|
|
Security Watch: Squatters Jumping Claims To Domain NamesDATE: 24-JUL-2006 Security Alerts and UpdatesA new attack has been identified based on last week's Top Threat, a zero-day vulnerability in PowerPoint.The nature of the attack points to use as a pinpoint corporate espionage tool. A report by Symantec indicates that a Trojan named Trojan.Riler.F is installed by malicious code in a PowerPoint file as an LSP (Layered Service Provider), which is a special type of network driver that allows features to be added to the Winsock interface without replacing any existing files.The attack creates these two files:- %System%\SNootern.dll
- %System%\uidmngr.ini
It then installs SNootern.dll as an LSP and creates this registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9 Then it opens a back door on the system by connecting the soswxyz.8800.org and johnmy66.vicp.net on TCP port 7128. It then listens and awaits commands from a remote attacker. This attack has been found only in very specific organizations, indicating that it is being used in a targeted attack and is not yet in the wild. But look for more of these to appear soon.
|
|
|
Data Protection Virtual Tradeshow
Available On-Demand
Join Cameron Crotty and experts as they explore best practices and solutions needed to maintain a secure flow of data.
|
|
|
