World Cup-themed PDF attack kicks off
Poisoned guide spotted
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Miscreants have booted a World Cup-themed email malware attack onto the web, taking advantage of existing material on the tournament.
Booby-trapped emails are doing the rounds, posing as messages from African Safari organiser Greenlife. The emails contain an attached PDF file claiming to provide a guide to the first African edition of football's most prestigious tournament.
In reality, the attachment payload takes advantage of a recently patched Adobe Reader vulnerability (involving the handling of TIFF files and resolved with a patch on 16 February) to drop malware into machines running an unpatched version of Adobe reader.
Hackers behind the attack have taken Greenlife's genuine guide (available on its website) and inserted exploit code instead of content related to this June's tournament and travel in South Africa.
The poisoned version of the guide was sent to an unspecified "major international organisation", email filtering outfit MessageLabs reports. The Symantec-owned hosted security operation adds that successful execution of the attack drops a rootlet and a backdoor Trojan on compromised machines, as explained in a detailed write-up here. ®
COMMENTS
Pointless Document Format
or Problematic Document Format - but never ever Portable -how did they manage to sell that lie to so many?
PDF Viewers
If you don't want to use Arobat, use xpdf,evince or one of the following:
http://en.wikipedia.org/wiki/List_of_PDF_software
Also, NEVER, EVER run it as an Administrative user to open a document.
Symantec on the ball as usual
I read the published Symantec analysis...
"Next the malware does a DNS lookup on some subdomain of microsoft.com (e.g. wwwco2vip.microsoft.com), and then it receives some information from that page, we don’t know what that is."
Why not, where the packets encrypted?
"It looks like the malware also attempts to contact other machines on the same network, probably to try and propagate the threat."
"it looks like", " probably"
Are these the words of erudite professionals?
I could do better myself, for the right kind of incentive.
As for using the world cup as a potential earner...
It doesn't matter what the occasion, if a viable percentage of Internet users are interested in an event, news item or some celebrity gossip, then some criminal somewhere is going to, or is going to employ someone to exploit the situation.
This is more expected than news.
Yes, despite all the "protection" offered by AV vendors the only real defences are the wits of the end user.
Sorry to finish on such a negative note ;-)
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
