'Storm worm' rages across the globe

"Storm worm," one of the larger Trojan horse attacks in recent years, is baiting people with timely information about a deadly, real-life storm front, security researchers said Friday.

Over an eight-hour period Thursday, malicious e-mails were sent across the globe to hundreds of thousands of people, said Mikko Hypponen, chief research officer for F-Secure.

People who open the attachment then unknowingly become part of a botnet. A botnet serves as an army of commandeered computers, which are later used by attackers without their owners' knowledge.

Storm worm carries the subject line "230 dead as storm batters Europe," Hypponen said, noting the unusual twist to the e-mail.

"The e-mail was started 15 hours ago, when the storm was peaking in Central Europe," Hypponen said. "This is unusual in that it was very timely."

Storm worm is a Trojan horse with an executable file as an attachment. Cybercriminals took advantage of social engineering, using the news of the European storm to get people to open the attached malicious file, which promises more news on the weather emergency. The recipient must open the file for it to execute.

The file creates a back door to a computer that can be exploited later to steal data or to use the computer to post spam.

Storm worm is already close to being as large as the bigger attacks of 2006, Hypponen said, though it's still smaller than Sasser and Slammer.

Hypponen also noted that this Trojan horse is unusual because most attacks these days tend to be smaller and targeted, as criminals seek to pilfer personal information for financial gain, rather than fame.

Though Storm worm is widespread, the damage may ultimately be minimal in the U.S. because most tech security companies will have already added it to their blocking list before people get into work, he added.

Other e-mail subject lines for it include "U.S. Secretary of State Condoleezza..." and "A killer at 11, he's free at 21 and..."

According to the Associated Press, the European storm has killed at least 41 people.

[J_Satch]

And of course....

...countless thousands of idiots gladly open the email and attachment.

[CentrOS]

Once again, the Macintosh from Apple proves to be the safer choice.

Once again, the Macintosh from Apple proves to be the safer
choice.

[sal-magnone]

lol

Yet another virus that I probably won't get. The last virus I got was a DOS virus in the late 80s.

It's hardly just the OS. The OS matters but not as much as people. Put MAC and LINUX boxes on the desktop, in the hands of similar users and desktop support groups and you'll get the same results.

[RoutinelyCalled]

Not about bragging rights

All this talk about writing a Mac virus and getting bragging rights ignores the main reason for viruses and worms these days...money! In the old days it was about who could write the coolest, fastest, most-targeted. Now it's about creating spam-bot networks to sell to as a service to spammers.

Read the article and it's obvious. How could a worm get sent to hurdreds of thousands of people (the intent) if it targeted an OS used by 10% of users. It ain't about props any more, it's about cash!

[imacpwr]

Macs weather the storm..!!

Switching to a Mac last year was the smartest move I ever made..!!

[clsgis]

Cnet is afraid

Once again, a story about an email worm which only affects one vendor's system fails to mention that vendor. Doesn't even mention the fact that it only hits one vendor's OS.

Don't you think that was a relevant detail? Why do you think it was left out?

The night after the Melissa worm hit, Ted Koppel had a real expert on his show, who explained in language anyone could understand exactly why the worm got so far so fast. It was a career-limiting move for Koppel. _Nightline_ doesn't do malware stories any more.

I worked on the biggest selling 10BASE-T card in the industry's history. We were the first with Linux support, and the default NIC in Linux kernels for years. Before I left, I asked our CEO why we never mentioned "works with Linux" on the retail box. He said he couldn't risk getting the 800 pound gorilla angry. The gorilla is irritable. Everybody in that business is afraid, and that includes the pundits and publishers.

http://notwindoze.blogspot.com

[sea_net]

LOL

REALLY GOOD HEADLINE

NO CIGAR

[lkrupp]

Letter to the writer of this article...

"Ms. Kawamoto,

Do you have a legitimate reason for not providing information
about the operating system this worm uses to propagate itself?
Are we to assume this worm affects ALL operating systems and
users or just one. On the surface it seems to you are deliberately
obfuscating the problem and don't want people to know what
system is affected. Is it C|net policy to protect the identity of a
certain operating system when it is the cause of a threat?"

[wbenton]

Internet Common Sense 101

>>>People who open the attachment then unknowingly become part of a botnet.<<<

Internet Common Sense 101: Don't click on unknown URL links or unknown attachments... ESPECIALLY if they're of the executable type, and ALSO especially if they're from an unknown spoofed source.

If you don't know how to tell the difference, then give up computing or learn how to tell the difference.

Doesn't really matter what OS the worm is after!!!

Internet Common Sense 101 is Internet Common Sense 101.

Adhere to it or get infected!!!

Walt

[rbannon]

What platform?

Linux, UNIX, Mac OS X, or Windows?