Re: First WMF mass mailer ItW (phishing Trojan)

[Gadi Evron <ge () linuxbox org>]

On Thu, 16 Feb 2006, Vulnerability Management wrote:
> Hi Gadi,
>
> Gadi Evron wrote:
> > The first worm (mass mailer) to (ab)use the WMF 0day is now spreading in
> > Australia.
>
> [...]
>
>  > The emails themselves do not contain the payload, but rather a URL to
>  > sites that will infect users.
>
>
> How can this be called a worm? AFAIK, malware that needs human 
> intervention to spread is a trojan, not a worm.

Taxonomy/terminology of viruses/malware is problematic, no one expert will
agree with the other.

(almost) all current worms are Trojan horses. If it is spread by email,
it's a mass mailer. It's a worm... any more than that and this will become
a religious discussion between those who work with these or a clue-less
one by those who don't. :)

In other words.. I will go with whatever you decide, as I don't see this
as really mattering in the AV world anymore (and that's a shame).

:)

Question: if one sees this spreading as a mass mailer, propagating (via
email) and infecting via a download(er) of a Trojan, why would it
matter?

Maybe it should be called a Trojan with mass-mailing capabilities (I'm
completely with you on that one).

        Gadi.

> >
> \a
>
> (Personal opinions only)
>
>
>
> -- 
> Andrew Simmons
> MessageLabs Security Team
>
> MessageLabs: Be certain
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email 
> ______________________________________________________________________

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/