Multiple computer worms released as "botwar" rages
{{date|August 18, 2005}}

Security experts are calling it a "botwar".  Multiple [[w:computer worms|computer worms]], with payloads that turn infected computers into sources of [[w:spam|spam]], [[w:viruses|viruses]] and security attacks, are being released by at least two separate groups.  Now newer versions of one group's worm include the ability to disable earlier versions of the other group's infection.  "The W32/Zotob-F worms (also known as Bozori) attempts to remove infections by earlier versions of the [[w:Zotob|Zotob]] worm and other malware, so it can take control of the compromised computer for itself", a Sophos news item stated.  F-secure's Weblog confirmed this and added "It seems there are two groups that are fighting: IRCBot and Bozori vs Zotobs and the other Bots."

Gregg Keizer of TechWeb News draws parallels between the current events and a prior example of criminal activity; "The most notable back-and-forth between [virus and worm writers] was in early 2004, when the writers of the [[w:Bagle|Bagle]] and [[w:Netsky|Netsky]] worm families engaged in a long-running tit-for-tat exchange where each tried to delete the other's code. The battle led to a veritable flood of malicious code that [lasted] weeks."  While some see a repeat of those events, other experts indicate that the current situation is "business as normal" for the criminals that create these "[[w:Botnet|bot networks]]".

A statement from [[w:Kaspersky|Kaspersky]] Lab stated that confusion over the naming of the worms has combined with overzealous reporting by infected news organisations to create confusion as to the magnitude of the attack.  At this stage they are not calling it an epidemic.

All of these worms currently exploit the [http://www.microsoft.com/technet/security/bulletin/ms05-039.mspx MS05-039 Plug and Play vulnerability], for which a patch has already been released.

== Sources ==
*{{source|url=http://www.sophos.com/virusinfo/articles/botwar.html
|title=War of the worms: Malware fights for control of insecure computers, Sophos reports
|author=
|pub=sophos.com
|date=August 17, 2005}}

*{{source|url=http://www.f-secure.com/weblog/#00000631
|title=This is not a viruswar, this is a botwar!
|author=
|pub=f-secure.com
|date=August 17, 2005}}

*{{source|url=http://www.newsfactor.com/news/Rival-Hacker-Groups-Spread-Worms/story.xhtml?story_id=1010038ZKJEA
|title=Rival Hacker Groups Spread Worms
|author=Agence France-Presse
|pub=newsfactor.com
|date=August 17, 2005}}

*{{source|url=http://www.kaspersky.com/news?id=168840109
|title=The biggest virus epidemic since Sasser and Mydoom? Kaspersky Lab comments on the current situation
|author=
|pub=kaspersky.com
|date=August 17, 2005}}

*{{source|url=http://www.cmpnetasia.com/nw_ViewArt.cfm?Artid=27451&Catid=5&subcat=50
|title=Bot Battle Brewing?
|author=Gregg Keizer
|pub=cmpnetasia.com
|date=August 17, 2005}}

 
{{Publish}}{{PD-Article}}
 {{archive}}
[[Category:Science and technology]]
[[Category:Internet]]
Security experts are calling it a "botwar".  Multiple computer worms, with payloads that turn infected computers into sources of spam, viruses and security attacks, are being released by at least two separate groups.  Now newer versions of one group's worm include the ability to disable earlier versions of the other group's infection.  "The W32/Zotob-F worms (also known as Bozori) attempts to remove infections by earlier versions of the Zotob worm and other malware, so it can take control of the compromised computer for itself", a Sophos news item stated.  F-secure's Weblog confirmed this and added "It seems there are two groups that are fighting: IRCBot and Bozori vs Zotobs and the other Bots."

Gregg Keizer of TechWeb News draws parallels between the current events and a prior example of criminal activity; "The most notable back-and-forth between virus and worm writers was in early 2004, when the writers of the Bagle and Netsky worm families engaged in a long-running tit-for-tat exchange where each tried to delete the other's code. The battle led to a veritable flood of malicious code that lasted weeks."  While some see a repeat of those events, other experts indicate that the current situation is "business as normal" for the criminals that create these "bot networks".

A statement from Kaspersky Lab stated that confusion over the naming of the worms has combined with overzealous reporting by infected news organisations to create confusion as to the magnitude of the attack.  At this stage they are not calling it an epidemic.

All of these worms currently exploit the  MS05-039 Plug and Play vulnerability, for which a patch has already been released.

*

*

*

*
Science and technology Internet