Warezov worm fiends target Skype
466889
Dial M for Malware The authors of the prolific Warezov worm are targeting users of Skype.â¦
729567
A group of internet security and instant messaging (IM) providers have teamed up to detect and thwart the growing threat of IM and P2P viruses and worms.
638063
Messages sent via Skype's IM tool ask users to download file, which can steal password, other information, security firm says.
123349
More VoIP security woes Skype has patched a flaw involving its SkypeFind feature. But the security researcher who discovered the flaw said the VoIP platform remains exposed to cross-zone scripting vulnerabilities, like the latest SkypeFind bug and an earlier flaw involving movie files.â¦Learn &amp; Contribute, Live &amp; Online - The Register Debates Green Computing
132097
(InfoWorld) - A sophisticated computer worm spreading via AOL Instant Messenger (AIM) is setting up a botnet that may be difficult to combat, security researchers said. The worm, known as W32.pipeline, propagates when AIM users click on a Web link that appears to have been sent to them by someone on their buddy list. They receive a message along the lines of, "Hey, would it be okay if I upload this picture of you to my blog?" If the recipient clicks on the link, an executable file that looks like a JPEG will download into a Windows folder, according to researchers at security company FaceTime Communications Inc. The file can then execute a number of different attacks, said Chris Boyd, security research manager for FaceTime Security Labs and the researcher who discovered the worm. It can open up the email port on the PC and send out spam messages. It can also install a variant of the "hacker defender" rootkit, which is widely deployed and difficult to remove. One of the most dangerous aspects of the worm is that it can also connect to remote file upload sites, which Boyd believes the worm authors' use as sort of staging sites where they can continuously download new infections. Once a computer is infected, the program will propagate using the same instant messaging method. The worm is unique because the program seems to be able to contact a number of different sites around the globe randomly. FaceTime researchers had different results when running the same file. "Previously, where we've seen something similar to this attempted, if one file is pulled offline or removed by an ISP, the whole chain goes down," Boyd said. "But this one, if one file goes missing or gets pulled down, it will potentially make a call to another file. It has quite a random aspect to it."So far, he estimates that the botnet -- a group of similarly infected computers that are remotely controlled -- has 1,000 to 2,000 members. More computers may have been infected but not made part of the botnet. The best defense is for AIM users to be wary of clicking on links. If a user receives an unexpected link from a buddy, the user can always reply to ask if they have sent the link, to make sure it is legitimate. FaceTime has updated its virus protection software to prevent users from infection, and other antivirus vendors may do the same. AIM users that get infected can try to remove the worm but may have to wipe and reformat their drives to get rid of it.
15636
Virus writers have developed a &#39;Peeping Tom&#39; worm that can use webcams to spy on computer users in their home or workplace, internet security watchers have warned.
176831
The first computer worm to eavesdrop on network traffic after it infects a computer has been discovered by security experts. The SDBot.
553964
Pipeline A new worm spreading over AOL Instant Messenger seeks to built a botnet of zombie Windows PCs. The Pipeline worm packs an executable file disguised as a JPEG, which if executed, tries to download other strains of malware rootkits and Trojans. Pipeline uses the AIM Buddy List on infected computers to target other prospective marks.â¦
16229
(InfoWorld) - Computer security analysts are studying reports of a worm that may be circulating via a feature in Skype's popular VOIP (voice over Internet protocol) service. Security vendor Websense said the worm spreads through Skype's chat feature. Users receive a message asking them to download a file called "sp.exe." The executable is a Trojan horse that can steal passwords. If a user runs the Trojan it triggers another set of code to spread itself. The first infected PCs appeared in the Asia-Pacific region, particularly in Korea, Websense reported on its blog on Tuesday. It said it was still investigating the issue. Not all security experts were in agreement, however. F-Secure received a sample of the worm and determined that it did not, in fact, target Skype, said Mikko Hypponen, chief research officer. "What's clear is, there's no massive worm outbreak with Skype at the moment," Hypponen said. "We are following the situation." The SANS Internet Storm Center said it was "hearing some details of a new worm spreading via Skype IM" and asked for more information in a posting on its site. Websense said the executable appears to be encrypted with NTKrnl Secure Suite Packer, a polymorphic encryption program that makes files look unique to different detection engines. The original site that hosted the code is not serving it any more, Websense said. Â
373163
Websense warns of a Skype worm on the loose; Opera adds a security alert layer to its browser.
431764
Insecurity plug-in Skype users, Beware a new Trojan that uses subtle social engineering tricks to try to steal your login credentialsâ¦
238166
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs--it wants to invade their homes, too.
26470
Anti-virus companies are warning of a new variant of the Sdbot mass-mailing worm that installs a network sniffer in order to grab unencrypted passwords, apparently the first worm to do so.
518422
(InfoWorld) - The recent spate of malware attacks propagating throughout the user base of the Skype Internet calling system illustrates a broader trend toward cyber-criminals moving to take advantage of VoIP platforms as they become increasingly popular. Security researchers tracking the latest pack of worm viruses to wriggle their way through the Skype community's chat system said that the threats are nearly identical to attacks that have plagued users of other publicly-available messaging applications for years. However, as Skype and other VoIP systems become even more widespread and greater numbers of businesses move to adopt the technologies, experts predict that cyber-criminals will ratchet-up the severity and diversity of the attacks they aim at users of the software. In mid-May, London-based Skype -- which is owned by eBay -- launched a series of trials of new enterprise features that it hopes will encourage larger numbers of businesses to consider use of its publicly-available VoIP applications. The potential to use such programs to infiltrate business networks and carry out attacks will drive malware code writers and other schemers to similarly increase their focus on VoIP platforms, researchers said. On May 24, Chris Boyd, a researcher at FaceTime Communications -- which established a partnership to provide security applications to Skype in Feb. 2007 -- noticed a new variant of the so-called Skype worm that has been spreading through the VoIP client's messaging system for the last several months. Unlike previous versions of the threat that merely passed themselves along to other Skype users via their contact lists, the new variant will also "jump" to other more established networks, including the ICQ and MSN messenger platforms. The development illustrates not only that attacks aimed at users of VoIP networks are escalating and becoming more sophisticated, but also that they are being pulled into use by the smartest and most aggressive cyber-criminals looking for new revenue streams, Boyd said. "There are a lot of businesses picking up Skype in the workplace, and it's a good bet that if they have Skype on there, they have other IM clients. The attackers are really trying to hit as many people as possible in a random manner, but this is the first instance we've seen of an attempt to get a foot in the door of other networks using Skype," Boyd said. While the attack merely passes itself along to contacts listed in the messaging accounts of affected users, versus dropping malware onto their computers, it does attempt to lure people into clicking on links that point to a range of virus-infecting Web sites. Boyd said that several of the involved URLs have been used in previous attacks on Skype users, including a handful of sites registered through Chinese hosting companies. The researcher believes that the endgame of the hackers behind the threat is to steal valuable data from infected users and pass it back to themselves over Skype's encrypted messaging system. Boyd said that there is also growing evidence of attackers building proof-of-concept botnet threats aimed specifically at Skype users. "Things can potentially get passed out of an organization using Skype because the messaging communications are encrypted and hard to fiddle with. That could be one of the angles," Boyd said. "It's just interesting that the attacks we saw for several months have been so consistent, and now there's this significant change in targeting different networks. I think we'll see more editions in the coming weeks and a substantial attack on Skype users at some point." In late March 2007, researchers at F-Secure first unearthed a Skype worm variant that attempted to trick users into visiting a Web site that downloaded a malware program which was designed to communicate to hackers over a Yahoo mail server to confirm its infection and load additional programs onto affected PCs. Variants of the attack, which subsequently tried to infect users with keystroke logging software and other data-thieving programs, have continued to appear since that time. Tony Magellanez, a systems engineer at Helsinki, Finland-based F-Secure, said that such a move by hackers to port their IM-based threats to VoIP software should come as no surprise. "Chat has obviously been around forever, and the ability to share information via these tools has opened it up to the types of attacks we're seeing," Magellanez said. "The attacks aren't being made against any vulnerability in the software but instead against the social aspects of its use that make it an attractive target." The researcher said, in fact, that the Skype application in particular has exhibited a small number of vulnerabilities and proven fairly resistant to malware threats, a performance he attributes to significant work on the part of the company to engineer the system with security in mind. Other researchers echoed that sentiment but pointed out that most large businesses will still likely adopt VoIP tools designed specifically for the enterprise and avoid publicly-available programs like Skype out of fear for potential attacks. "At this point, we're really just talking about VoIP as a transport vector for attacks as is the case with the Skype worm attacks, which is predictable when you consider other IM-based threats," said Chris Hoff, chief technology officer at Crossbeam Systems. "Like anything else, when VoIP becomes a more legitimate pathway for attackers to go after monetary systems, they will come after it, but it also seems like businesses are taking a more pragmatic approach to adopting VoIP when it comes to security." For instance, Hoff said most companies are running their VoIP systems on standalone networks to make it harder for hackers to access the programs and protect availability of their calling capabilities. Such planning should make a big difference as more dangerous VoIP threats are created, he said. Tom Cross, a researcher with the X-Force team at IBM's ISS division, agreed that Skype is in some sense becoming a victim of its own success with the recent emergence of more worms. In addition to a rapidly increasing number of users, the researcher also attributed greater e-mail and IM security awareness among customers as a reason for the uptick in activity. "From a technical standpoint, these worms don't really have anything to do with VoIP, it's being targeted just as any other popular communications tool will be," Cross said. "Hackers are also moving to different technologies to perform their attacks because we've gotten better at detecting them on other platforms; spam and e-mail don't work as well for the attackers anymore, so VoIP offers a new opportunity where end-users may not be expecting this type of threat, yet."ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
389353
Bot software that turns PCs into zombies spreads via holes in Symantec and Microsoft products.
766564
The recent spate of malware attacks propagating throughout the user base of the Skype Internet calling system illustrates a broader trend toward cyber-criminals moving to take advantage of VoIP platforms as they become increasingly popular.
87931
Latest worm poses a risk to many Web sites using the PHP scripting language.