Die, Spyware, Die!

The Italian Job

Illustration: Brian Stauffer

If you need evidence that the spyware threat has expanded beyond Web snooping and pop-up ads, check out the complicated story behind The Italian Job.

Though the name refers to a heist film (and its remake), "The Italian Job" in this case was a cyberattack that targeted Italian Web sites, combining hacked Web servers, drive-by browser exploits, password-stealing spyware programs, and stealthy rootkits. Researchers at Trend Micro discovered this blended attack in July when thousands of Italian-language Web sites were hacked and booby-trapped.

By the time law enforcement authorities hooked up with Web site owners to help investigate the rigged sites, the attack's keystroke-logging software had uploaded a multitude of user names and passwords to hacker-controlled servers.

"They were just casting the net as wide as possible, mostly looking for user names and passwords for online games and banking sites," says Trend Micro researcher Paul Ferguson. Traditional signature-based antivirus and antispyware protections didn't provide much help until after the malicious Web sites were discovered, according to Ferguson.

Researchers (including Ferguson) traced the attacks to an exploit-generating kit called MPack that is available as a software product on the Internet. Originally sold on Russian underground sites, this do-it-yourself attack tool is used primarily to seed hijacked Web sites through a maze of browser redirects and drive-by downloads.

Ferguson says that MPack also comes with a rootkit component that hides deep inside an attacked operating system, away from inquisitive eyes of security scanners.

Antivirus veteran Roger Thompson, who keeps track of malicious Web activity for Exploit Prevention Labs, believes that today's sophisticated malware threats demand a stronger response than an antispyware application that merely looks at client/server communications for signs of usage-tracking activity. "When you depend on signatures, you're always playing catch-up. The bad guys are timing their attacks carefully, tweaking their code ever so slightly to stay ahead of antivirus and antispyware software," he says.

As the threats continue to evolve, security companies struggle to keep pace--and none have to move faster than developers of antispyware applications.

Ryan Naraine is a freelance technology journalist who specializes in Internet and computer security issues.