Oops! Google Sent 'Worm' to E-mail List

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

UPDATED: E-mail subscribers to Google’s (Quote) video blog got more than
they bargained for from a mailing this week.

The search giant accidentally e-mailed the notorious “Kama Sutra” worm to
subscribers of its Google Video e-mail list.

Three posts sent to the 50,000 subscribers of the Google Video Blog e-mail
group included the W32/Kasper.A@mm mass mailing worm, according to Google.

Also known as the Kama Sutra worm, the security threat, while largely
harmless, gained the moniker in February after being distributed disguised
as e-mailed porn.

An internal moderator of a list inadvertently allowed a couple of
outside messages, which contained a virus, to be sent to the Google Video
list,” a Google spokesperson told internetnews.com.

The company advised subscribers of the group to use an antivirus
application to remove the worm. “We’re taking steps to ensure this doesn’t
happen again,” Google said in a statement addressed to users of the mailing
list.

Google said it “used the situation as a reminder to all moderators to
carefully review all messages before distributing them,” according to the
spokesperson.

A high-profile company such as Google isn’t the first to inadvertently
distribute something similar to users or customers, said Graham Cluley,
senior technology consultant with security firm Sophos.

Some of the most well-known instances of mailing lists used to
distribute security nastiness actually has come from security watchdogs.

Two years ago, Finnish-based security firm F-Secure discovered that the Netsky-B
worm had been sent to members of its UK security list. Like Google, F-Secure
said at the time it would tighten controls on how messages are approved.

Russian hackers had previously invaded a security mailing list run by that
country’s Kaspersky Labs, which accidently sent the Braid e-mail worm to subscribers.

Clulely said it’s a reminder about internal processes. Any company that doesn’t have processes in place about what can be posted to their mailing lists could also suffer.

Companies need to restrict mailing lists to only approved messages, he added. Such a measure would ensure “no malware has sneaked its way onto the wires.”

Web 2.0 resources, such as blogs and mailing lists, are often the victims
of social engineering tactics, according to Sophos.

In a similar security snafu, popular user-written resource Wikipedia fell
victim last week to scammers.
As internetnews.com reported, hackers created a page for the open
encyclopedia’s German edition warning of a new version of the Blaster virus.
What seemed like a link to an antivirus tool was actually a virus.

This article was first published on InternetNews.com. To read the full article, click here.