London’s Metropolitan Police department confirmed to CBS News on Wednesday that their e-crime unit was investigating a botnet created by Ukrainian hackers. The Met would not say what other agencies they are working with, but they do often work with other agencies on cases involving international cyber-crime, including the FBI.
CBSNews.com partner CNET reported Tuesday that Ophir Shalitin, Finjan’s marketing director, said in an interview on the eve of the RSA security conference that the gang had compromised computers in 77 government-owned domains in the U.S. and elsewhere.

[Cops Hunting Monster-Botnet Builders]

The botnet, which appears to be larger than the infamous Storm botnet was in its heyday, has infected machines from some 77 government-owned domains — 51 of which are U.S. government ones, according to Ophir Shalitin, marketing director of Finjan, which recently found the botnet. Shalitin says the botnet is controlled by six individuals and is hosted in Ukraine.
Aside from its massive size and scope, what is also striking about the botnet is what its malware can do to an infected machine. The malware lets an attacker read the victim’s email, communicate via HTTP in the botnet, inject code into other processes, visit Websites without the user knowing, and register as a background service on the infected machine, for instance. The bots communicate with their command and control systems via HTTP.

[Researchers Find Massive Botnet On Nearly 2 Million Infected Consumer, Business, Government PCs]

The presence of a Conficker infection may be detected if a user is unable to navigate to the following websites:

http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm&inid=us_ghp+link_conficker_worm

http://www.mcafee.com

If a user is unable to reach either of these websites, the Conficker infection may be indicated (the most current variant of Conficker interferes with queries for these sites, preventing a user from visiting them). If a Conficker infection is suspected, the infected system should be removed from the network. Major anti-virus vendors and Microsoft have released several free tools that can verify the presence of a Conficker infection and remove the worm. Instructions for manually removing a Conficker infection from a system have been published by Microsoft in Knowledgebase Article 962007.
US-CERT encourages users to prevent a Conficker infection by ensuring all systems have the MS08-067 patch (part of Security Update KB958644, which was published by Microsoft in October 2008), disabling AutoRun functionality (see US-CERT Technical Cyber Security Alert TA09-020A), and maintaining up-to-date antivirus software.
US-CERT will provide additional information as it becomes available.

[Conficker Worm Targets Microsoft Windows Systems]

John Schiefer, 27, of Los Angeles, who used the online handle “acidstorm,” pleaded guilty last year to accessing protected computers to conduct fraud, disclosing illegally intercepted electronic communications, wire fraud and bank fraud. Schiefer was sentenced by United States District Judge A. Howard Matz, who also ordered the defendant to pay a $2,500 fine.
When he pleaded guilty, Schiefer admitted that he illegally accessed hundreds of thousands of computers in the United States and that he remotely controlled these compromised machines through computer servers. Once in control of the “zombie” computers, Schiefer used his botnets to search for vulnerabilities in other computers, intercept electronic communications and engage in identity theft.
In connection with the wiretapping scheme, Schiefer admitted that he and others installed malicious computer code, known as “malware,” on zombie computers that captured electronic communications as they were sent from users’ computers. Because victims with compromised computers did not know that their computers had become infected and were “bots,” they continued to use their computers to engage in commercial activities, such as making online purchases. Schiefer’s “spybot” malware allowed him to intercept communications sent between victims’ computers and financial institutions, such as PayPal. Schiefer sifted through those intercepted communications and mined usernames and passwords to accounts. Using the stolen usernames and passwords, Schiefer made purchases and transferred funds without the consent of the victims. Schiefer also gave the stolen usernames and passwords, as well as the wiretapped communications, to others. Schiefer is the first person in the nation to plead guilty to wiretapping charges in connection with the use of botnets.
Schiefer also admitted stealing information from numerous computers by accessing the PStore, which is intended to be a secure storage area of computers running Microsoft operating systems. To accomplish this, Schiefer installed malware on computers that caused them to send account access information, including usernames and passwords for PayPal and other financial websites, to computers controlled by Schiefer and others. Schiefer used that information to make unauthorized purchases using funds transferred directly from victims’ bank accounts. Finally, Schiefer admitted defrauding a Dutch Internet advertising company with his armies of zombie computers. Schiefer signed up as a consultant with the advertising company and promised to install the company’s programs on computers only when the owners of those computers gave consent. Instead, Schiefer and two co-schemers installed that program on approximately 150,000 zombie computers whose owners did not give consent. Schiefer was ultimately paid more than $19,000 by the advertising company.
In addition to his guilty pleas to the criminal charges, Schiefer has agreed to pay approximately $20,000 in restitution to the Dutch advertising company and financial institutions that he defrauded.
This case was investigated by the Federal Bureau of Investigation.

[Conficker Activity Update]

[Virus Bulletin announces new anti-spam certification scheme]

It’s important that if you haven’t patched Windows yet, you do so immediately at the Microsoft update web site .
[New Windows worm builds massive botnet]

Unpatched exploits like this are still common with Internet Explorer and it’s why we recommend users avoid using the web browser. While Firefox is far from perfect, Mozilla Corporation is much more responsive to security exploits and release security patches in a much more timely manner.
[Zero-Day IE7 Flaw Being Actively Exploited]