Largest Botnet Gains Foothold in Fortune 500
A botnet possibly twice the size of Storm is not just a consumer PC user problem. 50 of the Fortune 500 have been compromised according to Dark Reading:
The so-called Kraken botnet has been spotted in at least 50 Fortune 500 companies and is undetectable in over 80 percent of machines running antivirus software. Kraken appears to be evading detection by a combination of clever obfuscation techniques, including regularly updating its binary code and structuring the code in such a way that hinders any static analysis, says Paul Royal, principal researcher at Damballa.
If static analysis and signature based detection are falling behind, more emphasis is needed on behavioral analysis and network monitoring. With malware developer putting so much effort in avoiding infection detection, we should shift to detecting the output, which in this case is primarily spam. This approach is limited though, we can't wait for more malicious payloads to destroy or steal data to identify them.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
