MyDoom’s One-Two Punch Lacks Wallop

With the latest MyDoom variant largely under control, the second wave of

the virus author’s attack is losing steam, according to security

analysts.

It seems that what was meant to be a digital one-two punch is lacking

the necessary wallop.

”Companies pretty much have MyDoom under control and that took the

steam out of Zindos,” says Steve Sundermeier, a vice president with

Medina, Ohio-based Central Command. ”If this latest version of MyDoom

had been more successful, it would have been a completely different

story.”

MyDoom, which caused considerable disruption when it was originally

released into the Wild this past January, reappeared earlier this week

in the form of a new variant. The variant, named by different anti-virus

vendors as either MyDoom-M, MyDoom-N or MyDoom-O, was first detected in

the United Kingdom on Monday and quickly started to spread.

Analysts at MessageLabs, Inc., a managed email security company based in

New York, report that in the first 24 hours they intercepted 599,641

copies of the virus. But that pales in comparison to the original —

MyDoom-A — which released more than 5 million copies into the Wild in

its first 24 hours.

What makes the latest MyDoom variant interesting is the new twist in how

it propagates. The worm contains links to several different search

engines and runs ‘get requests’ on them to harvest email addresses.

Security analysts say some search engine sites, such as Google,

reportedly experienced some slow downs and possibly even intermittent

interruptions.

The worm also carries a Trojan that is installed on TCP Port 1034.

And that open port ushers in what analysts say was surely a planned

second wave of the attack.

On Tuesday, analysts at iDefense, a security intelligence company based

in Reston, Va., reported finding Zindos-A in the Wild. The malware scans

for randomized IP addresses with TCP port 1034 open. This is the port

that the new MyDoom variant opens. Once it finds that open port,

Zindos-A uploads a copy of itself, which is then executed by a mechanism

inside the new MyDoom variant. After creating a .exe file on the

infected computer and modifying the Windows registry, Zindos-A launches

a denial-of-service attack against the Microsoft.com Web site.

But Ken Dunham, director of malicious code for iDefense, notes that with

the MyDoom threat being buttoned up, there isn’t much opportunity for

Zindos-A to take hold.

”There was a rapid response from anti-virus companies… and the sheer

number of MyDoom infections has dropped dramatically over the last 24

hours,” says Dunham. ”Corporations removed the MyDoom threat and that

cuts off the potential for Zindos to have a big affect. Without the

MyDoom infection, Zindos has nothing to infect.”

But Dunham says analysts are still on alert for the multi-layered attack

to potentially continue.

”It’s all part of a planned attack, and we’re not sure the attack is

over,” he adds. ”We’re definitely on alert status, recognizing the

potential for additional code to be launched.”

RELATED NEWS AND ANALYSIS

• Ethics and Artificial Intelligence: Driving Greater Equality

  FEATURE |  By James Maguire,
  December 16, 2020

• AI vs. Machine Learning vs. Deep Learning

  FEATURE |  By Cynthia Harvey,
  December 11, 2020

• Huawei’s AI Update: Things Are Moving Faster Than We Think

  FEATURE |  By Rob Enderle,
  December 04, 2020

• Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 18, 2020

• Key Trends in Chatbots and RPA

  FEATURE |  By Guest Author,
  November 10, 2020

• Top 10 AIOps Companies

  FEATURE |  By Samuel Greengard,
  November 05, 2020

• What is Text Analysis?

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 02, 2020

• How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 29, 2020

• Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 23, 2020

• The Super Moderator, or How IBM Project Debater Could Save Social Media

  FEATURE |  By Rob Enderle,
  October 16, 2020

• Top 10 Chatbot Platforms

  FEATURE |  By Cynthia Harvey,
  October 07, 2020

• Finding a Career Path in AI

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  October 05, 2020

• CIOs Discuss the Promise of AI and Data Science

  FEATURE |  By Guest Author,
  September 25, 2020

• Microsoft Is Building An AI Product That Could Predict The Future

  FEATURE |  By Rob Enderle,
  September 25, 2020

• Top 10 Machine Learning Companies 2021

  FEATURE |  By Cynthia Harvey,
  September 22, 2020

• NVIDIA and ARM: Massively Changing The AI Landscape

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  September 18, 2020

• Continuous Intelligence: Expert Discussion [Video and Podcast]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 14, 2020

• Artificial Intelligence: Governance and Ethics [Video]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 13, 2020

• IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI

  FEATURE |  By Rob Enderle,
  September 11, 2020

• Artificial Intelligence: Perception vs. Reality

  FEATURE |  By James Maguire,
  September 09, 2020