World's third largest spam botnet 'Grum' taken down

Security researchers announced they’ve dismantled the world's third-largest botnet, known as Grum, which is believed to have been responsible for 18% of the world's spam.

The shutdown was a joint effort between California security firm FireEye, the British-based Spamhaus Project, and the Russian-based Computer Security Incident Response Team known as CERT-GIB who worked together and convinced the companies that hosted Grum’s command and control servers to pull the plug on the operation.

Grum relies on two types of control servers: one to push configuration updates to the infected computers that are part of the botnet and another to tell the botnet what spam emails to send.

Initially researchers from FireEye were able to take down two command and control (CnC) servers hosted in the Netherlands of the second kind.

While this crippled the botnet’s operation, remaining CnC servers hosted in Russia, Panama, and a few in Ukraine that cropped up at the last minute in response to the previous shutdowns could still be used to update the botnet and direct it to new spam template servers.

Fortunately, that didn’t happen and yesterday Grum was dealt its final blow as folks in the worldwide security industry collaborated to apply pressure to local ISPs and domain registrars to shut down the remaining servers.

The researchers said the botnet had been using as many as 120,000 infected "zombie" computers to send out spam each day. More than 20,000 computers are apparently still spewing out junk email, but without the active CnCs they will soon be rendered ineffective.

First malware ever found in iOS App Store malicious app removed

For the first time, according to Kaspersky Labs, security researchers have unearthed what appears to be malware on the Apple App Store. "Find and Call", a Russian-language app which touted contact list simplification, was discovered to be a little toointerested in its users' contact lists. Security experts discovered that Find and Call would upload the victim's entire address book and GPS coordinates to a remote server, and then proceed to spam all of their contacts.

Apple quickly pulled the app, citing guidelines which prohibit app makers from uploading contacts to remote servers. However, this is not the first time an app from the App Store has quietly stolen address books from unsuspecting iPhone and iPad users.

Path, a popular social photo-taking app, was busted last year by an observant developer who noticed the app was sending more data to third-party servers than it should have. It was discovered that Path was actually storing contact lists on remote servers in order to suggest friends its users.

While Path responded appropriately and their intentions seemed mostly benevolent, users had no idea this was occurring. Following the discovery, Path modified their app to warn users of the behavior. Apple also responded by updating its developer guidelines; however, Apple has since been criticized for not uniformly enforcing some of those rules.

Love it or hate it, Apple's walled garden has seemingly had a positive effect on minimizing malware -- at least, so far. On the other hand, the Android Market (now known as Google Play) has been portrayed as something very different. Reports of malware on Google Play have been frequent and plenty, but Google has taken steps this year to clean up their app store.

Source