"Virus from China the gift that keeps on giving"

[David Farber <dave () farber net>]

________________________________________
From: Steve Goldstein [steve.goldstein () cox net]
Sent: Thursday, March 27, 2008 11:51 AM
To: Dewayne Hendricks; David Farber
Subject: Article: "Virus from China the gift that keeps on giving"

Dewayne, Dave,

Not sure if this had already been posted on your lists.  I had tried to find it in my archives in order to respond to 
an article about digital photo frames in today's Washington Post 
(http://blog.washingtonpost.com/fasterforward/2008/03/getting_framed.html), and could not, so I found it on line and 
sent it in to the author.  If it has not appeared previously on your lists, please consider posting it as a service to 
your readers.  hanks,  --SteveG

========================================================
Virus from China the gift that keeps on giving
Deborah Gage, Chronicle Staff Writer
Friday, February 15, 2008

http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/02/15/BU47V0VOH.DTL&type=tech

An insidious computer virus recently discovered on digital photo frames has been identified as a powerful new Trojan 
Horse from China that collects passwords for online games - and its designers might have larger targets in mind.
"It is a nasty worm that has a great deal of intelligence," said Brian Grayek, who heads product development at 
Computer Associates, a security vendor that analyzed the Trojan Horse.
The virus, which Computer Associates calls Mocmex, recognizes and blocks antivirus protection from more than 100 
security vendors, as well as the security and firewall built into Microsoft Windows. It downloads files from remote 
locations and hides files, which it names randomly, on any PC it infects, making itself very difficult to remove. It 
spreads by hiding itself on photo frames and any other portable storage device that happens to be plugged into an 
infected PC.
The authors of the new Trojan Horse are well-funded professionals whose malware has "specific designs to capture 
something and not leave traces," Grayek said. "This would be a nuclear bomb" of malware.
By studying how the code is constructed and how it's propagated, Computer Associates has traced the Trojan to a 
specific group in China, Grayek said. He would not name the group.
The strength of the malware shows how skilled hackers have become and how serious they are about targeting digital 
devices, which provide a new frontier for stealing information from vast numbers of unwary PC owners. More than 2.26 
million digital frames were sold in 2007, according to the Consumer Electronics Association, and it expects sales to 
grow to 3.26 million in 2008.
The new Trojan also has been spotted in Singapore and the Russian Federation and has 67,500 variants, according to 
Prevx, a security vendor headquartered in England.
Grayek said Mocmex might be a test for some bigger attack, because it's designed to capture any personal, private or 
financial information, yet so far it's only stealing passwords for online games.
                                         8< ...snip ... >8

If you think bought an infected device, call your retailer.
-- Best Buy: (877) 467-4289
-- Sam's Club: (888) 746-7726
-- Target: (800) 591-3869
-- Costco: (800) 955-2292
E-mail Deborah Gage at dgage () sfchronicle com.
http://sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/02/15/BU47V0VOH.DTL
This article appeared on page C - 1 of the San Francisco Chronicle
San Francisco Chronicle Sections

-------------------------------------------
Archives: http://www.listbox.com/member/archive/247/=now
RSS Feed: http://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com