Software // Enterprise Applications
News
7/27/2004
04:30 PM
50%
50%

MyDoom Attackers Target Microsoft

The second phase of the attack is planting a tool to launch a denial-of-service attack against the software maker.

The second phase of an Internet virus attack that began Monday is now under way, some Internet security firms warn.

Early Monday morning, the MyDoom.M virus began infecting thousands of computer systems worldwide. The virus flooded E-mail boxes and slowed the performance of many search engines, including AltaVista, Google, Lycos, and Yahoo.

Security experts are unsure how many systems were infected with the MyDoom variant. However, E-mail security services firm MessageLabs reported intercepting nearly 600,000 infected E-mails in roughly 24 hours ending Tuesday morning. Infections seem to have slowed down since them, the company says.

Internet security firm McAfee Inc. says it has seen the rate of the attack slow down as well, says Brain Mann, whose title is avert outbreak manager. "Yesterday we were seeing reports of about 50 to 60 every hour. However, we've only seen 84 since midnight, and it's been averaging about 10 an hour now," Mann says.

Despite the slowdown, security researchers now say a second wave of the attack is under way.

The new attack uses MyDoom-infected systems to launch a denial-of-service attack against Microsoft's Web site, says Ken Dunham, director of malicious code at security firm iDefense Inc., in an E-mail alert.

When the MyDoom variants infect a system, the worm inserts a Trojan horse called Zincite.A onto the infected system, various security firms report. The Zincite.A Trojan horse opens a backdoor on the system that makes it possible for attackers to take control of the compromised system. Zincite.A opens TCP port 1034 on infected systems.

IDefense and Internet security firm Symantec Corp. say they're seeing a new Trojan called Zindos.A, which scans for Internet addresses for open 1034 TCP ports. When Zindos.A finds an open TCP 1034 port, it copies itself to that system and can be activated by the Zincite.A Trojan horse.

Once the infection process is complete, Zindos.A attempts to attack Microsoft.com with a denial-of-service attack.

So far, Zindos.A is not widespread. But that could change quickly, says Oliver Friedrichs, senior manager for Symantec Security Response. "There is the potential that this could escalate quickly, given the numbers of infected systems out there," he says.

Dunham agrees. "If a computer is infected with Zincite, the Trojan installed by MyDoom, it will likely be infected with Zindos.A in the near future. The number of computers infected with Zincite is likely high," he says.

Microsoft is preparing itself. "Microsoft has taken steps to ensure that Microsoft.com remains available to customers," a spokeswoman says. "The Microsoft.com network is stable and has been consistently accessible to customers. Microsoft is working to fully assess Zindos."

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest, Dec. 9, 2014
Apps will make or break the tablet as a work device, but don't shortchange critical factors related to hardware, security, peripherals, and integration.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of December 7, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program!
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.