Fartashphoto's Blog

The Iranian Cyber Army and Botnets

Posted in Uncategorized by fartashphoto on October 25, 2010

A group of malicious hackers who attacked Twitter and the Chinese search engine Baidu are also apparently running a for-rent botnet, according to new research.

The so-called Iranian Cyber Army also took credit last month for an attack on TechCrunch’s European website. In that incident, the group installed a page on TechCrunch’s site that redirected visitors to a server that bombarded their PCs with exploits in an attempt to install malicious software.

Researchers with a security startup called Seculert have traced the malicious server behind those attacks and found indications that the Iranian Cyber Army may also be running a botnet.

There are many computer crime gangs that create botnets, or networks of compromised computers, that can then be rented to other players in the cybercrime industry, such as spammers.

The Iranian Cyber Army is believed to be behind the botnet since the administration panel showed the same e-mail address that was displayed after the Twitter and Baidu defacement attacks. Also, a page displaying statistics on the number of infected machines showed the group’s name in its HTML source code, according to screenshots posted by Seculert.

The statistics page showed that as many as 14,000 PCs were being infected per hour. Since the server has been active since August, Seculert estimates it may have successfully infected as many as 20 million PCs.

The botnet has been used to distribute some of the more notorious malicious software programs including Zeus, which is used to hack into online banking accounts, and the data-stealing Trojans called Gozi and Carberp, Raff said.

An e-mail address links the botnet to earlier attacks claimed by the Iranian Cyber Army.

When Twitter was attacked in December 2009, users were direct to a different website bearing a green flag and the message “This site has been hacked by Iranian Cyber Army,” along with the group’s supposed e-mail address.

As I wrote in my last article, (Cyber Army and Stuxnet in a Cyber war) Iran’s regime like to retaliate with a cyber attack against Israel or the West and I think that’s what they’re doing now.

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: