RE: [BULK] - New Skype Worm

["Hubbard, Dan" <dhubbard () websense com>]

Pls see update information here:

http://www.websense.com/securitylabs/alerts/alert.php?AlertID=716 

Yesterday Websense Security Labs reported on our blog that there was a
potential Worm propagating via Skype (see:
http://www.websense.com/securitylabs/blog/blog.php?BlogID=101). After
investigation we have discovered that this is not a self propagating
worm and is actually a Trojan Horse.

After discussions with the very helpful Skype security team, the
behavior of this Trojan using the Skype API is as per the specifications
of the API. The end-user who is running Skype does get notified that a
program is attempting to access it and must acknowledge it.

*there is no vulnerability in Skype at this time that has been
uncovered*

For more details on the Skype API see
https://developer.skype.com/Docs/ApiDoc/Overview_of_the_Skype_API

At the time of this alert the websites that were used to download the
Skype API code and the site that is used to download new copies of the
Trojan were both down.

-----Original Message-----
From: Christopher Mosby [mailto:m () md3v com] 
Sent: Tuesday, December 19, 2006 8:49 AM
To: bugtraq () securityfocus com
Subject: [BULK] - New Skype Worm

Websense Security Labs has had reports of a new worm that uses Skype to
propagate. We are still investigating the issue but here are the details
so
far:

* users receive messages via Skype Chat to download and run a file
* the filename is called sp.exe
* assuming the file is run it appears to drop and run a password
stealing Trojan Horse
* the file also appears to run another set of code that uses Skype to
propagate the original file
* the file is packed and has anti-debugging routines (NTKrnl Secure
Suite
packer)
* the file connects to a remote server for additional code
* the original site has been black holed and is not serving the code
anymore
* the number of victims is still TBD
* the original infections appear to be in APAC region (Korea in
particular)

More: http://www.websense.com/securitylabs/alerts/alert.php?AlertID=716