Malware targets OpenOffice users
Malware miscreants have crafted a cross-platform worm targeted at OpenOffice users that's capable of infecting Windows, Mac, and Linux computers.
The OpenOffice/StarBasic macro worm, dubbed BadBunny, is a proof-of-concept worm that's not been seen outside the lab. Most anti-virus firms describe it as a low-risk threat.
OpenOffice users are liable to get infected if they open an OpenOffice Draw file called badbunny.odg. If open, the file downloads and displays a pornographic jpg image of a man dressed as a rabbit making the beast with two backs with a scantily clad woman in a woodland setting.
How very fur-verted.
The dropped XChat and mIRC scripts are used to replicate in an attempt to distribute the virus. Sections of the code also attempt to knock out access to anti-virus websites.
The malware was writen by the d00mriderz VX team, a group that's written StarOffice malware in the past. The Stardust virus, created by the same group in May 2006, tried to download a picture of porn star Silvia Saint. BadBunny is the most complex sample of such malware to date and the first that attempts to infect multiple system platforms, at least in theory.
"The hackers have written plenty of StarBasic malware in the past, but the most 'in the wild' this one is likely to get is by displaying a picture of a furvert in the woods," said Graham Cluley, senior technology consultant for Sophos.
"This is old-school malware - seemingly written to show off a proof of concept rather than a serious attempt to spy on and steal from computer users. A financially motivated hacker would have targeted more widely used software and not incorporated such a bizarre image." ®
Doug hit it right on the head. This does not even exploit a vulnerability, any macro-enabled system can be abused, but unless you've lowered your security level for macros, you have to tell OOo to let it run. I myself always put OOo's macro security to "high," to stop the other idiot users from doing something exactly like this.
Feeling Left Out
I Use OpenOffice on Solaris ...
I'm feeling a little left out ... Since it was Sun who released the source code and started the project in the first place, and since Solaris is their OS ...
I feel really let down now, i'll just have to install windows ...
OK, let's assume I ran a Linux box and I happened to be unexpectedly sent an unidentified porn pic in .odg format. What would I do? I'd log out as a user and log in as root to open it (with things to configured to allow Perl scripts to run unchecked from user files in my home directory). And, of course, I'd first make sure I'd installed the XChat IRC client and got it running. So I'd be fucked. And, frankly, I'd deserve to be. In fact, I'd deserve to be condemned to use Windows Vista for the rest of my life.
We're told this by whom? A senior techie at Sophos? And what does Sophos sell?
Call me a cynic ...