I just finished dealing with an incident as a result of a user clicking on an email asking him to install a Microsoft Patch. Instead of fixing his PC (which was fixed anyway because our patch management RULEZ!!1!) he downloaded a trojan that started flooding spam.

FSecure has a great screenshot of it here, along with a demonstration of how the domain name that is hosting the patch is actually a distributed beastie and has the ability to constantly mutate to avoid being shutdown. FSecure calls it a “fast flux” domain.

You can’t just block a single IP with a router. This type of block should be put in three places. First, put a block in the gateway Antivirus system to stop all emails containing the domain in the body text pertaining to the fast flux domain. Next, blacklist the DNS of the domain if you have an internal DNS system. Finally, put a block for that url in your content filters to prevent your users from surfing to that domain in case the local hosts file is compromised.

So what are you waiting for? Block cfm48.com now.

Like This Post? Rate it and tell your friends! Click the Share button below.