full-disclosure - First WMF mass mailer ItW (phishing Trojan)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Feb 16 15:25:06 2006
From: ge at linuxbox.org (Gadi Evron)
Subject: First WMF mass mailer ItW (phishing Trojan)

On Thu, 16 Feb 2006, Vulnerability Management wrote:
> Hi Gadi,
> 
> Gadi Evron wrote:
> > The first worm (mass mailer) to (ab)use the WMF 0day is now spreading in
> > Australia.
> 
> [...]
> 
>  > The emails themselves do not contain the payload, but rather a URL to
>  > sites that will infect users.
> 
> 
> How can this be called a worm? AFAIK, malware that needs human 
> intervention to spread is a trojan, not a worm.

Taxonomy/terminology of viruses/malware is problematic, no one expert will
agree with the other.

(almost) all current worms are Trojan horses. If it is spread by email,
it's a mass mailer. It's a worm... any more than that and this will become
a religious discussion between those who work with these or a clue-less
one by those who don't. :)

In other words.. I will go with whatever you decide, as I don't see this
as really mattering in the AV world anymore (and that's a shame).

:)

Question: if one sees this spreading as a mass mailer, propagating (via
email) and infecting via a download(er) of a Trojan, why would it
matter?

Maybe it should be called a Trojan with mass-mailing capabilities (I'm
completely with you on that one).

	Gadi.

> > 
> \a
> 
> (Personal opinions only)
> 
> 
> 
> -- 
> Andrew Simmons
> MessageLabs Security Team
> 
> MessageLabs: Be certain
> 
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email 
> ______________________________________________________________________
>