(September 11 & 14, 2009)
The Grups Trojan horse program uses Google groups as a command
and control channel. Grups requests a page from a certain private
newsgroup to get instructions. Information gathered from examining
the Trojan indicates that it is a prototype in the process of being
tested. While news groups have been used to distribute malware, this
is believed to be the first instance of such a group being used as a
command and control channel, according to Symantec, which discovered
the Grups Trojan.
http://www.theregister.co.uk/2009/09...ontrol_trojan/
http://www.informationweek.com/news/...leID=219900032
http://www.itworld.com/security/7754...nd-and-control
http://www.eweek.com/c/a/Security/Sy...alware-183661/
[Editor's Note (Pescatore): Bot-net generation malware has been
using all kinds of communication channels, from Twitter to news
groups to more generic drop/search/find mechanisms using blog comment
fields, etc. Yet more black list signature approaches (IP address/URL
reputations) will not be sufficient - the executables themselves have
to be dealt with.]
Add to del.icio.us 
Can you digg it?
Linear Mode
