Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: First WMF mass mailer ItW (phishing Trojan)
From: Lance James <bugtraq () securescience net>
Date: Fri, 17 Feb 2006 11:02:45 -0800

Gadi Evron wrote:
The first worm (mass mailer) to (ab)use the WMF 0day is now spreading in
Respectfully speaking:

There are a few corrections to this that need to be expressed.

The language you're using describing it as a mass-mailing worm is coming
off confusing to some. The WMF exploit is actually seeded on a website,
and the mass-mailing is used to get people to go to that site. Stating
that it's a worm is similar to saying that phishing emails and spam are
worms. I have seen some actual phishing worms, and this is definitely
not it.

A correction also needs to be made on this comment

"Abusing websites is mostly how WMF is
exploited, but no much in the way of emails before today."

This is grossly incorrect - here are the dates we started seeing this

January 3rd -  WMF exploit distributing identified phishing trojan
January 9/10th -  WMF exploit distributing identified phishing trojan
Jan 18th/19th - WMF exploit distributing identified phishing trojan
Jan 22nd-25th - WMF exploit distributing identified phishing trojan
Jan 24th - WMF exploit distributing identified phishing trojan

I can go into February but we get the point.

This same phishing group works in regions, so it's not surprising that
they are now targeting Australia. They are also targeting Europe as well
in February.

WMF Mass-Mailing phishing has not been uncommon, just in small
distributions, so it may have not been seen on the radar. Since the
public discovery of the WMF exploit, there have been a few mass-mailings
taking users to a site that distributed WMF exploits to date.

Best Regards,
Lance James
Secure Science Corporation
Author of 'Phishing Exposed'

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]