|
|
New virus preys on old IE flaw
|
09-19-03
(Philadelphia & Conshohocken, PA)
(Philadelphia and Conshohocken,PA)
The Swen or Gibe.F virus, which preys upon an IE vulnerability that was publicized and patched two years ago, is quickly spreading. Users are falling for the new bug largely because it appears as an e-mail that falsely claims to contain an IE, Outlook, and Outlook Express security patch. This line of attack has allowed the virus to spread rapidly, but security experts warn that Swen is not the "critical" virus they have been forecasting.
Ken Dunham, manager of malicious code intelligence for Reston, Va.-based iDefense, said that Swen preys upon people's best intentions, appearing as an e-mail that purports to be a security update from Microsoft.
The worm is programmed to send an official-looking e-mail that says it contains a "cumulative patch" for several Internet Explorer, Outlook and Outlook Express vulnerabilities.
A Microsoft representative noted that the software maker does not send out patches as e-mail attachments.
In addition to spreading via e-mail, experts said, Swen can be transmitted over services such as Internet relay chat (IRC) and through peer-to-peer networks. The virus turns on file sharing--if it is not already turned on--and creates a shared directory with multiple copies of itself under various file names, said Kevin Haley, a group product manager at Symantec Security Response. Among the files Swen tries to disguise itself as are virus removal tools.
Haley said the social engineering that the virus writer used is most troubling.
"Those things are pretty interesting and pretty dangerous," he said.
The threat posed by Swen is rated fairly low by antivirus companies such as McAfee and Symantec, despite the worm's growing prevalence. "It doesn't look like it is causing a lot of trouble at least right now," Haley said. The threat is somewhat higher for home users and users outside the United States who are more likely to be using older, unpatched software, McAfee said.
"Swen is quickly gaining ground in Europe and has the potential to become very widespread in a short period of time," Dunham said in an e-mail.
The emergence of Swen comes as security companies have warned that a potentially major bug could soon emerge based on a recently disclosed Windows vulnerability. Experts said earlier this week that code that could quickly be used to create such a bug are already being distributed on underground hacker sites.
BACK to the Netforcement News Page.
REQUEST MORE INFORMATION On how Netforcement can help you secure the integrity of your network.
|
|
