jon_s
08-05-2003, 06:48 AM
(Just thought I would let people know)
Latest worm uses IT administrator tactics
Mimail bug tries to convince you it was sent by the IT department
A new mass-mailing virus, which disguises itself as a file sent by a computer user's network administrator, began infecting systems on Friday.
The worm, which is being dubbed 'mimail', attempts to exploit a vulnerability in Internet Explorer that allows a script to be executed by an infected computer. The worm then tries to use that script to mass email itself, potentially clogging mail servers or slowing down networks, according to anti-virus company Symantec.
The arrival of Mimail comes amid heightened fears that a large-scale attack on the internet could be looming. The US government warned last week that a widespread flaw in Windows could be used to generate an attack.
The email that carries the worm has "your account" in the subject line, according to Symantec, and the body reads, "Hello there, I would like to inform you about important information regarding your e-mail address. This e-mail address will be expiring. Please read attachment for details."
It is then signed "Best regards, Administrator" and contains an attachment labelled "message.zip" that carries the malicious code.
In terms of its method, the mimail bug is somewhat similar to other mass-mailing worms, said Sharon Ruckman, a senior director at Symantec Security Response. What's trickier than usual, she said, is the way the email that carries the worm tries to get people to open the attachment.
"The social engineering aspect [is] a lot more serious," Ruckman said. "You believe it was the administrator from your own domain, whether that is your company or your ISP."
Also of note, Ruckman said, is that the mass emailing code is contained in an HTML file, a type of file not normally associated with executing programs. Ruckman recommended that corporations either delete the attachments at the server level or block messages with the "your account" subject line.
As of 1:45 p.m. PST, Symantec said it had received 125 total submissions of the worm and had rated it as a threat level of 3 on a scale of 1 to 5.
Latest worm uses IT administrator tactics
Mimail bug tries to convince you it was sent by the IT department
A new mass-mailing virus, which disguises itself as a file sent by a computer user's network administrator, began infecting systems on Friday.
The worm, which is being dubbed 'mimail', attempts to exploit a vulnerability in Internet Explorer that allows a script to be executed by an infected computer. The worm then tries to use that script to mass email itself, potentially clogging mail servers or slowing down networks, according to anti-virus company Symantec.
The arrival of Mimail comes amid heightened fears that a large-scale attack on the internet could be looming. The US government warned last week that a widespread flaw in Windows could be used to generate an attack.
The email that carries the worm has "your account" in the subject line, according to Symantec, and the body reads, "Hello there, I would like to inform you about important information regarding your e-mail address. This e-mail address will be expiring. Please read attachment for details."
It is then signed "Best regards, Administrator" and contains an attachment labelled "message.zip" that carries the malicious code.
In terms of its method, the mimail bug is somewhat similar to other mass-mailing worms, said Sharon Ruckman, a senior director at Symantec Security Response. What's trickier than usual, she said, is the way the email that carries the worm tries to get people to open the attachment.
"The social engineering aspect [is] a lot more serious," Ruckman said. "You believe it was the administrator from your own domain, whether that is your company or your ISP."
Also of note, Ruckman said, is that the mass emailing code is contained in an HTML file, a type of file not normally associated with executing programs. Ruckman recommended that corporations either delete the attachments at the server level or block messages with the "your account" subject line.
As of 1:45 p.m. PST, Symantec said it had received 125 total submissions of the worm and had rated it as a threat level of 3 on a scale of 1 to 5.