You Can Be The Next Distributor Of Malware!

Many bold and challenging ideas have finally became successful e-businesses. The sort of web sites we'll speak about today have been launched as result of more than bold ideas.

At a first look a web site like this might seam an average one -- has a pretty agreeable interface, a fully functional home page, a FAQ section, a list of links points, etc. Beside the above, it offers software (!!!) spelling out terms and conditions for using it together with the details about the supported forms of payment.

What really offers this kind of sites is malware (malicious code or simply a kind of viruses) that buyers can use to infect visitors to their sites. It is quite doubtful that this type of e-commerce is legitimate especially when visitors can't find contact information about the providers.

The most interesting thing about this 'service' is that for downloading a spyware Trojan horse to his/her web site, the owner GETS PAID ˆ50 (about $66) per week. There is also a potential to get more money for clean installs of the malicious code on end-user systems. The site promises: "If your traffic is good, we will change rates for you".

Opinions

The web site we were talking about is thought to be Russian. Security researchers consider that web sites like this one are opening a new era of malware development and distribution. This means that times when malware writers distributed their codes only to insiders has pass into oblivion.

Gunter Ollmann, director of security strategies at IBM's Internet Security Systems X-Force says that lately they have to deal with highly organized exploit providers. It mainly works in countries that don't have extradition treaties with USA. The biggest concern about this is that for a small subscription fee (from $20 per month) spyware distributors and spammers can use exploit engines to infiltrate systems worldwide.

What hardens greatly the security software job is the fact that exploit code uses a range of morphing techniques to evade detection, according to Ollmann. The malware writers usually take advantage of the systems' vulnerabilities.

Unmasking

One of this malware providers was disclosed by Don Jackson, a security researcher at SecureWorks Inc. He was studying a Trojan horse called Gozi designed to steal data from encrypted Secure Sockets Layer streams. The code took advantage of a vulnerability in the iFrame tags of Internet Explorer being planted on hosted Web sites, community forums, social networking sites and sites belonging to small businesses.

It appeared to be hosted by a server in St. Petersburg, Russia and maintained by a group called 76Service. But the real creator of the Gozi code is Russian hacking group called the HangUp Team from which 76Service purchased it. Experts say that the estimated price for such a code is about $1,000 to $2,000, depending on how sophisticated it is.

According to security software experts, they deal with professionals who can get to personal information such as passwords, credit card numbers, etc. When it comes to money it is pretty serious, not the teenage hackers!