Security firms and Homeland Security within the U.S is warning everyone of a new large scale attack on the Internet that's currently under way. Security firms say that thousands of web sites have already been infected by a virus. If a user goes to a web site which has been infected, the user will become infected if running Internet Explorer. The virus takes advantage of an exploit in Internet Explorer, an exploit that Microsoft has yet to fix. Once a end-user has been infected with the virus, their computer will be used to send spam to millions of people. NetSec, one of the large security firms, said there are some well known sites already infected but they declined to name the affected Web sites for liability reasons but said they are "big, big sites." Read more

A new virus is out that affects only cell phones and is probably the first known mobile virus. According to Kaspersky Labs, an anti-virus firm, the new virus called "Cabir" infects cell phones running the Symbian Operating System. The new virus was written by 29a, a group of virus writers that specializes in proof-of-concept viruses. The virus spreads thru a wireless Bluetooth connection and attempts to find other phones with the Symbian operating system. Read More..

Messenger Plus Zone reports that on 6/11/04 at around 6:30PM Eastern Standard Time, Messenger Plus! Zone obtained a copy of a file ("SWMPplugin.exe") that is known as Backdoor.Prorat (Symantec). The trojan was circulated as a Messenger Plus! Plugin that add's new sounds, and after receiving this file it was processed and scanned and it is a dangerous backdoor. The Trojan can allow a hacker to gain complete control of your computer. The trojan HAS been reported to Patchou.

RealNetworks Inc. has recently been made aware of security vulnerabilities that could potentially allow an attacker to run arbitrary code on a user's machine. While we have not received reports of anyone actually being attacked with this exploit, all security vulnerabilities are taken very seriously by RealNetworks Inc. Real has found and fixed the problem.

Security Update 2004-06-07 delivers a number of security enhancements and is recommended for all Macintosh users. This update includes the following components:

DiskImages LaunchServices Safari Terminal

This update delivers a number of security enhancements and is recommended for all Macintosh users.

www.cdfreaks.com
*Update* Due to the reactions below and the fact that I posted this story, I did a spyware experiment. I cleaned my system with both Spybot Search and Destroy and Adaware 6 with latest updates. Then I set a restore point, then installed the program. I was greeted with no less than 34 entries and two new folders! The worst piece was Virtual Bouncer - extortion ware. From the Spyware-Guide website:

Danger Level: 4 [Explain]
Official Description: Claims to be an adware remover.

Highly critical security bug was discovered in Internet Explorer. One can create a web page which after loading in IE causes corruption of the registry with IE Entries and according to our tests also its crash.

Instructions for patching and cleaning vulnerable Windows 2000 and Windows XP systems:

Vulnerable Windows 2000 and Windows XP machines may have the LSASS.EXE process crash every time a malicious worm packet targets the vulnerable machine which can occur very shortly after the machine starts up and initializes the network stack.

When cleaning a machine that is vulnerable to the Sasser worm it is necessary to first prevent the LSASS.EXE process from crashing, which in turn causes the machine to reboot after a 60 second delay. This reboot cannot be aborted on Windows 2000 platforms using the Shutdown.exe or psshutdown.exe utilities and can interfere with the downloading and installation of the patch as well as removal of the worm.

W32.Sasser.Worm is a worm that attempts to exploit the MS04-011 vulnerability. It spreads by scanning randomly-chosen IP addresses for vulnerable systems. make sure you installed the MS04-011 Patch.

Hackers have broken into some of the world's most powerful computer clusters in recent weeks in an apparently coordinated cyberattack targeting research and academic institutions.

Although officials sought Wednesday to play down the seriousness of the threats, some security experts warned that such a break-in could potentially enable a serious attack on the Internet.

Stanford University, the San Diego Supercomputer Center and the University of Illinois' National Center for Supercomputing Applications were among the systems hit.

Also affected was TeraGrid, a government-funded effort to link together several supercomputers, including those at San Diego and NCSA, so scientists can better crunch data for weather forecasting, astronomy and medicine.

TrendLabs has declared a Yellow Alert to control the spread of PE_BAGLE.Q. TrendLabs has received numerous infection reports of this malware spreading in Korea and Japan.

This new BAGLE variant is capable of infecting files. It propagates via email in two ways. The first is by sending emails, which do not have an attachment. Instead it contains a link, which upon opening the email, starts a series of events that eventually downloads this file infector into the system. The second is that the email may contain varying subjects, message bodies, and attachment file names, just like its earlier variants.

BetaNews: Just two days after portions of the Windows 2000 Service Pack 1 source made its way onto the Internet, the first exploit to take advantage of bugs discovered in the now opened code has appeared on security mailing lists. The vulnerability lies in Internet Explorer's handling of bitmap images. With a specially created bitmap, a remote user can cause a buffer overflow and execute arbitrary code on a target system. The author of the report, which was seemingly posted with malicious intent, indicates the flaw was uncovered when analyzing the file "imgbmp.cxx" within the Windows source code.

WinHelpLine.info bietet auf ihrer Homepage eine sehr gute FAQ zum Wurm 'MyDoom', der laut Kaspersky Labs die Liste der meist verbreiteten Malware mit fast 80% anführt. Es wird Hilfestellung in folgenden Bereichen gegeben:
- Wie können Sie sich vor diesem Virus schützen?
- Wie können Sie feststellen, dass ihr Computer von Mydoom.B infiziert ist?
- Was sollten Sie tun, wenn Ihr Computer infiziert ist? Zu finden ist diese FAQ HIER.

Trivial file spoofing in Internet Explorer 6.0.2800.1106 and all of 'its' patches to date on WIN XP [probably others]: Content-Disposition: attachment; filename=malware.{3050f4d8-98B5- 11CF-BB82-00AA00BDCE0B}fun_ball_gites_pie_throw%2Empeg"

Die Mailingliste Full Disclosure dokumentiert ein weiteres Sicherheitsloch im Internet Explorer, das nach einem ähnlichen Muster arbeitet wie der kürzlich bekannt gewordene Ordner-Bug in Windows XP. Ein Angreifer kann dem Internet Explorer Dateien mit falschen Endungen unterschieben, so dass ein Opfer vermeintlich sichere Dateien öffnet und so womöglich gefährlichen Programmcode ausführt. Mehr Infos

Symantec Security Response has developed a removal tool to clean W32.Novarg.A@mm infections.

Also known as: W32/Mydoom@MM [McAfee], WORM_MIMAIL.R [Trend], Win32.Mydoom.A [Computer Associates], W32/Mydoom-A [Sophos], I-Worm.Novarg [Kaspersky]

W32.Novarg.A@mm is a mass-mailing worm that arrives as an attachment with the file extension .bat, .cmd, .exe, .pif, .scr, or .zip.

Microsoft Internet Security and Acceleration (ISA) Server 2004 is the advanced application layer firewall, VPN, and Web cache solution that enables customers to easily maximize existing IT investments by improving network security and performance. ISA Server 2004 Beta allows you to preview the upcoming functionality in this upcoming version.

Just days after it first surfaced, the MyDoom worm has become the fastest spreading computer virus in history. MyDoom's payload is far from innocuous, too. When opened, the virus installs a stealth program on the victim's computer that opens up a software "back door." Attackers can then bypass the PC's security and turn the system into a bounce point, or proxy, for any network-based attack. More at TechReport

Computer security experts fear a new worm - Bagle-A - which began spreading rapidly across Australian email overnight could be a rehearsal for a more concerted worldwide attack in coming weeks. According to Daniel Zatz, security director for Computer Associates Australia, Bagle-A carries an expiry date, possibly indicating more robust versions of the worm could be slated for release soon - drawing comparison to the Sobig worm.