Cisco: 'Here you have' worm caused brief havoc
IDG News Service - The "Here you have" worm that clogged e-mail systems on Thursday briefly caused one of the worst spam outbreaks of 2010, according to Cisco Systems.
For a few hours -- between 17:45 and 20:30 GMT -- the worm accounted for between 6 percent and 14 percent of all spam measured by Cisco's IronPort group.
It was the biggest spam outbreak since scammers pounced on the iPad launch back in March to try to trick people into visiting malicious websites, said Nilesh Bhandari, a product manager with Cisco. "That is humongous," he said.
"Here you have" spread primarily via e-mail, in messages that tried to entice victims into visiting a website that would install a malicious script on their computers. That script then scoured the victim's Outlook contacts list and sent similar messages to new victims. The worm also spread over the network, using a special PsExec script and via USB drives.
The worm's advance has been halted now for two reasons: Antivirus companies have added detection for the worm, and the website that hosted the malicious script has been taken offline. Cisco's data shows that by 12:00 GMT Friday it accounted for virtually none of the spam Cisco was tracking.
The worm primarily affected business networks in the U.S., Microsoft said in an analysis of the incident, posted late Friday. "For the first twelve hours of attack activity we monitored, 91% of the infections and infection attempts were reported from our corporate clients--the opposite of the pattern we normally see," Microsoft said.
It reportedly slowed down networks at Disney, Procter & Gamble, Wells Fargo and NASA.
This type of mass-mailing worm has largely been off the radar since the days of the Anna Kournikova and I Love You outbreaks in the early 2000s, but security experts say there are a few unusual things about "Here You Have."
There are several signs that may link it to a Libyan jihadist hacker named Iraq Resistance, SecureWorks said on Friday.
Most agree that the worm is not particularly sophisticated. Its success shows that it's still possible to infect a lot of computers by finding ways to trick people into doing things they shouldn't -- such as clicking on links and running malicious files. "[It] just shows that the human exploit is the easiest vector," said Alex Lanstein, a researcher with security vendor FireEye, in an e-mail message.
- SIP Migration: Addressing CIOs' Concerns Recent data from IDG Research shows that many IT executives are counting on SIP to help them meet employee efficiency and customer experience...
- City Solved Network Mystery - Saves $30K The City of Jacksonville put their hunch to work and not only solved a mystery, but found a new and innovative use for...
- Using Video to Gain a Competitive Advantage: A Business Strategy for Mid-Market Companies The insights provided in this white paper are based on industry analysts and 30+ years of experience from the Video Collaboration Group at...
- The Truth About Virtual Computing for CAD If you're a user of graphics-intensive software such as 3D modeling, simulation and analysis, and visualization, you might be skeptical about moving to...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Why Are Customers Really Deploying an NGFW? It seems every IT Security expert is talking about the NGFW, but what are people really doing? This webcast covers 5 real-world customer... All Network Security White Papers | Webcasts