A number of spam campaigns containing Rapidshare links point to Trojans and other malware stored on the cloud-based storage site.
Spammers
are using cloud-based storage services to store malware, allowing them to
circumvent e-mail spam filters, according to security experts at Kaspersky Lab
and MX Lab.
Kaspersky
Lab detected the click-fraud Trojan, a variant of the
Trojan-Dropper.Wind32.Drooptroop family, which has been in circulation since
the beginning of December, said
Vicente
Diaz, a Kaspersky Lab expert. There are over 7,000 variants of this
particular family, according to Kaspersky. As with other types of malware that
took advantage of the
holiday
season, the executable file for this Trojan was named gift.exe, Diaz said.
The
security firm detected more than 1,000 infections using this technique to
distribute this variant, according to Diaz.
The
Trojan is stored on Rapidshare, a cloud-based file-sharing and storage service.
The spam messages that users receive in their in-box have no text, just a
single link pointing to a valid Rapidshare URL. These messages get past spam
filters because there are no malicious files attached, the domain name is not
considered a "bad" one, and executables hosted on Rapidshare aren't
automatically classified as a threat, said Diaz.
There
was also a recent fake antivirus spam campaign that included a Rapidshare link
pointing to surprise.exe, according to security firm
MX
Lab. The executable file downloads and installs the fake AV Security Shield
on the user's computer, which runs after the computer is rebooted.
Once
downloaded, there's no guarantee that authentic antivirus products will detect
these Trojans. According to MX Lab, only 16 of the 43 major antivirus products
detected surprise.exe as a Trojan or as fake AV.
Malware
is getting harder to detect, as authors "run through 40 or more antivirus
software [programs] to make sure the viruses they are developing don't get
detected before releasing it,"
Neil
Daswani, CTO of Dasient, told eWEEK.
The
Drooptroop Trojan hooks into the spoolsv.exe process and intercepts network
traffic to and from the browser, redirects user requests, and allows a remote
user to gain access to the system, said Diaz. The Trojan also has a fake AV
component, as it displays a fake AV scan inside a browser window to scare the
user into buying the counterfeit security product.
Scammers
seem particularly attracted to Rapidshare for hosting malware. Sophos warned
about spam messages with Rapidshare links pointing to a fake AV back in 2009.
Jerome Segura of
Pareto Logic also reported several pieces of malware being stored on the
site. Those files were downloaded by other Trojans, not by a user, Segura
said.
"This
is a major risk and flaw in file hosting services" and "rather
convenient" for the bad guys, Segura said.
Because
of the holiday, Rapidshare was not available for comment.
Enterprises
work with cloud storage providers to reduce IT operating costs and simplify
maintenance. Spammers are apparently thinking along similar lines, such as not
having to deal with bandwidth costs, said Segura. Using
a free service makes the fake AV scam even more profitable, said Diaz.
Malware
has taken advantage of other online cloud services in the past, said Diaz.
Examples include using Twitter as a communication channel for botnets, Amazon
EC2 to host remote control servers and advertising networks to distribute
malicious ads.
Email
Print
