Storm Worm variant targets blogs, bulletin boards
548032
Blogs, bulletin board notices posted by victims of Trojan horse contain links to malicious Web sites.
342444
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs - it wants to invade their homes, too.
605079
A variant of the Zafi worm, Zafi.d, is doing the rounds disguised as a Christmas message. This worm arrives via email and through peer-to-peer networks bearing the message &quot;Happy Hollydays&quot; and the subject
375239
Some clever, sexy Christmas-themed spam and a long holiday season helped the criminals behind the notorious&#160;Storm Worm&#160;more than double their network of infected PCs over the past few weeks, security experts say.Storm kicked off its holiday spam-and-malware campaign on the day before Christmas, sending off a flurry of e-mail that invited victims to visit a&#160;Christmas-themed strip show&#160;on Web sites such as Merrychristmasdude.com. Victims who downloaded the strip show found their PCs attacked by malicious software.This site, and about 14 other Storm-related domains, was registered using a Russian domain name registrar called Nic.ru, where staff was largely unavailable during the holidays, according to Richard Cox, the chief information officer with the Spamhaus anti-spam effort.&quot;The trouble was they were quite simply out to Christmas lunch,&quot; Cox said. &quot;And they didn&#39;t get back until Wednesday.&quot;Spamhaus representatives tried to contact the registrar on Dec. 26, but they soon discovered that the company was essentially shut down. Four days later they received an e-mail from a Nic.ru employee saying that they would have to wait until staff returned to work in January before anything could be done, Cox said.Storm&#39;s creators took advantage of another common problem in the domain name registration system. They targeted a registrar that did not have an established policy for taking down malicious domains, so that gave the criminals a little more time to run their scam, Cox said.By Wednesday of this week, Nic.ru had removed the Storm-related domains from its database, knocking the criminal network&#39;s Web sites offline.But now security experts say that Storm has more than doubled in size, adding about 25,000 PCs to a network that had been 20,000 strong.Storm&#39;s creators also changed the configuration of their malware, making it harder for security software to detect it, and this helped inflate the number of infections, Cox said.The Christmas campaign was &quot;pretty effective at growing the botnet,&quot; said Jose Nazario, senior security engineer at Arbor Networks. &quot;The contributing factors there were clearly the successful timing, tied to a major Western holiday, coupled with tweaks to the malware to avoid antivirus detection.&quot;Storm Worm has been attacking computer users since January 2007, when it began tricking victims into downloading malicious software, claiming that it was a video of violent storms that had been ravaging Europe.Since then it has been one of the most virulent sources of malware, although it has shrunk in size as detection methods have improved. Recently the network appears to have begun renting out its infected PCs to phishers, according to some researchers.&quot;Storm is an insidious pest. We&#39;ve learned essentially how to manage it,&quot; said Nazario. But, he added, the success of this Christmas campaign proves that the network can still be a serious threat. &quot;They&#39;re great marketers,&quot; he said.&#160;
704436
(InfoWorld) - A Republican Party Web site has been hacked, and for some time it has been spreading a variation of the long-running Storm Trojan horse to vulnerable visitors, a security researcher said Friday. This is the first time that Storm has taken to the Web for its victims, said Dan Hubbard, head of research at San Diego-based Websense. "The big news is that Storm has added infecting sites to its arsenal," said Hubbard. Storm debuted in January but only cracked the top malware lists early this summer, and has become infamous for its ability to adapt its infection strategies. "They have a knack for latching onto the latest newsworthy events and capitalizing on the public interest in them," Symantec researcher Hon Lau said last month. "And if no newsworthy events are happening at the time, then they will just make them up." Until now, Storm has infected users via files attached to e-mail or through links embedded in spam. The change noticed by Websense's scanners, however, means that Storm's backers have moved to other attack vectors -- in particular, compromised Web sites that sport malicious IFRAMEs. Users visiting such sites are instantly infected with the Trojan if their browsers are not patched against whatever exploit the IFRAME code is throwing out. According to Hubbard, several hundred sites have been compromised by Storm's makers, then seeded with IFRAMES that can inject the Trojan into vulnerable PCs. One such site was a Republican Party Web site for the 1st Congressional District of Wisconsin. Within hours after Websense notified the site's owners, however, it had been purged of the dangerous IFRAME code. By mid-morning Friday, it was safe to visit. Hubbard did not know how the site was compromised. The motive behind Storm's continued attacks and its expansion into new areas like this, said Hubbard, is a never-ending appetite for bots -- compromised computers that can be used for spamming or other criminal activities either by the original attackers or by others who lease sections of the botnet. "Storm's botnet is clearly the biggest around," said Hubbard, who estimated its size as "conservatively, in the hundreds of thousands, although some people have thrown out numbers like 1 million or 2 million or even 4 million." Earlier this month, in fact, MessageLabs pegged the botnet at 2 million machines. In the last few weeks alone, Storm has spread through e-mails touting a real-time scoreboard site for National Football League games, spam hyping a Web site that wished Americans a happy Labor Day holiday, and more mail that used YouTube videos as bait. Computerworld is an InfoWorld affiliate
76646
Blog: Various people hiding behind pseudonyms are fueling news about a supposed worm for Mac OS X.
475856
A new version of the Zafi e-mail worm is spreading seasonal greetings along with its malicious code, according to antivirus software companies.
669622
Mass-mailing Zafi-D worm, which disguises itself as a Christmas greeting, is infecting more than one in every ten emails. The worm, which spreads in a file attached to email messages containing the text âHappy
369121
Please be aware as there&#39;s a new virus worm spreading on the net. The Zafi.D variant is a Christmas wish e-mail together with a .
146946
Worm creates scrapbook entries on Orkut profiles and then propagates to friends on the network.
70179
At least one new variant of a worm spread rapidly from Asia and Europe to U.S. computers Friday morning, filling up people's e-mail accounts, but otherwise causing little apparent damage.
706450
The Storm worm was part of a spam campaign that pointed recipients to a Web site wishing them a happy Labor Day, then downloaded malware.
231302
A new variant of the MyDoom worm that exploits an unpatched flaw in Microsoft Corp.'s Internet Explorer (IE) browser is in the wild and posing particular risk to home and small business users, security experts warned this week.
656315
Unknown DDoS tool, predecessors A deluge of Trojan-laced spam that slyly tricked recipients by promising information about winter storms ravaging Northern Europe last month was even more crafty than we thought.â¦
436341
Called W32.Funner, the worm upon infection attempts to spread itself through the host&#39;s MSN Messenger contact list. Apart from altering Windows&#39; host file and adding nearly 1000 URLs, the worm also attempts
601188
Dark clouds are gathering over the local blogosphere. First there were "splog" attacks, pieces of spam left in the comments area of local blogs. That was kids' stuff. Now it appears that at least two blogs in the western suburbs have become victims of a new, scarier menace: blogjacking.
395515
The Santy worm, which originally flared up a week ago as bulletin board Web sites found their pages erased and defaced by the worm&#39;s own text, has begun to spread using both Google and other search engines.