No coffee, but here's another Bagle

TalkBack 7 of 20:

Next »

« Previous

• Thread View
• Flat View

Okay sending spam is the goal, but how does it work?

A series of time-restricted worms have been observed. Each infects a machine and sends out a burst of copies and notification to a site. The site is closed fairly quickly, I imagine, but many infected computers have been identified.
As virus scanners are updated, the worm becomes less and less successful; probably largely disappears before its expiration date.

What's going on?

Apparently, the purpose is to keep control over the machine so that it can act as a relay/distribution point for spam. It's intended to make money.

Okay.

The question I'm wondering about is the worm's distribution method. Wouldn't an antivirus be able to clean out everything the worm installed? An antivirus successful enough to stop the spread of the worm would also eliminate the worm-writer's ability to control the machine, it seems.

I can see two possible explanations for these experiments.
First, the actual worm designed to work with a spam-spreader hasn't been issued. When it is, it'll work for a little while, then be killed. I don't like this explanation much, because whatever is being advertised will be identifiable, which means the company paying for the spam is known, and from there it'll be easy to find the spam sender. That person may or may not be able to help find the worm-writer, but s/he is in for a very hard time.

The second possibility makes more sense: anti-virus programs may not be cleaning the computer completely. What's being tested is not the worm, but the mask. The only way the worm-writer can find out whether the mask works is to see if the anti-virus companies get past it.
When the successful mask has been confirmed, the worm-writer will issue spam in small enough bursts that it'll be impossible to identify what's happening, so the infected pc's won't be easily identifiable, and no one will guess the mask's existence.
Other worms with the mask would be issued to increase the supply of infected machines.
Finding a working mask would be worth experiments.

Anybody agree, disagree?

Posted by: Anton Philidor   Posted on: 02/17/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now
• Building the Virtualized Enterprise with VMware Infrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now