Blowing up a Storm for Valentine's Day

Stephen Withers
Thursday, 17 January 2008 10:06

Your IT - Home IT

Security vendors are warning of a fresh outbreak of the Storm (Dorf) Trojan using romantic themes ahead of Valentine's Day.

Subject lines include "Falling In Love with You", "Special Romance", "You're In My Thoughts", "Sent with Love", "Our Love Will Last", "Our Love is Strong", "Your Love Has Opened", "You're the One", "A Toast My Love", "Heavenly Love", "Memories of You", "Pages from My Heart", "Eternal Love" and "A Dream is a Wish".

The body contains another phrase from the list of subject lines, plus a URL containing a numeric IP address pointing to a computer that has already become part of the botnet. If the recipient is foolish enough to click on the link, he or she is taken to a web page that displays a heart and attempts to download malware onto their PC.

"This heart attack has been spammed out on a huge scale by an organised gang hell-bent on stealing access to your PC for criminal purposes. It seems the hackers were too impatient to wait for St Valentine's Day this year before plucking on heart strings in their attempt to infect the unwary," said Graham Cluley, senior technology consultant at Sophos. "People will be truly love sick if they let the malicious code run on their PC."

PC Tools’ chief threat officer Kurt Baumgartner said a similar campaign occurred last year. "Interestingly, we witnessed a variant of the worm dropping files like burito.ini and burito5e84-1216.sys before killing anti-virus products and adding the victim's computer to its botnet," he said.

"The ini file maintains a list of p2p peer information for maintaining communication throughout the botnet, while the sys file is a driver that injects code deep into the operating system," explained Baumgartner.

Symantec senior security response engineer Hon Lau said "I feel that this campaign has started a little bit too early. Maybe the Peacomm creators feel that they need a head start this time, since they started a bit late on their Christmas 2007 campaign."