Free Newsletter
Register for our Free Newsletters
Newsletter
Zones
Access Control
LeftNav
Alarms
LeftNav
Biometrics
LeftNav
Detection
LeftNav
Deutsche Zone (German Zone)
LeftNav
Education, Training and Professional Services
LeftNav
Government Programmes
LeftNav
Guarding, Equipment and Enforcement
LeftNav
Industrial Computing Security
LeftNav
IT Security
LeftNav
Physical Security
LeftNav
Surveillance
LeftNav
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
ProSecurityZone Sponsor
 
 
News

Education and military domains targeted as spam relays

BitDefender UK : 01 May, 2008  (Technical Article)
Video files on .edu and .mil domains contain prompt for Media Player download that contains Trojan.
BitDefender has announced that BitDefender antivirus analysts have uncovered a spam-sending scheme of Byzantine complexity. The discovery came with the identification of spam e-mails which claim to contain links to videos. When users try to click and see the video, they are instead prompted to download a 'media player."

The media player is in fact Backdoor.Edunet.A, a piece of malware which uses victims' computers as a channel for sending commands to a series of mail servers. The mail servers, which are used to spread spam, are mostly in the .edu and .mil domains.

The list of servers is retrieved by the trojan from a series of web servers which are either compromised themselves or part of the attackers' own network. The list of web servers is continuously changing, but that of the targets has, so far, remained constant.

The trojan sends the commands in the hopes of finding an open relay - a mis-configured mail server that allows anyone to send e-mails - basically making it appear that any mail originating from the trojan is actually one that has been sent from the open relay.

BitDefender researchers have determined that, at least currently, none of the servers in the current target list are actually vulnerable.

'It's not every day that you stumble on the workings of an honest-to-God hacking ring, let alone one that has a predilection for using military and university-run mail servers as spam relays," declared Sorin Dudea, BitDefender's head of AV Research. "It would be interesting to identify what, if anything, the institutions that own the targeted servers have in common."

For further details on the new celebrity spam botnet, please visit BitDefender's Defence Portal site.
Bookmark and Share
 
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
 
   © 2012 ProSecurityZone.com
Netgains Logo