IDG News Service - The Windows attack used by a recently discovered worm is being picked up by other virus writers and will soon become much more widespread, according to security vendor Eset.
Eset reported Thursday that two new families of malicious software have popped up, both of which exploit a vulnerability in the way Windows processes .link files, used to provide shortcuts to other files on the system.
The vulnerability was first exploited by the Stuxnet worm, discovered on computer systems in Iran last month. Highly sophisticated, Stuxnet targets systems running Siemens industrial control system management software. The worm steals SCADA (supervisory control and data acquisition) project files from Siemens' computer systems.
Siemens issued a Security Update for its customers on Thursday, but Microsoft has yet to patch the Windows bug that permits the worm to spread.
The newly discovered malware is "far less sophisticated" than Stuxnet and "suggests bottom feeders seizing on techniques developed by others," said Eset researcher Pierre-Marc Bureau, writing in a blog post.
One of the new samples installs a keystroke logger, a tool hackers use to steal passwords and other data, on the victim's computer. "The server used to deliver the components used in this attack is presently located in the US, but the IP is assigned to a customer in China," Bureau said.
The other variant could be used to install one of several different pieces of malicious software.
As each new variant of the attack pops up, it adds pressure on Microsoft to patch the underlying vulnerability. Microsoft's next set of security patches is due Aug. 10, but if enough customers get infected, the company may be forced to rush out an emergency patch for the issue.
Microsoft has already posted a temporary workaround to the problem and says it is working on a patch.
Right now, the Stuxnet worm makes up a very tiny volume -- less than 1/100th of a percent -- of the malware that Eset is seeing on the Internet, said Randy Abrams, Eset's director of technical education, in an interview.
However that's likely to change. "It's likely to become one of the most prevalent attack vectors," he said. "I expect that within a few months, we'll see hundreds if not thousands of pieces of malware using the link vulnerability."
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- BlackBeard Case Study In this case study, learn how a business with 95% of revenues generated online was hit by DDoS attacks over a 6-month period,...
- Four Ways DNS Can Accelerate Business Growth This e-book describes how DNS has developed over the years to support business growth as new needs have emerged, for example, advanced traffic...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Network Security White Papers | Webcasts