Six months ago, in the previous volume of Symantec's Internet Security Threat Report,I wrote that we were seeing a shift away from “noisy” worms towardstargeted Trojans that attract less attention. In the second half of2006, this trend remained true, as the volume of Trojans reported bySymantec customers increased and the volume of worms decreased. At thesame time, a lot of these Trojans are becoming more sophisticated.
In the latest edition of the Internet Security Threat Report,we note that multi-stage downloaders, also referred to as modularTrojans, are becoming more prevalent most likely because of theirversatility. The first stage of these downloaders is usually a smallTrojan that disables your security and antivirus applications thendownloads a more complex threat. Since the initial stage disablessecurity applications, the second stage can be almost...
In March, 1999, an email worm named Melissa caused havoc across the Internet. I can recall hearing stories of people unplugging their mail servers because they couldn’t deal with the flood of email messages Melissa generated. Then, in 2001, two worms—Code Red and Nimda—generated so much traffic that some people disconnected their networks from the Internet in order to cope. In January, 2003, the Slammer worm caused so much traffic that it even took down banks’ ATM machines. Even though these worms all caused a lot of headaches and created headlines worldwide, with the exception of Nimda, none of them really did much other than spread.
Since Slammer, I can’t recall any other worms causing so much traffic that they’ve affected bandwidth across the Internet. Why is this? Well, I would say there are a few reasons. First and foremost, I think this change can be summed up in one word: money.
As we reported in the latest edition of the Symantec...
One server controlling thousands of client computers. Sound familiar? This statement is often used to describe a botnet. But, as Tom Ptacek and Dave Goldsmith of Matasano Security pointed out in their Black Hat presentation titled “Do Enterprise Management Applications Dream of Electric Sheep?”, the same statement can be used to describe enterprise management applications. These applications are developed to help network and system administrators with the tasks of configuring and managing hundreds or even thousands of client computers from a single server. This is also known as distributed systems management. Unfortunately, many of these enterprise management applications contain common vulnerabilities and weaknesses that were fixed in most other applications long ago.
