PowerPoint overtakes Word as most common virus exploit vector

Stan Beer
Sunday, 22 April 2007 16:02

Your IT - Home IT

For the first time, PowerPoint has emerged as the most common exploit vector for email viruses, according to a new report from a messaging security vendor.

The result of March 2007 data gathered by MessageLabs was likely driven by the large number of attacks perpetrated by one gang using the same attack file, mostly originating from an IP address within Taiwan, according to the company. Achieving notoriety as a carrier of typical email viruses, .exe files only accounted for 15% of the targeted attacks, while the more familiar Microsoft Office suite accounted for 84% of targeted attacks in March 2007.

According to MessageLabs, other characteristics of these attacks include that they are typically timed to arrive during the busy workday and rarely over a weekend and most commonly target these five industry sectors: electronics, aviation, public sector, retail and communications.  

“The bad guys know which organizations have data worth stealing and are picking them out one by one,” said Alex Shipp, Senior Anti-Virus Technologist, MessageLabs. “These targeted attacks are highly difficult to detect as the large majority consist of a single email to one individual, which means they never have anti-virus signatures created by traditional anti-virus software. However, if you happen to be that one company targeted the impact could be devastating.”

Some cyber-criminals continue to use the same attack file relentlessly. One gang has used the same two attack files since November 2006 and in March the gang used these files 151 times, making them one of the highest profile gangs responsible for more than 20% of all targeted attack emails.

The attack is launched by execution of an index.exe file from an IP address that belongs to China United Telecommunications Corporation. Once downloaded, the file gives the attacker complete control over the PC. Detection of this exploit was minimal, with only five anti-virus companies recognizing the exploit.