Websense Discovers Worm Moving through Skype

There is yet another worm in cyber space, and this one is moving around through Skype, a popular VoIP application. The San-Diego based Internet security firm, Websense, made this discovery and posted the alert to all users. The worm was found to have originated somewhere in the Asia-Pacific region, most likely Korea.

According to a release from Websense, the worm propagates through Skype chat, an instant messenger tool, and asks users to download and run an executable file called sp.exe. Once a user downloads this file, it installs spyware on the user’s system, which can be used to steal passwords and other such personal information and cause serious damage. Not just that, the worm can also connect to a remote server to download more malicious code.

Websense further stated that the worm, which was flagged by Symantec as well (and named W32.Chatosky), was using the NTKrnl Secure Suite Packer, an encryption program that makes the file appear unique to threat detection engines. What in effect it does is make the worm difficult for anti-virus kits to sniff out.

Websense has been continuously monitoring the situation and the latest reports are highly encouraging. After a careful assessment of the situation, security analysts have now downgraded the threat level that the worm posed. The latest assessment is that it is a Trojan horse, according to Dan Hubbard, VP of research at Websense. According to him, it is not a worm, because it is not exploiting a vulnerability in the target system.

Hubbard has further confirmed that the servers that the Trojan uses to download the additional malicious code are probably down by now, and that the Trojan was spreading rather slowly, if not dead already.

Skype is famous for its VoIP application, as mentioned earlier, which allows users to make free phone calls over the Internet. Famous for this service, Skype uses a contact list like the one seen in instant messenger services. It also has a chat function that allows instant text messaging, thereby together forming an online messenger service-like suite of applications. It was acquired for $2.6 billion by eBay, the online auction company, and has currently more than 7 million subscribers.