Feeds

Doomjuice variant ups the ante in MS attack

Prelude to Friday the 13th assault?

  • alert
  • submit to reddit

Intelligent flash storage arrays

A new version of the Doomjuice worm has been released into the wild in an apparent effort by hackers to modify an attack against Microsoft's Web site.

Doomjuice-B attacks www.microsoft.com, much like its predecessor Doomjuice-A, but now it sets random HTTP headers to make it more difficult to filter out the attack traffic. Its assault begins tomorrow.

TDoomJuice-B is smaller in size than DoomJuice-A because it does not drop the source code of MyDoom-A. AV vendor F-Secure reckons DoomJuice-B is slightly more virulent than its predecessor.

Netcraft estimates the scope of the "zombie" network potentially commanded by DoomJuice-B is likely to be smaller than the original pool of MyDoom-compromised machines which has kept www.sco.com offline with a DDoS attack since the start of February.

Both variants of Doomjuice use a backdoor left open by MyDoom-A to spread, instead of propagating through email or P2P file-sharing networks. Neither versions attacks SCO's Web site.

MyDoom infected anything between 400,000 and one million PCs, according to sundry estimates. Yesterday more than 65,000 IP addresses were actively scanning to and from port 3127, the backdoor left open by MyDoom_A, according to he SANS Institute's Internet Storm Center. This suggests that many users have cleaned up their act.

Netcraft has published a chart showing the performance of all the sites involved in the MyDoom/DoomJuice DDoS attacks here. ®

Related Stories

Latest Email worm (MyDoom) has SCO-facing payload
SCO posts $250,000 worm bounty
MyDoom assault forces SCO.com off the net
MyDoom variant attacks Microsoft.com
Worms pour through MyDoom back door

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.