Urgent Warning from ZDNet.
"Storm Worm Variant Targets Blogs, Bulletin Boards"
A variant of the Trojan horse attacks known as Storm Worm emerged Monday, targeting people who post blogs and notices to bulletin boards.
Storm Worm emerged in January and raged across the globe in the form of e-mails with attachments that, when opened, loaded malicious software onto victims' PCs, commandeering the machines so they could be used for further attacks.
The new Storm Worm variant attacks the machines of unsuspecting users when they open an e-mail attachment, click on a malicious e-mail link or visit a malicious site, said Dmitri Alperovitch, principal research scientist at Secure Computing.
But the twist comes when these people later post blogs or bulletin board notices. The software will insert into each of their postings a link to a malicious Web site, said Alperovitch, who rates the threat as "high."
"We haven't seen the Web channel used before," he said. "In the past, we've seen malicious links distributed to people in a user's address book and made to look like it's an instant message coming from them."
The danger in this most recent case, he added, is that the user is actually posting a legitimate blog or bulletin board notice, unaware that a malicious link has been slipped into the text of the posting.
Now this from Secure Computing.
Blogs, bulletin boards and webmail are now being spammed with messages to visit a website to view "fun" videos.
Secure Computing has discovered a website containing a variant of the Storm worm. The worm installs a component on a user's machine that analyzes all network traffic via a layered service provider (LSP) integration and dynamically modifies blog comments, discussion posts and webmail-based emails as they are being posted by the user to include a link to the malicious code, thereby propagating itself to other victims.
"This signifies a new trend in malware that is spread through blogs, message boards and web-based email," said Dmitri Alperovitch, Principal Research Scientist, Secure Computing. "And this threat is particularly insidious in that anti-virus detection doesn't always work.
This threat utilizes server polymorphism, which means that it is continuously being repackaged to make the binary appear different to signature-based anti-virus solutions." With the executable file being changed continuously, it easily sneaks below the radar of the leading anti-virus programs, which are largely signature-based.
Viruses, worms, Trojans and other malware have traditionally been distributed through users' email address books, and made to look like messages coming from them.
With this threat, we begin to see the addition of a Web attack component to traditional email based malware," said Alperovitch. "Secure Computing has already seen evidence of the malware propagating through messaging forums, such as Men's Health magazine, as well as thousands of blog sites," he said.
Appliances utilizing Secure Computing's TrustedSource(TM) global reputation system and proactive malware detection are already protected from this type of malware activity.
SOURCE Secure Computing Corporation 02/28/2007
Web site: http://www.securecomputing.com
0329 02/28/2007 14:29 EST http://www.prnewswire.com