News Stay informed about the latest enterprise technology news and product updates.

Mimail-L takes sleazy aim at antispam sites

Another variant of the Mimail worm has appeared that targets antispam sites. Mimail-L, however, implies some of the blacklist sites are selling child pornography, in addition to trying to steal sensitive user data and launching denial-of-service attacks against antispam sites.

The latest variant of the Mimail worm, which appeared Tuesday, takes particularly sleazy aim at antispam groups.

Mimail-L, like some previous versions, targets antispam groups, but its tack is perhaps the most severe. "The writer has lowered himself to depths we have not see before," said Graham Cluley, senior technology consultant with U.K.-based Sophos PLC.

Recipients randomly receive one of two messages. The first reports that a weekly fee for child pornography has been charged to the recipient's credit card. The message implies the pornography came from antispam groups. "If you want to cancel membership and your CD pack please email order and credit card details to," the message reads.

The worm sometimes travels with a message purporting to be from a woman to her lover. The body text implies that the worm file contains photos of the woman nude. After infecting systems, the worm searches infected systems for e-mail addresses and then mails out copies of itself using its SMTP engine.

The worm tries to launch a distributed denial-of-service (DDoS) attack against the Spamhaus Project and other antispam Web sites.

So far, Spamhaus hasn't seen any problems with its site associated with the worm. Even if an attack occurs, the organization is ready. "We're set up to deal with attacks exactly like this," said Steve Linford of Spamhaus. "We have multiple machines, one in front of the other, specifically to filter out bad traffic and let only clean HTTP requests through."

The implication that Spamhaus is involved with child porn is both disturbing and baffling to Linford.

"Naturally, each time we are then inundated with complaints from angry users, angry that 'we' are 'going to charge their cards' and angry that we are 'selling child pornography,'" he said. "None of the thousands of users who contact us stop to think we're actually an antispam organization that does not sell anything."

So far, it's debatable whether Mimail-L is spreading that much in the wild. There seems to be some problems with its mailing routine, said Craig Schmugar, an antivirus researcher with McAfee AVERT. Thousands of copies of the worm were sent out, but it's unclear whether the worm started working on its own, he said.

Dig Deeper on Email and Messaging Threats-Information Security Threats

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.