Friday, January 19, 2007

Beware the Storm Worm

Over the last few days we have suffered some severe weather in the UK, yesterday was truly horrendous with winds of up to 99 miles per hour causing 11 deaths, many injuries and millions of pounds worth of damage.

If that wasn't bad enough, it seems that the bad guys took advantage of this and sent out a mass email attack with a trojan horse attatchment with the subject line, "230 dead as storm batters Europe."

As reported by TechRepublic;

"Storm Worm," one of the larger Trojan horse attacks in recent years, is baiting people with timely information about a deadly, real-life storm front, security researchers said Friday.

Over an eight-hour period Thursday, malicious e-mails were sent across the globe to hundreds of thousands of people, said Mikko Hypponen, chief research officer for F-Secure.

People who open the attachment then unknowingly become part of a botnet. A botnet serves as an army of commandeered computers, which are later used by attackers without their owners' knowledge.

Storm Worm carries the subject line "230 dead as storm batters Europe," Hypponen said, noting the unusual twist to the e-mail.

"The e-mail was started 15 hours ago, when the storm was peaking in Central Europe," Hypponen said. "This is unusual in that it was very timely."

Storm Worm is a Trojan horse with an executable file as an attachment. Cybercriminals took advantage of social engineering, using the news of the European storm to get people to open the attached malicious file, which promises more news on the weather emergency. The recipient must open the file for it to execute.

The file creates a back door to a computer that can be exploited later to steal data or to use the computer to post spam.

Email to watch out for;

Subject
230 dead as storm batters Europe
U.S. Secretary of State Condoleezza Rice has kicked German Chancellor Angela Merkel
A killer at 11, he''s free at 21 and kill again!
British Muslims Genocide

Attachment
Read More.exe
Full Clip.exe
Full Story.exe
Video.exe


0 comments:

Sitemeter