<html>
<body>
<blockquote type=cite class=cite cite=""><font size=3><br>
<img src="http://content.govdelivery.com/attachments/fancy_images/USDHSUSCERT/2015/11/675988/us-cert-banner-700x100-2_original.png" width=700 height=100 alt="U.S. Department of Homeland Security US-CERT">
<br><br>
National Cyber Awareness System:<br>
<a href="https://www.us-cert.gov/ncas/alerts/TA15-337A">TA15-337A:
Dorkbot</a><br>
12/03/2015 06:40 PM EST<br><br>
Original release date: December 03, 2015<br><br>
<br>
</font><h3><b>Systems Affected</b></h3><font size=3><br><br>
<br><br>
Microsoft Windows<br><br>
<br>
</font><h3><b>Overview</b></h3><font size=3><br><br>
<br><br>
Dorkbot is a botnet used to steal online payment, participate in
distributed denial-of-service (DDoS) attacks, and deliver other types of
malware to victims’ computers. According to Microsoft, the family of
malware used in this botnet “has infected more than one million personal
computers in over 190 countries over the course of the past year.” The
United States Department of Homeland Security (DHS), in collaboration
with the Federal Bureau of Investigation (FBI) and Microsoft, is
releasing this Technical Alert to provide further information about
Dorkbot.<br><br>
<br>
</font><h3><b>Description</b></h3><font size=3><br><br>
<br><br>
Dorkbot-infected systems are used by cyber criminals to steal sensitive
information (such as user account credentials), launch denial-of-service
(DoS) attacks, disable security protection, and distribute several
malware variants to victims’ computers. Dorkbot is commonly spread via
malicious links sent through social networks instant message programs or
through infected USB devices.<br><br>
In addition, Dorkbot’s backdoor functionality allows a remote attacker to
exploit infected system. According to Microsoft’s analysis, a remote
attacker may be able to:
<ul>
<li>Download and run a file from a specified URL;
<li>Collect logon information and passwords through form grabbing, FTP,
POP3, or Internet Explorer and Firefox cached login details; or
<li>Block or redirect certain domains and websites (e.g., security
sites).
</ul><br><br>
</font><h3><b>Impact</b></h3><font size=3><br><br>
<br><br>
A system infected with Dorkbot may be used to send spam, participate in
DDoS attacks, or harvest users' credentials for online services,
including banking services.<br><br>
<br>
</font><h3><b>Solution</b></h3><font size=3><br><br>
<br><br>
Users are advised to take the following actions to remediate Dorkbot
infections:
<ul>
<li><i>Use and maintain anti-virus software</i> – Anti-virus software
recognizes and protects your computer against most known viruses. Even
though Dorkbot is designed to evade detection, security companies are
continuously updating their software to counter these advanced threats.
Therefore, it is important to keep your anti-virus software up-to-date.
If you suspect you may be a victim of Dorkbot, update your anti-virus
software definitions and run a full-system scan. (See
<a href="http://www.us-cert.gov/ncas/tips/ST04-005">Understanding
Anti-Virus Software</a> for more information.)
<li><i>Change your passwords</i> – Your original passwords may have been
compromised during the infection, so you should change them. (See
<a href="http://www.us-cert.gov/ncas/tips/ST04-002">Choosing and
Protecting Passwords</a> for more information.)
<li><i>Keep your operating system and application software up-to-date</i>
– Install software patches so that attackers cannot take advantage of
known problems or vulnerabilities. You should enable automatic updates of
the operating system if this option is available. (See
<a href="http://www.us-cert.gov/ncas/tips/ST04-006">Understanding
Patches</a> for more information.)
<li><i>Use anti-malware tools</i> – Using a legitimate program that
identifies and removes malware can help eliminate an infection. Users can
consider employing a remediation tool (see example below) to help remove
Dorkbot from their systems.
<li><i>Disable Autorun – </i>Dorkbot tries to use the Windows Autorun
function to propagate via removable drives (e.g., USB flash drive). You
can disable Autorun to stop the threat from spreading.
</ul><br>
<br>
</font><h4><b>Microsoft</b></h4><font size=3><br><br>
<br><br>
<a href="http://www.microsoft.com/security/scanner/en-us/default.aspx">
http://www.microsoft.com/security/scanner/en-us/default.aspx</a><br><br>
The above example does not constitute an exhaustive list. The U.S.
Government does not endorse or support any particular product or
vendor.<br><br>
<br>
</font><h3><b>References</b></h3><font size=3><br><br>
<br><br>
<ul>
<li>
<a href="http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx">
Microsoft Malware Protection Center – Worm: Win32/Dorkbot</a>
<li>
<a href="http://blogs.technet.com/b/mmpc/archive/2015/12/03/microsoft-assists-law-enforcement-to-help-disrupt-dorkbot-botnets.aspx">
Microsoft Malware Protection Center – Microsoft assists law enforcement
to help disrupt Dorkbot botnets</a>
</ul><br><br>
</font><h3><b>Revision History</b></h3><font size=3><br><br>
<br><br>
<ul>
<li>December 3, 2015: Initial Publication
</ul><hr>
This product is provided subject to this
<a href="http://www.us-cert.gov/privacy/notification">Notification</a>
and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a>
policy.<br>
<hr>
A copy of this publication is available at
<a href="https://www.us-cert.gov">www.us-cert.gov</a>. If you need help
or have questions, please send an email to
<a href="mailto:info@us-cert.gov">info@us-cert.gov</a>. Do not reply to
this message since this email was sent from a notification-only address
that is not monitored. To ensure you receive future US-CERT products,
please add US-CERT@ncas.us-cert.gov to your address book. <br>
OTHER RESOURCES: <br>
<a href="http://www.us-cert.gov/contact-us/">Contact Us</a> |
<a href="http://www.us-cert.gov/security-publications">Security
Publications</a> | <a href="http://www.us-cert.gov/ncas">Alerts and
Tips</a> | <a href="http://www.us-cert.gov/related-resources">Related
Resources</a> <br>
STAY CONNECTED: <br>
<a href="http://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/new">
<img src="https://service.govdelivery.com/banners/GOVDELIVERY/SOCIAL_MEDIA/envelope.gif" width=25 height=25 alt="Sign up for email updates">
</a> <br><br>
SUBSCRIBER SERVICES:<br>
<a href="http://public.govdelivery.com/accounts/USDHSUSCERT/subscribers/new?preferences=true">
Manage Preferences</a> |
<a href="https://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/one_click_unsubscribe?verification=5.950164116ce9221a178d1afcfce6b64a&destination=w3hwn@comcast.net">
Unsubscribe</a> |
<a href="https://subscriberhelp.govdelivery.com/">Help</a><br>
<hr>
This email was sent to w3hwn@comcast.net using GovDelivery, on behalf of:
United States Computer Emergency Readiness Team (US-CERT) · 245 Murray
Lane SW Bldg 410 · Washington, DC 20598 · (888) 282-0870
<a href="http://www.govdelivery.com/portals/powered-by">
<img src="https://service.govdelivery.com/banners/GOVDELIVERY/logo_gd_poweredby.gif" width=115 height=35 alt="Powered by GovDelivery">
</a> <br><br>
No virus found in this message.<br>
Checked by AVG - <a href="http://www.avg.com">www.avg.com</a><br>
Version: 2016.0.7227 / Virus Database: 4477/11107 - Release Date:
12/03/15</font></blockquote></body>
</html>