On Mon, 22 May 2006 13:46:26 +0100, Roy Schestowitz wrote:
> Following the Symantec Advisory from Saturday, this severe Word hack is
> already being exploited.
>
> Hackers have developed malicious code designed to exploit an
> unpatched vulnerability in Microsoft Word 2002 and 2003.
This, as with nearly 100% of all malware, is only a problem if
intended victim is logged on under an account that has admin rights.
You'd be hard pressed to find any malware that is capable of any serious
damage that doesn't assume the user has admin rights. If that assumption
turns out to be invalid most malware falls flat on it's face and is
rendered relatively harmless.
Look at what this latest word/excel document exploit tries to do:
*************************************************************************
technical details
When Backdoor.Ginwui is executed, it performs the following actions:
1. Creates the following files:
* %System%\Winguis.dll
* %System%\drivers\IsPubDRV.sys
* %System%\drivers\RVdPort.sys
* %System%\drivers\DetPort.sys
2. Adds the following registry entry:
"AppInit_DLLs" = "%System%\Winguis.dll"
to the registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
so that it is executed every time Windows starts:
3. Creates the following Mutex:
Global\\GUI40ServiceStart
4. Hooks the following APIs to hide itself:
# EnumProcessModules
# GetModuleFileNameExW
# Module32NextW
# FindFirstFileW
# FindNextFileW
# AllocateAndGetTcpExTableFromStack
# AllocateAndGetTcpTableFromStack
# InternalGetTcpTable
# GetTcpTable
# EnumServicesStatusA
# EnumServicesStatusW
# RegEnumKeyA
# RegEnumKeyW
# RegEnumKeyExA
# RegEnumKeyExW
# RegEnumValueA
# RegEnumValueW
# RegSetValueExA
# RegSetValueExW
# RegQueryValueExA
# RegQueryValueExW
***********************************************************************
All of those things will fail if attempted as a regular user. So how
is the machine going to get infected if the word document is opened by a
normal user?
And don't tell me that Windows machines aren't "useable" unless you log on
as admin, it's simply not true, and can't be supported with specific real
world examples.
--
Regards
T.G. Reaper
|
|
