Novel Worms: One Sniffs, Another Talks
26470
Anti-virus companies are warning of a new variant of the Sdbot mass-mailing worm that installs a network sniffer in order to grab unencrypted passwords, apparently the first worm to do so.
496843
Technique claims to be able to stop Internet worms within milliseconds of an outbreak.
719261
A new version of an old computer worm has a nasty twist, anti-virus firm Sophos warned on Monday. The Rbot-GR worm can use webcams attached to infected computers to spy on users.
98994
A new version of the worm that spread from infected Microsoft Corp. Internet Information Services (IIS) Web servers in June has been identified and is using instant messages (IMs) and infected Web sites in Russia, Uruguay and the U.S. to spread itself, according to one security company.
40495
When the Santy.a worm started spreading on Tuesday, Mikko Hypponen knew he had a way to stop the worm in its tracks. The only problem: He had trouble finding the right people to talk to at search giant Google.
213644
A new method to detect and help stop worm attacks being developed by researchers at Penn State University is using the speed of connections to detect the attacks. The system also uses other algorithms to limit the number of false positives
429964
A variant of an older worm is poorly designed, but it nonetheless shows the effectiveness of our manager's incident-response process.
469986
The Bagle worm shifts shape to outsmart antivirus software. Plus: Media player patches and Feds' fraud crackdown.
281583
InfoWorld - Security experts have spotted the first attempts to create an Internet worm that propagates using instant messages and exploits a recently disclosed flaw in Microsoft software.
613037
(InfoWorld) - An anonymous security researcher claimed this weekend to have created a worm that exploits a vulnerability in the Mac OS X operating system which Apple missed in a May round of patches. A poster on theÂ Information Security Sell OutÂ blogÂ said Sunday that he or she had written a proof-of-concept worm "in a few hours" that exploits a variation of a vulnerability patched in May by Apple. According to the researcher (actually, in one posting, "writers" is used so there may be more than one contributing), he or she exploited a still-unpatched bug in mDSNResponder, a component of Apple's Bonjour automatic network configuring service, in the worm's code. "This vulnerability, as with the ones fixed, gives remote root access," the researcher said. Apple'sÂ May security update,Â 2007-005, included a fix for the mDSN bug. Info Sec's blogger(s) said the worm was also "very 'customer' specific" and crafted for cash. "[It] could easily be changed to be more malicious," said the researcher. The same blogger made aÂ minor stirÂ in April when, after a $10,000 security conference contest concluded, he or she claimed to have grabbed the exploit from the conference wireless network and reverse-engineered the vulnerability. Conference organizers, however, denied that the wireless network had been cracked. When asked to back up his or her claims, the Info Sec blogger only replied: "There is no real benefit to me in doing so. I am not one who cares if people believe my claims or not." In the same comment thread, the Info Sec blogger also promised to post the captured packets and other information "Once this bug is patched by Apple and I am satisfied that I would not be adding additional risk." Apple patched theÂ QuickTime vulnerabilityÂ May 1. The Info Sec blogger has not yet, however, posted the nicked network traffic. Attempts to reach the Info Sec blogger via e-mail were unsuccessful.
192196
bug text As worms proliferated through the first half of the year, attacks gained in sophistication. Also: A start-up fights zombies.
10244
Security researchers are warning of a new worm, dubbed &quot;Funner,&quot; targeting Microsoft&#39;s MSN Messenger instant messaging application.
437767
Microsoft is moving to counter some scathing comments regarding a security paper authored by researchers at its Cambridge, England, facility.The paper, &quot;Sampling Strategies for Epidemic-Style Information Dissemination,&quot; looks at how worms sometimes inefficiently spread their code.The research explores how a more efficient method could, for example, be used for distributing patches or other software. The advantage would be that patches could be distributed from PC to PC, rather than from a central server.That method would reduce the load on a server, and patches would be distributed faster. But the patches would have the same qualities as a computer worm, a generally malicious file.Since a story about the paper appeared on Thursday in the New Scientist magazine, the paper has been roundly assailed.&quot;This is a stupid idea,&quot; wrote Bruce Schneier, a security expert, author and CTO of Mountain View, Calif.-based enterprise security vendor BT Counterpane, on Tuesday, before quoting a passage from the New Scientist story on his blog.Schneier wrote that the idea of so-called &quot;benevolent worms&quot; comes up every few years.However, a worm is designed to run without the consent of a user, which doesn&#39;t make it a good method of software distribution, Schneier wrote. The worm patching technique could also make the patches hard to uninstall or interrupt during installation, he wrote.Worms designed to distribute software patches could also be hacked to distribute malicious software, wrote Randy Abrams, director of education for security vendor Eset, in his regular e-mail commentary.Forced patching is also troublesome since some patches may not be compatible with critical software, Abrams wrote.&quot;Breaking into computers is a bad idea,&quot; Abrams said.A Microsoft spokesman said on Monday that the New Scientist story is not inaccurate. However, the writer of the story &quot;sexed&quot; up the research paper a bit, particularly with the headline that used the phrase &quot;friendly worms,&quot; the spokesman said.In response to the criticism, Microsoft said it doesn&#39;t intend to develop patch worms.&quot;This was not the primary scenario targeted for this research,&quot; according to a statement.The company also said it will continue to let customers decide how and when they apply security updates.One of the paper&#39;s authors, Milan Vojnovic, said in a statement that there were no plans to incorporate the ideas into Microsoft&#39;s products. Efforts to reach Vojnovic for comment were unsuccessful.
583159
Experts are not in agreement about reports that a password-stealing worm may be spreading via the popular Skype VoIP service, but they're closely studying reports of the spreading infection.
716663
Networked multifunction devices share PC vulnerabilities to worms, hackers.
473672
Security researchers issue a warning about new worms that are targeting smart phones running the Symbian S60 second-edition phones.
695856
After a fairly quiet fall, mass-mailing worm starts to spread on Windows PCs. Plus: Air Force turns to Microsoft for security help.