[ISN] Hacked computers receive updated spam tool

[InfoSec News]

http://www.computerworld.com/securitytopics/security/virus/story/0,10801,110599,00.html

By Jeremy Kirk
APRIL 17, 2006
IDG NEWS SERVICE

Computers infected with a well-known piece of malware began
downloading a new spam tool Sunday night used by hackers to send
unwanted e-mail.

Malware writers working as part of the infamous Bagle spam gang began
sending a new spamming tool Sunday night to thousands of hacked
computers, said Mikko Hypponen, chief research officer at F-Secure
Corp., a security company in Helsinki, Finland.

If a computer is infected with the Bagle worm, a hacker can download
other malicious programs to the machine. In turn, those programs can
send out spam to other machines without the knowledge of the user.

Once a computer is under their control, malware writers can upgrade
the malicious software they have installed. Last night, machines
infected with Bagle variants were downloading the new spam tool from a
server in Slovakia hosting a real-estate Web site.

"This is the way virus writers can upgrade the infected machines,"  
Hypponen said. "It's like [Microsoft Corp's] Windows update for
viruses."

The download link was buried within the Web site, and it's unlikely
the owners had any idea it was being used. Last night, the link was
cut off, Hypponen said.

But within hours, a French site hosted in the U.S. was hosting a link
with the malware, Hypponen said. The Internet service provider hosting
that site has been contacted, but so far, the link remains active, he
said.

F-Secure uses automated tools to poll URLs used by virus writers to
host bad malware, Hypponen said.

About 99% are decoys, set up to throw off attempts to track them down.  
But when a site suddenly becomes active, Hypponen said, efforts are
made to contact the Internet service providers to shut them down.