Gadi Evron wrote: > The first worm (mass mailer) to (ab)use the WMF 0day is now spreading in > Australia. > Respectfully speaking: There are a few corrections to this that need to be expressed. The language you're using describing it as a mass-mailing worm is coming off confusing to some. The WMF exploit is actually seeded on a website, and the mass-mailing is used to get people to go to that site. Stating that it's a worm is similar to saying that phishing emails and spam are worms. I have seen some actual phishing worms, and this is definitely not it. A correction also needs to be made on this comment "Abusing websites is mostly how WMF is exploited, but no much in the way of emails before today." This is grossly incorrect - here are the dates we started seeing this activity: January 3rd - WMF exploit distributing identified phishing trojan January 9/10th - WMF exploit distributing identified phishing trojan Jan 18th/19th - WMF exploit distributing identified phishing trojan Jan 22nd-25th - WMF exploit distributing identified phishing trojan Jan 24th - WMF exploit distributing identified phishing trojan I can go into February but we get the point. This same phishing group works in regions, so it's not surprising that they are now targeting Australia. They are also targeting Europe as well in February. Summary: WMF Mass-Mailing phishing has not been uncommon, just in small distributions, so it may have not been seen on the radar. Since the public discovery of the WMF exploit, there have been a few mass-mailings taking users to a site that distributed WMF exploits to date. -- Best Regards, Lance James Secure Science Corporation www.securescience.net Author of 'Phishing Exposed' http://www.securescience.net/amazon/