PONY BOTNET VERSION 1.9 STRIKES AGAIN 

     Well it seems like some unscrupulous people are out trying to steal your personal information on line again. Surprise! Surprise! Researchers at Trustwaves SpiderLabs have uncovered a database with 2 million stolen user ID's and passwords. Most of these passwords are associated with social media giants like Facebook, Twitter, Yahoo, and more.

     At first glance it seemed like this attack was directed toward the Netherlands, because 97% of the stolen account information originated from here. The United States by comparison had less than 2,000 stolen credentials. Analyzing the data further suggests this wasn't the case. It now appears that this was a global attack.  According to researchers, "A closer look at the IP log files revealed that most of the entries from NL IP range are, in fact, a single IP address that seems to have functioned as a gateway or reverse proxy between the infected machines and the command-and-control server, which resides in the Netherlands as well." This means the researches can't confirm if the Netherlands was indeed the target or just unlucky.

     The malware behind this attack was the Pony Botnet controller Version 1.9. Botnet is a key-logging malware that captures passwords and user credentials from infected machines. This particular bonnet can be built and hosted directly on a web site. From its website it can connect to a SQL database and will automatically store the details from infected users.

     Another troubling bit of information uncovered from this attack was the poor password habits of web site visitors. Some of the most common passwords discovered were1234, 123456, and the word password.

How to know if you are infected and what you should do about it

     For those of you unsure about what a botnet is here is a rather simplistic view of one. Botnets are large networks of infected computers that hackers can control simultaneously. This enables them to preform large scale Denial of Service attacks or send out billions of spam messages. To become part of a botnet a computer needs to be infected with some type of Trojan virus. The best way to prevent this is to protect yourself with a reliable anti-malware program that is current. If the anti-malware program isn't updated on a regular basis it will begin to loose its effectiveness exponetially as new threats are constantly being introduced.

     Even with anti-malware programs installed on your computer savvy users will be on the look out for warning signs of an infection. These can be signs like Windows programs won't open or a loss of performance and basic functionality. If you are experiencing any of these issues it is recommended that you run some type of spy detection software. One that I came across was SpyHunter Detection Scanner. The creators of this program suggest you download it on a known clean computer and either by USD or CD run it on the suspected computer. If a virus is found the full version of SpyHunter can then be purchased, so the virus can be removed.

     Lastly remember to use a secure password. It may not of helped much in this case but there are other threats that can be adverted with secure passwords.

http://www.enigmasoftware.com/ponybotnet-removal/

http://news.cnet.com/8301-1009_3-57614479-83/researchers-discover-database-with-2m-stolen-login-credentials/