Superworm Crisis eats Macs, VMware and - shock - Windows

Security watchers have discovered a virus strain that compromises VMware virtual machines as well as infecting Mac OS X and Windows computers and Windows Mobile devices. It demonstrates previously unseen capabilities in the process. The Crisis malware typically arrives in a Java archive file (.jar) and is typically installed …

[Anonymous Coward]

Where are you now ...

RICHTO ?

[Anonymous Coward]

So

So long as you don't play the free porn video......

[RICHTO]

Re: Where are you now ...

Here. First ever malware for Windows Mobile I think? But then it hasnt been updated for many years...

This isnt actually exploiting any vulnerability as far as I can see other than stupidity?

[Anonymous Coward]

Re: Where are you now ...

> This isnt actually exploiting any vulnerability as far as I can see other than stupidity?

It's a threat to all WP7 users then ;-)

[Gerhard den Hollander]

Re: Where are you now ...

both of them must be worried then .....

[RICHTO]

Re: Where are you now ...

I was thinking more of Mac users. They are mostly journalists too stupid to use a computer or 'creative' types that left school with only a GCSE in Art....

[Anonymous Coward]

Hardcoded IP for a command and control which it pings every five minutes.

Mmmm.

Smells like amateur hour.

[Anonymous Coward]

As does the article itself

[dotdavid]

Wait a minute, that's *my* IP they're using! The bastards!

Wait...

[Anonymous Coward]

:)

Reminds of the days on IRC when someone would post "TEACH ME TO HACK" on a channel and we told them to direct <whatever script was current> at 127.0.0.1. Strangely, they dropped offline then :)

[Anonymous Coward]

@AC

I think most *nix related channels have had such experiences. Even so, I found that using addresses such as 127.10.45.65 proofed to be way more effective than the "easily recognizable" default address.

[jai]

late?

This is listed on the Symantec and Sophos websites since 25th July. It's a bit late to be talking about it now isn't it?

It's seems that Symantec has been detecting this type of jar delivered malware since 2010!

Or is it just the way it attacks VMWare that makes it news worthy?

[Jon Lamb]

Re: late?

I've always assumed the article delay was usually caused by having to think up a catchy sub-title. Not sure what happened here.

[diodesign]

Re: late?

Yeah, it's the four-way whammy of VMware, Mac OS X, Windows and Windows Mobile (what's that?) that's new.

C.

[Miek]

Re: late?

Wake me up when it has Linux support.

[RICHTO]

Re: late?

That will be when Linux grows past 1% market share....

[Miek]

Re: late?

1% in which market?

[RyokuMas]

Nope...

I'd bet it's because it's only just been revealed that this can affect Windows mobile devices - and the opportunity to take a swipe was too much to resist...

[Fred Flintstone]

Re: Nope...

the opportunity to take a swipe was too much to resist

What? It scans gestures too?

[Anonymous Coward]

What? It scans gestures too?

A virus that uses gestures <flick through patent applications>, sorry Apple own that one, it can no longer be used in the US. The rest of the world can freely be infected.

[Destroy All Monsters]

Ass slappage worm

There was a write up in July...

http://www.theregister.co.uk/2012/07/25/mac_crisis_malware/

[Magnus_Pym]

Worm? Virus?

Does it not say 'tricks the user into installing" ?

That's a Trojan then isn't it?

[diodesign]

Re: Worm? Virus?

There's no trickery involved if transfered by an infected drive, AIUI.

C.

[Anonymous Coward]

Re: Worm? Virus?

Trojan = Malicious software that pretends to be something useful in order to trick user into running it.

[Frumious Bandersnatch]

Re: Worm? Virus?

pretends to be something useful in order to trick

Like a giant wooden horse, for example. Someone should surely be able to find a use for that.

[Anonymous Coward]

Flash player java applet?

Wossat?

[Anonymous Coward]

Re: Flash player java applet?

@Destroy all monsters: Thanks, your link to the previous story told me that a "Flash player java applet" is a "Java Archive file which pretends to be Adobe Flash Player"

The idea of Adobe writing a Flash installer in Java raises a smile, if nothing else

[Badvok]

Re: Flash player java applet?

And if Adobe actually used Java to implement Flash it would probably be faster and less resource hungry.

[Anonymous Coward]

previous unseen capabilities

Err

"It demonstrates previous unseen capabilities in the process."

No it really does not. Spreading between differing OS's is not new, Dropping via the web using social engineering is not new or key-logging, Rootkit install, killing AV's or pretty much everything else listed.

In-fact I can still remember the first publicly recorded worm that could run unmodified on both Win and Linux boxes written by a member of the 29a. Sorry but having the Binary’s for three differing OS's is not really new or novel either.

[TheRealRoland]

So....

Now the new question in certain circles will be 'But will it run Crisis?'

[JDX]

Windows Mobile

Does that specifically mean the old version, or Windows Phone also?

[Steve Knox]

"Flash Player Java applet"

Hmm. My copy of Adobe Flash is incredibly buggy and slow. I wonder if there's anything I can replace it with -- oh, here's this e-mail, apparently Adobe has ported Flash to an incredibly buggy and slow platform! Surely that will work better!

[Anonymous Coward]

@Reg: Do Homework, use Proper Terms

This is clearly a Trojan Horse, as the first thing you need to do is to enter the system password. But yeah, let's sell MacOSX virus scanners for the Total-O-Bozos to protect them from themselves.

Surely Symantec, Kaspersky and M$ pay with nice advertising on the site for this Bull$hit news.

[Dave 126]

So...

Can it break out of a virtual machine?

Can it be stopped from getting onto a dormant virtual machine if the VM's virtual disk is encrypted?

I ask as a domestic user who is intending to use a VM for internet browsing, as an extra safeguard against nasties. I would say it is actually for a friend who might visit dodgy websites, but you lot will just say 'A friend. Yeah right, we believe you'

[Gordon Fecyk]

Same prevention methods work

Once launched, the worm puts in place a rootkit to hide itself from view; installs spyware to record the user's every move on the computer[...]

Can't install anything as a non-admin, either on MacOS or Windows. Also not new.

[url]

finally we have the answer

...

...

...

it can run crisis

[The Jase]

The OS wars

Nothing pisses me off more than on a forum when you ask

"I have problem xyz with Windows application abc"

And some tosspot writes "get application xyz instead" or "get a Mac/Linux".

That's like saying "I have a problem with my petrol Honda starting"

and someone saying "get a diesel instead" or "get a Ford/Toyota"

That's not an answer people.

[SiempreTuna]

Never Mind What It Is ..

.. how do I find out if my PC/Mac/VM/(no-one has an MS phone so forget that) is infected and if so, how do I get rid of it?!

[RICHTO]

Re: Never Mind What It Is ..

Domestos kills all known viruses dead. Try putting some of that in your connection ports, and you should be fine....

[TrishaD]

@The Jase

Or indeed people who's reaction to news of new malware is to castigate the stupidity of the average PC user.

I'd remind anyone working in IT of one small fact...

It's the 'dumbass' end user who pays your wages, whether directly or indirectly.

[angelochoa]

Re: @The Jase

Or that they may be "the stupid <something else> user"

[Anonymous Coward]

Introducing the Evil virus..

.. it installs Windows 8 everywhere..

[ross]

it amazes me, all the panic about this when this

http://www.sniperspy.com/

and others like it are freely available to any one with about $100.00 US. and they are legal!!!!! but it is as scary as any virus. it does more than this virus we are talking of here. even the Australian Privacy Foundation don't see it as anything to worry about apparently