Google's Orkut fights off worm attack - report
146946
Worm creates scrapbook entries on Orkut profiles and then propagates to friends on the network.
125692
(InfoWorld) - Skype users are under attack from aÂ new wormÂ that spreads through the peer-to-peer Internet phone application'sÂ chat feature. The attack begins when a user receives an instant message containing a link from someone in their contact list or an unknown Skype user, said Villu Arak, a Skype spokesman based in Tallinn, Estonia. There are several versions of the chat messages, which are "cleverly written" to fool users, Arak wrote on the Skype heartbeat blog. The link appears to contain a JPEG photo file, but if clicked causes the Windows run/save dialog box to appear, which asks whether the user wants to save or run a ".scr" file. The file is malicious software that can then access a user's PC via Skype's API (application programming interface). The malicious file has been named W32/Ramex.A. "Users whose computers are infected with this virus will send a chat message to other Skype users asking them to click on a web link that can infect" their computers, Arak wrote. To avoid trouble, users should not download the file. At least two security vendors, F-Secure and Kaspersky Lab, have updated their software to detect the worm, Arak wrote. Instant message programs are another way hackers can try to gain control over PCs. Access to one person's instant messenger or e-mail account can mean contact details for many others, allowing hackers to use malicious e-mails or instant messages to lure victims into downloading malicious software. Â
297722
(InfoWorld) - A new worm targeting a flaw in Sun Microsystems Inc.'s Solaris 10 OS delivers crude artsy payloads, including a drawing of a turkey in ASCII text. The use of an ASCII drawing by a hacker is "a bit old school," said Graham Cluley, senior technology consultant for Sophos PLC. The worm -- called Unix/Froot-A or Wanuk -- takes advantage of a zero-day flaw that was patched by Sun three days after exploit code was published last month. The vulnerability lies within the Telnet daemon, a process that runs in the background and waits for another Telnet client to connect, which can allow a hacker to log in without a password. An attacker could eventually gain complete control over the machine. The worm scans port 23 to see if Telnet is running, then sends data to exploit the vulnerability, Cluley said. Infected computers then scan for more vulnerable machines, he said. The drawings -- some of which are more offensive than the turkey -- can appear on the monitors of other machines connected to the infected machine, Cluley said. Sophos hasn't heard of any companies being affected. Users of Solaris are advised to apply the patch and disable Telnet, Cluley said. Â
90728
A new variant of the Santy worm, which attacks Web pages usuing the PHP bulletin board software, appeared this week. Earlier variants used Google to find vulnerable Web pages; the new
719261
A new version of an old computer worm has a nasty twist, anti-virus firm Sophos warned on Monday. The Rbot-GR worm can use webcams attached to infected computers to spy on users.
522864
Security researchers say Google may be on to something with its research on whether IIS servers are more likely to be vulnerable to malware. But there could be a plethora of reasons why that's the case.
624348
Google Gives Brazil Orkut Data on Criminals Google has made the decision to work with the Brazilian authorities by complying with a court order to supply Brazil with data which could help identify Orkut users who are using the social network for the spreading of child porngraphy and as a center for hate crimes. Unlike the [...]
77205
A new computer worm that attacks bulletin board services spread silently and quickly around the Internet Tuesday, infecting at least 38,000 systems within a few hours, experts said.
732352
(InfoWorld) - Google has offered Indian police a special tool for priority reporting of objectionable material on its social networking site, Orkut. Google's Orkut social networking site has come in for criticism and even litigation from groups in India that object to its depiction of India and Indian historic figures. The site also has fan clubs of Indian gangsters, and Indian police said these could be used to find new recruits. The reporting tool does not affect the way Google treats users' data but only enables faster, direct communication, a spokeswoman for Google said Tuesday. Â  The police will still be required to follow an appropriate legal process in order to get user-identifying information, she added. Some Indian newspapers and a TV channel have quoted a police official in Mumbai saying that Orkut agreed to provide the police with the IP address from which an objectionable message has been posted on the site and the ISP involved. The Google spokeswoman confirmed that the company's legal team met with police from various states in India but said there was no question of Google sharing IP addresses with the Indian police without the appropriate legal process being followed. The process for reporting objectionable material on Orkut remains the same, as do Google's own procedures for deciding whether or not to remove the material from the site, she added.
169493
A new Internet worm was spreading quickly, threatening to overload computer systems around the world by generating copies by e-mail, security experts said.
16963
The first cross-platform worm specifically tailored for the open-source OpenOffice.org and StarOffice productivity suites has raised a few hackles in open source circles, since it appears to tarnish the suite&#39;s reputation for security.
754347
Hacker web sites are claiming to have posted proof-of-concept exploit code for the latest critical Microsoft Corp software vulnerability, which is sometimes a precursor to broader attacks using a worm.
79963
Web gateway filtering specialist Finjan is reporting a new toolkit that uses randomized JavaScript to stay hidden from virus crawlers and deliver its payload via compromised Web sites.Dubbed by Finjan's Malicious Code Research Center (MCRC) as the "Random JS Toolkit," the malware development package is allowing attackers to create threats that only attempt to victimize an individual computer in the same manner a single time to protect against discovery by anti-virus systems and researchers' automated "crawlers."By dynamically changing the JavaScript employed to deliver each variant of attack being created, and by using random file names that are only delivered to the same machine or IP address once, Finjan researchers said the malware authoring package is meant to avoid the programs used by AV researchers to find new threats emerging on the Web.Typically when automated crawler programs come across new attack samples, they return to the threats' source URLs to verify their names and characteristics and to create signature files that allow their products to block the programs -- or they enter the sites onto so-called blacklists of compromised domains.However, once a machine has been infected with an attack made using the Random JS Toolkit, the threat will recognize that the machine has already been targeted and won't attempt to download it again, thereby thwarting efforts to identify or track the exploits, Finjan experts contend.During the month of December 2007, Finjan estimates that more than 10,000 individual sites were compromised with attacks built using the Random JS Toolkit. Most of the URLs serving as distribution points for the attacks were legitimate sites that had been hijacked, the company said.Among the infected sites were some that would qualify as well-known, highly trusted domains, said Yuval Ben-Itzhak, chief technology officer of Finjan.Ben-Itzhak said the toolkit serves as a prime example of the types of tactics he expects leading-edge malware authors to utilize more frequently in the coming year."We've found the initial 10,000 sites, but we're sure that there are many more that have already been infected. When we can find this number of exploits, it is clear that this must be a very significant attack that has affected a lot of people," he said. "Using the combination of techniques available in this toolkit, the threats that are being created can become very powerful and stay alive to infect people for longer periods of time."Among the types of malware infections being served up using the toolkit, Finjan has observed everything from Trojan viruses and keystroke loggers to botnet recruiting programs, he said.For its part, Finjan's real-time code inspection technology can defend against such threats because it eschews the use of traditional virus signatures or blacklists in favor of constant monitoring for any malware activity coming across a network armed with one of its devices, Ben-Itzhak maintains.Rival AV vendors, including Symantec, contend that features such as the market leader's recently developed "generic exploit prevention," based on behavioral cues, should also be able to isolate and defend against such emerging attacks.Unlike the widespread iFrame attacks that proliferated across the Web during 2007, threats created using the Random JS Toolkit will also be much harder for security researchers to track down because they do not lead back to central sites where the actual malware code itself is hosted, Finjan maintains.Since the involved malware code is loaded directly on a site, and it won't attempt infect the same computer or IP address twice, traditional URL blacklisting and signature-based techniques will likely prove futile against the attack, the company said.However, from what the security appliance vendor can deduce, Ben-Itzhak said the firm believes there is only one malware group currently using the toolkit."From what we can tell, all the information flowing back from the compromised sites is heading to the same server," he said. "This indicates that there is probably only one group controlling this malware code thus far, and that they are probably being very successful; this is just another step forward for the criminals involved to continue to improve their attack methods and remain undetected."Ben-Itzhak said that the involved server is not one that matches any of the company's lists of machines controlled by well-known malware authoring groups such as the Russian Business Network. The server the company is tracking was originally located in Europe, but has recently been moved to China -- and likely will continue to be moved around to avoid detection, according to the expert.Most of the data the security company has seen being sent to the server has been related to online banking username and password data, he said.As part of its investigation, Finjan discovered that one of the Web properties infected with the randomized JavaScript attacks was an online advertising network that serves up as many as 14 million online banner ads per week. The security device maker reported that unnamed company was informed and is currently working to clean out its systems.
98994
A new version of the worm that spread from infected Microsoft Corp. Internet Information Services (IIS) Web servers in June has been identified and is using instant messages (IMs) and infected Web sites in Russia, Uruguay and the U.S. to spread itself, according to one security company.
87931
Latest worm poses a risk to many Web sites using the PHP scripting language.
116333
Google acted quickly to block Santy.A, a worm that targeted the company&#39;s popular Internet search engine. Antivirus experts say this threat has passed, but predict that it may be just
155916
Google has blocked a new type of Internet worm that was targeting the company's search engine in order to find vulnerable computers on the Internet.