Kindsight Blog

Today, we released the Kindsight Security Labs Malware Report for Q1 2012. This quarterly report reveals statistics and security trends for malware infections in home networks and mobile devices. Kindsight Security Labs brings a unique perspective to the space because we detect threats in the network by looking for communications from subscribers’ infected devices to cybercriminal servers.

The ongoing battle against botnets was front and center in the news for March. On one side, Microsoft continued to take a leadership role in the battle, as they were part of another raid to gather evidence and deactivate servers involved in cybercrime. While on the other side, two new botnets were discovered by the security industry.

At the same time, the FCC issued its Anti-Bot Code of Conduct and several organizations formed the Industry Botnet Group to pursue the short-term goals outlined by the U.S. Commerce and Homeland Security departments.

As I was reviewing my email recently, I was “disappointed” to learn that the IRS had declined my Income Tax Refund Appeal due to a misunderstanding of the facts. To speak with someone about it, I could contact them during their convenient office hours on Wednesday and Friday, 3 AM- 8:30 AM, by calling their 1-900 number.

In addition to getting up at an ungodly hour, they will charge $3.59/min to lookup the file to see why they are declining the appeal. Thankfully to avoid this expense and inconvenience, they attached instructions to the email on how to provide the required details and re-submit the appeal.

Late last year, we noticed an encrypted p2p command and control protocol used by malware identified as ZeroAccess, Sirefef, Vobfus and many of other names. The use of this protocol, with slight variations, has been seen in a variety of seemingly unrelated malware samples in our lab, indicating fairly common usage of this component in a number of different malware bundles.

The scale of the infection was quite large. In November, we started to see a significant number of infections. For example, in one network on a single day, we saw 313 infected computers out of a population of 150K. This indicates that roughly one in every 500 computers is infected with some variant of malware that is using this command and control protocol.