Bangkok--19 Jun--Core & Peak
We all know the importance of keeping systems patched with the latest Microsoft updates, to avoid security threats that seek to exploit known vulnerabilities in the Microsoft Operating System. But what if the patch, itself, was a security threat? Trend Micro detected a trojan earlier this week with social engineering that begged precisely that question.
It all started with an email, purportedly from Microsoft, claiming that a new worm was spreading — and that immediate action was required from the user, to install a security patch to prevent infection. And due to some problems with the Microsoft Automatic Update site, as the message claimed, the patch was attached to the email.
Sound suspicious? It should. According to Jamz Yaneza, Senior Threat Analyst at Trend Micro, this technique is used pretty regularly, but infrequently — and convincingly — enough to be successful. “Since 2003, we have seen a number of instances where a Microsoft patch or update message was used to trick users into infecting their systems”, said Yaneza. “The code itself is really different, so it’s likely the work of different writers each time, but the technique is similar — and gaining popularity.”
According to Yaneza, instead of installing a patch, the attachment was actually the malware executable. Therefore, launching the attachment would actually install a commercially-available keylogger, which can be freely downloaded from the Internet. Additionally, the user’s system would have been infected with at least three different trojan spyware components, which are well-known to security vendors, but have been reused in modular fashion for this malware. According to Yaneza, this particular sample represents a failed attempt, but cautions on the need to remain vigilant. “Luckily, this particular malware was damaged, so the attachment failed to execute as planned”, said Yaneza. “But it’s not uncommon for us to see copycats in the near-term future who write malware that does work, so we want to get the word out now, to avoid potential infections.”
Utilizing a technique popularized with phishing scams, the writer of this malware attempted to give the email an authentic appearance by appending the familiar white Microsoft logo on a blue background to the top of the message — likely copying the actual legitimate logo from Microsoft’s own Web site. As with modern-day phishing scams, the technique employs professional-looking, HTML-based e-mails that include company logos, font styles, colors, graphics, and other elements to successfully spoof the supposed sender — and a call to action that prompts recipients of the e-mail to react immediately. The only difference here is that the malicious code is attached to the email, rather than including a link to another site, where the crime will be committed.
Jeffrey Aboud, threat response manager at Trend Micro, advises users that, in addition to ensuring their systems contain the most recent security patches and updated antivirus definitions, it’s absolutely essential to remain vigilant. “As with just about any social engineering technique, user education is by far and away the best defense”, said Aboud. “Microsoft, security vendors, banks — just about any legitimate business — would never include security patches or sensitive information in an email attachment. That’s simply not the way business is done.”
Jasper Pimentel, security analyst at Trend Micro, points to a number of “problems” with this particular sample, which were telltale signs it was bogus:
1. The message referenced an old malware, Beagle.D, as the malware that “is spreading”
2. The message pleaded with the user not to take the advisory as a joke (which is quite unprofessional for a company such as Microsoft)
3. It threatened the user with legal culpability if the patch was not installed (there is currently no Legal recourse in any country in the world, where the “victim” is held liable for not patching his/her system)
4. As with many spam, phishing, and other email-borne threats, this message contained several spelling and grammar errors
It’s important to note that future malware utilizing this technique may correct these problems, so users can’t trust an email just because these signs aren’t present. “When in doubt, it’s best to open a browser and enter the vendor’s URL directly”, adds Pimentel. “You lose nothing but a few extra moments going that route, as opposed to potentially losing a great deal by trusting an email that came from who knows where.”
For further information, please contact:
Srisuput Siangyen, PR Consultant Core & Peak Co., Ltd.Tel. 02-439-4600 ext. 8300
Email:[email protected]