Fake Microsoft security alert includes Trojan patch
The e-mail identifies itself as 'Microsoft Security Bulletin MS05-039'
IDG News Service - A new wave of spam that disguises itself as a Microsoft Corp. security bulletin contains a link to malicious software that gives attackers complete access to the infected machine, security researchers are reporting.
The e-mail, which began circulating late Tuesday, identifies itself as Microsoft Security Bulletin MS05-039, and offers a link to what it claims is a patch against the Sober Zafi and Mytob worms.
In fact, there is no such thing as Microsoft Security Bulletin MS05-039, and real Microsoft security bulletins offer links to a Microsoft download site, rather than to the patches themselves, said Mikko Hypponen, director of antivirus research at F-Secure Corp.
The phony patch is a variant of the SDBot Trojan software, which is at present not detected by antivirus software products, according to a report from security research firm WebSense Inc.
The risk of someone downloading this Trojan appears to be very low right now, because the server hosting the Trojan downloads no longer appears to be active, Hypponen said. That server, which appeared to be hosted by ThePlanet.com Internet Services Inc., apparently has exceeded its allowed bandwidth, he said.
"I think this particular case is not going to be a problem anymore, but nevertheless I think it was a fairly interesting case," Hypponen said. "I wouldn't be surprised to see more of this happening."
The Swen e-mail worm, which began circulating in 2003, used a similar technique, he said.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts