Stinkysteve
07-27-2004, 09:46 AM
Story here:
http://www.internetweek.com/breakingNews/showArticle.jhtml?articleID=25600533
New MyDoom Worm Really Bad Apple
By Gregg Keizer, TechWeb News
A new version of the pernicious MyDoom worm broke onto the Internet Monday with such speed that security firms raced to rachet up their threat assessments.
MyDoom.o -- but pegged as MyDoom.m by Symantec -- is a relatively standard variant of the MyDoom family. This mass mailer infects systems when users open the attached file; it spoofs the return address, often masquerading as coming from the support desk at the user's company; and relies on the typical MyDoom trick of posing as messages about e-mail problems or undelivered mail.
The worm got good traction almost immediately. U.K.-based filtering firm MessageLabs, for instance, said in an e-mail alert that it had intercepted 23,000 copies in the first five hours of the outbreak. Symantec, meanwhile, reported receiving double the usual number of submissions from its client, while McAfee also noted a much-higher-than-usual number of submissions.
Vendors reacted by upping their threat levels. Symantec, for instance, pushed it from a "3" in its 1 through 5 scale to a "4," the first time the company has used that ranking since Sasser. McAfee pegged it as "Medium-on-Watch," a rating it's used only once before in 2004, and only three times during all of 2003.
The worm has some peculiar characteristics that may account for such quick success, said experts.
"It's double zipping," said Brian Mann, the outbreak manager with McAfee's AVERT research team. "Archiving the attachment is a pretty standard MyDoom technique, but some of the attached files in this version are zipped within a zip. That's harder for some anti-virus products to detect."
Symantec's Vincent Weafer, the senior director of its security response team, had another explanation. "It's sing several online search engines to look for valid addresses."
Not only does MyDoom.o hijack addresses from the usual places -- address books on the compromised machine -- to spread itself, but it also queries the Google, Yahoo, Alta Vista, and Lycos search engines for any addresses that match the domains of those it steals from the infected PC.
If MyDoom.o finds an address such as "bob@thisbigcompany.com," for example, it runs a search on the four sites for other addresses with the "thisbigcompany.com" domain.
"It looks like an efficiency tactic," said Weafer. "If it's able to find more valid addresses, and mail only to them, it may be able to avoid detection for a longer period."
Some enterprise anti-virus and message security software watches for evidence of mass mailings from within the company, or messages sent to random-looking addresses, then shuts down those systems' mail privileges.
But while MyDoom.o is big today, Weafer didn't think it would be tomorrow.
"Although it's still accelerating, I think we'll see this fall off -- as we have other MyDooms -- in the next 24 hours."
http://www.internetweek.com/breakingNews/showArticle.jhtml?articleID=25600533
New MyDoom Worm Really Bad Apple
By Gregg Keizer, TechWeb News
A new version of the pernicious MyDoom worm broke onto the Internet Monday with such speed that security firms raced to rachet up their threat assessments.
MyDoom.o -- but pegged as MyDoom.m by Symantec -- is a relatively standard variant of the MyDoom family. This mass mailer infects systems when users open the attached file; it spoofs the return address, often masquerading as coming from the support desk at the user's company; and relies on the typical MyDoom trick of posing as messages about e-mail problems or undelivered mail.
The worm got good traction almost immediately. U.K.-based filtering firm MessageLabs, for instance, said in an e-mail alert that it had intercepted 23,000 copies in the first five hours of the outbreak. Symantec, meanwhile, reported receiving double the usual number of submissions from its client, while McAfee also noted a much-higher-than-usual number of submissions.
Vendors reacted by upping their threat levels. Symantec, for instance, pushed it from a "3" in its 1 through 5 scale to a "4," the first time the company has used that ranking since Sasser. McAfee pegged it as "Medium-on-Watch," a rating it's used only once before in 2004, and only three times during all of 2003.
The worm has some peculiar characteristics that may account for such quick success, said experts.
"It's double zipping," said Brian Mann, the outbreak manager with McAfee's AVERT research team. "Archiving the attachment is a pretty standard MyDoom technique, but some of the attached files in this version are zipped within a zip. That's harder for some anti-virus products to detect."
Symantec's Vincent Weafer, the senior director of its security response team, had another explanation. "It's sing several online search engines to look for valid addresses."
Not only does MyDoom.o hijack addresses from the usual places -- address books on the compromised machine -- to spread itself, but it also queries the Google, Yahoo, Alta Vista, and Lycos search engines for any addresses that match the domains of those it steals from the infected PC.
If MyDoom.o finds an address such as "bob@thisbigcompany.com," for example, it runs a search on the four sites for other addresses with the "thisbigcompany.com" domain.
"It looks like an efficiency tactic," said Weafer. "If it's able to find more valid addresses, and mail only to them, it may be able to avoid detection for a longer period."
Some enterprise anti-virus and message security software watches for evidence of mass mailings from within the company, or messages sent to random-looking addresses, then shuts down those systems' mail privileges.
But while MyDoom.o is big today, Weafer didn't think it would be tomorrow.
"Although it's still accelerating, I think we'll see this fall off -- as we have other MyDooms -- in the next 24 hours."