Cisco: 'Here you have' worm caused brief havoc

For a few hours, it accounted for between six per cent and 14 per cent of all spam

The "Here you have" worm that clogged e-mail systems on Thursday briefly caused one of the worst spam outbreaks of 2010, according to Cisco Systems.

For a few hours -- between 17:45 and 20:30 GMT -- the worm accounted for between six per cent and 14 per cent of all spam measured by Cisco's IronPort group.

It was the biggest spam outbreak since scammers pounced on the iPad launch back in March to try to trick people into visiting malicious websites, said Nilesh Bhandari, a product manager with Cisco. "That is humongous," he said.

"Here you have" spread primarily via e-mail, in messages that tried to entice victims into visiting a website that would install a malicious script on their computers. That script then scoured the victim's Outlook contacts list and sent similar messages to new victims. The worm also spread over the network, using a special PsExec script and via USB drives.

The worm's advance has been halted now for two reasons: Antivirus companies have added detection for the worm, and the website that hosted the malicious script has been taken offline. Cisco's data shows that by 12:00 GMT Friday it accounted for virtually none of the spam Cisco was tracking.

The worm primarily affected business networks in the U.S., Microsoft said in an analysis of the incident, posted late Friday. "For the first twelve hours of attack activity we monitored, 91 per cent of the infections and infection attempts were reported from our corporate clients -- the opposite of the pattern we normally see," Microsoft said.

It reportedly slowed down networks at Disney, Procter & Gamble, Wells Fargo and NASA.

This type of mass-mailing worm has largely been off the radar since the days of the Anna Kournikova and I Love You outbreaks in the early 2000s, but security experts say there are a few unusual things about "Here You Have."

There are several signs that may link it to a Libyan jihadist hacker named Iraq Resistance, SecureWorks said on Friday.

Most agree that the worm is not particularly sophisticated. Its success shows that it's still possible to infect a lot of computers by finding ways to trick people into doing things they shouldn't -- such as clicking on links and running malicious files. "[It] just shows that the human exploit is the easiest vector," said Alex Lanstein, a researcher with security vendor FireEye, in an e-mail message.

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is robert_mcmillan@idg.com

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags internetmalwareCisco Systems

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Essentials

Brother MFC-L3745CDW Colour Laser Multifunction

Learn more >

Mobile

Exec

Sony WH-1000XM4 Wireless Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?