Slashdot Mirror

← Back to Stories (view on slashdot.org)

Pushdo Trojan Infects 11,000 Systems In 24 Hours

Posted by Unknown on from the bots-everywhere dept.

An anonymous reader writes Bitdefender has discovered that a new variant of the Trojan component, Pushdo, has emerged. 77 machines have been infected in the UK via the botnet in the past 24 hours, with more than 11,000 infections reported worldwide in the same period. The countries most affected so far by the Pushdo variant are India, Vietnam and Turkey. Since Pushdo has resurfaced, the public and private keys used to protect the communication between the bots and the Command and Control Servers have been changed, but the communication protocol remains the same.

9 of 32 comments (clear)

  1. Missing information by Anonymous Coward · · Score: 3, Insightful

    What operating system does this software run on?

    1. Re:Missing information by just_another_sean · · Score: 3, Interesting

      This is what I was wondering... AFAICT the first link is /.'ed and the second link doesn't go in to any technical details. I'm assuming Windows until I hear otherwise but the geographic mix is interesting; are these Windows XP boxes? Is the fact that the infections are concentrated in India and Asia an indication of the many people there that have not upgraded?

      I'd never heard of Pushdo before this, anyone else know more about it?

      --
      Creationist Textbook Stickers Declared Unconstitutional by CowboyNeal
    2. Re:Missing information by mspohr · · Score: 2

      We always assume Windows (to the point where most articles don't even mention it) and that is true again in this case.
      It is useful to know which versions of Windows:
      Systems affected:

      The Pushdo trojan malware affects the following systems:

              Windows 2003
              Windows XP
              Windows 2000
              Windows NT
              Windows 98
              Windows 95

      --
      I don't read your sig. Why are you reading mine?
    3. Re:Missing information by operagost · · Score: 3, Insightful

      So basically, all EOL systems that have no business being connected to a network except for 2003, which also shouldn't be connected unless it has SP2 and all security patches.

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    4. Re:Missing information by grcumb · · Score: 3, Insightful

      Well it runs on Windows obviously. With the number of reported infections, the speed with which it happened, and the fact that it is a Trojan (meaning you need to trick the user into running it), it can only be Windows.

      This propagation rate is positively tiny. Honestly, I don't know why it's even part of the headline. For context, this paper (PDF, sorry) shows Code Red infecting over 500,000 machines in an hour.

      If 11,000 machines in a day is an event, then we should all be sitting back and breathing a sigh of relief that the bad old days are over....

      (Not that I believe that they are. I just don't see any reason for the breathless headline.)

      --
      Crumb's Corollary: Never bring a knife to a bun fight.
  2. Is this a ZeuS variant? by timrod · · Score: 2

    The way the article describes Pushdo, it sounds a lot like ZeuS - they use practically the same methods of operation (DGA to generate random domain names, fast-flux to stop anyone shutting down the C&C servers) and it seems that like ZeuS, Pushdo started from an initial codebase and was changed multiple times after being shut down.

    1. Re:Is this a ZeuS variant? by bogdan.botezatu · · Score: 3

      It's not a Zeus variant. It's world's largest spambot ever (72bn messages per day). The figures show the old bots getting upgraded to the new variant.

  3. No-Ip by Curunir_wolf · · Score: 2

    Just shutdown No-IP servers. That should fix it.

    --
    "Somebody has to do something. It's just incredibly pathetic it has to be us."
    --- Jerry Garcia
  4. Country least affected... by operagost · · Score: 2

    North Korea is least affected, due to their "Don't let anyone have computers, well they don't have electricity anyway" security policy.

    --

    Gamingmuseum.com: Give your 3D accelerator a rest.