Cisco: 'Here you have' worm caused brief mayhem
The worm mainly spread through emails enticing victims to visit malicious websites
By Robert McMillan | Published: 10:16, 13 September 2010
The "Here you have" worm that clogged e-mail systems on Thursday briefly caused one of the worst spam outbreaks of 2010, according to Cisco Systems.
For a few hours, between 17:45 and 20:30 GMT the worm accounted for between 6 percent and 14 percent of all spam measured by Cisco's IronPort group.
It was the biggest spam outbreak since scammers pounced on the iPad launch back in March to try to trick people into visiting malicious websites, said Nilesh Bhandari, a product manager with Cisco. "That is humongous," he said.
Related Articles on Techworld
"Here you have" spread primarily via email, in messages that tried to entice victims into visiting a website that would install a malicious script on their computers. That script then scoured the victim's Outlook contacts list and sent similar messages to new victims. The worm also spread over the network, using a special PsExec script and via USB drives.
The worm's advance has been halted now for two reasons: Antivirus companies have added detection for the worm, and the website that hosted the malicious script has been taken offline. Cisco's data shows that by 12:00 GMT Friday it accounted for virtually none of the spam Cisco was tracking.
The worm primarily affected business networks in the US, Microsoft said in an analysis of the incident, posted late Friday. "For the first twelve hours of attack activity we monitored, 91% of the infections and infection attempts were reported from our corporate clients--the opposite of the pattern we normally see," Microsoft said.
It reportedly slowed down networks at Disney, Procter & Gamble, Wells Fargo and NASA.
This type of mass-mailing worm has largely been off the radar since the days of the Anna Kournikova and I Love You outbreaks in the early 2000s, but security experts say there are a few unusual things about "Here You Have."
There are several signs that may link it to a Libyan jihadist hacker named Iraq Resistance, SecureWorks said on Friday.
Most agree that the worm is not particularly sophisticated. Its success shows that it's still possible to infect a lot of computers by finding ways to trick people into doing things they shouldn't, such as clicking on links and running malicious files. "[It] just shows that the human exploit is the easiest vector," said Alex Lanstein, a researcher with security vendor FireEye, in an e-mail message.
