Skype warns users of Windows worm
545288
InfoWorld - Skype users are under attack from a&#160;new worm&#160;that spreads through the peer-to-peer Internet phone application&#39;s&#160;chat feature.
304869
Antivirus companies are warning internet users about a fast-spreading new worm that infects web servers running a popular package of online bulletin board software, and uses the Google search engine to find vulnerable servers to infect.
436341
Called W32.Funner, the worm upon infection attempts to spread itself through the host&#39;s MSN Messenger contact list. Apart from altering Windows&#39; host file and adding nearly 1000 URLs, the worm also attempts
518422
(InfoWorld) - The recent spate of malware attacks propagating throughout the user base of the Skype Internet calling system illustrates a broader trend toward cyber-criminals moving to take advantage of VoIP platforms as they become increasingly popular. Security researchers tracking the latest pack of worm viruses to wriggle their way through the Skype community's chat system said that the threats are nearly identical to attacks that have plagued users of other publicly-available messaging applications for years. However, as Skype and other VoIP systems become even more widespread and greater numbers of businesses move to adopt the technologies, experts predict that cyber-criminals will ratchet-up the severity and diversity of the attacks they aim at users of the software. In mid-May, London-based Skype -- which is owned by eBay -- launched a series of trials of new enterprise features that it hopes will encourage larger numbers of businesses to consider use of its publicly-available VoIP applications. The potential to use such programs to infiltrate business networks and carry out attacks will drive malware code writers and other schemers to similarly increase their focus on VoIP platforms, researchers said. On May 24, Chris Boyd, a researcher at FaceTime Communications -- which established a partnership to provide security applications to Skype in Feb. 2007 -- noticed a new variant of the so-called Skype worm that has been spreading through the VoIP client's messaging system for the last several months. Unlike previous versions of the threat that merely passed themselves along to other Skype users via their contact lists, the new variant will also "jump" to other more established networks, including the ICQ and MSN messenger platforms. The development illustrates not only that attacks aimed at users of VoIP networks are escalating and becoming more sophisticated, but also that they are being pulled into use by the smartest and most aggressive cyber-criminals looking for new revenue streams, Boyd said. "There are a lot of businesses picking up Skype in the workplace, and it's a good bet that if they have Skype on there, they have other IM clients. The attackers are really trying to hit as many people as possible in a random manner, but this is the first instance we've seen of an attempt to get a foot in the door of other networks using Skype," Boyd said. While the attack merely passes itself along to contacts listed in the messaging accounts of affected users, versus dropping malware onto their computers, it does attempt to lure people into clicking on links that point to a range of virus-infecting Web sites. Boyd said that several of the involved URLs have been used in previous attacks on Skype users, including a handful of sites registered through Chinese hosting companies. The researcher believes that the endgame of the hackers behind the threat is to steal valuable data from infected users and pass it back to themselves over Skype's encrypted messaging system. Boyd said that there is also growing evidence of attackers building proof-of-concept botnet threats aimed specifically at Skype users. "Things can potentially get passed out of an organization using Skype because the messaging communications are encrypted and hard to fiddle with. That could be one of the angles," Boyd said. "It's just interesting that the attacks we saw for several months have been so consistent, and now there's this significant change in targeting different networks. I think we'll see more editions in the coming weeks and a substantial attack on Skype users at some point." In late March 2007, researchers at F-Secure first unearthed a Skype worm variant that attempted to trick users into visiting a Web site that downloaded a malware program which was designed to communicate to hackers over a Yahoo mail server to confirm its infection and load additional programs onto affected PCs. Variants of the attack, which subsequently tried to infect users with keystroke logging software and other data-thieving programs, have continued to appear since that time. Tony Magellanez, a systems engineer at Helsinki, Finland-based F-Secure, said that such a move by hackers to port their IM-based threats to VoIP software should come as no surprise. "Chat has obviously been around forever, and the ability to share information via these tools has opened it up to the types of attacks we're seeing," Magellanez said. "The attacks aren't being made against any vulnerability in the software but instead against the social aspects of its use that make it an attractive target." The researcher said, in fact, that the Skype application in particular has exhibited a small number of vulnerabilities and proven fairly resistant to malware threats, a performance he attributes to significant work on the part of the company to engineer the system with security in mind. Other researchers echoed that sentiment but pointed out that most large businesses will still likely adopt VoIP tools designed specifically for the enterprise and avoid publicly-available programs like Skype out of fear for potential attacks. "At this point, we're really just talking about VoIP as a transport vector for attacks as is the case with the Skype worm attacks, which is predictable when you consider other IM-based threats," said Chris Hoff, chief technology officer at Crossbeam Systems. "Like anything else, when VoIP becomes a more legitimate pathway for attackers to go after monetary systems, they will come after it, but it also seems like businesses are taking a more pragmatic approach to adopting VoIP when it comes to security." For instance, Hoff said most companies are running their VoIP systems on standalone networks to make it harder for hackers to access the programs and protect availability of their calling capabilities. Such planning should make a big difference as more dangerous VoIP threats are created, he said. Tom Cross, a researcher with the X-Force team at IBM's ISS division, agreed that Skype is in some sense becoming a victim of its own success with the recent emergence of more worms. In addition to a rapidly increasing number of users, the researcher also attributed greater e-mail and IM security awareness among customers as a reason for the uptick in activity. "From a technical standpoint, these worms don't really have anything to do with VoIP, it's being targeted just as any other popular communications tool will be," Cross said. "Hackers are also moving to different technologies to perform their attacks because we've gotten better at detecting them on other platforms; spam and e-mail don't work as well for the attackers anymore, so VoIP offers a new opportunity where end-users may not be expecting this type of threat, yet."ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
16229
(InfoWorld) - Computer security analysts are studying reports of a worm that may be circulating via a feature in Skype's popular VOIP (voice over Internet protocol) service. Security vendor Websense said the worm spreads through Skype's chat feature. Users receive a message asking them to download a file called "sp.exe." The executable is a Trojan horse that can steal passwords. If a user runs the Trojan it triggers another set of code to spread itself. The first infected PCs appeared in the Asia-Pacific region, particularly in Korea, Websense reported on its blog on Tuesday. It said it was still investigating the issue. Not all security experts were in agreement, however. F-Secure received a sample of the worm and determined that it did not, in fact, target Skype, said Mikko Hypponen, chief research officer. "What's clear is, there's no massive worm outbreak with Skype at the moment," Hypponen said. "We are following the situation." The SANS Internet Storm Center said it was "hearing some details of a new worm spreading via Skype IM" and asked for more information in a posting on its site. Websense said the executable appears to be encrypted with NTKrnl Secure Suite Packer, a polymorphic encryption program that makes files look unique to different detection engines. The original site that hosted the code is not serving it any more, Websense said. Â
334880
A new family of worms which uses an unpatched vulnerability in Internet Explorer is spreading widely across the net.
671906
A major outage is affecting many Skype users' ability to log on to the network and send IMs. The company is mum, but some pin the blame on a series of Microsoft updates released yesterday.
648109
New version of mass-mailing worm, discovered Friday, tries to disable defenses on destination PCs.
271741
Sophos released a warning yesterday about a worm that has the capability to use webcams to spy on computer users in their home or workplace.
126451
Although Skype today plugged another critical flaw in its software, vulnerability researcher Aviv Raff said that another problem, this one in the SkypeFind feature, can be used to inject attack script into systems.
199836
Users are being warned about a Windows virus that travels with a game of Tetris.
15636
Virus writers have developed a &#39;Peeping Tom&#39; worm that can use webcams to spy on computer users in their home or workplace, internet security watchers have warned.
564600
A worm targeting Windows PCs is spreading through the service's instant messenger, making the VoIP's chat software the latest to come under the hacker gun.
613717
A new variant of the Sober worm is rapidly spreading via e-mail. Visit the Virus Threat Center for breaking news and the latest alerts.
689953
A recently detected exploit code foreshadows a likely worm-style attack on Windows machines plagued with the JPEG vulnerability made public last week, security experts said Thursday.
578328
(InfoWorld) - A new variant ofÂ the Stration worm, which has been plaguing Windows users for the past year, has made the jump from Skype to the ICQ and MSN Messenger networks. This latest variant popped up earlier this week, according to Chris Boyd, a researcher at FaceTime Communications, who blogs under the pseudonym "Paperghost." "They're using Skype as a jump off into other more established networks," Boyd said. "The infection will go looking for other instant messaging clients that are on the PC and then attempt to send the infection message that it initially sends through Skype through these other chat systems." For a computer to be infected, a user must first click on a link and then agree to download an executable file. In one sample provided by Boyd, the malicious link is listed below the instant message, "Check this out. Give me your opinion." Once installed, the worm will gradually start to send out messages to the victim's contacts, Boyd said. Instant message worms have spread from network-to-network in the past, but this is the first time Boyd has seen a worm jump from Skype to another network. "It's an odd system to make, because these guys have a foot in the door [in the Skype network]," he said. "You think they'd focus all their energies onto exploiting Skype." Stration is not widespread and is considered to be a low-risk infection, but it has been a tough worm to fight for some security vendors. Over the past year it has morphed into hundreds of variants, and antivirus companies have been having a hard time keeping track of its many iterations. Stration has also been called "Warezov" and "Stratio." Nobody knows who is behind the worm, but the domains that host the malicious code are registered through a Chinese Internet company, Boyd said. Â
54319
New worm spreads through Skype's chat feature, infects PCs with malware.