Feeds

NetSky-V spreads on auto-pilot

Joins assault on P2P sites

  • alert
  • submit to reddit

High performance access to file storage

Yet another NetSky virus arrived on the scene today. NetSky-V spreads using a well known Internet Explorer vulnerability, connected with the handling of XML pages. Instead of depending on users double clicking on infectious email attachments, the worm can spread automatically across vulnerable Windows boxes.

Users can be infected by NetSky-V simply by reading an infected email.

Just as well then that NetSky-V, although it has been observed in the wild, is far less common than previous versions. Most anti-virus firms rate NetSky-V as low-to-medium risk. A previous variant, NetSky-Q ,was also capable of auto-execution but it used a different exploit mechanism (an IE iFrame vulnerability, dating back three years) to the vulnerability exploited by Netsky-V.

Emails contaminated by NetSky-V come with subject lines such as 'Converting message. Please wait...' and exploit code which attempts to download a copy of the worm from an infected user's computer.

The worm's payload contains code designed to spread infectious emails to addresses harvested from victim machines, which become zombie drones.

From 22 to 29 April, NetSky-V is programmed to launch a denial of service attack on file-sharing and warez websites (www.cracks.am, www.emule.de, www.kazaa.com, www.freemule.net and www.keygen.us).

Four previous versions of NetSky have targeted a similar list of sites. NetSky-Q infected more machines than its DDoS worm siblings and was therefore responsible for the most severe attack to date.

Sites such as www.kazaa.com remained up and running during an attack by NetSky-Q between 8 April and 11 April. However www.cracks.am was seriously bogged down. Other sites targeted by Netsky-Q - www.edonkey2000.com and www.emule-project.net - removed themselves from DNS records during the duration of the attack.

Mikko Hyppönen, director of nti-Vivrus Research at Finnish AV firm F-Secure, said the attacks "were fairly successful since most of the sites, except Kazaa, went down."

Advice to defend against Netsky in all its varied guises follows a familiar pattern: update AV signature files, apply patches, use a personal firewall and wear a regulation tin-foil hat. ®

Related stories

Kazaa and eDonkey brace for Netsky-Q onslaught
Netsky tops virus charts by a country mile

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.