Is Second Wave of MyDoom Attack Rolling In?

A new variant of the MyDoom worm is kicking up a small online storm,

battering search engines and opening backdoors across the globe.

The variant, named by different anti-virus vendors as either MyDoom-M,

MyDoom-N or MyDoom-O, hit the Wild on Monday and spread rapidly.

Sporting a new twist in the way it propagates, the worm contains links

to several different search engines and tries to use them to harvest

email addresses.

Security analysts say some search engine sites, such as Google,

reportedly experienced some slow downs and possibly even intermittent

interruptions.

”This is the first time I’ve ever seen a worm perform a Google search

to harvest email addresses for an email routine,” says Ken Dunham,

director of malicious code for iDefense, Inc., a security intelligence

company based in Reston, Va. ”It’s interesting that this worm was

released while Google has a pending IPO. However, it appears that the

backdoor component of the worm is the real motive behind this widespread

worm.”

The new variant, which appears to have peaked yesterday, still is

circulating in high numbers today, according to analysts from

MessageLabs, Inc., a managed email security company based in New York.

Analysts there report intercepting 599,641 copies of the virus so far.

But those numbers pale in comparison to the original MyDoom, which took

the Internet by storm this past January.

Mark Sunner, chief technical officer of MessageLabs, says they

intercepted more than 5 million copies of MyDoom-A in its first 24 hours

in the Wild.

”This is causing a fair bit of commotion, but this variant hasn’t got

anywhere near the numbers of the original,” says Sunner. ”But because

of what it’s done to the search engines, its ability to affect the

community as a whole is quite significant. Other than that, we’d call

this a medium level of aggression.”

Symantec Corp., an information security company based in Cupertino,

Calif., has labeled MyDoom-M as a Level 4 threat, with Level 5 being the

most dangerous.

The new MyDoom variant is a mass-mailing worm with an SMTP engine that

sends copies of itself out to addresses harvested from infected machines

or off of search engines. The worm also carries a Trojan that is

installed on TCP Port 1034.

” The Trojan is what has got us worried,” says Dunham. ”This backdoor

has been completely changed from the one that was in earlier versions of

MyDoom… This is a very complicated backdoor. The code is very

difficult to wade through.”

MessageLabs’ Sunner says the backdoor carries some disturbing commercial

capabilities.

”This variant isn’t dangerous from a traditional standpoint. It’s not

deleting files or amending spreadsheets,” says Sunner. ”But all the

viruses these days have a commercial motivation to them. That Trojan can

be used as an effective spam sending mechanism…. I don’t think this

virus’ main intention was to create denial-of-service attacks on the

search engines. This is about spam.”

Is a Second Wave Coming?

Dunham says the new MyDoom variant is just the first line of attack in a

bigger battle.

Today, Dunham’s analysts report finding Zindos-A in the Wild. The

malware scans for randomized IP addresses with TCP port 1034 open. This

is the port that the new MyDoom variant opens. Once it finds that open

port, Zindos-A uploads a copy of itself, which is then executed by a

mechanism inside the new MyDoom. After creating a .exe file on the

infected computer and modifying the Windows registry, Zindos-A attacks

the Microsoft.com Web site with a denial-of-service attack.

”It appears that the release of Zindos-A is part of a multi-stage

MyDoom attack against Microsoft.com and possibly to perform other

actions,” says Dunham.

RELATED NEWS AND ANALYSIS

• Ethics and Artificial Intelligence: Driving Greater Equality

  FEATURE |  By James Maguire,
  December 16, 2020

• AI vs. Machine Learning vs. Deep Learning

  FEATURE |  By Cynthia Harvey,
  December 11, 2020

• Huawei’s AI Update: Things Are Moving Faster Than We Think

  FEATURE |  By Rob Enderle,
  December 04, 2020

• Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 18, 2020

• Key Trends in Chatbots and RPA

  FEATURE |  By Guest Author,
  November 10, 2020

• Top 10 AIOps Companies

  FEATURE |  By Samuel Greengard,
  November 05, 2020

• What is Text Analysis?

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 02, 2020

• How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 29, 2020

• Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 23, 2020

• The Super Moderator, or How IBM Project Debater Could Save Social Media

  FEATURE |  By Rob Enderle,
  October 16, 2020

• Top 10 Chatbot Platforms

  FEATURE |  By Cynthia Harvey,
  October 07, 2020

• Finding a Career Path in AI

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  October 05, 2020

• CIOs Discuss the Promise of AI and Data Science

  FEATURE |  By Guest Author,
  September 25, 2020

• Microsoft Is Building An AI Product That Could Predict The Future

  FEATURE |  By Rob Enderle,
  September 25, 2020

• Top 10 Machine Learning Companies 2021

  FEATURE |  By Cynthia Harvey,
  September 22, 2020

• NVIDIA and ARM: Massively Changing The AI Landscape

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  September 18, 2020

• Continuous Intelligence: Expert Discussion [Video and Podcast]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 14, 2020

• Artificial Intelligence: Governance and Ethics [Video]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 13, 2020

• IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI

  FEATURE |  By Rob Enderle,
  September 11, 2020

• Artificial Intelligence: Perception vs. Reality

  FEATURE |  By James Maguire,
  September 09, 2020