New Worm Installs Sniffer

fmorgan writes "Netcraft just posted a note saying that a new worm installs a network sniffer in the infected computers." When I read these things it kind of makes me wonder why it took this long. Update: 09/13 22:47 GMT by T : More innovation: Ant writes "The Register has a story about a piece of malware that 'talks' to victims. The Amus email worm uses Windows Speech Engine (which is built-in to Windows XP) to deliver a curious message to infected users. The message reads: "How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule." ("Gule. Gule" is Turkish for "Bye. Bye". "Hamsi" is a small fish, like an anchovy, found in the Black Sea). F-Secure has a copy of the sound file generated by the message."

Comments

the bad one

[Clover_Kicker]

I'm waiting for a virus that greps all your documents for each name in your address book.

If a document contains a person's name, email it to them.

I can see it now, salary spreadsheets and confidential memos flying around to the very people who are not allowed to see them...

As usual these useless virus alerts lack info.

[zaqattack911]

How does it Normally spread?
What windows vulnerabilities is it using?
is it an email attachment? what is the attachement called .. or its variants??

For christ sake...

Love, Zaq

Why did it take this long?

[rjamestaylor]

Perhaps it took this long because the bad guys were busy installing keystroke recorders so that they could defeat encrypted network traffic. Also, switched networks help keep the impact of the sniffing to the infected computer -- unless the network terminates at an infected computer -- thus making this less as threat to large organization using 100% switched networks...