Friday, October 06, 2006

Zombie Computers, Backdoor Trojans, and Hackers

If you run a Windows program on your PC, you may have more to worry about than popup ads and other online annoyances. According to a Microsoft report released in June, Backdoor Trojans are one of the most common threats to internet users, and have the potential to put your computer in the hands of a hacker.

A Backdoor Trojan is a group of Trojan horse programs that open a back door in the computer system, allowing a hacker to access the computer and use it as a zombie computer. A zombie is a computer that is controlled by a hacker and can be used to perform malicious tasks remotely, without the knowledge of the computer’s owner. For the most part, zombie computers are used to perform actions that the perpetrator would not want to have traced back to him. Hence, he performs the actions from the zombie computer, effectively covering his tracks.

Some of the more common actions a zombie can be used for are:

  1. Spamming – Spamming involves the sending of massive amounts of spam emails through the zombie.
  2. Click fraud – An act in which the controller of the zombie will use the zombie to click on a pay-per-click ad, generating revenue for a third party.
  3. Distributed denial of service attacks – An attack that makes a computer resource unavailable to its users, either by forcing the computer to reset or consume its resources, or by obstructing the communication media between the intended users and the computer.
In the case of a zombie computer, all this and more can be perpetrated through a victim’s computer without the victim ever having knowledge of it. And, according to a recent report by Cipher Trust, a New York-based messaging security company, a recent spread of Mocbot worm variants that exploit a Windows security flaw has caused a 23 percent rise in Cipher Trust’s detection of zombie computers. Microsoft has issued a patch for the flaw.

Some steps you can take to prevent your computer being captured and converted into a zombie include:
  1. Keep your operating system up to date – Scan your syst5em for missing security patches and install any new ones on a regular basis.
  2. Install the Windows Update tool to get automatic updates to your Windows system.
  3. Upgrade your operating system to its most current version. Older software has a hard time keeping up with current security updates.
  4. Always use a firewall. This is just standard.
  5. Educate yourself on all possible ways to contract a virus, Trojan, or worm, including through open ports as well as email.
  6. Be vigilant about updating your antivirus software, and remember to still take precautions against new infections that antivirus companies may not be aware of yet. Follow the common sense rule of avoiding opening anything you don’t recognize and running an up to date security package.
If your computer is acting sluggish or slowing down frequently, it is possible that it might be being used as a zombie computer. If you think this is the case, the best thing to do is disconnect it from the internet immediately and have it checked by a computer services organization. After the machine has been cleaned of possible viruses, worms, Trojan horses, spyware, and other malware, install and update your antivirus and anti spyware software, firewall, and other security software. Make sure to change all passwords you use online and on the computer, as they may have been intercepted by the remote hacker.