Nytro Posted August 23, 2013 Report Posted August 23, 2013 [h=1]Popular download management program has hidden DDoS component, researchers say[/h][h=2]Orbit Downloader's DDoS component is used to attack websites and can cause Internet connection problems for users[/h][h=3]By Lucian Constantin[/h] August 22, 2013 — IDG News Service — Recent versions of Orbit Downloader, a popular Windows program for downloading embedded media content and other types of files from websites, turns computers into bots and uses them to launch distributed denial-of-service (DDoS) attacks, according to security researchers. Starting with version 4.1.1.14 released in December, the Orbit Downloader program silently downloads and uses a DLL (Dynamic Link Library) component that has DDoS functionality, malware researchers from antivirus vendor ESET said Wednesday in a blog post. The rogue component is downloaded from a location on the program's official website, orbitdownloader.com, the ESET researchers said. An encrypted configuration file containing a list of websites and IP (Internet Protocol) addresses to serve as targets for attacks is downloaded from the same site, they said. Orbit Downloader has been developed since at least 2006 and judging by download statistics from software distribution sites like CNET's Download.com and Softpedia.com it is, or used to be, a popular program. Orbit Downloader was downloaded almost 36 million times from Download.com to date and around 12,500 times last week. Its latest version is 4.1.1.18 and was released in May. In a review of the program, a CNET editor noted that it installs additional "junk programs" and suggested alternatives to users who need a dedicated download management application. When they discovered the DDoS component, the ESET researchers were actually investigating the "junk programs" installed by Orbit Downloader in order to determine if the program should be flagged as a "potentially unwanted application," known in the industry as PUA. "The developer [of Orbit Downloader], Innoshock, generates its revenue from bundled offers, such as OpenCandy, which is used to install third-party software as well as to display advertisements," the researchers said, noting that such advertising arrangements are normal behavior for free programs these days. "What is unusual, though, is to see a popular utility containing additional code for performing Denial of Service (DoS) attacks," they said. The rogue Orbit Downloader DDoS component is now detected by ESET products as a Trojan program called Win32/DDoS.Orbiter.A. It is capable of launching several types of attacks, the researchers said. First, it checks if a utility called WinPcap is installed on the computer. This is a legitimate third-party utility that provides low-level network functionality, including sending and capturing network packets. It is not bundled with Orbit Downloader, but can be installed on computers by other applications that need it. If WinPcap is installed, Orbit's DDoS component uses the tool to send TCP SYN packets on port 80 (HTTP) to the IP addresses specified in its configuration file. "This kind of attack is known as a SYN flood," the ESET researchers said.Articol complet:http://ht.ly/ocw3t Quote
