Wednesday, April 14, 2004

New Bugbear Virus finds New IE Hole:
"This has been a busy week for virus writers and antivirus vendors. We've seen some more Netsky and Bagle variants, as well as a number of new Trojans. However, the most prevalent has been last week's top threat Netsky.P, followed by Netsky.C and Netsky.D. While we haven't seen a wide distribution yet, a new Bugbear variety is starting to make the rounds?4Bugbear.C or Bugbear.E (depending on antivirus company reporting it). Bugbear.C attacks through an HTML attachment, and an unpatched Internet Explorer vulnerability. See our top threat for more information. "

Compared with PC users, Apple users have been fairly immune to viruses. However, a new "concept" Trojan is making waves in the Mac community. Intego, a security company announced the appearance of a new Trojan, MP3Concept. While Indego's press release describes potentially malicious payload the Trojan can have such as file deletion, sending e-mail, or infecting other MP3, Jpeg, GIF or QuickTime files, the MP3 Concept only shows a text message, and plays an MP3 of a man laughing. According to Symantec, the Trojan is not in the wild yet. Codemonkey takes a bit more of a swipe at Intego saying they are spreading FUD. The famous Nigerian 419 scam (also known as the advance payment scam) was in the news this week, with the conviction of one of the scammers. According to UK newspaper AllAfrica.com , Peter Okoeguale, a Nigerian living in Wales, was arrested for committing fraud. He was sentenced to 20 months, and faces deportation to Nigeria once freed. Unfortunately, this perpetrator is only one of probably hundreds or thousands of scammers preying on victims looking to make a fast buck. The Nigerian 419 scam, named after the Nigerian penal code covering fraud, comes in a number of varieties. Some offer a victim an investment in a Nigerian company, or a share of a large sum of money being spirited out of the country by an exiled high official. They often send the victim a forged or stolen check that the victim is to hold while they put up their own money. There are many web sites that explain and fight the scam. A quick search on Google for Nigerian Scam will bring up hundreds results. Peter Ferrie and Frederic Perriot, researchers at Symantec have just published an analysis of the Welchia.B (Nachi.B) worm in Virus Bulletin called "The Wormpire Strikes Back". Welchia.B attempts to be a good worm by removing other worm infections. The analysis is a terrific look under the hood of the virus, with a little Star Wars humor tossed in. If you're interested in a deeper understanding of worms in general, and Welchia in particular, take a look at Peter's whitepaper.

http://www.pcmag.com/print_article/0,1761,a=124102,00.asp

No comments: