{"id":777,"date":"2008-01-02T14:07:02","date_gmt":"2008-01-02T14:07:02","guid":{"rendered":"https:\/\/www.darknet.org.uk\/2008\/01\/nugache-the-next-big-storm\/"},"modified":"2015-09-09T19:39:42","modified_gmt":"2015-09-09T11:39:42","slug":"nugache-the-next-big-storm","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2008\/01\/nugache-the-next-big-storm\/","title":{"rendered":"Nugache &#8211; The Next Big Storm?"},"content":{"rendered":"<p>[ad]<\/p>\n<p>We&#8217;ve covered quite a few <a href=\"https:\/\/www.darknet.org.uk\/tag\/storm\/\">Storm<\/a> stories &#8211; now it seems there is a new player in town, which could possibly the most advanced malware and botnet instigator so far.<\/p>\n<p>It&#8217;s also something I&#8217;ve predicted before, peer to peer malware networks running without a command and control server, no single point of failure and much more tricky to take down. The guys writing these things are getting smart, random communications, peers drop and reconnect, everything is encrypted..<\/p>\n<blockquote><p>Dittrich, one of the top botnet researchers in the world, has been tracking botnets for close to a decade and has seen it all. But this new piece of malware, which came to be known as Nugache, was a game-changer. With no C&#038;C server to target, bots capable of sending encrypted packets and the possibility of any peer on the network suddenly becoming the de facto leader of the botnet, Nugache, Dittrich knew, would be virtually impossible to stop.<\/p>\n<p>&#8220;The authors are making these subtle little changes to keep it under the radar, and they&#8217;re succeeding,&#8221; said Dittrich.<\/p>\n<p>This is the future of malware and it&#8217;s not a pretty picture. What it is, is a nightmare: a new breed of malicious software developed, tested and sold by professionals and engineered to change on the fly, adapt to its environment and evade traditional defenses. <\/p><\/blockquote>\n<p>It&#8217;s definitely going to be interesting watching this one develop and waiting to see what kind of countermeasures come up. Software quality is starting to appear in malware, these are robust and technically competent worms and botnets.<\/p>\n<blockquote><p>The creators of these Trojans and bots not only have very strong software development and testing skills, but also clearly know how security vendors operate and how to outmaneuver defenses such as antivirus software, IDS and firewalls, experts say. They know that they simply need to alter their code and the messages carrying it in small ways in order to evade signature-based defenses. Dittrich and other researchers say that when they analyze the code these malware authors are putting out, what emerges is a picture of a group of skilled, professional software developers learning from their mistakes, improving their code on a weekly basis and making a lot of money in the process.<\/p><\/blockquote>\n<p>It seems like it&#8217;s a real cottage industry right now and there are some very talented programmers and security specialists working on these projects.<\/p>\n<p>But then again it&#8217;s just like any other industry, where there&#8217;s bad there&#8217;s good and vice versa..and there is money to be made on both sides of the fence.<\/p>\n<p><!--adsense#New468--><\/p>\n<p>Source: <a href=\"http:\/\/searchsecurity.techtarget.com\/originalContent\/0,289142,sid14_gci1286808,00.html\">SearchSecurity.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>[ad] We&#8217;ve covered quite a few Storm stories &#8211; now it seems there is a new player in town, which could possibly the most advanced malware and botnet instigator so far. It&#8217;s also something I&#8217;ve predicted before, peer to peer malware networks running without a command and control server, no single point of failure and [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[7],"tags":[2385,2593,2386,115,111,113,497],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/777"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=777"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/777\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}