{"id":7187,"date":"2015-12-04T14:43:11","date_gmt":"2015-12-04T22:43:11","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=7187"},"modified":"2019-04-20T16:24:32","modified_gmt":"2019-04-20T16:24:32","slug":"7187","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=7187","title":{"rendered":"DorkBot Technical Alert (TA15-337A) by DHS, FBI, and Microsoft"},"content":{"rendered":"

\t\t\t\tAlert (TA15-337A)<\/a><\/strong>\nDorkbot\nOriginal release date: December 03, 2015\nSystems Affected<\/strong>\nMicrosoft Windows\nOverview<\/strong>\nDorkbot is a botnet used to steal online payment, participate in distributed denial-of-service (DDoS) attacks, and deliver other types of malware to victims\u2019 computers. According to Microsoft, the family of malware used in this botnet \u201chas infected more than one million personal computers in over 190 countries over the course of the past year.\u201d The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI) and Microsoft, is releasing this Technical Alert to provide further information about Dorkbot.\nDescription<\/strong>\nDorkbot-infected systems are used by cyber criminals to steal sensitive information (such as user account credentials), launch denial-of-service (DoS) attacks, disable security protection, and distribute several malware variants to victims\u2019 computers. Dorkbot is commonly spread via malicious links sent through social networks instant message programs or through infected USB devices.\nIn addition, Dorkbot\u2019s backdoor functionality allows a remote attacker to exploit infected system. According to Microsoft\u2019s analysis, a remote attacker may be able to:\n\t\n\n

  • Download and run a file from a specified URL;\n\n\n
  • Collect logon information and passwords through form grabbing, FTP, POP3, or InternetExplorer and Firefox cached login details; or\n\n\n
  • Block or redirect certain domains and websites (e.g., security sites).\n<\/li>\n\n
    \nImpact<\/strong>\nA system infected with Dorkbot may be used to send spam, participate in DDoS attacks, or harvest users’ credentials for online services, including banking\nservices.\nSolution<\/strong>\nUsers are advised to take the following actions to remediate Dorkbot infections:\n\n\n
  • Use and maintain anti-virus software \u2013 Anti-virus software recognizes and protects your computer against most known viruses. Even though Dorkbot is designed to evade detection, security companies are continuously updating their software to counter these advanced threats. Therefore, it is important to keep your anti-virus software up-to-date. If you suspect you may be a victim of Dorkbot, update your anti-virus software definitions and run a full-system scan. (See Understanding Anti-Virus Software for more information.)\n\n\n
  • Change your passwords \u2013 Your original passwords may have been compromised during the infection, so you should change them. (See Choosing and Protecting Passwords for more information.)\n\n\n
  • Keep your operating system and application software up-to-date \u2013 Install software patches so that attackers cannot take advantage of known problems or vulnerabilities. You should enable automatic updates of the operating system if this option is available. (See Understanding Patches for more information.) Use anti-malware tools \u2013 Using a legitimate program that identifies and removes malware can help eliminate an infection. Users can consider employing a remediation tool (see example below) to help remove Dorkbot from their systems.\n\n\n
  • Disable Autorun \u2013 Dorkbot tries to use the Windows Autorun function to propagate via removable drives (e.g., USB flash drive). You can disable Autorun to stop the threat from spreading.<\/li>\n\n
    \nMicrosoft<\/strong>\nhttp:\/\/www.microsoft.com\/security\/scanner\/en-us\/default.aspx\nThe above example does not constitute an exhaustive list. The U.S. Government does not endorse or support any particular product or vendor.\nReferences<\/strong>\n\n\n
  • Microsoft Malware Protection Center \u2013 Worm: Win32\/Dorkbot\n\n\n
  • Microsoft Malware Protection Center \u2013 Microsoft assists law enforcement to help disrupt Dorkbot botnets<\/li>\n\n
    \nRevisions<\/strong>\nDecember 3, 2015: Initial Publication]]>\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"

    \t\t\t\t\t\t<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"amazonpipp_noncename":"","amazon-product-isactive":"","amazon-product-single-asin":"","amazon-product-content-location":"1","amazon-product-content-hook-override":"2","amazon-product-excerpt-hook-override":"3","amazon-product-singular-only":"","amazon-product-amazon-desc":"","amazon-product-show-gallery":"","amazon-product-show-features":"","amazon-product-newwindow":"2","amazon-product-show-list-price":"","amazon-product-show-used-price":"","amazon-product-show-saved-amt":"","amazon-product-timestamp":"","amazon-product-new-title":"","amazon-product-use-cartURL":"","amazon_featured_post_meta_key":"","_amazon_featured_alt":"","amazon-product-template":"","footnotes":""},"categories":[64],"tags":[],"class_list":["post-7187","post","type-post","status-publish","format-standard","hentry","category-risks"],"_links":{"self":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7187","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7187"}],"version-history":[{"count":1,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7187\/revisions"}],"predecessor-version":[{"id":7900,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7187\/revisions\/7900"}],"wp:attachment":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7187"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7187"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7187"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}