Trojan hides in fake Citibank e-mail

TalkBack 10 of 12:

Next »

« Previous

• Thread View
• Flat View

Sounds like...

...another exploit involving ActiveX/ActiveScripting. If so, you don't need to do anything other than browse to an infected Web page using IE (the only browser subject to this class of exploits, by the way), which is how my sister lost her system oh, about three years ago. That one didn't plant a trojan...according to what I can gather from her description of the damage, code in the Web page itself uploaded a batch file or executable that mangled her Windows registry (I think she might have been on 98SE or ME at the time), which is not incredibly difficult to do, according to security folks. If you can get even a simple DOS batch file to run on the victim's system, you can add, delete and alter registry entries at will. A really well-written exploit involving ActiveScripting will allow you to upload and execute a program on a victim's machine without his or her assistence or knowledge. At least, until the next time he or she attempts to reboot.

VBScript exploits hidden in Web pages are said to be fairly straight-forward to write (I wouldn't know...never tried to write one). According to 'White Hat' exploiters, the only way to stop them is to totally disable ActiveX/ActiveScripting in IE and Outlook/Outlook Express. But then, you can't make use of Windows Update from Microsoft's Web site (yes, I know...supposedly you can set up 'Trusted Sites' or ask IE to query you about each ActiveX control offered, but I understand these feeble barriers are easy for scriptkiddies to get around).

This being so, you can imagine that if you were a hacker who wanted to exploit Company X, and you knew that Company X had over, say, 50 employees, you would feel very confident that you could lure at least *one* person from the victim organization to a Web page to upload an executable. If you've ever been around any company that had any salespeople, you just KNOW that you could get a bite with an email like this:

"Dear Ms. Smith--

Allow me to introduce myself.

I'm Drew Magilicutty, Vice President of Research and Development at Amazing Widgets, Inc. We are in the process of accepting bids for a large project that we wish to initiate in the first quarter of 2004. Our project bid specification docs are rather lengthy, involving an 80,000-word overview, a 10,000-word federal requirements quidelines doc, a couple of Gant charts on project timeline budgeting and a spreadsheet in Excel format. We've put our entire bid requirements package on the Web at www.yourescrewed.com/toolatenowsucker.html and would very much like to invite your company to review our project requirements and submit a bid if interested. After reviewing the Web pages, if interesting in pursuing a bid submission, please call my office at 1-800-TOOLATE, extension 666.

Sincerely,

Drew Magilicutty,
Vice President of Research and Development
Amazing Widgets, Inc."

You KNOW that any reasonably aggressive salesperson (and the good ones are ALWAYS aggressive) would be at the Web page the instant something like this hit their inbox. And once they hit that Web site, well, the hacker owns Company X.

Which is what is happening now to U.S. companies, from Eastern European hackers, from what I'm reading. They get into your network, lift privy information, then blackmail you to not release it to your competitors or other places it might cause you damage. I'm betting dollars to doughnuts that the means these people are using to break into networks is through luring people to malware-infected Web pages. It's pretty easy to wire home a Windows password file with a small Trojan. Hell, the infamous BackOrifice trojan could do weird things like open and close your CD tray at a command from the hacker who owned your machine!

Microsoft has been whined at, shouted at, cursed...since at LEAST 1997 by security experts who warned them that ActiveX/ActiveScripting (especially VBScript) was essentially a malware writer's toolkit. Microsoft has refused to ditch the technology, for reasons that leave me totally mystified.

Posted by: Yen_z   Posted on: 11/13/03 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Dell Latitude Notebooks With Embedded Broadband Wireless Networking Provide Sales Force With Mobile Access Dell Edward Don & Company is a world-class distributor of food service ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now