An Outlook worm to jam NSA's Echelon

[InfoSec News <isn () c4i org>]

http://www.theregister.co.uk/content/6/19004.html

[I'm a little guilty on this one, After hearing about Echelon at a
party at Defcon 5, I did a little digging and created a list of words
that has been called "The actual Echelon keyword list." Honestly its a
meme I was able to create with a bunch of intelligence community
slanted words with a select few more words that I was able to
watermark in to see how this would propagate over the Internet. 

Boy, there are alot of suckers out there. :)

Well, several groups have claimed the spookwords list as their own,
and took the complete credit for "Jam Echelon Day's" that have
happened over the years. Think about it, why would the NSA want to
hear about themselves?

The complete original list is at: 
http://www.c4i.org/erehwon/spookwords.html

A few of these words in the virus are some of my watermarked words in
the spookwords list, so now that I have kinda come clean on this one
here is the rest of the story. - WK]



By: Thomas C Greene in Washington
Posted: 16/05/2001 at 20:42 GMT

UK-based anti-virus outfit Sophos is reporting a new variant of the
LoveBug Outlook worm which contains a large amount of hidden text,
apparently designed to attract the US National Security Agency's
Echelon spy satellite network and overload it.

Comments within the executable file include large swaths of text such
as:

"NSA national security agency code PGP GPG satellite cia yemen toxin
botulinum mi5 mi6 mit kgb .mil mil base64 us defence intelligence
agency admiral diplomat alert! BATF," and so on.

As for social engineering, this worm looks like a total non-starter.
The subject line reads, !!!; the body reads, :-) MuCuX...; and then
there's an attached file: echelon.vbs. We don't expect it to get very
far.

Which is sort of a pity, really; the author has a few pertinent
observations to make and questions to ask, such as "Stop Violence
Pentagon. Why are you testing your new weapons on iraq? You are trying
to protect children from porn but you are also killing them and other
innocent people in iraq... ...and another thing... why are you using
echelon type stupid things to listen around...?"

Why indeed, many reasonable people will wonder.

The virus was "written By Extirpater and beyin. (i am NOT from iraq,
and not protecting iraq/islamic anyway)."

After introducing themselves, the authors then suggest, "hey others,
lets fl00d the echelon..." and from there the whole slew of keywords
commences.

These are believed to initiate an Echelon snoop session; but as we
reported back in 1999, it's likely that Echelon relies on
pattern-recognition rather than dictionaries, so loading millions of
e-mails with tantalizing keywords really won't attract the machinery
and bring the system down.

The new Outlook worm is also mildly destructive, and will over-write
MP2 and MP3 files and .jpeg files by modifying their extensions; and,
like the LoveBug which it resembles, mail itself to everyone on a
victim's address list.

Also, "if the worm determines that mIRC (Internet Relay Chat) is
installed on the system it will drop a mIRC script that will send the
worm on via mIRC," Sophos says.

The company says they've had only one report of the worm in the wild,
which is hardly a surprise considering its weak inducements to open
the attachment.

Still, it's an amusing piece of work, if not much of a threat. And
anyone who fears they might just be stupid enough to activate the
attachment of an e-mail bearing the message, :-) MuCuX... is welcome
to download Sophos' latest definitions here.

Below is the full text of the file's comments, as reported by Sophos:

Written By Extirpater and beyin. (i am NOT from iraq, and not
protecting iraq/islamic anyway) Stop Violence Pentagon. Why are you
testing your new weapons on iraq? You are trying to protect children
from porn but you are also killing them and other innocent people in
iraq... ...and another thing... why are you using echelon type stupid
things to listen around...?< Hey others, lets fl00d the echelon...
.gov @ NSA national security agency code PGP GPG satellite cia yemen
toxin botulinum mi5 mi6 mit kgb .mil mil base64 us defence
intelligence agency admiral diplomat alert! begin pgp message cert HQ
password secret information Shamil Basaev BATF Tactical information
broadcasting service netsec DEA Ayman Al Zawahiri RADINT ETA Fort
Meade explosive gun conspiracy primer detonator initiator unicos al
amn al-askari cray arpanet node backdoor mi-6 mi-5 terrorism SSCI
sairi islamic revolution assembly not for public private korea
diplomat wiretap Usame bin Laden DF ZARK SERT VIP ARC S.E.T set ssl
hezbollah hizbullah afiwc compusec M51 phsical security division
MOSSAD DDos denial of sevice don't try to contact me astel DH breaking
machine Xu Yongyue agent agents national infrastructure air command
control facility nm info Lieutenant tactical defcon mortars rpg7
propellants defensive evasion boobytraps secure internet rsa uzi buy
hrt hk33ke aks-74 galil arm detcord pmk40 silencers timing devices
information security naval yard sao reno jics computer terrorism NAIA
SAPM ASU ECHELON ASTS RSP ISS JDF NAAP RSO encryption ASWS USDOJ SAMU
COSMOS DATTA e99ll bill clinton george bush nash asis seal team 3 MSEE
M.P.R.I top secret mossberg sursat 5926 telint fraud analyzer b61-7
sbu err SO13 reojdykarna airframe 510 EuroFed Avi shelter Cryto AG IDP
RHL MP5K-SD sniper gign exon shell masuda eada shs NSWF sabotage
nitrate Counter terrorism RCMP CTU CQB CONUS BOP CID thief NCSA ISACA
ASVC spook words flashbangs magnum resta 777 666 MD2 MD4 MDA 747 boing
domestic disruption smuggle Z-200 Security Consulting Keyhole NABS
Kilderkin covert video pathfinders oscor merlin ntt sl-1 sr-71 sr71
f117 f-117 cornflower TNT rdx amfo hmtd lead azide styphante ddnp
nitrostarch mines grenades rockets fuses nitrocellulose c4 ambush
sniping spoof sniff sniffing sniffer motorcade assassination jtf-6
psyops privacy




ISN is hosted by SecurityFocus.com
---
To unsubscribe email isn-unsubscribe () SecurityFocus com.