Trojan Uses Hotmail and Gmail as Spam Host

By Anuradha Shukla

TMCnet Contributing Editor

 

BitDefender has announced that a joint effort between the BitDefender and Yahoo security teams have apparently stymied the criminals behind Trojan.Spammer.HotLan to generate and use Yahoo accounts to send spam.

The company points out that the malware authors have switched to generating Hotmail and Gmail accounts to send their spam. BitDefender believes that the malware authors have found a way of bypassing the captcha systems of the two webmail providers.

The captchas ensure that it is humans, not computers who try to create the account, in an effort to stem exactly this kind of service abuse.

BitDefender explains that every active copy of the HotLan trojan tries to create an account, sending off the captcha image in an encrypted form to a spammer-controlled Website. A solution is then sent back to it and entered in the appropriate field. The trojan then pulls encrypted spam e-mails from another Website, decrypts them and sends them to (presumably valid) addresses taken from yet another Website.

According to Viorel Canja, head of BitDefender Antivirus Lab, there were 514 thousand Hotmail accounts created as of Friday, as well as about 49 thousand at Google (News - Alert).

“However, it is worth noting that while most of the Hotmail accounts are operational, Gmail accounts get blocked pretty fast, usually about a couple of days after being created,” said Canja in a statement to the press.

BitDefender was reportedly the first security company to detect the trojan and add a generic signature, which has successfully identified all the versions of the trojan created so far. The company has offered support to the affected parties.

Don't forget to check out TMCnet’s White Paper Library, which provides a selection of in-depth information on relevant topics affecting the IP Communications industry. The library offers white papers, case studies and other documents, which are free to registered users.