Feeds

Mutant son of MyDoom plans three-pronged attack

Multiple vulns exploited, end of world nigh

  • alert
  • submit to reddit

Remote control for virtualized desktops

Virus writers have used code from the infamous Mydoom worm to create a potentially dangerous new Internet worm which uses multiple methods to spread.

Plexus-A spreads using three different methods: infected email attachments, file-sharing networks and Windows vulnerabilities (the LSASS vulnerability used by Sasser and the RPC DCOM flaw used by Blaster). The as yet unknown virus authors used MyDoom source code as the basis for creating Plexus, according to an analysis of the worm by Russian AV firm Kaspersky Labs.

David Emm, senior technology consultant at Kaspersky Labs, said that the multiple spreading methods is helping Plexus to infect more machines. No worm since Nimda has used as many methods to spread, according to Emm. Kaspersky rates Plexus as a moderate risk. It is spreading - but nothing like as fast as Sasser or Blaster - and the main concern about the worm stems from the fact it creates a backdoor for hackers on infected machines. These compromised machines could be used for spam runs or as a platform for DDoS attacks. However the motives of the virus authors behind the worm remain unclear.

Plexus-A chooses from five different email message headers in an attempt to bamboozle users. Each message has a different header, body and attachment name. The only characteristic which does not change is the file size: 16208 bytes when compressed with FSG and 57856 when uncompressed. Mac and Linux users are - as usual - immune but Plexus is a menace for Windows users.

Upon execution Plexus-A copies itself to the Windows system registry under the name upu.exe, which runs every time a machine is rebooted after infection. Plexus sends copies of itself to email addresses harvested from the hard drives of infected machines.

The worm is among the first to specifically target users of Kaspersky Labs' AV software. Plexus' payload includes attempts to prevent downloads of Kaspersky Anti-Virus database updates. Plexus also scans the Net for systems vulnerable to the flaws it exploits. The worm opens a backdoor onto infected machines on port 1250, making it possible for files to be remotely uploaded to and from the victim machine. The open port leaves the victim machine vulnerable to further attacks, Kaspersky Labs warns.

Users are advised patch Windows boxes, update anti-virus signature files and use firewalls to shelter against Plexus and similar irritants that are doubtless just around the corner. Is there no end to this viral madness? ®

Related stories

Windows worms tax ISPs
Sasser worm creates havoc
Sasser creates European pandemonium
German police arrest Sasser worm suspect
Sasser ups cost of Windows - Gartner
Phatbot arrest throws open trade in zombie PCs
Blaster rewrites Windows worm rules

Internet Security Threat Report 2014

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.