Little damage done by pro-Palestinian virus

[InfoSec News <isn () C4I ORG>]

http://news.cnet.com/news/0-1003-200-5185169.html?tag=mn_hd

By Robert Lemos
Special to CNET News.com
March 19, 2001, 4:55 p.m. PT

A handful of companies have been hit by a computer virus named
Injustice that causes a victim's computer to send pro-Palestinian
messages to 25 Israeli organizations and government agencies.

The worm is largely benign and does not damage data on the infected
PC, but the flurry of e-mails its sends to other computers could swamp
a business' network, said Ian Hameroff, business manager for security
solutions at antivirus and PC services company Computer Associates.

"It is spreading at a medium rate, nowhere near epidemic," he said.
"The interesting thing is its usage as a vehicle for a political
message."

Rival antivirus firm Trend Micro rated the virus as a medium threat.

The mass-mailing worm represents the latest strike in the online
battle between supporters of the Palestinians and those of the
Israelis. Late last year, both sides traded blows by defacing Web
sites that support the opposing side.

While other political viruses have been seen in the past, Injustice
has the potential to be the most effective to date.

The virus appears as an attachment to an e-mail message with the
subject line "RE: Injustice" and the following message:

Dear (Outlook User name)/ Did you send the attached message, I was not
expecting this from you!

The worm is a Visual Basic script attachment called INJUSTICE.TXT.VBS.
Once opened, the program will display an anti-Israeli message in a
text dialog box.

"PLEASE ACCEPT MY APOLOGIES FOR DISTURBING YOU," states the message.
"Remember that one day YOU may be in this situation. We need every
possible help." The rest of the message describes the death of a
12-year-old Palestinian boy.

 The virus sends itself in e-mail messages to the first 50 entries in
the infected computer's Outlook address book, along with 18 Israeli
government addresses, eight organizations and to the Webmaster of the
country's official Web site.

Finally, Injustice uses Microsoft's Internet Explorer to open six
windows to a variety of Web sites, including an electronic petition to
the United Nations High Commissioner for Human Rights.

"I've had people send me e-mail to get me to sign a petition," said
Susan Orbuch, spokeswoman for Trend Micro. "But I've never seen a
virus that tries to get people to sign a petition." Trend Micro calls
the virus VBS_Staple.A.

The virus writer apparently tried to make the virus as harmless as
possible.

"Note: Do not worry," he states in the text of the virus. "This is a
harmless virus. It will not do any thing to your system. The intension
(sic) is to help Palestinian people to live in PEASE (sic) in their
own land."

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".