Computer Associates has warned of a co-ordinated malware attack (CMA) described as among the most sophisticated yet unleashed on the net. The attack involves three different Trojans – Glieder, Fantibag and Mitglieder – in a co-ordinated assault designed to establish a huge botnet under the control of hackers. CA reckons that access to the compromised PCs is for sale on a black market, at prices as low as five cents per PC.
CA security researchers reckon the three items of malware have been combined to maximise the potency of the overall assault. The elements of the attack include:
Glieder-AK: the "infantry element" of the malware attack infects systems, open up backdoors that exploited by the follow-on Trojans. On 1 June, 2005, eight new Glieder variants appeared in rapid succession and quickly spread. "The apparent objective is to get to as many victims as fast as possible with a lightweight piece of malware," CA said.
The Fantibag Trojan further disables the security features of compromised systems. It exploits networking features of target systems to prevent those systems from being able to communicate with anti-virus firms or with Microsoft’s Windows update site, so isolating infected systems.
The Mitglieder Trojan opens a backdoor on a compromised system, leaving them under the control of hackers.
"The co-ordination between the Glieders and Fantibag Trojans can have a potentially devastating effect on desktop systems. This phenomenon is indicative of how malware is becoming increasingly sophisticated and more directly linked to criminal endeavours," said Simon Perry, CA's VP of security strategy, EMEA.
MyTob 'dumbs down' virus creation
Confusingly, the Glieders and Fantibag Trojans are both known as Bagle downloader variants by other anti-virus vendors. Altogether it’s been an exceptionally busy week for new computer viruses. As well as the attack described by CA numerous new versions of the MyTob worm have also been produced. These variants typically pose as warnings from sys admins about the misuse of a potential victim's email account with Subject lines such as "*DETECTED* Online User Violation, Your Email Account is Suspended For Security Reasons and Account Alert."
When an infected attachment is launched, MyTob-CM (the most common of this week's variants) attempts to turn off security applications. It also attempts to open a backdoor on infected Windows PC, allowing hackers to exploit compromised systems. Anti-virus firm Sophos reckons the creators of MyTob appear to be a group of virus writers called Hellbot. Carole Theriault, security consultant at Sophos, said similarities in code point to possible links between the authors of MyTob and the long running MyDoom series of worms.
What makes MyTob stand out as a trend is less the number of recorded infections, which are relatively low, than how rapidly it is propagating, according to Trend Micro. The Japanese ant-virus firm has identified 125 new variants spotted in less than three months. "MyTob appears to have been made even easier to implement and vary. This has been a honey pot for lesser skilled programmers - script kiddies - to make their own variants, contributing to the rapid growth rate of MyTob variants in the wild," it said.
One variant, MyTob-AR, seen earlier this week added spyware and adware to infected computers. This malware can be used to track usage including keystrokes and could be used to steal valuable personal information such as passwords, a worrying development in the evolution of the malware family.
It almost goes without saying but all the MyTob variants, along with the Bagle downloaders, infects only Windows PCs. Apple, Linux and those few souls out there still running OS/2 are all immune, as usual. Standard defence precautions against viral attacks apply in defending against the various new Windows worms and Trojans released this week. Windows users need to apply the latest security patches, update anti-virus tools and to resist the temptation to open suspicious-looking emails. Applying a personal firewall wouldn't go amiss either. ®
related stories
Blank virus blanks email
Window of exposure lets viruses run rampant
Trojan attack takes files hostage
Sober worm tops May viral charts
Computer Associates are warning of a current three pronged, co-ordinated malware attack on computers that are using Microsoft Windows and are connected to the Internet. The attack involves the use of three different Trojan horses called Glieder, Fantibag and Mitglieder. The goal is to create a botnet consisting of a large number of compromised computers. Access to this group of compromised machines will then be available on a black market, at prices as low as five cents per machine.

*Win32.Glieder.AK: The first of the three, this Trojan horse attempts to de-activate an extensive list of security/antivirus related processes and services running on the target computer. It also attempts to lower security settings in order to facilitate easier access for subsequent Trojan horses.

*Fantibag: This second Trojan horse creates filters on the target machine in order to prevent access to a large number of antivirus companies' Web sites. Thus, not only is the target computer now well and truly compromised, but an average Windows user will be completely unable to remove these violations of their system.

*Mitgleider: Once the first two Trojan horses have largely eliminated any possibility that the target will be able to defend itself, this one finishes the job. It opens port 38884 and configures it to act as a SOCKS 4 proxy, but the compromised system can now also be commanded to do the following:-
**Changing the backdoor port number
**Updating the trojan
**Downloading and execute files
**Uninstalling the trojan
**Initiating an SMTP server on TCP port 25, which can be used to relay spam.
**Executing files on the infected computer
**Downloading and executing files via an URL

It should be noted that these Trojan horses only affect the Microsoft Windows family of operating systems. No other operating systems (such as Linux and Apple's OS X) are vulnerable.  In order to prevent infection, Windows users are advised to ensure that they have the latest operating system patches from Microsoft, that their chosen antivirus software is up to date, and that they are using firewall software where appropriate.