 |
|
|
| News archive about antivirus software, virus threats, trojans |
|
May 2006
Bogus Microsoft security warning leads to malware -- Posted by Igor_Donchenko on Wednesday, May 31 2006
Experts at SophosLabs, Sophos's global network of virus, spyware and spam analysis centers, have warned of a spammed email campaign which claims to be security advice from Microsoft, but actually tries to encourage users to install a keylogger onto their computers.
The spammed emails, which purport to come from patch@microsoft.com, claim that a vulnerability has been found "in the Microsoft WinLogon Service" and could "allow a hacker to gain access to an unpatched computer".
Recipients are advised to click on a link in the email to download the patch. However, the link really points to a non-Microsoft website and initiates the download of the Troj/BeastPWS-C Trojan horse, which is capable of spying on the infected user and stealing passwords.
From: Microsoft <patch@microsoft.com>
Subject: Microsoft Winlogon Service - Vulnerability Issue
Message:
Microsoft Coorporation
A new vulnerability has been discovered in the Microsoft WinLogon Service, that would allow an attacker to gain access to an unpatched computer.
Since your email is part of our private mail lista and you have successfully registrated your Microsoft Windows, you can download the patch to fix this vulnerability before others do.
Plese click the link below to download the patch and protect your computer against WinLogon attacks:
http://www.microsoft.com/patches-winlogon-critical/ winlogon_patchV1.12.exe
You are free to share this with all your friends and relatives that are using Microsoft Windows Operating System.
Thank you
Microsoft Coorp.
Microsoft Coorp.
When first installed the Trojan horse displays the following bogus message
Microsoft WinLogon Service successfully patched.
but is secretly logging keystrokes and sending them to an email address belonging to the hacker.
"People are slowly learning that Microsoft does not email out security fixes as attachments, but they also need to learn to be careful of blindly clicking on links to download fixes too without checking that the email is legitimate," said Graham Cluley, senior technology consultant at Sophos. "In this case, the hackers made a mistake by referring to 'Microsoft Coorp' rather than 'Microsoft Corp', but its possible that users would miss that typo in their rush to protect themselves."
Sophos recommends that users visit Microsoft's website at www.microsoft.com/security for information about Microsoft security patches.
"The hackers are playing a dangerous game, because if Microsoft finds out who is responsible for besmirching their name in this way they are likely to throw the full force of the law at them," continued Cluley. "Security is becoming a hot topic for the software giant, and they don't want malware and spam to sully the company's public image through this kind of criminal activity."
Source: www.sophos.com
|
|
