Worm Alert
01-27-2004, 01:51 PM
#1
Senior Member
Thread Starter
Join Date: Aug 2002
Location: Denver, CO
Posts: 4,985
http://www.cnn.com/2004/TECH/internet/01/2...read/index.html
Experts: Vicious worm 'Linux war' weapon
Anti-virus vendor: One in 12 e-mails infected
By Jeordan Legon
CNN
Tuesday, January 27, 2004 Posted: 12:40 PM EST (1740 GMT)
(CNN) -- A sneaky e-mail worm continued to clog Internet traffic Tuesday, spreading faster than previous Web bugs by appearing as an innocuous error message.
The worm -- dubbed "MyDoom," "Novarg" or "WORM_MIMAIL.R" -- was copying itself at a fierce pace, so fast that some companies were having to shut down their mail servers to stop it. And a new clue was emerging as to the source of the infection.
Virus experts suggested MyDoom's author was a fan of the Linux open source community, because the bug, which targets computers running Microsoft Windows, launched a Denial of Service Attack on SCO's site. Utah-based SCO Group, owner of the UNIX operating system, claims some versions of the Linux operating system use its proprietary code.
"The MyDoom worm takes the Linux Wars to a new intensity," said Chris Belthoff, an analyst for anti-virus firm Sophos. "It appears that the author of MyDoom may have taken the war of words from the courtrooms and Internet message boards to a new level by unleashing this worm which attacks SCO's Web site."
Infected messages were intercepted in 142 countries and one in 12 e-mails being protected by Britain-based MessageLabs was carrying the worm, the anti-virus vendor reported. In comparison, the widespread SoBig virus that hit last August -- at its peak -- only attacked 1 out of 17 e-mails handled by the firm. Web-monitoring firm Keynote said MyDoom slowed Internet performance significantly Monday afternoon. And the worm appeared to cause an "uptick in terms of performance" Tuesday morning, said Keynote analyst Roopak Patel.
"We're essentially watching the virus follow the sun as the various time zones come online," MessageLabs Chief Technical Officer Mark Sunner said.
The worm is contained in e-mails with random senders' addresses and subject lines. While the body of the e-mail varies, it usually includes what appears to be an error message, such as: "The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment."
While many computer users are savvy about not opening executable files or other attachments that may contain viruses, the latest worm masks itself as an innocuous text document or a file that your computer appears unable to read.
"This one is almost begging you to click on the attachment," said Sharon Ruckman, the head of anti-virus firm Symantec's security response team.
When loaded, some versions of the worm launch Notepad and show random characters. At the same time it replicates itself, opens a backdoor that could allow hackers to break in and, in some instances, installs a "keystroke" program that records everything being typed, including passwords and credit card numbers.
The worm also was spreading via popular Internet file sharing networks such as Kazaa, where it appeared with names such as "Winamp5" "ICQ2004-final." Nullsoft's Winamp offers an MP3 music-playing tool and ICQ is a popular Web chat program.
Anti-virus experts said MyDoom, which surfaced Monday afternoon, was on track to hit even more machines than Nimda, a 2001 worm that spread widely with an attachment that read "Readme.exe."
This time, besides the "binary attachment" message, MyDoom comes with all different file extensions including .pif, .zip and .csr. It also uses an attachment icon similar to one used for Windows text messages. All of this, security experts warn, was succeeding in tricking people into thinking the e-mail was legitimate.
The best thing to do to stop the spread of the worm, experts said, was to ignore or delete it. And to update anti-virus software.
After a relative lull in the number of viruses distributed during the holidays, anti-virus experts said last week's "Bagle" worm and now "MyDoom" were keeping Internet security gurus on their toes.
"The virus writers [are] ... back from vacation and they've started pushing out their creations," said Vincent Gullotto, who runs Network Associates' McAfee Anti-Virus Emergency Response Team.
Experts: Vicious worm 'Linux war' weapon
Anti-virus vendor: One in 12 e-mails infected
By Jeordan Legon
CNN
Tuesday, January 27, 2004 Posted: 12:40 PM EST (1740 GMT)
(CNN) -- A sneaky e-mail worm continued to clog Internet traffic Tuesday, spreading faster than previous Web bugs by appearing as an innocuous error message.
The worm -- dubbed "MyDoom," "Novarg" or "WORM_MIMAIL.R" -- was copying itself at a fierce pace, so fast that some companies were having to shut down their mail servers to stop it. And a new clue was emerging as to the source of the infection.
Virus experts suggested MyDoom's author was a fan of the Linux open source community, because the bug, which targets computers running Microsoft Windows, launched a Denial of Service Attack on SCO's site. Utah-based SCO Group, owner of the UNIX operating system, claims some versions of the Linux operating system use its proprietary code.
"The MyDoom worm takes the Linux Wars to a new intensity," said Chris Belthoff, an analyst for anti-virus firm Sophos. "It appears that the author of MyDoom may have taken the war of words from the courtrooms and Internet message boards to a new level by unleashing this worm which attacks SCO's Web site."
Infected messages were intercepted in 142 countries and one in 12 e-mails being protected by Britain-based MessageLabs was carrying the worm, the anti-virus vendor reported. In comparison, the widespread SoBig virus that hit last August -- at its peak -- only attacked 1 out of 17 e-mails handled by the firm. Web-monitoring firm Keynote said MyDoom slowed Internet performance significantly Monday afternoon. And the worm appeared to cause an "uptick in terms of performance" Tuesday morning, said Keynote analyst Roopak Patel.
"We're essentially watching the virus follow the sun as the various time zones come online," MessageLabs Chief Technical Officer Mark Sunner said.
The worm is contained in e-mails with random senders' addresses and subject lines. While the body of the e-mail varies, it usually includes what appears to be an error message, such as: "The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment."
While many computer users are savvy about not opening executable files or other attachments that may contain viruses, the latest worm masks itself as an innocuous text document or a file that your computer appears unable to read.
"This one is almost begging you to click on the attachment," said Sharon Ruckman, the head of anti-virus firm Symantec's security response team.
When loaded, some versions of the worm launch Notepad and show random characters. At the same time it replicates itself, opens a backdoor that could allow hackers to break in and, in some instances, installs a "keystroke" program that records everything being typed, including passwords and credit card numbers.
The worm also was spreading via popular Internet file sharing networks such as Kazaa, where it appeared with names such as "Winamp5" "ICQ2004-final." Nullsoft's Winamp offers an MP3 music-playing tool and ICQ is a popular Web chat program.
Anti-virus experts said MyDoom, which surfaced Monday afternoon, was on track to hit even more machines than Nimda, a 2001 worm that spread widely with an attachment that read "Readme.exe."
This time, besides the "binary attachment" message, MyDoom comes with all different file extensions including .pif, .zip and .csr. It also uses an attachment icon similar to one used for Windows text messages. All of this, security experts warn, was succeeding in tricking people into thinking the e-mail was legitimate.
The best thing to do to stop the spread of the worm, experts said, was to ignore or delete it. And to update anti-virus software.
After a relative lull in the number of viruses distributed during the holidays, anti-virus experts said last week's "Bagle" worm and now "MyDoom" were keeping Internet security gurus on their toes.
"The virus writers [are] ... back from vacation and they've started pushing out their creations," said Vincent Gullotto, who runs Network Associates' McAfee Anti-Virus Emergency Response Team.
01-27-2004, 03:59 PM
#4
Administrator
Join Date: Jul 2001
Location: Stuart, FL
Posts: 24,416
Thread
Thread Starter
Forum
Replies
Last Post
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)