Storm Trojan dupes users with Halloween jig
The latest holiday-inspired spam by the botnet-building malware in progress
October 31, 2007 12:00 PM ETComputerworld - The Storm Trojan is flooding e-mail in-boxes with a Halloween spam blitz, security companies said this morning. This is just the latest example of the bot-building malware's knack of capitalizing on current events to dupe people into infecting their PCs.
The newest campaign arrives in messages with subject heads such as "Dancing Bones" and "The most amazing dancing skeleton," said Abingdon, England-based Sophos PLC in an alert posted on its site. The messages include a link to a malicious URL posing as a Halloween-themed site; once there, users can click on a file, "halloween.exe," which purports to be a dancing skeleton game, but which actually fires up Storm in the background.
Visitors running unpatched machines can also be hit by Storm after a multistrike exploit package pings the PC for vulnerabilities and, if it finds one, compromises the computer and as the slips in Storm.
"This is just the latest incarnation of the poisoned e-card attack, also known as Storm, which has dominated the malware scene for months," Graham Cluley, a Sophos consultant, said in a statement. "The gang responsible are experts at choosing topical disguises or crafting alluring e-mails."
Storm's makers have relied on current events and holidays since the Trojan first appeared in January as an attachment to a message broadcasting news of that month's major windstorm in Europe. Since then, Storm has piggybacked on messages hyping everything from the Fourth of July to Labor Day.
The malware has become famous in security circles for its use of social engineering tricks. More than two months ago, Symantec Corp. researcher Hon Lau acknowledged the hackers' ability to craft tempting messages. "They have a knack for latching on to the latest newsworthy events and capitalizing on the public interest in them," Hon said then. "And if no newsworthy events are happening at the time, then they will just make them up."
All of Storm's energies are devoted to hijacking PCs so it can use them as bots in a network, or botnet, of hacked machines. Recently, researchers have reported that the Storm botnet may be splitting up into smaller segments, perhaps in preparation for sale to others who could use them for spamming or other schemes.
Most antivirus products have signature definitions in place that detect and delete the Storm Trojan used in the Halloween attack, according to London-based Heise Security.
Read more about security in Computerworld's Security Knowledge Center.
Storm
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Death to PST Files
Download Now
The Tangled Web: Silent Threats & Invisible Enemies
Download Now
Tape Killed the IT Guy
Watch Now
Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now
BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!
What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now
Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".
eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

