Posted on behalf of Dan Bleaken, Malware Analyst, Symantec Hosted Services

In the past few days we have noticed that the Rustock botnet has been sending a lot more spam using TLS (Transport Layer Security). TLS is the successor to SSL and is a popular way of sending email through an encrypted channel, rather than sending it in the clear like most emails are sent. MessageLabs Intelligence tracks the use of TLS in order to determine how much spam is sent over TLS, and which botnets are sending it.

Not all mail servers force clients to use TLS, but it is frequently used for securing the communications channel between the client email sender and the email server to which the message is being delivered. It prevents eavesdropping of email traffic that would otherwise be sent in plain sight for anyone else on the network to see if they so wished, perhaps using network analysis tools.  Some businesses mandate TLS for remote clients, for example, an employee connecting...

Posted on behalf of Tony Millington, Malware Operations Engineer, Symantec Hosted Services

MessageLabs Intelligence tracked a new targeted attack yesterday using emails pretending to be from the New York Times sending out it's "Times Reader" software hitting six different domains. One domain was a public sector domain, one was a law firm, three were to chemical companies, but most interestingly the last one was an online gambling company. All are UK based companies. The email attacks appear to have originated from Greece. We can't see this being used as a botnet.
 
When executed the "Times Reader Plugin.exe" uses iexplore.exe to send encrypted data which resolves to an IP address in Denmark which looks like a computer on a home network. It doesn't display anything when you run the exe, so the victim wouldn't know they have been infected. The only indication is an iexplore.exe process running when there is no IE browser session...

By Paul Wood, MessageLabs Intelligence Senior Analyst, Symantec Hosted Services

Ten years ago, on 14 February 2000, DDoS or distributed denial-of-service attacks – which attempt to cause disruption to an online service or application – knocked a number of high profile websites leaving them offline for several hours, including a well known auction site, the website of a global news channel and an internationally recognized online retail site. Fast forward a decade and DDoS attacks have evolved to be more sophisticated, more prevalent and more dangerous than ever. Most recently, the website of a prominent Russian newspaper was targeted causing major disruption for the publication and its readers. 

Botnets are a key player in DDoS attacks. Right now, we know that the most prominent spam-sending botnets control over five million active PCs.  The actual number of botnets in existence is likely to be much higher as an infected bot only becomes...

Tuesday 16th February marks the five year anniversary of the first US arrest for SpIM. In 2005 New York teenager Anthony Greco was arrested and charged with sending more than 1.5 million pieces of ’SpIM’ (spam sent through an instant messenger system) advertising pornography and mortgages.

Today enterprises, SMEs and consumers make wide use of Instant Messaging (IM) at work and home to keep in touch with clients, colleagues and friends. However, while IM use is expected to increase considerably over the next year, few users are conscious of the dangers IM presents not only to a single machine but potentially to an entire network. While spam is now an instantly recognised term with computer users, SpIM is still a relatively new kid on the block, yet opening links over IM from an unknown contact comes with the same risks as opening attachments or emails from unknown senders.

MessageLabs Intelligence predicted in our 2009 annual security report (...