Fake Microsoft security alert includes Trojan patch
The e-mail identifies itself as 'Microsoft Security Bulletin MS05-039'
IDG News Service - A new wave of spam that disguises itself as a Microsoft Corp. security bulletin contains a link to malicious software that gives attackers complete access to the infected machine, security researchers are reporting.
The e-mail, which began circulating late Tuesday, identifies itself as Microsoft Security Bulletin MS05-039, and offers a link to what it claims is a patch against the Sober Zafi and Mytob worms.
In fact, there is no such thing as Microsoft Security Bulletin MS05-039, and real Microsoft security bulletins offer links to a Microsoft download site, rather than to the patches themselves, said Mikko Hypponen, director of antivirus research at F-Secure Corp.
The phony patch is a variant of the SDBot Trojan software, which is at present not detected by antivirus software products, according to a report from security research firm WebSense Inc.
The risk of someone downloading this Trojan appears to be very low right now, because the server hosting the Trojan downloads no longer appears to be active, Hypponen said. That server, which appeared to be hosted by ThePlanet.com Internet Services Inc., apparently has exceeded its allowed bandwidth, he said.
"I think this particular case is not going to be a problem anymore, but nevertheless I think it was a fairly interesting case," Hypponen said. "I wouldn't be surprised to see more of this happening."
The Swen e-mail worm, which began circulating in 2003, used a similar technique, he said.
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!