eLatta, LLC AntiVirus Information and Risk

AntiVirus Links

Active Content | Buffer Overflow | Shell Script | Trojan Horse | Web Bug | AntiVirus Links

Virus Treat List, the list provides a synopsis of the latest virus-related threats discovered by Symantec™ Security Response, including information on: Category Rating (risk), Name of Threat (threat), the day on which the threat was identified (discovered), and the day on which a virus definition was added to protect against the threat (protection). Please click on the Virus Threat List for additional information or check out the Virus Calendar.

Removal Tools, viruses have become increasingly complex and virus infections involve more system elements than ever before. Symantec™ Security Response has developed tools to automatically conduct what would often amount to extensive and tedious manual removal tasks. If your system has become infected, the tools listed here should aid you in repairing the damage.

Hoax Page, Symantec™ Security Response uncovers hoaxes on a regular basis. These hoaxes usually arrive in the form of an email. Please disregard the hoax emails - they contain bogus warnings usually intent only on frightening or misleading users. The best course of action is to merely delete these hoax emails. Please refer to this page whenever you receive what appears to be a bogus message regarding a new virus, or promotion that sounds too good to be true.

Joke Page, the jokes listed here will not perform any malicious action on your computer. Each of them is a joke program. Joke programs are programs which attempt to display something humorous or only pretend to perform a malicious action. Though often annoying, these jokes are not dangerous.

Attacks to Your Computer System

Active Content attacks, which take advantage of various active HTML and scripting features and bugs.

These types of attacks are aimed at people who use a web browser or HTML-enabled email client to read their email, which is a very large portion of the global community. Typically these attacks attempt to use the scripting features of HTML or of the email client (typically Javascript or VBScript) to retrieve private information from the victim's computer or to execute code on the victim's computer without the victim's consent (and possibly without the victim's knowledge). Less dangerous forms of these attacks can automatically cause the recipient's computer to display some content the attacker wishes, such as automatically opening an advertising or pornography web page when the message is opened, or perform a Denial-of-Service attack on the recipient's computer through code that freezes or crashes the browser or the entire computer.

Note: The simplest way to completely avoid such attacks is to not use a web browser or HTML-enabled email client to read your email.

But in the real world in which we live today, you would be hard pressed not to use a web browser or email. It may also be possible to configure your email client to turn off the interpretation of script code. See your program documentation for details. Turning off scripting in your email client is strongly recommended (there is no good reason to support scripting in email messages). An HTML-enabled email client on a Macintosh is just as vulnerable to active-HTML email attacks as an HTML-enabled email client on Windows or Unix. The vulnerabilty will vary from system to system based on the email client rather than the operating system.

Microsoft Outlook users should visit this page that describes tightening down Outlook's security settings.

Buffer Overflow attacks, where the attacker sends something that is too large to fit into a fixed-size memory buffer in the email client, in the hopes that the part that doesn't fit will overwrite critical information rather than being safely discarded.

Definition: A buffer is a region of memory where a program temporarily stores data that it is processing. If this region is of a predefined, fixed size, and if the program does not take steps to ensure that data fits within that size, there's a bug: if more data is read than will fit within the buffer, the excess will still be written, but it will extend past the end of the buffer, probably replacing other data or program instructions.

A buffer overflow attack is an attempt to utilize this weakness by sending an unexpectedly long string of data for the program to process. These attacks can be used as Denial-of-Service attacks, because when a program's memory gets randomly overwritten the program will generally crash. However, by carefully crafting the exact contents of what overflows the buffer, it is in some cases possible to supply program instructions for the victim's computer to execute without the victim's consent. The attacker is mailing a program to the victim, and it will be run by the victim's computer without asking the victim's permission.

Note: That this is the result of a bug in the program under attack. A properly written email client will not allow random strangers to run programs on your computer without your consent. Programs subject to buffer overflows are incorrectly written and must be patched to permanently correct the problem.

Patches for Outlook are available via the Microsoft security site.

Shell Script attacks, where a fragment of a Unix shell script is included in the message headers in the hopes that an improperly-configured Unix mail client will execute the commands.
Another attack on the user's privacy, but not on system security, is the use of so-called Web Bugs that can notify a tracking site when and where a given email message is read.

Note: Many programs running under Unix and similar operating systems support the ability to embed short shell scripts (sequences of commands similar to batch files under DOS) in their configuration files. This is a common way to allow the flexible extension of their capabilities.

Some mail-processing programs improperly extend this support for embedded shell commands to the messages they are processing. Generally this capability is included by mistake, by calling a shell script taken from the configuration file to process the text of some headers. If the header is specially-formatted and contains shell commands, it is possible that those shell commands will get executed as well.

Trojan Horse attacks, where an executable program or macro-language script that grants access, causes damage, self-propagates or does other unwelcome things is mailed to the victim as a file attachment labeled as something innocuous, such as a greeting card or screen saver, or hidden in something the victim is expecting, such as a spreadsheet or document.

These attacks are usually used to breach security by getting a trusted user to run a program that grants access to an untrusted user (for example, by installing remote-access back door software), or to cause damage such as attempting to erase all of the files on the victim's hard disk. Trojan Horses can act to steal information or resources or implement a distributed attack, such as by distributing a program that attempts to steal passwords or other security information, or may be a "self-propagating" program that mails itself around (a "worm") and also mailbombs a target or deletes files (a "worm with an attitude").

Note: The "I Love You" worm is an excellent example of a Trojan Horse attack: a seemingly-innocuous love letter was actually a self-propagating program.

For this attack to succeed the victim must take action to run the program that they've received. The attacker can use various "social engineering" methods to convince the victim to run the program; for example, the program may be disguised as a love letter or joke list, with the filename specially constructed to take advantage of Windows' propensity for hiding important information from the user.

Most people know that the .txt extension is used to indicate that the file's contents are just plain text, as opposed to a program, but Windows' default configuration is to hide filename extensions from the user, so in a directory listing a file named textfile.txt will appear as just "textfile" (to avoid confusing the user?).

Note: An attacker can take advantage of this combination of things by sending an attachment named "attack.txt.exe" - Windows will helpfully hide the .exe extension, making the attachment appear to be a benign text file named "attack.txt" instead of a program. However, if the user forgets that Windows is hiding the actual filename extension and double-clicks on the attachment, Windows will use the full filename to decide what to do, and since .exe indicates an executable program, Windows runs the attachment. Blam! You're owned.

Typical combinations of apparently-benign and dangerously-executable extensions are:

xxx.TXT.VBS: an executable script (Visual Basic script) masquerading as a text file
xxx.JPG.SCR: an executable program (screen saver) masquerading as an image file
xxx.MPG.DLL: an executable program (dynamic link library) masquerading as a movie

Note: This attack can be avoided simply by not running programs that have been received in email until they have been checked over, even if the program seems to be harmless and especially if it comes from someone you don't know well and trust.

*** Double-clicking on email attachments is a dangerous habit. ***

Bugs in the email client or poor program design may allow the attack message to automatically execute the Trojan Horse attachment without any user intervention, through either the use of active HTML, scripting or buffer overflow exploits included in the same message as the Trojan Horse attachment or a combination of these. This is an extremely dangerous scenario and is currently "in the wild" as a self-propagating email worm that requires no user intervention for infection to occur. You can be sure that this won't be the only one.

Another channel for Trojan Horse attacks is via a data file for a program that provides a macro (programming) language, for example, modern high-powered word processors, spreadsheets, and user database tools.

If you cannot simply discard attachments that may put you at risk, it is recommended that you install anti-virus software (which detects and disables macro-language Trojan Horses) and that you always open data file attachments in the program's "do not automatically execute macros" mode (for example, by holding down the [SHIFT] key when double-clicking the attachment).

Note: If your system administrator (or someone claiming to be your system administrator) emails you a program and asks you to run it, immediately become very suspicious and verify the origin of the email by contacting your administrator directly by some means other than email. If you receive an attachment claiming to be an operating system update or antivirus tool, do not run it. Operating system vendors never deliver updates via email, and antivirus tools are readily available at the antivirus vendor websites.

Web Bug privacy attacks, an HTML email message can refer to content that is not actually within the message, just as a web page can refer to content that is not actually at the website hosting the page.

This can commonly be seen in banner ads on a website at http://www.geocities.com/ for example that may include a banner ad that is retrieved from a server at http://ads.example.com/ when the page is rendered, the web browser automatically contacts the web server at http://ads.example.com/ and retrieves the banner ad image. This retrieval of a file is recorded in the server logs at http://ads.example.com/, giving the time it was retrieved and the network address of the computer retrieving the image.

Applying this to HTML email involves putting an image reference in the body of the email message. When the mail program retrieves the image file as part of displaying the mail message to the user, the web server logs the time and the network address of the request. If the image has a unique filename, it is possible to determine precisely which email message generated the request. Typically the image is something that won't be visible to the message recipient, for example an image that consists of only one transparent pixel, hence the term Web Bug it is, after all, intended to be "covert surveillance".

Note: It is also possible to use a background sound tag to achieve the same result.

Telephone: 203.439.4300