Olympics a target for Trojans
The world’s athletes and hackers now share a common focus – the Beijing Olympics. Whilst the athletes have a legitimate reason to concentrate on the Games, today’s hackers are using the 2008 Olympics for their own glory.
MessageLabs, a provider of messaging and web security services to businesses worldwide, has revealed research showing the frequency and locations of targeted Trojan attacks and the tools used to avoid detection.
In the last six months MessageLabs has intercepted 13 separate Olympic themed attacks, across several different data-rich industries. With legitimate-sounding e-mail subject titles such as "The Beijing 2008 Torch Relay" and "National Olympic Committee and Ticket Sales Agents", some attacks purport to be from the International Olympic Committee, based in Lausanne, Switzerland, however the reality is that all but one attack has been sent from an IP addresses within Asia-Pacific.
Targeted Trojans are usually aimed at specific individuals within an organisation with the purpose of infiltrating networks for corporate espionage. Each attack is usually small in numbers and often utilises social engineering techniques, such as personalisation, to persuade the recipient to open the e-mail and attachment.
Hackers are constantly shifting to new delivery formats to hide the sinister malware and to avoid detection by traditional anti-virus engines, as well as using harmless and common attachment types which are not blocked. In these instances, Microsoft Office Database (MDB) files, usually hidden within a ZIP file, are one of the latest formats to be used.
Once the MDB file has been downloaded the MDB exploit will drop an EXE file to the disk and steal data. MessageLabs predicts that in the coming year hackers will vary their use of formats even further with 1 Byte XOR Key, Multiple XOR keys and ROR, ROL, ADD and SUB formats to be exploited.
Alex Shipp, MessageLabs Senior Anti Virus Technologist and Imagineer, issues an ominous warning to businesses: "These attacks are highly targeted at organisations that have highly confidential and valuable data, such as military and government bodies.
"Presuming that you have not been targeted is not proof that you have not been. The malicious EXE file can remain undetected for several months, so it may be that your organisation has been penetrated and crucial information has already leaked. Businesses need to up their game and fortify themselves against a dangerous new breed of hacker, Hacker 3.0, who is prepared to stop at nothing to achieve their goal."
Loading ...