Web Design Directory

  w   w   w   .   d   e   s   i   g   n   d   i   r   .   n   e   t
An industry leading web design, hosting and development directory. We bring together the best web designers and their customers. Find the lates website business news and updates.
Search DesingnDIR
Advertising | Submit Site »
   » Home Page / Industry News  
  Find Services Provider       Technology Stories        WebSite Services   
MyDoom Variant Searches Google For New Victims

2005-02-17 15:06:00

Another variant of the one-year-and-counting MyDoom worm family hit the Internet late Wednesday, infecting Windows PCs, culling e-mail addresses from four popular search engines, and installing a backdoor that gives the attacker control of systems.

Dubbed MyDoom.as, MyDoom.au, or MyDoom.bb -- depending on the anti-virus vendor -- the worm is essentially the same as MyDoom.o, which debuted in July 2004. The biggest difference, said experts, is that it's assembled with a different code "packager."

"It's basically the same as MyDoom.o," said Graham Cluley, a senior technology consultant with U.K.-based security vendor Sophos. "It's packaged with 'mew,' a tool that some hackers use to disguise their malware."

While early results were mixed Thursday morning -- some vendors said that the new MyDoom was spreading relatively slowly, while others said just the opposite -- all have raised their warning ratings for the malicious code to at least medium.

"We're not seeing MyDoom as particularly significant," said Cluley. "It's currently the ninth most common virus we're seeing, but it's accounting for just two percent of all viruses and worms, far below that of, say, old versions of Netsky or Zafi."

Sam Curry, the vice president of Computer Associates' eTrust security group, had a different take. "We're raising MyDoom.au to 'high' in part because of the rate at which it's spreading."

MyDoom.o in 2004, and today's variation, share several characteristics, most notably code that uses four search sites -- Google, Yahoo, AltaVista, and Lycos -- to sniff out additional e-mail addresses to use for propagating.

"Like other e-mail worms, it searches your hard drive for addresses, but then it uses the domain names it's found to discover other victims via search engines," said Cluley. "So, if it finds the e-mail address "mickey.mouse@disney.com" on your drive, it then searches Google and perhaps finds Donald Duck and Bambi's addresses, too."

Unlike last summer, however, when Google's (and other search sites') performance suffered because of the large number of searches run by infected machines, it's unlikely it (and others) will be affected by the newest MyDoom.

"I don't expect that to happen this time," said Cluley. "For one thing, there doesn't seem to be a critical mass. And Google and others took action last year, so that when they get these types of requests now, they just reject them."

Benchmarking data from Web monitoring and metrics vendor AlertSite bore out Cluley's prediction. "We report no impact to Yahoo and Google," said a spokesman for the Boca Raton, Fla.-based company.

MyDoom.as/au/bb has common characteristics with other members of the family, including posing as an e-mail system error message, disguising the payload in a variety of file formats (including .zip), and most damaging, depositing a backdoor on the infected PC.

"The variant knocking at the front door is familiar, but it's leaving the backdoor open to something much more sinister," said CA's Curry. "It's creating a zombie network."

The backdoor Trojan, which was identified as Gawo by CA, CEB.f by McAfee, and Nemog.d by Symantec -- naming consistency isn't one of the anti-virus industry's strengths -- opens port 1034 and listens for commands from the controlling hacker.

"This is typical of worms and viruses," said Cluley. "Hackers try to download a backdoor component which they can then use to upload other programs to conduct spam or denial-of-service attacks."

Cluley and Curry, as well as representatives from other security firms, urged users to update their virus definition files (although some vendors will detect the new MyDoom as is).

Several anti-virus companies have posted detection and removal tools, including this one from Symantec.

When MyDoom recently had its first "anniversary," experts pegged the worm as a "turning point" and "major milestone" in worm creation, thanks to the for-profit motivation of its writer(s), who are more interested in creating vast armies of compromised machines than gaining 15 minutes of infamy.

As Thursday's example shows, MyDoom is far from dead, said Curry of Computer Associates. "MyDooms usually come in a string of four or five in a row that use essentially the same code, but every now and then one uses the right combination of social engineering or code to spread faster," he said.

"[MyDoom] may be a year old, but it can still be prolific," he said.

Yahoo Buys Photo-Sharing Site Flickr

Microsoft, Alcatel Ink Pact To Kick-Start IPTV Availability

Payments Via Cell Phones To Grow Rapidly This Year

Predicted Wave of Worms Hits, Then Dissipates

IP PBX Revenues Up 72 Percent

Hopping A Train With DoCoMo Smart Card

Opera Unveils Voice-Enabled Program Guide For Consumer Electronics

In Web Search, Four Words Is The Sweet Spot

Time Warner Launches VoIP Service For PBXs

Order-Management Software Brings Automation To Online Florist



   
» Web Hosting Interviews
Web Hosting interviews, news and reviews. Compare the Best web hosting providers.
» Daw - Web Hosting Blog
Views and Comments about Hosting Industry. News, Trends, Products and Sevices.
» Your WebSite Here
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371


» Submit your site to Web Design Directory

About Us | Advertising | Privacy | Terms Of Use | Contact Us

© DesignDIR.net 2003 - 2017, part of of Business Address Network. All Rights Reserved!