a program Websense calls "Dumador"--is installed, it turns the computer into a "zombie," allowing it to be remotely controlled by the hackers. The compromised machines then become part of a "bot" network, which can then be used to launch distributed denial-of-service attacks.

"This is definitely the first time we've seen this specific approach," said Ross Paul, a senior product development manager at Websense. "Basically, they're taking a social engineering attack vector with a lot of users."

Websense said it had been monitoring the attacks, but couldn't divulge the identity of those responsible or say whether it was collaborating with the authorities on the case.

In other news: Microsoft swims upstream on security Cisco's prime position in IP networking Open-and-shut cases for Office News.com Extra: Tech gurus say they'll 'switch from Mac' Video: Reporter or rodent? "In general, these kinds of attack are perpetrated by organized rings of people. In some cases we know their nicknames, which we share with law enforcement. We regularly share information with the police, when that makes sense," Paul said.

Websense could not say how many users had been affected by the attack. Monitoring botnet activity is "very difficult" to do because of the crossborder nature of the networks, Paul said.

The Dumador Trojan allows hackers to use HTTP to control the bots and trigger them to upload information. Typically, the most popular method of bot control is through Internet Relay Chat (IRC).

[nickcarraway]

ping

[SamAdams76]

They say that to do injustice is, by nature, good; to suffer injustice, evil; but that the evil is greater than the good. And so when men have both done and suffered injustice and have had experience of both, not being able to avoid the one and obtain the other, they think that they had better agree among themselves to have neither; hence there arise laws and mutual covenants; and that which is ordained by law is termed by them lawful and just. This they affirm to be the origin and nature of justice;—it is a mean or compromise, between the best of all, which is to do injustice and not be punished, and the worst of all, which is to suffer injustice without the power of retaliation; and justice, being at a middle point between the two, is tolerated not as a good, but as the lesser evil, and honoured by reason of the inability of men to do injustice. For no man who is worthy to be called a man would ever submit to such an agreement if he were able to resist; he would be mad if he did. Such is the received account, Socrates, of the nature and origin of justice.