New Phishing System Takes Advantage of JPEG Bug

New Phishing System Takes Advantage of JPEG Bug
( Page 1 of 2 )

Attack has not spread widely, but future variants could improve. Experts call methods sophisticated, including the use of an XML-based template file.Symantec Corp.s Threat Analyst Team has discovered an exploit in the wild that utilizes the recently announced JPEG vulnerability in Microsoft Corp.s GDI+ library to install a new and sophisticated phishing system.

eWEEK.com spoke with Oliver Friedrichs, senior manager of Symantec Security Response, who said the infected image is not able to attack a system from within Internet Explorer or Outlook, but only from within Windows Explorer, the file system browsing utility. Therefore, an attacker would likely need to entice a user to view the file from within the file system. Perhaps for this reason, Symantec says the spread of the attack is limited for now.

This was the most feared scenario for this vulnerability. Because of the nature of this particular attack, as a heap-based integer underflow vulnerability, implementations of the attack are likely to be specific to the application, perhaps even versions of the application, in which the image is viewed. Friedrichs says that it may not be possible to exploit the vulnerability from within Outlook or Outlook Express.

Resource Library:

Once the user views the infected JPEG image, named ducky.jpg, the exploit code launches and downloads a file named ll.exe from the site maybeyes.biz. This file is saved as y.exe in the c:\ directory and executed. y.exe then downloads a second file from maybeyes.biz, upd.exe, and saves it as divxencoder.exe in the %SYSTEMROOT% directory (usually c:\windows) and executes it. This file then injects a DLL file embedded in it into Windows explorer.exe.

eWEEK.com confirmed in testing that Symantec anti-virus programs detect the infected JPEG as Trojan.Ducky and the two executable files that follow it as Trojan.Spabot and Downloader.Trojan. Symantec recommends strongly that users apply the proper Microsoft patches in addition to running current anti-virus software.

Next page: How the phishing attack works.

>>> More Network Security & Hardware Articles          >>> More By Larry Seltzer