New Massive Botnet Twice the Size of Storm -Kraken botnet

[Malcontent]

http://www.darkreading.com/document....WT.svl=news1_1

SAN FRANCISCO -– RSA 2007 Conference –- A new botnet twice the size of Storm has ballooned to an army of over 400,000 bots, including machines in the Fortune 500, according to botnet researchers at Damballa.

The so-called Kraken botnet has been spotted in at least 50 Fortune 500 companies and is undetectable in over 80 percent of machines running antivirus software. Kraken appears to be evading detection by a combination of clever obfuscation techniques, including regularly updating its binary code and structuring the code in such a way that hinders any static analysis, says Paul Royal, principal researcher at Damballa.

"It's easy to trace but slow to get antivirus coverage. It seems to imply [the creators] have a good understanding of how AV tools operate and how to evade them," Royal says.

Kraken's successful infiltration of major enterprises is a wakeup call that bots aren't just a consumer problem. Damballa and other botnet experts over the past few months have seen an unsettling rise in bot infections in enterprises.

[FanJ]

From that article:

Just how Kraken is infecting machines is still unclear, but Royal says the malware seems to appear as an image file to the victim. When the victim tries to view the image, the malware is loaded onto his or her machine. "We know the picture... ends in an .exe, which is not shown" to the user, Royal says.

(emphasis by me)

Didn't we have WormGuard for these kind of things (.jpg.exe etc) for ages already?

I don't know how many of the old folks still use it, but I do.

[SystemJunkie]

Someone should better describe the technique they use.

[DDCchik]

There is some more information here.

http://blog.washingtonpost.com/secur...sh_of_the.html