Technology news and Jobs 
Information Technology News MessageLabs uncovers new Microsoft Word Vulnerability
Information Technology News MessageLabs uncovers new Microsoft Word Vulnerability | MessageLabs uncovers new Microsoft Word Vulnerability |
|
| by Stan Beer | |
| Wednesday, 13 December 2006 | |
|
In this instance, the attack emails originated from a Yahoo email account which the attacker unusually accessed through webmail from a mobile device CDMA link to further hide his identity. The content of the emails focused on current issues in Iran and questions around its nuclear program and appeared to be highly targeted to the recipients to appear trustworthy. The email contained an attachment called "Rapid Response issues.doc," which contained the malware exploiting the new zero-day unannounced Word vulnerability. The vulnerability would then cause MS Word to drop an executable file, executing it and exiting. The executable file, when executed, then drops another, now clean, word document with a similar name to the original file, and another executable file. The dropped clean word document is then opened and it indeed contains some text about the political situation around Iran allowing the recipient to think that nothing unusual has happened. However, the dropped executable file gets executed by a dropper. After that, it remains resident in memory and does a number of malicious actions, including waiting for remote commands sent to another email address, checking a particular web address - possibly, for updates, or for getting remote commands - and gathering information about the system it is executed on. When specific information about the system is collected, it sends it to a particular email address. According to MessageLabs, this particular attack does not fit any of the known patterns, and is likely to be from a new group of criminals entering the field of electronic industrial espionage.{moscomment}
Get stories like this delivered daily - FREE - subscribe now
|
Tags
| < Next story in category | Previous story in the category > |
|---|
