Re: Mydoom: Perfect Storm Averted or Just Ahead?

[Papp Geza <pappgeza () tolna net>]

Hello WolfgangK ,

2004. január 29., 6:34:49, írtad:
Experience shows that programmers are quick to "improve" upon initial code,
modifying and releasing variants (note Sobig and now Mydoom.b -
http://www.computerworld.com/securitytopics/security/virus/story/0,10801,89494,00.html?SKC=news89494 ).

*************
Early information indicates that the new variant is likely spreading in the wild,
said Ken Dunham, director of malicious code at iDefense Inc., a security consulting
company in Reston, Va.

Dunham said the Mydoom.B worm modifies the standard hosts file in a Windows folder
that can block access to 65 Web sites, most of which are antivirus Web sites, in an
apparent attempt to block users from downloading antivirus solutions and data. 

“This new variant of Mydoom is worse than Mydoom.A,” Dunham said in a statement via e-mail.
“And an attack on the Microsoft.com Web site could cause a significant disruption of
services for users worldwide. It’s feasible that Mydoom.A computers are now being used to
help launch Mydoom.B, via the proxy setup supported by the worm. If this is the case,
Mydoom.B will likely become very prevalent in the wild in just a few short hours.” 

Although that doesn’t mean millions of computers are actually infected, it could mean millions
of e-mails harboring the worm are in the wild, Dunham said. 

He said computer users should be on guard for a succession of worm attacks this year.
“Undoubtedly, attackers are now mirroring the success of worms like Sobig to launch
successive attacks in 2004,” Dunham said.

> Describe specialist, you plead who.
 http://www.computerworld.com/securitytopics/security/virus/story/0,10801,894
94,00.html?SKC=news89494 )link.
************************************
Lesson learned - >read you:
1. Do not rest on your laurels, assuming your network has good
defense-in-depth ( Executables stripped away at Email server, Outlook
security patch installed)because the first wave didn't affect you.  The next
version could be modified with condition right to target your environment
and hit you with a perfect storm.

2.  It would be difficult for a malicious programmer, cyber terrorists or
cyber activists to target a specific environment and protect others ( Eg.,
launch denial of service against SCO.com because I like LINUX and don't like
SCO legal actions.  Protect my computer at Berkley.edu because I don't want
to effect my own Email.)  Programmers can easily modify code and launch an
attack against another environment.

Comments?
**************************
Karl,
> You write what, so that Sobig is and connection between the MydoomB - this is
> fancy only. MydoomA  other hardly B variant - but this deviates in bulk from Sobig.
> The variant from Sobig!s  worm gear represents also this header MydoomB  from one.src file.
Ø_3ærÙ|
JÒ¼­'Vw_ێĕ5äÊòŽ;CwéUdìˆ
"Épc›4±ÙH-˜{L‰W°_áÂÑr©0½
J©ñƒ5­µ±[3ÕþÈ8É~Á*S/¬†ŽÜ›zßt¢.­^ES_üG÷^%ҍšv°Á“„üíßU¦£©äñ(. öõj½Åœ°M7ô¦™}#Å7¶Vœ‚j¡Ó#¸qI±!ÏX“·žÖ©yú,'g™—}£Š 
坍uÈÓ͆³÷ÛËså³ÊÆÈĆ«þúg?eÛo0W®úÁ
nÌc\&Té^ȶki›|
HPCw™à½xh݂År(K~secúÕ\†L…h_™n|H—V¨!i¿
ê4gj”ÇÊv¹œ‰ÕÈÚÜDޅ¸$}8k<,Ø[À邰¬“Û‹,k¯Aì/‘ðê±ß/) ¹â퍐’ü~‚JJŠ{ÚmŸPBP÷Õ*‡&¢¡,À5\ŠÔœ™êWp5›òT¤Ë*…Ò©L‡Ïi‰ŸMÅxW$y‘Ðı)ïëšI
¸rŸ»õBãÚô
v›RìÙsiÙ 
.“ÕIÐtõQW¶¼;V#XŽ¹âHvñNCqrðç2‰úz1ø¸îv¿,º¶Á[T9濹Äv,__dz«ÚýªáE•ÎÚßyG:nw`Ñêð5»$kìŽg¢;6¢úI.OÆևbáNzÏ3&h/IÄôðÔr:v9ÇøÍwÝxϜ·í<7ÎaÎ9ùáýì
‹4Òµš…fU¼È坨nêy^Dµû’ˆ˜ìáÄ7Q©¬ôÙ>Ür•QŠ˜N2Ò
{PéÔz¤n؈֞–UélÌDdw\,L°~Tà‡I3ð\*÷dÒyV$ÌUUé"!dì

-- 
Üdvözlettel,
  Geysap
  Network and Virussecurity from Hungary                            mailto:pappgeza () tolna net

www.gyik.com
"VIRUS CORE TEAM"
====================================
Fiat justitia, pereat mundus!
------------------------------------
we protect your digital worlds... 
====================================

















 

 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html