Viruses have teamed up, experts warn

[Tami]

Viruses have teamed up, experts warn
By JACK KAPICA

Three different viruses have been posing an increasing threat because they work together in what security experts at Computer Associates are calling a co-ordinated malware attack.

The attack involves three Trojans — Win32.Glieder, Win32.Fantibag and Win32.Mitglieder — which are displaying signs of co-ordination as they spread and infect computer systems. They combine different components in waves to compromise large numbers of PCs.

Computer Associates say the three represent "a convergence of malware on an unprecedented scale" and have raised their threat assessment rating to "medium." It added that eight new variants of Glieder appeared in rapid succession and have quickly spread.

Glieder is the initial piece of malware that infects home computers, creating a set of vulnerabilities that are exploited by the pair of trojans. Once the Glieder is in place, the Fantibag Trojan further disables the security features of compromised systems. It exploits networking features of target systems to prevent those systems from being able to communicate with antivirus companies and with Microsoft's update site. This isolates the infected systems and prevents access to antivirus updates or Windows patches.

Then the Mitglieder Trojan opens a backdoor on a compromised system, changing the host from merely another infected computer into a resource that can be exploited. This element acts as a proxy, forcing all Internet traffic to known points, and it can be used to track behaviour, record keystrokes, and set up spam relay points, among other things.

The apparent objective is to get to as many victims as fast as possible with a lightweight piece of malware, with Glieder serving as the "beachhead" for the more heavy-duty malware elements by lowering the security profile of an infected system.

Computer Associates speculates that the presence of a co-ordinated attack represents an attempt to develop a market for the information gathered from the infected machines, and cites reports that indicate the price of selling captured computer power and Internet resources might be as little as five cents per PC. Control of "zombie" PCs could be sold to serve as spam relays, sources for stolen data, and potential targets for identity theft.

Corporate IT security professionals are also being warned to be alert to the possibility that these events may foreshadow a new phase of industrial espionage, since many home and branch-office PCs connect to corporate networks.

[url=\"http://www.globetechnology.com/servlet/story/RTGAM.20050603.gtvirusjun3/BNStory/Technology/\"]source: Global Technology[/url]