New MyDoom Worm Is Bad Apple - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


New MyDoom Worm Is Bad Apple

The variant has spread so rapidly that security vendors quickly upgraded their threat assessments.

A new version of the MyDoom worm broke onto the Internet Monday with such speed that security firms raced to ratchet up their threat assessments.

MyDoom.o, pegged as MyDoom.m by Symantec Corp., is a relatively standard variant of the MyDoom line. This mass mailer infects systems when users open the attached file; it spoofs the return address, often masquerading as coming from the support desk at the user's company; and relies on the typical MyDoom trick of posing as messages about E-mail problems or undelivered mail.

The worm got good traction almost immediately. U.K.-based filtering firm MessageLabs said in an E-mail alert that it had intercepted 23,000 copies in the first five hours of the outbreak. Symantec reported receiving double the usual number of submissions from its clients, while McAfee also noted a much higher than usual number of submissions.

Vendors reacted by upping their threat levels. Symantec, for instance, pushed it from a "3" in its 1 through 5 scale to a "4," the first time the company has used that ranking since Sasser. McAfee pegged it as "Medium-on-Watch," a rating it's used only once before in 2004, and only three times during all of 2003.

The worm has some peculiar characteristics that may account for such quick success, said experts.

"It's double zipping," said Brian Mann, outbreak manager at McAfee's Avert research team. "Archiving the attachment is a pretty standard MyDoom technique, but some of the attached files in this version are zipped within a zip. That's harder for some anti-virus products to detect."

Vincent Weafer, senior director of Symantec's security response team, had another explanation. "It's using several online search engines to look for valid addresses."

Not only does MyDoom.o hijack addresses from the usual places--address books on the compromised machine--to spread itself, but it also queries the Google, Yahoo, Alta Vista, and Lycos search engines for any addresses that match the domains of those it steals from the infected PC.

"It looks like an efficiency tactic," said Weafer. "If it's able to find more valid addresses, and mail only to them, it may be able to avoid detection for a longer period."

Some enterprise anti-virus and message security software watches for evidence of mass mailings from within the company, or messages sent to random-looking addresses, then shuts down those systems' mail privileges.

But while MyDoom.o is big today, Weafer didn't think it would be tomorrow. "Although it's still accelerating, I think we'll see this fall off--as we have other MyDooms--in the next 24 hours."

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
2020 State of DevOps Report
2020 State of DevOps Report
Download this report today to learn more about the key tools and technologies being utilized, and how organizations deal with the cultural and process changes that DevOps brings. The report also examines the barriers organizations face, as well as the rewards from DevOps including faster application delivery, higher quality products, and quicker recovery from errors in production.
The State of Chatbots: Pandemic Edition
Jessica Davis, Senior Editor, Enterprise Apps,  9/10/2020
Deloitte on Cloud, the Edge, and Enterprise Expectations
Joao-Pierre S. Ruth, Senior Writer,  9/14/2020
Data Science: How the Pandemic Has Affected 10 Popular Jobs
Cynthia Harvey, Freelance Journalist, InformationWeek,  9/9/2020
Register for InformationWeek Newsletters
Current Issue
IT Automation Transforms Network Management
In this special report we will examine the layers of automation and orchestration in IT operations, and how they can provide high availability and greater scale for modern applications and business demands.
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll