2 min read

Worm Attack: A Grudge Match With Symantec?

The Rinbot worm, which hit the computer network at Turner Broadcasting Thursday, targets flaws in Symantec and Microsoft SQL Server software.
Is the virus writer targeting Symantec in some type of grudge match as the CNN story implied? That's still up in the air.

"From time to time virus writers leave messages in their code. Sometimes these are shout-outs to other virus writers, sometimes it is their own nickname, and other times they send messages to us," wrote Stephen Doherty, a security response engineer with Symantec, in his blog on Wednesday. "Here is one that speaks for itself: Dear Symantec: For years I have longed for just one thing, to make malware with just the right sting, you detected my creation and got my domains killed, but I will not stop, I can rebuild." The virus writer then ended his message with a string of expletives aimed at Symantec and Doherty himself.

Doherty didn't say which piece of malware this message was embedded in.

Cluley, though, says these kinds of messages aren't all that uncommon. They were more common when the majority of viruses were written by script kiddies in their basements, instead of high-tech criminals looking to make a fortune through cybercrime.

Moriarty agrees. "It's just another worm," he says. "Most likely it's someone who wrote malware for Symantec because they're one of the largest corporate installments of antivirus. If you're writing, you go after the big boys."