Internetworkers: http://www.ibiblio.org/internetworkers/

[David Minton <dminton AT mindspring.com>]

Uh, not quite. According to Symantec, infection installs a backdoor that can
allow download and execution arbitrary files. From their web site:


http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a AT mm.html


"W32.Novarg.A@mm is a mass-mailing worm that arrives as an attachment with
the file extension .bat, .cmd, .exe, .pif, .scr, or .zip.

When a computer is infected, the worm will set up a backdoor into the system
by opening TCP ports 3127 through 3198, which can potentially allow an
attacker to connect to the computer and use it as a proxy to gain access to
its network resources.

In addition, the backdoor can download and execute arbitrary files.

The worm will perform a Denial of Service (DoS) starting on February 1,
2004. It also has a trigger date to stop spreading on February 12, 2004."



It has been suggested that the DDoS is just a red herring to distract from
the destructiveness of the virus.

David

-- 
DesignHammer Media Group, LLC : 919.313.4588 : http://designhammer.com




On 1/28/04 11:18 AM, "Ian Meyer" <ianmeyer AT mac.com> wrote:

> What is hilarious to me is how the media is just using their stock
> virus/worm coverage. Its
> mainly affecting people" not businesses and how its terrible and
> destructive and vicious, when its none of those. I mean, as bad as a
> DDoS is, thats *all* its doing, and its only doing it to SCO, its not a
> trojan or anything else (that we know of at this point)...
> 
> Damn news media...
> 
> ~Ian
> 
> 
> On Jan 28, 2004, at 9:00 AM, Thomas Beckett wrote:
> 
>> The Mydoom virus is apparently set up to launch a DOS attack on SCO on
>> Feb. 1.
>> http://www.nytimes.com/2004/01/27/technology/27CND-VIRU.html
>> 
>> "But security analysts believe the ultimate purpose of Mydoom is
>> embodied in its instructions to infected computers to bombard the Web
>> site of the SCO Group, of Lindon, Utah, which owns licensing rights to
>> the Unix operating system, a competitor of Microsoft Windows.
>> 
>> Unless an infected computer is immediately cleaned of Mydoom, the worm
>> will instruct the computer to connect to the SCO Group's Web site
>> beginning Feb. 1. The cumulative effect of the worldwide barrage,
>> which is intended to last until Feb. 12, could be to shut down that
>> Web site. Computer experts also say that the mass-mailing planned for
>> next month, known in the industry's parlance as a denial-of-service
>> attack, could cause collateral damage to networks in which many
>> computers were already infected and were trying to communicate with
>> the SCO Web site.
>> 
>> . . . .
>> The SCO Group today offered a reward of up to $250,000 for information
>> leading to the arrest and conviction of the people responsible for
>> creating Mydoom.
>> 
>> The SCO Group's president and chief executive, Darl McBride, said
>> Mydoom is the fourth attempted denial-of-service attack against the
>> company in the 10 months, and provides a window into what he called
>> "the darker side of the Linux community we've been fighting."
>> ---
>> Come and play at the InterNetWorkers Web site!
>> http://www.ibiblio.org/internetworkers/
>> You are currently subscribed to InterNetWorkers mailing list
>> To unsubscribe visit
>> http://lists.ibiblio.org/mailman/listinfo/internetworkers
>> 
> 
> ---
> Come and play at the InterNetWorkers Web site!
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit 
> http://lists.ibiblio.org/mailman/listinfo/internetworkers