Small attack triggered Microsoft's emergency patch, says researcher
Trojan that prompted out-of-cycle Windows update infected 200 machines
November 4, 2008 12:00 PM ETComputerworld - The Trojan horse whose attacks convinced Microsoft Corp. to issue an emergency patch for Windows had infected only about 200 computers prior to the fix's Oct. 23 release, a security researcher said today.
Joe Stewart, director of malware research at SecureWorks Inc., tracked down "Gimmiv," the Trojan that started the rush to patch. By accessing three control servers used by Gimmiv's makers, downloading log files and then decrypting the encrypted data, Stewart was able to pinpoint its origin, the first evidence of its spread and the overall number of infected PCs.
Twelve days ago, Microsoft warned of a critical vulnerability in the Windows Server service, which is used by all versions of the operating system, including client editions, to connect to file and print servers on a network. Hackers were already exploiting the bug in what Microsoft called "limited, targeted attacks," the company said, as it issued a patch outside its normal second-Tuesday-of-the-month schedule.
Gimmiv, which Microsoft tagged as "Win32/MS08067.gen!A" instead, was identified as the malware that prompted the emergency patch.
It first popped up Aug. 20 and was probably written by a South Korean hacker, said Stewart. According to the log files, however, the Trojan was present at only two IP addresses in August, and then only briefly. "One of these IP addresses, located in Korea, we can tell was running Gimmiv in a VMware virtual machine, exactly the kind of thing you might expect someone testing a piece of malicious mobile code to do," said Stewart.
Not until Sept. 29, however, did Gimmiv show up "in the wild" as log files noted an infected PC in Hanoi, Vietnam. All told, approximately 200 machines in 23 countries were successfully attacked by Gimmiv between Sept. 29 and Oct. 23, when Microsoft released its out-of-cycle fix. Many of the machines were on two networks in Malaysia, and few systems outside of Asia were compromised.
The log files recorded just one hacked machine in North America, for instance.
"But we had just as many questions after this as before," said Stewart, who ticked off a long list of unusual characteristics of Gimmiv. "They weren't the worst programmers ever, but it seemed like this was put together quickly. It almost felt like a half-finished program."
Stewart found lots of debug code in Gimmiv, as well as code that led nowhere. "Sections were supposed to do something, but never did," he said. "For example, it pings a Web site in China and then if that's not available, Google. It sends a special pattern in the ping but doesn't do anything with the results.
Microsoft
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Death to PST Files
Download Now
The Tangled Web: Silent Threats & Invisible Enemies
Download Now
Tape Killed the IT Guy
Watch Now
Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now
BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!
What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now
Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".
eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

