IBM Sees Weather DDoS Attacks From Bill Gates Linux Botnet

A botnet that infects Linux computers and used to carry out DDoS attacks is active again, says IBM. It's the "Bill Gates botnet" which last year was first detected, reports IBM . The bot-amplification uses DNS to carry out the DDoS attacks.

With DNS amplification open DNS servers are used to enhance the traffic to the attacked websites or services. An interesting feature of this malware, according to the Russian anti-virus company Dr. Web together with the Finnish F-Secure paid attention to the last year malware. According to the Russian virus fighter is the Gates-malware also allegedly found because of a sophisticated modular structure that never experienced Linux malware.

At the time, it was unknown how the malware was spreading. Something where IBM still has no answer. It is not known who is behind the botnet. However, the company argues that there has been observed a significant increase in traffic, which are used forged packets and the destination IP address in China.

Criminals Steal $ 1 Million Through Malware And Phone Trick

Cyber ​​criminals have managed to steal through a combination of malware and a phone trick more than $ 1 million of companies, says IBM. The attacks on the organizations start with a spear phishing email containing an infected link or attachment. Once the link or attachment is opened the computer becomes the Upatre malware infected. This malware then downloads the Dyre banking Trojan.

This Trojan is designed specifically to steal money from online bank accounts. To bypass the two-factor authentication using more banks cyber criminals use a trick. Once employees log on to the bank site shows the malware on the infected computer a message stating that there are problems with the bank site and a special phone number to be dialed to login.

Once the employee number calling sucked in the login details for online banking and simultaneously used for the transfer of large sums to other accounts. One organization was also due to a DDoS attack, which is likely to serve as a distraction. According to IBM let these attacks show that employees often the weak link in the security and are therefore more in security awareness and training should be invested.

IBM: Most stores In US Attacked via Command Injection

Most stores in the United States that it was the last year the target of an attack were attacked through command and SQL injection, according to a study ( pdf ) from IBM. According to the company halved the number of attacks against American chains, but there were or 61 million records stolen. Every day some 3,000 attacks would be observed, although IBM does not let you know where exactly consist. However, there was an increase in the number of attacks on cash-malware, which criminals infect the systems used by stores to checkout.

Despite several major incidents involving cash-malware played a leading role involved in most incidents in the retail sector command and SQL injection. In command injection are vulnerable applications through commands on the underlying server. SQL injection allows an attacker to execute SQL commands, making it possible for example to read sensitive data from the database.

"The complexity of SQL implementations and the lack of data validation by managers shall ensure that databases are a major target," said the researchers from IBM. Thus, command injection attacks against at nearly 6,000 stores observed. Whilst also brute force attacks and Shellshock leak used by attackers.