Anti-virus companies are warning of a new variant of the Sdbot mass-mailing worm that installs a network sniffer in order to grab unencrypted passwords, apparently the first worm to do so.
Separately, experts noted the appearance of another unusual worm—besides the usual infestation and damage, Amus uses Windows XPs built-in speech engine to inform users they are about to be infected.
Like other Sdbot variants, worm_sdbot.uh installs numerous backdoor capabilities on an infected machine, allowing a remote attacker to issue commands on the system, according to a technical analysis by Trend Micros Dexter To, which discovered the worm on Sept. 8.
The worm creates a bot that uses functions of NetBEUI (NetBios Extended User Interface), a protocol used by network operating systems, to find usernames and passwords, and uses these to create copies of itself on shared folders. The bot can also log users keystrokes, a way of recording sensitive information such as passwords before it is encrypted.
The innovation, however, is the use of a network sniffer to monitor traffic on the LAN (local area network). The sniffer looks for logins for system administration, banking sites and PayPal accounts, filtering traffic with a list of common strings. “It appears this is the first time a worm has done this,” said Thomas Kristensen, chief technical officer at Danish security firm Secunia. “If a hacker could see all the traffic on a LAN, that could be very interesting.”
While the tool could be dangerous, Kristensen said that the sniffer would only detect unencrypted passwords, such as those sent automatically by an application or logins to e-mail accounts. Those most in danger could be smaller businesses or those using older networking hubs—the use of increasingly prevalent switches on a network would limit what the sniffer could detect, Kristensen said.
Patrick Nolan of the SANS Institutes Internet Storm Center agreed that the introduction of sniffers could create new problems. “If the Trojans described by Trend can successfully transmit the filters packet captures back to the owner they are going to cause problems well beyond typical bot infestation issues,” he wrote in a Monday advisory.
Page 2
The Amus worm poses less of a threat but is one of the more bizarre worms to have surfaced, security experts said. Spreading via Outlook to e-mails found in the Windows Address Book, the worm arrives with the subject “Listen and Smile” and the body text “Hey. I beg your pardon. You must listen.”
If a user executes the attachment, masum.exe, the worm generates a short message in a robotic female voice, using Windows XPs built-in speech capabilities: “How are you. I am back. My name is mister hamsi. I am seeing you. Haaaaaaaa. You must come to turkiye. I am cleaning your computer. 5. 4. 3. 2. 1. 0. Gule. Gule.” Finnish security firm F-Secure has archived a sound file of the speech here.
“Gule gule” is Turkish for “bye bye,” according to an advisory from Sophos Antivirus; hamsi is a small anchovy-like fish found in the Black Sea. The worm also changes the settings of Internet Explorer so that users see the following message (translated from Turkish) as their start page: “Konneting du pepil and dizkoneting you. Means: What difference does it make if you get connected or not. The local line quality is terrible anyway.”
The worm isnt all laughs: Among other things it may attempt to delete all INI or DLL files from the Windows folder, depending on the day of the month. Anti-virus vendors refer to Amus as Amus.A, I-Worm.Amus.a, W32/Amus.a@MM and W32/Amus-A, among other aliases.
Check out eWEEK.coms Security Center at http://security.eweek.com for the latest security news, reviews and analysis.
Be sure to add our eWEEK.com developer and Web services news feed to your RSS newsreader or My Yahoo page
