Taking advantage of international concern regarding the daily
demonstrations in Burma, IT security and control firm Sophos has
cautioned computer users to be wary of a malicious email which
claims to be a message of support for monks and other protesters in
Burma from the Dalai Lama. In reality, however, it carries a
malicious attack designed to infect the recipient's PC.
The email reads as follows:
Dear Friends & Colleagues, Please find enclosed a
massage from His Holiness the Dalai Lama in support of the recent
pro-democracy demonstrations taking place in Burma. This is for
your information and can be distributed as you see fit.
Best wishes.
Tenzin Taklha
Joint Secretary
Office of His Holiness the Dalai Lama
When users open the attached document (filename: hhdl
burma_001.doc), it attempts to exploit a Word vulnerability
which in turn tries to drop a Trojan horse onto the victim's PC.
Sophos proactively detects the malicious document as Exp/1Table-B and the
Trojan it tries to install as Agent-CGU.
Sophos experts note that to add even more credibility to the
message and to encourage a greater number of victims to open the
attachment, a link to official website of the Dalai Lama was
included.
The email links to the genuine Dalai Lama
website in an attempt to look more credible.
"The Burmese regime is said to have tried to stop news from
coming out of the country by shutting down internet cafes and
controlling computer users' access to the net. People around the
world are hungry to hear about the latest situation in the country
and support the pro-democracy movement, and may be tempted to read
this so-called letter from the Dalai Lama," said Graham Cluley, senior
technology consultant at Sophos. "Using topical news stories to
trick unwary computer users into opening and downloading malicious
code is one of the oldest tricks in the book, but it's obviously
still working or the hackers wouldn't waste their time on it. We
should all use our common sense and question the legitimacy of
emails sent out of the blue."
Sophos recommends companies protect themselves with a consolidated solution which can control network access and defend
against the threats of spam, hackers, spyware and viruses.
The latest in a long line of political malware
Sophos experts note that this is not the first time that viruses
and Trojan horses have been connected with political events:
W32/Deadcode-A
Displayed a nationalistic message associated with a Serbian
politican.
W32/Mirsa-A
Spread a message in support of the "Fathers 4 Justice"
campaign.
W32/Maslan-C
Disguised as pictures of a nude glamour model, this virus launched
a series of denial-of-service attacks on websites run by Chechen
rebel separatists.
W32/Zafi-C
Attacked the website of the newly appointed Hungarian Prime
Minister.
W32/Zafi-B
Calls for the introduction of the death penalty in Hungary.
W32/Cycle-A
Complained about the quality of life in Iran.
W32/Zafi-A
Displays a message calling for Hungarian patriotism, timed to
coincide with the country joining the European Union.
W32/Quaters-A
Launches a scathing attack on British Prime Minister Tony Blair and
attempts to knock the Downing Street website off the internet.
W32/Colevo-A
Redirects the web browsers of infected computers to a variety of
pictures of Evo Morales, leader of the Bolivian coca leaf growers'
union and runner-up in 2002's presidential elections.
W32/Vote-A
Calls for a vote on whether America should go to war against the
followers of Islam.
W32/Yaha-Q
Apparently written in response to attacks on Indian websites, this
worm not only attempts to launch a denial of service attack against
five Pakistani websites, but also contains a number of inflammatory
messages directed at Pakistani hackers.
W32/Yaha-E
Launches a denial-of-service attack against a Pakistani government
website.
Mawanella worm (also known as
VBS/VBSWG-Z)
Displays a message describing the burning down of two mosques and
one hundred Muslim-owned shops in Mawanella, Sri Lanka.
Injustice
worm (also known as VBS/Staple-A)
Opens a number of pro-Palestinian websites and describes the
alleged murder of a 12-year-old Palestinian child at the hands of
Israeli soldiers. In addition, the worm spams itself to members of
the Israeli government.
W32/Caric-A
Poses as a cartoon screensaver of former US President Bill Clinton
playing the saxophone. An item of female underwear emerges from the
bottom of the instrument.
Sophos is headquartered in Boston, US and Oxford, UK. More information is available at www.sophos.com.