Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Nugache worm kicking up a Storm

By Ellen Messmer , Network World , 01/07/2008
  • Share/Email
  • Comment
  • Print

Although the infamous Storm worm enters 2008 with a reputation as the world’s most dangerous botnet, security experts say there’s an up-and-comer called Nugache that could give it a run for its money.

Nugache was first sighted about two years ago as a worm designed to work with chat protocols, says Paul Henry, vice president of technology evangelism at Secure Computing. As such, it did not propagate virulently. But last month, hackers believed to be tied to the notorious Russian Business Network online criminal mob gave Nugache  a facelift, copying many of the successful attributes of Storm, such as encryption, a rootkit and the ability to spread as Web-borne malware.

“It’s following the Storm worm,” Henry says. “Nugache now includes the ability to encrypt itself and every version that rolls out is generated a bit differently to obfuscate detection.”

Nugache is now also peer-to-peer controlled to put it under a more decentralized command-and-control structure that makes it difficult to take down the botnet it can construct once it infects desktop machines.

Botnets can be used to send spam messages through compromised machines, among other criminal purposes. The rise of the Nugache botnet appears to already be giving the Storm botnet more competition.

“It’s creating a bargain basement for spam,” Henry says. Prices as low as 1 million spam messages for $100 are being advertised online mainly because of the rise of Nugache, he says.

Business and consumers should be aware that Nugache could attempt to compromise their desktop machines in various ways, particularly through Web-based drive-by downloads. One way it has been seen spreading is through URLs embedded by attackers in blogs.

“It’s not the owner of the blogs doing this,” Henry says. “There’s a program called Xrunner from the black-hat crowd that automates the insertion of URLS for Web-based malware sites for drive-by hacking.” Often, the old “fake video-codec” scam accompanies this ruse by trying to trick users who want to view video segments into downloading the Nugache malware.
Bigtime hacker groups such as the Russian Business network have grown adept into manipulating the Google ratings system to raise their profile in the search-engine display, Henry says.

  • Share/Email
  • Comment
  • Print
Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comments (2)
Login
Forgot your account info?

Not quite rightBy David Dittrich on January 18, 2008, 3:49 amThere are many errors in this story, which I believe result from Mr. Henry's misunderstanding or misinterpreting the source materials mentioned in Bruce Schneier's...

Reply | Read entire comment

RE: Nugache worm kicking up a StormBy Anonymous on January 8, 2008, 12:18 pmDo Nugache servers attack investigative interlopers like Storm servers are noted to do? If so, it seems it could almost be fun if you could spoof one botnet server...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Windows Vista: Necessity and Opportunity

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

Security Considerations When Deploying Remote Access Solutions

Effective network security is most successful when you use a layered approach, with multiple...

Webcasts

Migrating to Windows Vista: Necessity and Opportunity

The Vista era of Windows is here. Yet most organizations will retain Windows XP alongside new Vista...

Turning information into a Competitive Advantage

Companies today are realizing that competitive advantage is harder to sustain when based solely on...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Special Reports

Unified Threat Management from CheckPoint

Discover why Unified Threat Management Firewalls are ready for the enterprise today. High...

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.
Network World,to go. Wherever you are. Breaking news delivered to your mobile device. Select the hottest topics in networking and start receiving Network World on your mobile device today.