Sign in / up

back to article Superworm Crisis eats Macs, VMware and - shock - Windows

Security watchers have discovered a virus strain that compromises VMware virtual machines as well as infecting Mac OS X and Windows computers and Windows Mobile devices. It demonstrates previously unseen capabilities in the process. The Crisis malware typically arrives in a Java archive file (.jar) and is typically installed …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. Anonymous Coward
    Anonymous Coward

    Where are you now ...

    RICHTO ?

    1 0
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      So

      So long as you don't play the free porn video......

      0 1
    2. RICHTO
      Reply Icon
      Mushroom

      Re: Where are you now ...

      Here. First ever malware for Windows Mobile I think? But then it hasnt been updated for many years...

      This isnt actually exploiting any vulnerability as far as I can see other than stupidity?

      1 4
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Where are you now ...

        > This isnt actually exploiting any vulnerability as far as I can see other than stupidity?

        It's a threat to all WP7 users then ;-)

        5 3
        1. Gerhard den Hollander
          Reply Icon

          Re: Where are you now ...

          both of them must be worried then .....

          2 0
        2. RICHTO
          Reply Icon
          Mushroom

          Re: Where are you now ...

          I was thinking more of Mac users. They are mostly journalists too stupid to use a computer or 'creative' types that left school with only a GCSE in Art....

          0 1
  2. Anonymous Coward
    Anonymous Coward

    Hardcoded IP for a command and control which it pings every five minutes.

    Mmmm.

    Smells like amateur hour.

    6 0
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      As does the article itself

      2 6
    2. dotdavid
      Reply Icon
      WTF?

      Wait a minute, that's *my* IP they're using! The bastards!

      Wait...

      4 1
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        :)

        Reminds of the days on IRC when someone would post "TEACH ME TO HACK" on a channel and we told them to direct <whatever script was current> at 127.0.0.1. Strangely, they dropped offline then :)

        4 0
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          @AC

          I think most *nix related channels have had such experiences. Even so, I found that using addresses such as 127.10.45.65 proofed to be way more effective than the "easily recognizable" default address.

          1 0
  3. jai

    late?

    This is listed on the Symantec and Sophos websites since 25th July. It's a bit late to be talking about it now isn't it?

    It's seems that Symantec has been detecting this type of jar delivered malware since 2010!

    Or is it just the way it attacks VMWare that makes it news worthy?

    0 0
    1. Jon Lamb
      Reply Icon

      Re: late?

      I've always assumed the article delay was usually caused by having to think up a catchy sub-title. Not sure what happened here.

      4 0
    2. diodesign (Written by Reg staff) Silver badge
      Reply Icon

      Re: late?

      Yeah, it's the four-way whammy of VMware, Mac OS X, Windows and Windows Mobile (what's that?) that's new.

      C.

      3 2
      1. Miek
        Reply Icon
        Coat

        Re: late?

        Wake me up when it has Linux support.

        0 0
        1. RICHTO
          Reply Icon
          Mushroom

          Re: late?

          That will be when Linux grows past 1% market share....

          0 2
          1. Miek
            Reply Icon
            Linux

            Re: late?

            1% in which market?

            0 0
  4. RyokuMas
    Trollface

    Nope...

    I'd bet it's because it's only just been revealed that this can affect Windows mobile devices - and the opportunity to take a swipe was too much to resist...

    1 0
    1. Fred Flintstone Gold badge
      Reply Icon
      Coat

      Re: Nope...

      the opportunity to take a swipe was too much to resist

      What? It scans gestures too?

      1 0
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        What? It scans gestures too?

        A virus that uses gestures <flick through patent applications>, sorry Apple own that one, it can no longer be used in the US. The rest of the world can freely be infected.

        1 0
  5. Destroy All Monsters Silver badge

    Ass slappage worm

    There was a write up in July...

    http://www.theregister.co.uk/2012/07/25/mac_crisis_malware/

    2 0
  6. Magnus_Pym

    Worm? Virus?

    Does it not say 'tricks the user into installing" ?

    That's a Trojan then isn't it?

    0 0
    1. diodesign (Written by Reg staff) Silver badge
      Reply Icon

      Re: Worm? Virus?

      There's no trickery involved if transfered by an infected drive, AIUI.

      C.

      2 0

    2. This post has been deleted by its author

      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Worm? Virus?

        Trojan = Malicious software that pretends to be something useful in order to trick user into running it.

        6 1

        1. This post has been deleted by its author

        2. Frumious Bandersnatch
          Reply Icon

          Re: Worm? Virus?

          pretends to be something useful in order to trick

          Like a giant wooden horse, for example. Someone should surely be able to find a use for that.

          4 0
  7. Anonymous Coward
    Anonymous Coward

    Flash player java applet?

    Wossat?

    1 1
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Flash player java applet?

      @Destroy all monsters: Thanks, your link to the previous story told me that a "Flash player java applet" is a "Java Archive file which pretends to be Adobe Flash Player"

      The idea of Adobe writing a Flash installer in Java raises a smile, if nothing else

      2 0
      1. Badvok
        Reply Icon
        Trollface

        Re: Flash player java applet?

        And if Adobe actually used Java to implement Flash it would probably be faster and less resource hungry.

        0 0
  8. Anonymous Coward
    Anonymous Coward

    previous unseen capabilities

    Err

    "It demonstrates previous unseen capabilities in the process."

    No it really does not. Spreading between differing OS's is not new, Dropping via the web using social engineering is not new or key-logging, Rootkit install, killing AV's or pretty much everything else listed.

    In-fact I can still remember the first publicly recorded worm that could run unmodified on both Win and Linux boxes written by a member of the 29a. Sorry but having the Binary’s for three differing OS's is not really new or novel either.

    0 2
  9. TheRealRoland
    Meh

    So....

    Now the new question in certain circles will be 'But will it run Crisis?'

    4 0
  10. JDX Gold badge

    Windows Mobile

    Does that specifically mean the old version, or Windows Phone also?

    1 0
  11. Steve Knox
    WTF?

    "Flash Player Java applet"

    Hmm. My copy of Adobe Flash is incredibly buggy and slow. I wonder if there's anything I can replace it with -- oh, here's this e-mail, apparently Adobe has ported Flash to an incredibly buggy and slow platform! Surely that will work better!

    1 4
  12. Anonymous Coward
    Anonymous Coward

    @Reg: Do Homework, use Proper Terms

    This is clearly a Trojan Horse, as the first thing you need to do is to enter the system password. But yeah, let's sell MacOSX virus scanners for the Total-O-Bozos to protect them from themselves.

    Surely Symantec, Kaspersky and M$ pay with nice advertising on the site for this Bull$hit news.

    1 9
  13. Dave 126 Silver badge

    So...

    Can it break out of a virtual machine?

    Can it be stopped from getting onto a dormant virtual machine if the VM's virtual disk is encrypted?

    I ask as a domestic user who is intending to use a VM for internet browsing, as an extra safeguard against nasties. I would say it is actually for a friend who might visit dodgy websites, but you lot will just say 'A friend. Yeah right, we believe you'

    2 0
  14. Gordon Fecyk
    Boffin

    Same prevention methods work

    Once launched, the worm puts in place a rootkit to hide itself from view; installs spyware to record the user's every move on the computer[...]

    Can't install anything as a non-admin, either on MacOS or Windows. Also not new.

    0 0
  15. url
    Thumb Up

    finally we have the answer

    ...

    ...

    ...

    it can run crisis

    0 0
  16. The Jase

    The OS wars

    Nothing pisses me off more than on a forum when you ask

    "I have problem xyz with Windows application abc"

    And some tosspot writes "get application xyz instead" or "get a Mac/Linux".

    That's like saying "I have a problem with my petrol Honda starting"

    and someone saying "get a diesel instead" or "get a Ford/Toyota"

    That's not an answer people.

    9 0
  17. SiempreTuna
    FAIL

    Never Mind What It Is ..

    .. how do I find out if my PC/Mac/VM/(no-one has an MS phone so forget that) is infected and if so, how do I get rid of it?!

    0 0
    1. RICHTO
      Reply Icon
      Mushroom

      Re: Never Mind What It Is ..

      Domestos kills all known viruses dead. Try putting some of that in your connection ports, and you should be fine....

      0 1
  18. TrishaD

    @The Jase

    Or indeed people who's reaction to news of new malware is to castigate the stupidity of the average PC user.

    I'd remind anyone working in IT of one small fact...

    It's the 'dumbass' end user who pays your wages, whether directly or indirectly.

    3 1
    1. angelochoa
      Reply Icon

      Re: @The Jase

      Or that they may be "the stupid <something else> user"

      0 0
  19. Anonymous Coward
    Anonymous Coward

    Introducing the Evil virus..

    .. it installs Windows 8 everywhere..

    0 0
  20. ross

    it amazes me, all the panic about this when this

    http://www.sniperspy.com/

    and others like it are freely available to any one with about $100.00 US. and they are legal!!!!! but it is as scary as any virus. it does more than this virus we are talking of here. even the Australian Privacy Foundation don't see it as anything to worry about apparently

    0 0
This topic is closed for new posts.

Other stories you might like