Malware Automates Storing of Data Haul on File-Hosting Site SendSpace
Added 7th Feb 2012Trend Micro researchers have discovered a piece of malicious software that automatically uploads its stolen data cache to the SendSpace file-sharing service for retrieval.
Malware authors have used file-hosting and sharing servers for that purpose before, but this is the first time malware has been noticed to do that automatically, wrote Roland Dela Paz, a threat response engineer with Trend Micro.
SendSpace accepts files and then generates a link that can be shared with other people to download the content in the files. The malware has been configured to send files, copy the download link and send it to a command-and-control server along with the password needed to access the archive, Dela Paz wrote.
It appears SendSpace's terms of service would prohibit use of the site that way. SendSpace said in response to an email that it was "notified of this several days ago by Trend Micro themselves, and we're working to find a solution for this."
File-storage services offer several advantages for cybercriminals, said Rik Ferguson, director of security research and communication for Trend Micro in Europe.
Although the cybercriminals often use networks of proxy computers to mask how they are communicating with a compromised computer, using a storage service adds another layer, Ferguson said. "It breaks in some ways the chain of evidence," he said.
Also, authorities would be less likely to take down a legitimate file-hosting service than a new server set up by scammers, Ferguson said.
The services are especially useful for so-called Advance Persistent Threat attacks, where cyberspies seek to infiltrate an organization for a long period of time, Ferguson said. There is also a better chance that organizations that are hacked will not regard outbound connections to a file-hosting service as suspicious, making it less likely the connection will be shut down, he said.
"Basically it's criminals taking advantage of public infrastructure to appear less suspicious," Ferguson said.
latest news
-
Gearing IT for the Rains: What CIOs Need to Know
Here's how CIOs can prepare their organizations for monsoons, when faced by flooded basements, stranded employees, and disrupted services.
-
Why Microsoft Office for iPad is Inevitable
New reports have surfaced that Microsoft is developing Office apps for iOS and Android. If true, it's a very smart move by Microsoft.
-
Mobile Workers Work Longer Hours
Almost two-thirds of mobile employees say they are working 50 to 60 hour-plus weeks, with most working weekends too, according to research.
-
IBM: Only 16% CEOs Using Social Media to Connect with Customers
IBM says a study it did of some 1,700 Chief Executive Officers worldwide found that many indeed - or should be -- grasping social media as a key enabler of collaboration and innovation.
