Proxy service users download malware, unknowingly join botnet

In yet another example of if-it’s-too-good-to-be-true-it-probably-isn’t, hundreds of thousands of users signing up for a cheap and supposedly legitimate proxy service have ended up downloading malware and being ensnared into a botnet.

“The malware is Backdoor.Proxybox, and our investigation has revealed an entire black hat operation, giving us interesting information on the operation and size of this botnet, and leading us to information that may identify the actual malware author,” Symantec researcher Joseph Bingham writes.

The service – ProxyBox – supposedly provides access to its entire list of thousands of proxies for only $40 a month, which is obviously too cheap a price for the provider to break even. Nevertheless, users flocked to it.

In order to use it, they were required to download some software, which turned out to be the Backdoor.Proxybox malware.

The malware has three components – a dropper, the payload, and a rootkit. The dropper installs the payload and the rootkit. The rootkit’s goal is to prevent the payload and files associated with it to be discovered and removed from the computer, while the payload does actually act as a low-level proxy service, but also makes the machine join a botnet.

“Command-and-control server monitoring over the last few months has suggested that the botnet controller tries to keep the size around 40,000 active users online at any time. The controller has used several mediums for distribution, including Blackhole Web exploits,” Bingham writes.

“Interestingly, each command server also provided the botnet client with a backup server with a URL of [http://]proxybox.name. This is actually the front-end website, used to sell access to the botnet.”

This URL and several others hosting pages offering a wide range of VPN, proxy testing, proxy access and private antivirus scanning services have all the same author and the sam ICQ support number.

Users paying for the services are asked to use WebMoney, Liberty Reserve, and RoboKassa e-payment systems. The WebMoney account to which the payment is to be made has been tracked down to specific individual and the information tied to the account will hopefully lead to his arrest.