The Storm Worm (dubbed so by Finnish company
F-Secure) is a backdoor Trojan horse that affects computers using Microsoft
operating systems, identified as Small.dam, discovered on January 17, 2007.
The worm is also known as:
* Trojan.Downloader-647
* Trojan-Downloader.Win32.Small.dam
* Trojan.DL.Tibs.Gen!Pac13[3]
* Downloader-BAI (McAfee)
* Troj/Dorf-Fam (Sophos)
* Trojan.Peacomm (Symantec)
* TROJ_SMALL.EDW (Trend
Micro)
* CME-711 (MITRE)
* Win32/Nuwar.N@MM!CME-711
(Windows Live OneCare)
The Storm Worm infected thousands of computers
(mostly private) in Europe and the United States on Friday, January 19,
2007 using a topical e-mail message with the subject "230 dead as storm
batters Europe". During the weekend there were six subsequent
waves of the attack. As of Monday, January 22, the Storm Worm accounted
for 8% of all infections globally. The Storm Worm died off a bit
but now...
...Well it is back and more dangerous.
The
next two articles appeared in a recent Worldstart tip.
The Storm Rolls On
As you may recall, awhile back, we ran a couple
security articles on a Trojan virus called the "Storm Worm." If you remember
anything about those articles, you know that particular piece of malware
ended up scaring a lot of people and unfortunately, I'm here today to tell
you that it looks as if the Storm is back. And as if that weren't enough,
this time, it has been named the most deadliest e-mail virus of all time.
For all the important information on this, please keep reading!
To begin, I'm going to refer you back to one
of the previous articles we did on the Storm. Click http://www.worldstart.com/tips/tips.php/3373
to read it. As you can see, the Storm used to draw in its victims with
e-mail subjects that dealt with the government, etc. Now, it's pulling
people in with greeting card messages. Yes, that's right, the postcard
e-mail scam http://www.worldstart.com/tips/tips.php/3938 you've
been hearing so much about is now being classified along with the Storm
Worm virus. All of this started toward the end of June 2007 and it has
been on a steady roll ever since.
A couple other e-mail scams have been placed
into the Storm category as well, but the postcard scam is the worse by
far. It has also been said that the volume of spam coming from this virus
won't slow down any time soon. Unfortunately, the percentage of this kind
of spam e-mail will more than likely continue to increase between now and
the end of the year. Now, I know we've told you before, but please, if
you receive any kind of spam e-mail like this, do not open it. Just delete
it as fast as you can. There's no use keeping it around.
Riding Out the Storm
Well, as you already found out from today's
quick tip, the Storm Worm that took over the Internet like a hurricane
several months ago is back to its business of sending wave after wave of
attacks to poor, unsuspecting end users.
Wave one was a hailstorm of e-mails sent out
that referenced “Love“ or something romantic in the subject line, in order
to entice users into opening the e-mail. The sheer numbers of the spam
mail tripled to be the second highest e-mail threat in 12 months, with
about six million e-mails sent out after the dust had settled. This particular
e-mail threat is a little on the lame side and in most cases, could be
scuffed off as an obvious ploy to get a reader to open the message. This
is just phase one of the attack though, which in many security experts'
opinion, could help set up the second wave of the attack by giving it a
false sense of validity.
Wave two consisted of sending out e-mails with
“Virus Alert!” or something similar in the subject line. The e-mail also
contained a zip file attachment that claims it is the fix or update that
will get the virus you have on your system off. So, basically, the e-mail
is trying to convince the reader that they are already infected and this
attachment is the only way to get rid of it. In the body of the e-mail,
there is a password. This is used to apparently unlock the “fix,” allowing
you to open and install it. Of course, if you do open the zip file, chances
are, if you weren’t infected before, you are now.
If you remember the Storm Trojan, it is a nasty
and clever customer that pioneered new methods of infecting a user's PC.
It came with well thought out strategies to stay concealed as well. Now,
technology is in place to cover its tracks on the local machine, thanks
to the installation of a rootkit, which has the ability to cloak all of
the virus’ activity. The Storm Trojan also has the ability to turn off
your local security measures, which further masks itself and the activities
that it's maliciously conducting on the infected machine. After the initial
infection, the virus will attempt to connect to a P2P network to update
itself and to upload any information it has aggregated by going through
the user's hard disk drive(s). Of course, the Storm Trojan also scans your
hard drive for any e-mail addresses it can send itself to, in order to
propagate. And last, but definitely not least, there's the fact that your
infected PC is now a zombie machine and part of a bot network, just waiting
for orders.
Between the mass mailing of this and another
e-mail message using the Storm Worm with subject lines, such as "Missile
[sic] Strike: The USA Kills More Than [sic] 20,000 Iranian Citizens," "USA
Declares War on Iran" and "USA Just Have Started World War III," this has
been the most active virus in 12 months for e-mail born attacks. This comes
after I have said in more than one of my recent security articles that
we are seeing a serious decline of these types of attacks. Well, I guess
it was the calm before the storm. Thank goodness the taste of my shoes
doesn’t bother me too much!
Well, with the attacks popping back up since
the end of June 2007 (mostly with the postcard e-mail scam), most anti-security
companies have, for the most part, come out with the necessary updates
to protect your system. (Keep in mind that they only work if you update
your antivirus software). That, along with the fact that no matter what
an e-mail subject line says, our readers should know to never open e-mails
that seem strange, especially if they're from someone you don't know or
if they have an attachment. Bet you didn’t see that coming, did you?!
So, remember to update, update and update some
more. And please, don’t open unknown e-mails, especially any with attachments.
If you follow those rules, you should be just fine. |