[106654] in North American Network Operators' Group
Re: facebook worm
daemon@ATHENA.MIT.EDU (Paul Wall)
Thu Aug 7 19:57:03 2008
Date: Thu, 7 Aug 2008 19:56:44 -0400
From: "Paul Wall" <pauldotwall@gmail.com>
To: "Gadi Evron" <ge@linuxbox.org>
In-Reply-To: <Pine.LNX.4.62.0808062335530.14967@linuxbox.org>
Cc: nanog@merit.edu
Errors-To: nanog-bounces@nanog.org
Gadi,
Please take a few moments to reflect on:
http://www.nanog.org/endsystem.html
I'd appreciate it if you'd try and keep future off-topic postings like
this to a minimum, as it makes the list difficult to wade through to
get to what matters.
Regards,
Paul (not currently MLC, though I promise to put you in your place
once the SC affords me the privlege :)
On Thu, Aug 7, 2008 at 12:44 AM, Gadi Evron <ge@linuxbox.org> wrote:
> Hi all. You may want to be ready for a *possible* support lines flood today.
>
> Yesterday I discovered a fast-spreading facebook worm. It spreads by sending
> messages to all your facebook friends, from your account, asking them to
> click on a link in the .pl ccTLD.
>
> This worm is somewhat similar to zlob, here is a link to a kaspersky paper
> on a previous iteration of it, they call it koobface:
> http://www.kaspersky.com/news?id=207575670
>
> The worm collects spam subject lines from, and then sends the users personal
> data to the following C&C:
> zzzping.com
>
> I spoke with DirectNIC last night and the Registrar Operations (reg-ops)
> mailing list was updated that the domain is no longer reachable. That was
> very fast response time from DirectNIC, which we appreciate.
>
> The worm is still fast-spreading, watch the statistics as they fly:
> http://www.d9.pl/system/stats.php
>
> The facebook security team is working on this, and they are quite capable.
> The security operations community has been doing analysis and take-downs,
> but the worm seems to still be spreading.
>
> All anti virus vendors have been notified, and detection (if not removal)
> should be added within a few hours to a few days.
>
> For now, while users may get infected, their information is safe (unless the
> worm has a secondary contact C&C which I have not verified yet).
>
> It seems like some users may have learned not to click on links in email,
> but any other medium does not compute.
>
> Gadi.
>
>
