English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

IM malware tries a new approach

Roel
Kaspersky Lab Expert
Posted August 10, 14:40  GMT
Tags: Instant Messengers
0
 

We've recently received several inquiries regarding a certain worm.
At first glance, this worm didn't seem to have any new features. The combination of spreading via P2P and IM is not new at all.

When I had time to investigate further, I noticed something interesting.
Instead of relying on 'real' webservers, this malware simply turns the infected machine into a webserver.
The biggest advantage this approach has is the fact that the host is fairly unlikely to be shut down quickly.

As you can see from the description the worm connects to a specific server to determine the computer's (outside) I.P. address.
Most likely this is done to circumvent the problem of internally used I.P. addresses on computers, such as the 10.x.x.x and the 192.168.x.x ranges.

This is an interesting new approach. But for it to be effective, machines within a LAN will have to have the necessary portforward in place, and I'm not sure that this is widespread. We'll keep you posted on any developments.


Comments

If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog