Ads by TechWords

See your link here
Receive the latest technology news and information.
Security
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Small attack triggered Microsoft's emergency patch, says researcher

Trojan that prompted out-of-cycle Windows update infected 200 machines

November 4, 2008 12:00 PM ET

Computerworld - The Trojan horse whose attacks convinced Microsoft Corp. to issue an emergency patch for Windows had infected only about 200 computers prior to the fix's Oct. 23 release, a security researcher said today.

Joe Stewart, director of malware research at SecureWorks Inc., tracked down "Gimmiv," the Trojan that started the rush to patch. By accessing three control servers used by Gimmiv's makers, downloading log files and then decrypting the encrypted data, Stewart was able to pinpoint its origin, the first evidence of its spread and the overall number of infected PCs.

Twelve days ago, Microsoft warned of a critical vulnerability in the Windows Server service, which is used by all versions of the operating system, including client editions, to connect to file and print servers on a network. Hackers were already exploiting the bug in what Microsoft called "limited, targeted attacks," the company said, as it issued a patch outside its normal second-Tuesday-of-the-month schedule.

Gimmiv, which Microsoft tagged as "Win32/MS08067.gen!A" instead, was identified as the malware that prompted the emergency patch.

It first popped up Aug. 20 and was probably written by a South Korean hacker, said Stewart. According to the log files, however, the Trojan was present at only two IP addresses in August, and then only briefly. "One of these IP addresses, located in Korea, we can tell was running Gimmiv in a VMware virtual machine, exactly the kind of thing you might expect someone testing a piece of malicious mobile code to do," said Stewart.

Not until Sept. 29, however, did Gimmiv show up "in the wild" as log files noted an infected PC in Hanoi, Vietnam. All told, approximately 200 machines in 23 countries were successfully attacked by Gimmiv between Sept. 29 and Oct. 23, when Microsoft released its out-of-cycle fix. Many of the machines were on two networks in Malaysia, and few systems outside of Asia were compromised.

The log files recorded just one hacked machine in North America, for instance.

"But we had just as many questions after this as before," said Stewart, who ticked off a long list of unusual characteristics of Gimmiv. "They weren't the worst programmers ever, but it seemed like this was put together quickly. It almost felt like a half-finished program."

Stewart found lots of debug code in Gimmiv, as well as code that led nowhere. "Sections were supposed to do something, but never did," he said. "For example, it pings a Web site in China and then if that's not available, Google. It sends a special pattern in the ping but doesn't do anything with the results.



Jump to comments

Microsoft

Additional Resources

WHITE PAPER
Approximately 60 percent of data migration projects overrun time or budget, while some fail completely. Download this white paper, "Enhancing Your Chance for Successful Data Migration," to learn the critical steps you need to take to execute a data migration project with minimum cost and risk to your business.
WHITE PAPER
Read the Gartner research note to learn why the TCO of a server-based computing deployment used to deliver all applications to users is around 50% lower than that of an unmanaged desktop deployment.
WHITE PAPER
Economic downturns have a tendency to accelerate emerging technologies, boost the adoption of effective solutions, and punish solutions that are not cost competitive or that are out of synch with industry trends. This IDC White Paper presents the results of an IDC survey of 330 companies in Western Europe, Asia/Pacific and the Americas that measures the receptiveness to Linux and takes into consideration changing views driven by the disruptive economic environment that businesses face today.

What People Are Saying

White Papers & Webcasts

Share our Strength
Download Now  

Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...

Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.

Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...