Storm Botnet Is Behind Two New Attacks

We've gotten a number of submissions about the new tricks the massive Storm botnet has been up to. Estimates of the size of this botnet range from 250K-1M to 5M-10M compromised machines. Reader cottagetrees notes a writeup at Exploit Prevention Labs on a new social engineering attack involving YouTube. The emails, which may be targeted at people who use private domain registrations, warn the recipient that their "face is all over 'net" on a YouTube video. The link is to a Storm-infected bot that attacks using the Q4Rollup exploit (a package of about a dozen encrypted exploits). And reader thefickler writes that the recent wave of "confirmation spam" is also due to Storm, as was the earlier, months-long "e-card from a friend" series of attack emails.

Comments

Skynet...

[Colin Smith]

It's looking for more processing power...

http://www.emhsoft.com/singularity/

YKIMS!

Re:Thank you Microsoft

[Anonymous Coward]

Hope your happy Billyboy Gates! Hope my happy Billyboy Gates what?!

Re:Ha!

[MrMr]

Most Linux users seem to understand that it is unwise to surf while logged in as root, but at the same time they setup the Windows systems at their friends homes to do so, because "it would be too much of a hassle to use separate accounts for admin and working

You mean it is the evil linux haxors that deliberately sabotage poor Microsoft?

That is hilarious.

If only they could use the botnet for the good...

[Jafafa Hots]

... of all mankind. A distributed computing project for the benefit of the human race. Like, cracking blu-ray DRM or something.

Re:Thank you Microsoft

[ScentCone]

Hope your happy Billyboy Gates!

I'm not sure which is worse: unpatched Windows machines, or Linux boxes without the critical patch that allows fanboys to type the word "you're."

Re:Ha!

[ewhenn]

Agreed, but the other thing about this problem that really seems to burn all the sysadmins and network admins and IT geeks out here is that with all the amazing knowledge and problem solving abilities, no one has been able to devise an elegant solution to this problem.

That's because there is no elegant solution to social eng. attacks. The extent of human ignorance is obscene.

I bet if I sent out some random crap exe to a bunch of people, which when opened it would popup a box that said, "h4ck.exe would like to steal your credit card numbers, shit in your bed, and screw your girlfriend. Would you like to continue?" Ok, or cancel. And some people STILL would click ok.

Re:Thank you Microsoft

[Raideen]

My Linux box works fine. I'm not sure what you're problem is. ;-)

Re:I had a 500% increase in Spam on Tuesday Last W

[geekboy642]

Are you nuts? Nobody on Slashdot RTFAs.