Sunday, June 20, 2021

Is Second Wave of MyDoom Attack Rolling In?

A new variant of the MyDoom worm is kicking up a small online storm,

battering search engines and opening backdoors across the globe.

The variant, named by different anti-virus vendors as either MyDoom-M,

MyDoom-N or MyDoom-O, hit the Wild on Monday and spread rapidly.

Sporting a new twist in the way it propagates, the worm contains links

to several different search engines and tries to use them to harvest

email addresses.

Security analysts say some search engine sites, such as Google,

reportedly experienced some slow downs and possibly even intermittent

interruptions.

”This is the first time I’ve ever seen a worm perform a Google search

to harvest email addresses for an email routine,” says Ken Dunham,

director of malicious code for iDefense, Inc., a security intelligence

company based in Reston, Va. ”It’s interesting that this worm was

released while Google has a pending IPO. However, it appears that the

backdoor component of the worm is the real motive behind this widespread

worm.”

The new variant, which appears to have peaked yesterday, still is

circulating in high numbers today, according to analysts from

MessageLabs, Inc., a managed email security company based in New York.

Analysts there report intercepting 599,641 copies of the virus so far.

But those numbers pale in comparison to the original MyDoom, which took

the Internet by storm this past January.

Mark Sunner, chief technical officer of MessageLabs, says they

intercepted more than 5 million copies of MyDoom-A in its first 24 hours

in the Wild.

”This is causing a fair bit of commotion, but this variant hasn’t got

anywhere near the numbers of the original,” says Sunner. ”But because

of what it’s done to the search engines, its ability to affect the

community as a whole is quite significant. Other than that, we’d call

this a medium level of aggression.”

Symantec Corp., an information security company based in Cupertino,

Calif., has labeled MyDoom-M as a Level 4 threat, with Level 5 being the

most dangerous.

The new MyDoom variant is a mass-mailing worm with an SMTP engine that

sends copies of itself out to addresses harvested from infected machines

or off of search engines. The worm also carries a Trojan that is

installed on TCP Port 1034.

” The Trojan is what has got us worried,” says Dunham. ”This backdoor

has been completely changed from the one that was in earlier versions of

MyDoom… This is a very complicated backdoor. The code is very

difficult to wade through.”

MessageLabs’ Sunner says the backdoor carries some disturbing commercial

capabilities.

”This variant isn’t dangerous from a traditional standpoint. It’s not

deleting files or amending spreadsheets,” says Sunner. ”But all the

viruses these days have a commercial motivation to them. That Trojan can

be used as an effective spam sending mechanism…. I don’t think this

virus’ main intention was to create denial-of-service attacks on the

search engines. This is about spam.”

Is a Second Wave Coming?

Dunham says the new MyDoom variant is just the first line of attack in a

bigger battle.

Today, Dunham’s analysts report finding Zindos-A in the Wild. The

malware scans for randomized IP addresses with TCP port 1034 open. This

is the port that the new MyDoom variant opens. Once it finds that open

port, Zindos-A uploads a copy of itself, which is then executed by a

mechanism inside the new MyDoom. After creating a .exe file on the

infected computer and modifying the Windows registry, Zindos-A attacks

the Microsoft.com Web site with a denial-of-service attack.

”It appears that the release of Zindos-A is part of a multi-stage

MyDoom attack against Microsoft.com and possibly to perform other

actions,” says Dunham.

Similar articles

Latest Articles

3 AI Implementations That...

I was on a joint educational call for the World Talent Economic Economic forum on mobile computing this week. We drifted to topics that...

Survey of Site Reliability...

NEW YORK — Site reliability engineers (SREs) are warning of a looming scalability ceiling and saying the adoption of AIOps isn’t happening at a...

Druva Integrates sfApex to...

SUNNYVALE, Calif. — A maker of software for cloud data protection and management is helping companies safeguard essential customer data that their sales and...

Best Data Science Tools...

Data science has transformed our world. The ability to extract insights from enormous sets of structured and unstructured data has revolutionized numerous fields —...