[ news_security_news ]
New Storm Variant Hits Blogs, Emails
David Utter
Staff Writer
2007-02-27
 Insider Reports RSS Feed
A polymorphic version of the Storm worm will deliver a rootkit to an unsuspecting victim's machine, and from there will post a link to itself in the blog entries, forum posts, and emails coming from the now-infected system.
Secure Computing principal research scientist Dmitri Alperovitch discussed this new, dangerous variant of Storm with SecurityProNews. Due to the polymorphism employed by the variant, signature-based antivirus engines won't catch it.
Beware of links containing the text, "Have you seen this?" going to a destination with the words 'fun video' in them. These will lead to the malicious content.
The web browser will likely pop up a warning asking if the user wants to proceed with opening the executable. Doing so brings the rootkit onto the system, and prepares it for distribution to others.
That distribution happens whenever someone on the infected system communicates with others. The rootkit watches for blog or forum entries, or email sent from local software or web-based versions like Hotmail or Gmail. It's already showing up on numerous forums and blog posts, Alperovitch said.
It dynamically inserts the misleading text and link to those messages, where other readers will see it and possibly click it and continue the spread of this Storm variant.
Alperovitch said Secure Computing picked up on this new pest through its TrustedSource network. Its monitoring caught an email containing the malicious link, where further research confirmed the presence of the Storm malware.
He also noted that they have traced the link to a server in New Jersey, and are actively trying to get it shut down. Other servers could exist to pick up the load, and switching to them would take place outside US borders. The site's name is registered through an Estonian registrar that has developed a reputation for hosting such malware-related domains.
---
Tags: Storm, Polymorphic, Worm, Secure Computing
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the SecurityProNews updates: 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
