http://www.linuxinsider.com/perl/search ... everythingThe most recent threat to be circulated is called the Dropper-KG, which takes the form of a software installer that includes a copied version of a freeware World Cup results-tracking spreadsheet, lending it an air of legitimacy.
"A link may direct you to a less than reputable site which is looking to exploit vulnerabilities such as that recently found in Internet Explorer. If the user hasn't got the latest patch, their PC could become infected just by looking at a picture,"
http://www.eweek.com/article2/0,1895,1959084,00.aspWorld Cup Virus Season Kicks Off
By Matt Hines
May 8, 2006
Researchers at UK-based Sophos released notification of a new attack that infects Microsoft Excel files and has been disguised as a spreadsheet charting the national teams participating in the World Cup.
Identified by the security company as XF97/Yagnuul-A, the virus lives in an Excel file that offers to help people set up fantasy sports competitions related to the international soccer championship, and also attempts to market itself specifically to fans of the English Premiership, one of the world's top professional leagues.
Once the World Cup virus has infected a PC, it begins forwarding itself to other people using the corrupted machine and may also send itself to people listed in any e-mail client software on the device, Sophos said.
The Excel virus marks the second World Cup-oriented attack identified by the company in the last week. On May 4, Sophos detailed a Trojan virus dubbed Troj/Haxdoor-IN, which cloaked itself as a wall chart of the teams competing in the tourney that fans could print out and use to follow the action.
he threat was noticed as it was distributed via spam e-mail, and while it specifically targeted speakers of German, the virus could easily be adapted to other languages, researchers said.
As in the United States, where large amounts of office workers wager on the NCAA's Men Basketball Championship by joining related Web sites or filling out electronic forms, soccer fans abroad are increasingly creating their own leagues for following the World Cup, said Graham Cluley, senior technology consultant at Sophos.
"The hackers know that people are rabid for information to follow their favorite team in the tournament and that many will be at work, where they won't be able to watch live on TV and could fall prey to this sort of attack," said Cluley.
"People have become suspicious about opening a file that appears to be a revealing picture of a celebrity, but when it comes to something like sports, some people may still let their guard down out of curiosity."
PointerClick here to read about how Oracle is keeping customers waiting for security patches.
Attempts by hackers to take advantage of the wide appeal of the World Cup, which is held once every four years, are nothing new, Cluley said.
Sophos has tracked threats tied to the event since as far back as 1998. And there is also reason for hackers to believe that they could succeed using such ploys, as the Sober.n worm virusâ€â€which misrepresented itself as an opportunity for people to buy tickets to the World Cupâ€â€was one of the most widespread computer attacks of 2005 worldwide.
In addition to the sheer number of soccer fans around the globe interested in World Cup-related information, Cluley said that the event is also likely to draw many new Internet users and people in developing nations where anti-malware programs are less widely used, both of which could help the threat lure in more victims.
eSeminarsZiff Davis Media eSeminars invite: Join us on May 11 at 2 p.m. ET to learn critical best practices for e-mail and instant messaging applications, including tips on "hygiene" from Gartner.
For enterprises, the key is making sure that employees are vigilant about security threats at all times, regardless of what they may be crafted to look like, according to Cluley, who said that some companies have even begun e-mailing fake attacks to their workers just to monitor who may be easily coerced into opening suspicious messages or attachments.
"Whether it's a new TV series or some horrible natural disaster, the virus writers are quickly jumping on whatever hot news story is out there because they know a lot of people will be looking," Cluley said.
"Businesses don't need to send out a reminder to warn employees every time there's an earthquake or a big soccer match, but it should serve as an incentive to keep their systems protected and actively educate workers on what sorts of behavior to avoid."
PointerCheck out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.
The FIFA World Cup 2006 tournament won't get underway in Germany until early June, but computer virus writers are already attempting to cash in on the planet's most popular sporting event with viruses aimed at deceiving eager soccer fans.
http://www.sophos.com/pressoffice/news/ ... oorin.html4 May 2006
World Cup wallchart Trojan horse spammed out by hackers
Sophos customers protected through proactive protection
Experts at SophosLabsâ„¢, Sophos's global network of virus, spyware and spam analysis centers, have warned users about a Trojan horse that poses as a wallchart for the soccer World Cup tournament due to take place in Germany this summer.
The Troj/Haxdoor-IN Trojan horse has been spammed out to computer users via a link in a message offering a free wallchart for fans who wish to follow their favorite teams in the international football tournament. If PC users are tempted into running the malicious program they risk allowing hackers to gain access to their computer for criminal ends.
All examples of the emails seen so far have been in the German language, but there is no reason to believe that hackers will not switch to using other languages to increase their pool of potential victims.
The emails claim to offer a World Cup wallchart.
"The World Cup is one of the biggest sporting events of the year, and fans all over the globe will be following their national team avidly," said Graham Cluley, senior technology consultant for Sophos. "Malware authors are playing on interest in the tournament to try and infect as many people as possible, in an attempt to seize control, steal from, and spy on innocent users' computers."
Sophos's proactive technology was capable of detecting the Trojan horse (naming it as Troj/Haxdor-Fam), defending customers' computers without requiring an update.
Sophos experts report that this is not the first time that hackers have taken advantage of the World Cup competition.
A year ago, the Sober-N worm offered tickets to the tournament in an attempt to entrap unprotected users.
In 2002, the VBS/Chick-F virus tried to exploit workers desperate to find out the latest scores from the World Cup in S Korea/Japan.
In 1998, in the run-up to the World cup competition in France, another football-inspired virus asked infected victims to gamble on who the winner might be, and if the user did not choose the right team triggered a warhead which was capable of wiping all the data off the hard drive.
"It would be no surprise at all if more malware was written as the World Cup rapidly approaches," continued Cluley. "Everyone should be careful not to fall foul of football-related viruses and Trojan horses, as well as soccer-related spam and lottery scams."
Companies are recommended to protect their email with a consolidated solution to thwart the virus, spyware and spam threats and secure their desktops and servers with automatically updated anti-virus protection.
About Sophos
Sophos is a world leader in integrated threat management solutions, developing protection against viruses, spyware, spam and policy abuse for business, education and government. Sophos's reliably-engineered, easy-to-operate products protect more than 35 million users in more than 150 countries. Through 20 years' experience and a global network of threat analysis centers, the company responds rapidly to emerging threats - no matter how complex - and achieves the highest levels of customer satisfaction in the industry.
