New Trojan calls on Skype
Skype is now proud of its millions of online subscribers. At the same, those Trojan makers are becoming more interested at Skype too. It’s a news at NetworkAsia by: Network World Asia Staff
During this trip to Raleigh, NC, I bought some credit at Skype so that I can call China using the free Internet at the Hotel. The quality of SkypeOut is very impressively good, while the price is just 0.17c. Skype has been an International carrier, without nation barriers, even to China.
Another Trojan horse is spreading through the Internet telephone network of Skype Ltd.
The malicious code, known as both Warezov and Stration, is similar to an earlier version detected in February, but with a new URL (uniform resource locator) and a new version of the malicious code, according to an alert posted Thursday by Websense Inc.
Websense warns Skype users to watch for the message “Check up this,” with a URL containing a hyperlink.
The code itself isn’t self-propogating but when it runs, the URL is sent to everyone on the user’s contact list.
When users click on the link, they are redirected to a site that is hosting a file named file_01.exe. Users are then prompted to run the file and if they do, several other files are downloaded and run. The downloaded files are other versions of the Waresov/Stration malicious code.
Once the Trojan is installed in a system, it tries to connect to a Yahoo Inc. mail server to send an SMTP (Simple Mail Transfer Protocol) message.
However, that server doesn’t appear to be operating, according to Websense.
Skype, a division of eBay Inc., offers a number of Internet-based services, including VOIP (voice over Internet Protocol) and instant messaging.
The below is an old report on Skype trojans. Two years passed. We have one after another new trojans on Skype.
http://www.securityfocus.com/news/11348
Say hello to the Skype Trojan
John Leyden, The Register 2005-10-18
Virus writers are targeting Skype users with a new Trojan that poses as the latest version of the popular VoIP software.
Click here for Core!!
Net security firm MessageLabs has detected and blocked more than 800 copies of a new variant of the MyTob (AKA Fanbot) Trojan, which is being distributed by email. References and nicknames contained in the code lead MessageLabs to conclude that the malware was probably created by a well known Chinese black hat hacker and not the original author of the malware strain.
Maksym Schipka, a senior antivirus researcher at MessageLabs, said the malware is the first he’s aware of that mentions Skype and as such represents a new theme for social engineering attacks.
The malware arrives in an attachment in messages posing as the latest (v1.4) release of Skype. Legitimate downloads of the software only came out last week, so the attack is timely. If users open the infected payload on a vulnerable Windows machine they will find their PCs transformed into zombie clients (theoretically at least) under the control of computer hackers.
Schipka said that compromised machines fail to connect to IRC servers so they are not much use to the bad guys, right now. He added that the release of a variant of MyTob by someone other than the original author showed the source code was available in at least “some circles” of the computer underground. ®
Please read the below news, more and more worms and trojans are turning their targets to Skype.
http://www.networksasia.net/ena/article/articleDetail.jsp?id=420134
New worm wriggles around on Skype
Apr 17, 2007
By: Network World Asia Staff
A worm targeting Skype’s VOIP (voice over Internet protocol) application is harvesting e-mail addresses and directing users to a range of sites hosting other malicious software, security vendors said Monday.
Once a machine is infected, the worm sends a malicious link via instant messages to other users in person’s Skype contact list, according to F-Secure’s blog.
The link leads to an executable file that downloads a Trojan horse capable of downloading other malicious software, F-Secure said. It then shows a photo of a “lightly dressed” woman.
The link also directs users to at least eight Web sites with information about Africa. It’s not clear what type of scam or harm those pages intend, but some of the sites have advertising on them, indicating that it might be a click-fraud scam, said Graham Cluley, senior technology consultant for Sophos PLC. Click fraud refers to the various tricks used to get clicks on advertising banners, which generate revenue for Web page owners.
Skype has been targeted by worms in the past, none of which have inflicted great damage, and this one may be no different. “I would think this thing isn’t likely to spread terribly far and wide,” Cluley said.
That’s partly because malware spread via IM does not generally infect as many people as malware spread through more conventional routes, such as e-mail, Cluley said. Also, users can reply to a suspicious IM and ask the sender about the link, and the lack of a response can tip off the user that something is awry.
Some sophisticated IM malware can generate an automated response to trick the user into clicking on the link, but this one does not appear to have that capability, Cluley said. However, it does set Skype to “do not disturb” status, which blocks incoming calls and other notifications, and also prevents a user from responding to an IM, Cluley said.
F-Secure calls the worm “IM-Worm:W32/Pykse.A,” and Sophos named it “Mal/Pykse-A.”