full-disclosure - First WMF mass mailer ItW (phishing Trojan)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200602161619.k1GGJY7o007373@turing-police.cc.vt.edu>
Date: Thu Feb 16 16:20:05 2006
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: First WMF mass mailer ItW (phishing Trojan) 

On Thu, 16 Feb 2006 15:03:56 GMT, Vulnerability Management said:
> How can this be called a worm? AFAIK, malware that needs human 
> intervention to spread is a trojan, not a worm.

Enough users will just click 'OK' that it can effectively be considered
automatic enough to be classified a worm, not a trojan.

I mean - let's be realistic here. A worm that only manages 20% of the time to
turn off the A/V via pre-programmed means so it can continue propagating is
still clearly a worm (albiet a buggy one).  The mere fact that some worms use a
pre-programmed means to bypass the A/V that includes liveware muscular
activity(*) shouldn't eliminate its claim to wormhood....

(*) And yes, "just click OK" *is* sufficiently pre-programmed as to qualify as
automatic.  That's the *PROBLEM*... ;)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060216/a87cd12b/attachment.bin