Sunday, June 20, 2021

Large-Scale IM Virus Attack Feared

Security researchers are seeing the first signs of a large-scale
virus attack taking advantage of a known flaw in the way JPEG images are
processed in Microsoft Windows products.

Just days after warning
that proof-of-concept exploits were circulating, the SANS Internet Storm
Center (ISC) said it had received reports that a “GDIplus.dll” exploit
embedded on porn images was making the rounds on adult newsgroups.

Microsoft has already released a patch to fix the way GDI libraries
handle JPEG processing, and it released a scanning tool
to help detect the presence of products that
contain the GDI+ component and determine whether a security fix should
be applied.

In addition to adult images on Usenet, the ISC said it was
investigating reports that the profile feature in America Online’s AIM
instant messaging product was being used to entice users to view
malicious JPEG files.

The basic method is to attach GDI exploits to profiles on AIM. The
attacker then sends messages to get the user to go look at the user
profile that has a .JPEG with the GDIplus.dll exploit in it,” the Center
said in an advisory.

The exploit only uses the AIM user profile feature to propagate
itself and does not target any vulnerabilities in the AIM software.

Anti-virus firm Symantec has released advisories
for two Trojan Horse programs exploiting the GDI+ library flaw described
in Microsoft’s MS04-028
advisory.

Symantec has updated its virus definitions to protect from
Trojan Moo,
which has been programmed to download an .EXE file from a Web
site. Symantec rates the Trojan Moo threat as “low.”

The company also warned that a backdoor Trojan exploiting the same
flaw was making the rounds. Symantec said the Trojan is capable of
connecting to a predefined IP address to start a command shell on an
infected system. A command shell allows an attacker to download and
execute harmful code from a predefined domain.

Removal instructions for the backdoor can be found
here
.

Similar articles

Latest Articles

3 AI Implementations That...

I was on a joint educational call for the World Talent Economic Economic forum on mobile computing this week. We drifted to topics that...

Survey of Site Reliability...

NEW YORK — Site reliability engineers (SREs) are warning of a looming scalability ceiling and saying the adoption of AIOps isn’t happening at a...

Druva Integrates sfApex to...

SUNNYVALE, Calif. — A maker of software for cloud data protection and management is helping companies safeguard essential customer data that their sales and...

Best Data Science Tools...

Data science has transformed our world. The ability to extract insights from enormous sets of structured and unstructured data has revolutionized numerous fields —...