Storm Worm turns one
30667
Many unhappy returns Thursday marked the first anniversary of the infamous Storm Worm. Created by a Russian-based criminal network, the malware rapidly infected millions of PCs in Europe and North America and continues to be a problem.â¦
61520
com December 22, 2004, 4:00 AM PT. When the Santy.a worm started spreading on Tuesday, Mikko Hypponen knew he had a way to stop the worm in its tracks.
640257
The Storm Worm botnet network may be shrinking in size, but it has managed to send out 15 million of those annoying audio spam messages in October, according to anti-spam vendor MessageLabs.It&#39;s hard to believe that the Storm messages were effective. Recipients had to first click on an attachment -- usually given a misleading name&#160;such as&#160;beatles.mp3 or Britney.mp3 -- to hear the stock pitch, which featured a warbly robotic woman advising people to invest in online car seller, Exit Only.This kind of scam, called &quot;pump and dump,&quot; tries to nudge up the price of penny stocks by a cent or two, giving the spammers a way to make a quick buck by selling the stock before it crashes. Spammers have been delivering their messages in different formats, including&#160;PDF and Excel files, over the past few years as part of a cat-and-mouse game with spam blockers. This&#160;move to MP3 spam&#160;is the latest development in this battle, observers say.Spam watchers say that pump-and-dump schemes are the hottest and most lucrative area for spammers today.The spam run began on Oct. 17, and lasted about 36 hours, using infected computers in the Storm Worm network to send out the mails, MessageLabs said in a statement released Tuesday. The spam sounded strange and warbly because the voice in the message was &quot;synthesized using a very low compression rate of 16KHz to keep the overall file size small, at around 50KB, to avoid detection,&quot; the company said.Storm is thought to have landed on as many as 15 million PCs over the past year, but recently&#160;its network of infected PCs has been shrinking. University of California, San Diego, researchers recently pegged it at about 160,000 computers, only 20,000 of which are accessible at any one time.Exit Only said it was not involved in sending the spam. Its stock was trading around $0.41 on Oct. 18, the day after the Storm spam started. On Tuesday it closed at $0.20.
586598
Prosecution on ice The creators of the Storm Worm botnet are known to US authorities but a lack of co-operation from their counterparts in St. Petersburg, Russia, is preventing action being taken.â¦
236348
At least one new variant of a worm spread rapidly from Asia and Europe to US computers, filling up people&#39;s email accounts, but otherwise causing little apparent damage.
711576
Internet users were warned Monday of a new mass mailer worm that masquerades as an appeal for aid after last month's Indian Ocean tsunami disaster.ADVERTISEMENTReducing the Total Cost of OwnershipLearn how to reduce the total coast of ownership in enterprise data management in this case study.
446357
Amid groans of &quot;I wonder why it took so long?&quot; a new worm has been discovered that can access a webcam and microphone attached to an infected PC.
791
A new computer worm emerged on Tuesday which broke the speed record from the announcement of a security vulnerability in Microsoft&#39;s Internet Explorer to a full-blown virus that spreads in the wild.
375239
Some clever, sexy Christmas-themed spam and a long holiday season helped the criminals behind the notorious&#160;Storm Worm&#160;more than double their network of infected PCs over the past few weeks, security experts say.Storm kicked off its holiday spam-and-malware campaign on the day before Christmas, sending off a flurry of e-mail that invited victims to visit a&#160;Christmas-themed strip show&#160;on Web sites such as Merrychristmasdude.com. Victims who downloaded the strip show found their PCs attacked by malicious software.This site, and about 14 other Storm-related domains, was registered using a Russian domain name registrar called Nic.ru, where staff was largely unavailable during the holidays, according to Richard Cox, the chief information officer with the Spamhaus anti-spam effort.&quot;The trouble was they were quite simply out to Christmas lunch,&quot; Cox said. &quot;And they didn&#39;t get back until Wednesday.&quot;Spamhaus representatives tried to contact the registrar on Dec. 26, but they soon discovered that the company was essentially shut down. Four days later they received an e-mail from a Nic.ru employee saying that they would have to wait until staff returned to work in January before anything could be done, Cox said.Storm&#39;s creators took advantage of another common problem in the domain name registration system. They targeted a registrar that did not have an established policy for taking down malicious domains, so that gave the criminals a little more time to run their scam, Cox said.By Wednesday of this week, Nic.ru had removed the Storm-related domains from its database, knocking the criminal network&#39;s Web sites offline.But now security experts say that Storm has more than doubled in size, adding about 25,000 PCs to a network that had been 20,000 strong.Storm&#39;s creators also changed the configuration of their malware, making it harder for security software to detect it, and this helped inflate the number of infections, Cox said.The Christmas campaign was &quot;pretty effective at growing the botnet,&quot; said Jose Nazario, senior security engineer at Arbor Networks. &quot;The contributing factors there were clearly the successful timing, tied to a major Western holiday, coupled with tweaks to the malware to avoid antivirus detection.&quot;Storm Worm has been attacking computer users since January 2007, when it began tricking victims into downloading malicious software, claiming that it was a video of violent storms that had been ravaging Europe.Since then it has been one of the most virulent sources of malware, although it has shrunk in size as detection methods have improved. Recently the network appears to have begun renting out its infected PCs to phishers, according to some researchers.&quot;Storm is an insidious pest. We&#39;ve learned essentially how to manage it,&quot; said Nazario. But, he added, the success of this Christmas campaign proves that the network can still be a serious threat. &quot;They&#39;re great marketers,&quot; he said.&#160;
741947
(InfoWorld) - E-mail worms, not long ago the scourge of the Internet, have declined sharply in 2007, a security company has revealed. According to UTM security vendor Fortinet, the incidence of mass-mailing worms has declined by 5 percent each month since the start of the year, putting the once-feared worm well below other types of attack in terms of volume. The figures come from the company's The State of Malware report for June 2007. Viruses, spyware, and software exploits have remained roughly stable in volume throughout the same period, while Trojans have been climbing since February to represent the number one threat. Much less common mobile, IM, Linux, and non-mailed Win32 worms have all shown marked declines, albeit from relatively low levels. The company offers a variety of explanations for the marked decline. Users are now more aware of the need to mistrust e-mailed attachments, while corporates are employing better gateway security to strip e-mails of malicious code. Another possibility is that attackers might be moving from mass-mailing techniques to targeted attacks as a better avenue to profit. This theory is backed up by separate figures from MessageLabs published earlier this week that uncovered evidence of attacksÂ targeting named individuals in companies.Â Although rare by their nature, such attacks are reckoned to have a much higher chance of success than generic mass-mailing attacks. The age of the mass-mailing worms is not about to end, however, and could simply have entered a period during which it will decline to low levels before spiking from time to time. The best recent example of this isÂ the Storm wormÂ of January, which presented a high point against which worm volumes were bound to decline as the year wore on. The unique danger of worms is their ability to spread automatically in ways that can clog bandwidth before systems can react. Because worm detection systems are now so finely tuned, such malware has to do as much of its damage in possible within the first hour of spread, after which it will be filtered aggressively by security gateways. The worm's future could increasingly be as a form of malevolent political or terrorist protest rather than as a tool of criminal profit.
537303
Rust never sleeps, the wise man said, and neither do malware purveyors. After "treating" potential botnet inductees to strippers on Christmas, the keepers of Storm have switched tactics and unleashed a New Year's greeting.
522625
Nasty squall New features of botnets created by the infamous Storm Worm allow denial of service attacks to be launched against security defenders that attempt to interrupt its operation.â¦
237409
Storm, now a large remotely controlled botnet, is getting a graphic profile on a Web site set up to track it.
567473
A new version of the infamous Bagle worm series is spreading widely across the net.
744902
A worm that has the capability to using webcams to spy on users is circulating across the Net.
520488
The Storm Worm botnet network may be shrinking in size, but it managed to send out 15 million annoying audio spam messages in October.
604494
MicroWorld Software has cautioned Internet users about a new malicious worm known as the W32/Zafi-D. According to the antivirus and content security software provider, W32/Zafi-D behaves in a typical worm manner.