[ISN] Macro and script viruses dying off

From: InfoSec News (isnat_private)
Date: Thu Jan 02 2003 - 22:29:38 PST

  • Next message: InfoSec News: "[ISN] $100K Reward for Stolen ID Data"

    By John Leyden
    The end of standard mass mailing worms is nigh - maybe as soon as 
    before the end of 2003. But there replacements - Trojans and Spyware - 
    are much, much worse. 
    Or so Roger Thompson, technical director of TruSecure, a risk 
    management firm, forecasts. In particular he warns of the risk from 
    Remote Access Trojans (RATs) or backdoors posted on the Net or spread 
    via email. 
    "Malware code writers will continue to disguise RATs and backdoor 
    scripts as 'adult' movies and then post them to pornography new groups 
    targeting inexperienced users," he writes. "Expect them to continue 
    through 2003 but they will be mixed with more and more grey ware (i.e. 
    spyware and advertising monitoring that is barely legal)." 
    Thompson notes mass-mailing Windows viruses were largely unsuccessful 
    in hitting corporations in 2002, with the notable exception of 
    organisations which did implement proper filters. One of the two 
    biggest worms of the year was Klez, which infected home PCs mostly. 
    Macro and script viruses emerged at a rate of 200 to 300 a month in 
    2002 but this will decrease to approx. 20 to 30 per month, TruSecure 
    According to Thompson, the impact of the mass-mailing worm is mostly 
    over for corporations but it will still have an impact on SOHO (small 
    office/home office) environments this year. 
    Code Red 
    TruSecure (and more particularly its affable "Surgeon General" Russ 
    Cooper) came to notice in 2001 for predicting that the Code Red virus 
    had the potential to "meltdown" the Internet. 
    This warning was, we now know overstated. Cooper told us, when we met 
    up with him before Christmas, that he did not regret the warning. He 
    was acting, he said, on early analysis of Code Red and its possible 
    spread through NT4 boxes. This turned out to be a lesser risk than 
    first believed. 
    Fair enough; but TruSecure is still banging on about Code Red-style 
    attacks to this day. Thompson warning he expects "another attack in 
    2003 in the class and level of Code Red". 
    If he means another outbreak of hysteria from sectors of the security 
    community (which ought to know better) over some supposed 
    Internet-crushing threat, how could we disagree? 
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn'
    in the BODY of the mail.

    This archive was generated by hypermail 2b30 : Fri Jan 03 2003 - 09:12:56 PST