bugtraq - Re: New MyDoom variant

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <002b01c47ae0$33c10fd0$6565a8c0@IBMPIII>
Date: Thu, 5 Aug 2004 07:34:21 -0400
From: "James C. Slora Jr." <Jim.Slora@...a.com>
To: <bugtraq@...urityfocus.com>
Subject: Re: New MyDoom variant

Bryan Burns wrote

> According to Trend: htm.exe, txt.exe, txt.scr
>
> According to McAfee: EXE, COM, SCR, PIF, BAT, CMD
>
> According to Symantec: exe, txt.exe, htm.exe, txt.scr, zip
>
> Hmm, I wonder who is right...

Here's a generic explanation that may or may not apply to this specific
case:

Initial spammed distributions of email viruses do not always match the
pattern of the virus itself. The malware author can easily send it out with
one arbitrary set of extensions but have infected computers use a totally
different set that is written into the worm. A description that is based on
extensions seen in the wild will not necessarily match a description that is
based on analysis of the worm's code.

Worms, like any software, contain bugs of their own. They might also behave
differently depending on characteristics of the infected computer. Many
modern worms also have internal calculations that assign different
probabilities to each permutation of itself that the worm might send out.
Some worms update themselves from other infected systems or fixed web
sites - so variable behaviors can possibly be introduced without actually
generating an officially new variant. Different analysts may sometimes come
to different conclusions about how the worm will actually behave on
execution. Plus, the first quick description from any vendor frequently gets
revised after further analysis.

One approach to consider is not to rely on any fixed list of extensions for
a specific worm, and instead mistrust any extension that invites execution.
Even better, mistrust any file whose internal type allows execution.