Slashdot Mirror
When Malware Attacks Malware
PetManimal writes "Researchers say that the Storm Trojan/Peacomm worm has been tweaked to spread via IM programs and attack rival malware. Symantec sounded the alarm, and says that the exploit launches in AOL, Google Talk, and Yahoo Messenger windows that are already open, making it appear to be a legitimate message from a known user. The worm has modified the code from last year's Nuwar worm, and when activated, enables a DDoS attack against any site, including antispam services and servers supporting rival malware: 'Systems hijacked by Peacomm have also conducted DDoS attacks against at least five domains used by the creators of the noted Warezov (or Stration) worm. After a busy September and October, Warezov was credited by some analysts as the genesis of 2006's massive fourth-quarter spike in spam volume.'"
When Malware Attacks Malware
You get total protonic reversal.
The theory of relativity doesn't work right in Arkansas.
It just means that, in a few years, all of the malware will be significantly harder to kill. All of the weaker 'species' will have been driven to extinction (via changes in coding). It had to happen eventually. We may even see 'anti-viral resistant' strains.
'Loose' is when your pants are three sizes too big. 'Lose' is when you misuse 'loose'.
No MSN Messenger vulnerability. MS is safe. /DNRTFA
So is there going to be a screen saver that will show the good and bad malware attacking each other as the computer keeps waving a white flag?
The well known malware Internet Explorer has been attacking another well known malware WinXP for quite sometime. So why get worked about these obscure ones?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Nah, its all easy to kill if you use a ROM based OS.
Just reboot.
---- Booth was a patriot ----
http://blanu.net/curious_yellow.html This has been predicted for while now. I think I first read about Curious Yellow (above) 4 years ago. Still relevant today.
Someone probably could but then they'd need to identify the myriads of unknown processes running in the Windows background (and the ps list on Linux isn't becoming much easier to keep track of, either). With the complexity of modern operating systems, and the prevalence of vendor loaded junkware, it's probably a task of cataclysmic proportions to try and figure out what's legit, what's not, and what was legit (from the vendor) but has since become exploited. Vendor junkware probably isn't the highest quality code when it comes to security. A worm or trojan making use of a simple buffer overflow in IE can probably make use of exploits in third party background processes more easily than it can make use of (somewhat) more closely guarded holes in the Windows OS.
I've often marvelled that so few security experts rarely expand on the very real probability that common malware is not the end result but rather the vector. Every piece of rogue code running on the machine creates just as many new holes as the one it made use of. Many rootkits, for example, don't have much in the way of security to ensure that only the original installer has access to the newly enabled access method.
the NPG electrode was replaced with carbon blac
-ha?
This reminds me of that one worm (or whatever it's called) that spread around and tried fixing computers that were infected by another one. Too bad the damn thing clogged networks in the process.
so what OSs does this apply to?
And the Dept of Homeland security is doing what? exactly!
Sent from my ASR33 using ASCII
Thus begins the ecology of internet software. CPU cycles are simply too valuable (en masse) for one piece of malware to share with others.
Eventually, look for malware to get better and better and rooting out rival malware in order to take its place. As well, look for malware to be more cautious about consuming host resources, lest it get noticed by a user or antivirus package.
It's no different than Earthly biology. We think nothing of the colossal number of parasitic microorganisms currently hitching a ride on our metabolism. Some like E. coli are so useful that we even enthusiastically encourage (Yoplait anyone?). Symbiosis carries major advantages along the lines of "division of labor". How many years before real symbiosis is realized among internet-connected computers?
It would also evolve the antivirus landscape. The "OMG sterilize all machines!!!1!" mantra would change into a more relaxed problem: calculate the most efficient amount of CPU cycles to allocate among the competing tasks of:
That's how our bodies do it, anyway.
FATMOUSE + YOU = FATMOUSE
Only to idiots, are orders laws.
-- Henning von Tresckow
In Soviet Russia, malware attacks... malware?
Will someone please write a worm that 1) turns Windows Update on, 2) turns the Windows Firewall on, 3) turns off the keyboard & mouse ports for Windows 3.1, 95, 98, and ME machines thus forcing the retarded end users running on these platforms to upgrade, 4) installs ClamWIN and scans the hard drive, 5) installs SpyBot Search & Destroy and scans the hard drive, and 6) administers an electric shock to the aforementioned retarded end user for not taking care of this themselves?
If your dog was running around the neighborhood barking at people and biting them, they'd make you do something about the dog. I don't see why your computer gets to the do the same thing on the internet with such impunity.
2 cents,
QueenB.
HDGary secures my bank
Regardless of the operating system or the applications which run upon it, the ultimate weakness at the end of the day lies upon the end user. You can only secure a system to a certain point until the user begins losing functionality, until the end user becomes more educated...well expect to see evolution in Malware.
What isn't generally reported is that Peacomm uses "Your momma's so fat" insults in the DDOS attacks. By far the most devasting and hilarious DDOS this year.
Well, there's spam egg sausage and spam, that's not got much spam in it.
just make spamvertising illegal?
They could simply prosecute the companies that are advertising their products via spam, after all they must have either directly been the originators of the spam, or at least know who they are funding to do the dirty work.
The businesses that exist solely to send spam would dissapear overnight if their client base dissapeared.
I'm sure any government could easily be able to determine who is ultimately behind spam, simply by buying some advertised product then either tracking the credit card transaction or by working out what the supply chain is from drug batch numbers on the product etc.
I'm the author of the technical writeup detailing the attack on the rival spam group. But the only reason I was investigating the DDoS attacks launched by the Storm Worm/Peacomm/Nuwar is due to my own site being attacked after I detailed the pump-and-dump stock spam operation of the Rustock trojan. It is getting riskier to publish research on viruses and spam. I believe since spammers were able to take out Blue Security by DDoS attack, they are getting bolder in who they target. There's no downside for them.
This has been around for years. It's called Norton Antivirus
I have visions of Tron-esque gladiators fighting for the right to make the mainframe belong to the penis enlargment spam zombie network or the penny stock spam zombie network.
Also, it might be neat pitting malware against each other in a Code War type of visible environment.
More Twoson than Cupertino
The aplore worm used the same trick in 2002 except it setup a web server on each computer and sent a URL pointing to it in IM windows. I'm sure there are earlier examples but that is the first one off the top of my head.
I vote they make a spinoff of Robot Wars
I can see it now...
Malware wars... watch rival malware rip each other apart!
"Oh my god, Malwarior just executed an amazing kill maneuver!"
"it looks like Spymaster is only hanging on by a thread!
"Oh... and he's done for. Spymaster is terminated... add him to the hexdump!"
The original generic sig.
that a large percentage of malware is designed to turn the user's PC into a mail spamming bot. I, for the life of me, do not understand how this can be effective if ISPs took even moderate precautions.
1. Don't allow your users to send port 25 traffic to any address but your own mail server.
2. Don't allow any one user to send massive quantities of email. Most user's won't need to send thousands of emails in a single day.
3. Use blackhole lists to prevent SPAM from networks that don't follow the above rules.
It seems like the above three rules would put a big roadblock for spammers. Am I missing something?
The race isn't always to the swift... but that's the way to bet!
Hasn't norton a/v been doing exactly this for years? Malware, fighting malware? :)
NEXT ON NON STOP FOX!
I would alter my kernel to make sure it does not run. Say, something like, change the mechanism that issues a syscall, or perhaps the signature of executable files. Oh, and move the compiler to another place on disk.
I'm not really sure, and depending on how vicious this is, but sometimes maybe 2 wrongs do make a right... For those of you who haven't seen the movie "Swordfish" they pretty much use terrorism to dissuade other terrorist actions. Perhaps this type of virus/worm/etc could be a good thing for us, that for most virus/worm/spam creators it will become such a pain in the ass to wreak their havoc, it won't be worth it for them (would you keep intentionally making/distributing virus/etc if it meant you got DDoS'ed so hard your server melts every month, costing you money on hardware?)
But then again, perhaps 2 wrongs don't make a right...
Was it actually confirmed that spammers were able to DDoS Blue Security out of existence? Last I recall the evidence for that was weak.
If you mod me down, I shall become more powerful than you could possibly imagine.
Or we could just us a unix security model, and when something wants to sudo, force it to ask the console user for a password. Microsoft steals ideas all the time. Why can't they steal the unix model, and be done with it?
</Powerman5000>
Two program enter, one program leaves
Are Macs directly affected ? DDoS affects everyone but I'm wondering if this can screw with the actual OS.
- In terms of malware - one of the reasons people find out they have an infected computer is because it stops performing as "quickly" as it used to.
- In terms of spyware - people believe that the toolbar gizmo will benefit them...somehow
The problem with proposing the "toleration policy" as a reasonable solution is that it is not reasonable...If I can define an infection well enough to allow it because it doesn't suck up many CPU cycles...then I should just as easily be able to define it and remove/block it just as I do any other malware infection.
Chalmer
weirdest thing I ever saw: scientology advertising on slashdot.
Seeing as it's being totally abused don't you think it's time to disable it.
.. (Score:-1, Troll)0 01072
In this year 2007, why are we still talking about viruses, spam and malware. Why don't they make a desktop OS that don't get 'malware' merely by opening an email attachment or clicking on a web link.
IM programs and malware
http://slashdot.org/comments.pl?sid=222234&cid=18
davecb5620@gmail.com