Welcome Guest. | Log In| Register | Membership Benefits
  • Email this page E-mail this page
  • |  Print Print this page
  • |   Bookmark and Share
  • |  icon
  • | 

Volunteers Step In To Battle Kama Sutra Worm


Security experts from a volunteer task force have working overtime with the Internet Storm Center and others to contact ISPs and companies whose computers have been infected with the Kama Sutra worm.

By Gregg Keizer
TechWeb News
January 26, 2006 06:50 PM

Security experts from a volunteer task force have collaborated with the Internet Storm Center and others to contact ISPs and companies whose computers have been infected with the Kama Sutra worm before the Feb. 3 trigger when the worm begins overwriting files.

Kama Sutra, which also goes by a bewildering range of names including Nyxem.e and Blackmal.e, has been spreading for less than two weeks, and probably has infected several hundred thousand PCs, say analysts. Its most distinguishing characteristic: it will overwrite the data in a long list of document formats -- primarily those of Microsoft Office, but also some of Adobe as well as a pair of popular compression formats -- with a text string, rendering the files useless.

The worm also trips a Web site counter each time a copy infects a computer. It's this counter that led the TISF BlackWorm task force, a loose group of volunteers, to a list of affected domains.

According to Randy Vaughn, a professor of information systems at Baylor University, and a member of the task force, the counting site's host ISP provided a log of the counter page that was invaluable.

"We took the IP addresses and time stamps," said Vaughn, "and matched those to our lists of autonomous systems. We already had an automatic notification [system] running, so we sent out 2,000 notifications."

Once the notifications are received by the ISPs or companies, it's up to them to decide how to alert their users.

The task force came out of the MWP (Malicious Websites and Phishing) and DA research groups, a loose confederation of security professionals who work for anti-spam/anti-virus vendors, various nations' CERTs, universities, and ISPs. The group last mobilized publicly in August 2005 when it put out an alert warning of growing scams after Hurricanes Katrina and Rita hit the Gulf Coast of the U.S.

Vaughn characterized the task force and the MWP/DA as a volunteer "civil defense system," but acknowledged less kind descriptions. "We really don't like the term 'security vigilantes,'" he said.

The task force split the list with the SANS Institute's Internet Storm Center to e-mail notifications to ISPs and other networks whose addresses appeared in the log. "We've had an excellent response," Vaughn said. "I've gotten hundreds of e-mails from the networks we notified.

Page 2: 
1 | 2 Next Page »


Subscribe to RSS


Advertisement

CAREER CENTER
Ready to take that job and shove it?



TechCareers

SEARCH
Function:

Keyword(s):

State:
SPONSOR
RECENT JOB POSTINGS
CAREER NEWS
10 Search Engines You Don't Know About
Go beyond Google and get vertical. These specialized search sites will help you find the business information you need -- fast.

Yahoo Profits Fall 23%, Cuts 1,000 Jobs
Ari Balogh was named to the post of chief technology officer as the companys for a "realignment" of employees.

More articles from our career center





Subscription Info
Apply for a free 52-week subscription to InformationWeek (a $199 value)

Last Name:

First Name:

Title:

Company Name:

City:

Business Address:

Zip:

State:

Email Address:

NOTE: Offer valid for U.S., U.S. possessions, & Canada only

            

Join economist Chris Cornell and 3 CIOs in an Exclusive Online Exchange for Senior IT Executives: Using IT to Drive Value in a Turbulent Economy. November 5th only.