Feeds

An Outlook worm to jam NSA's Echelon

Well, sort of....

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

UK-based anti-virus outfit Sophos is reporting a new variant of the LoveBug Outlook worm which contains a large amount of hidden text, apparently designed to attract the US National Security Agency's Echelon spy satellite network and overload it.

Comments within the executable file include large swaths of text such as:

"NSA national security agency code PGP GPG satellite cia yemen toxin botulinum mi5 mi6 mit kgb .mil mil base64 us defence intelligence agency admiral diplomat alert! BATF," and so on.

As for social engineering, this worm looks like a total non-starter. The subject line reads, !!!; the body reads, :-) MuCuX...; and then there's an attached file: echelon.vbs. We don't expect it to get very far.

Which is sort of a pity, really; the author has a few pertinent observations to make and questions to ask, such as "Stop Violence Pentagon. Why are you testing your new weapons on iraq? You are trying to protect children from porn but you are also killing them and other innocent people in iraq... ...and another thing... why are you using echelon type stupid things to listen around...?"

Why indeed, many reasonable people will wonder.

The virus was "written By Extirpater and beyin. (i am NOT from iraq, and not protecting iraq/islamic anyway)."

After introducing themselves, the authors then suggest, "hey others, lets fl00d the echelon..." and from there the whole slew of keywords commences.

These are believed to initiate an Echelon snoop session; but as we reported back in 1999, it's likely that Echelon relies on pattern-recognition rather than dictionaries, so loading millions of e-mails with tantalizing keywords really won't attract the machinery and bring the system down.

The new Outlook worm is also mildly destructive, and will over-write MP2 and MP3 files and .jpeg files by modifying their extensions; and, like the LoveBug which it resembles, mail itself to everyone on a victim's address list.

Also, "if the worm determines that mIRC (Internet Relay Chat) is installed on the system it will drop a mIRC script that will send the worm on via mIRC," Sophos says.

The company says they've had only one report of the worm in the wild, which is hardly a surprise considering its weak inducements to open the attachment.

Still, it's an amusing piece of work, if not much of a threat. And anyone who fears they might just be stupid enough to activate the attachment of an e-mail bearing the message, :-) MuCuX... is welcome to download Sophos' latest definitions here. ®

Below is the full text of the file's comments, as reported by Sophos:

Written By Extirpater and beyin. (i am NOT from iraq, and not protecting iraq/islamic anyway) Stop Violence Pentagon. Why are you testing your new weapons on iraq? You are trying to protect children from porn but you are also killing them and other innocent people in iraq... ...and another thing... why are you using echelon type stupid things to listen around...?< Hey others, lets fl00d the echelon... .gov @ NSA national security agency code PGP GPG satellite cia yemen toxin botulinum mi5 mi6 mit kgb .mil mil base64 us defence intelligence agency admiral diplomat alert! begin pgp message cert HQ password secret information Shamil Basaev BATF Tactical information broadcasting service netsec DEA Ayman Al Zawahiri RADINT ETA Fort Meade explosive gun conspiracy primer detonator initiator unicos al amn al-askari cray arpanet node backdoor mi-6 mi-5 terrorism SSCI sairi islamic revolution assembly not for public private korea diplomat wiretap Usame bin Laden DF ZARK SERT VIP ARC S.E.T set ssl hezbollah hizbullah afiwc compusec M51 phsical security division MOSSAD DDos denial of sevice don't try to contact me astel DH breaking machine Xu Yongyue agent agents national infrastructure air command control facility nm info Lieutenant tactical defcon mortars rpg7 propellants defensive evasion boobytraps secure internet rsa uzi buy hrt hk33ke aks-74 galil arm detcord pmk40 silencers timing devices information security naval yard sao reno jics computer terrorism NAIA SAPM ASU ECHELON ASTS RSP ISS JDF NAAP RSO encryption ASWS USDOJ SAMU COSMOS DATTA e99ll bill clinton george bush nash asis seal team 3 MSEE M.P.R.I top secret mossberg sursat 5926 telint fraud analyzer b61-7 sbu err SO13 reojdykarna airframe 510 EuroFed Avi shelter Cryto AG IDP RHL MP5K-SD sniper gign exon shell masuda eada shs NSWF sabotage nitrate Counter terrorism RCMP CTU CQB CONUS BOP CID thief NCSA ISACA ASVC spook words flashbangs magnum resta 777 666 MD2 MD4 MDA 747 boing domestic disruption smuggle Z-200 Security Consulting Keyhole NABS Kilderkin covert video pathfinders oscor merlin ntt sl-1 sr-71 sr71 f117 f-117 cornflower TNT rdx amfo hmtd lead azide styphante ddnp nitrostarch mines grenades rockets fuses nitrocellulose c4 ambush sniping spoof sniff sniffing sniffer motorcade assassination jtf-6 psyops privacy

Build a business case: developing custom apps

More from The Register

next story
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Amazon says Hachette should lower ebook prices, pay authors more
Oh yeah ... and a 30% cut for Amazon to seal the deal
Philip K Dick 'Nazi alternate reality' story to be made into TV series
Amazon Studios, Ridley Scott firm to produce The Man in the High Castle
Nintend-OH NO! Sorry, Mario – your profits are in another castle
Red-hatted mascot, red-colored logo, red-stained finance books
Sonos AXES support for Apple's iOS4 and 5
Want to use your iThing? You can't - it's too old
Joe Average isn't worth $10 a year to Mark Zuckerberg
The Social Network deflates the PC resurgence with mobile-only usage prediction
Chips are down at Broadcom: Thousands of workers laid off
Cellphone baseband device biz shuttered
Feel free to BONK on the TUBE, says Transport for London
Plus: Almost NOBODY uses pay-by-bonk on buses - Visa
Twitch rich as Google flicks $1bn hitch switch, claims snitch
Gameplay streaming biz and search king refuse to deny fresh gobble rumors
Stick a 4K in them: Super high-res TVs are DONE
4,000 pixels is niche now... Don't say we didn't warn you
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.