AOH :: ISN-1099.HTM

Fake Microsoft security alert includes Trojan patch

Fake Microsoft security alert includes Trojan patch
Fake Microsoft security alert includes Trojan patch,10801,102907,00.html 

By Robert McMillan
JUNE 30, 2005

A new wave of spam that disguises itself as a Microsoft Corp. security
bulletin contains a link to malicious software that gives attackers
complete access to the infected machine, security researchers are

The e-mail, which began circulating late Tuesday, identifies itself as
Microsoft Security Bulletin MS05-039, and offers a link to what it
claims is a patch against the Sober Zafi and Mytob worms.

In fact, there is no such thing as Microsoft Security Bulletin
MS05-039, and real Microsoft security bulletins offer links to a
Microsoft download site, rather than to the patches themselves, said
Mikko Hypponen, director of antivirus research at F-Secure Corp.

The phony patch is a variant of the SDBot Trojan software, which is at
present not detected by antivirus software products, according to a
report from security research firm WebSense Inc.

The risk of someone downloading this Trojan appears to be very low
right now, because the server hosting the Trojan downloads no longer
appears to be active, Hypponen said. That server, which appeared to be
hosted by Internet Services Inc., apparently has
exceeded its allowed bandwidth, he said.

"I think this particular case is not going to be a problem anymore,
but nevertheless I think it was a fairly interesting case," Hypponen
said. "I wouldn't be surprised to see more of this happening."

The Swen e-mail worm, which began circulating in 2003, used a similar
technique, he said.

Attend the Black Hat Briefings and
Training, Las Vegas July 23-28 - 
2,000+ international security experts, 
10 tracks, no vendor pitches. 

Site design & layout copyright © 1986-2014 CodeGods