'Swiss army knife' worm spreads

W32.Nugache.A worm includes a novel peer-to-peer element

A new worm has been detected that is far more advanced than most malware picked up to date by investigators.

W32.Nugache.A spreads via email and IM channels but also includes a novel peer-to-peer element.

Once a PC is infected it keeps in contact with the controller and other infected machines via a peer-to-peer network using TCP port 8 rather than relying on IRC.

"We picked this up on honeynets over the weekend, and it's an interesting one," said Mark Murtagh, technical services director at internet monitoring firm Websense.
"It's rather like Kazaa. If one node is shut down by the PC being cleaned it forms a peer-to-peer network with the next available PC."

This is not the first time such technology has been used. The Linux worm Slapper used a similar technique in 2002.

In terms of controlling and building a botnet this technique makes it a lot harder to shut down networks, as well as making it harder for intrusion prevention systems to identify infections.