Wednesday, July 18, 2012

  • Wednesday, July 18, 2012
  • Elder of Ziyon
Kaspersky Labs analyzes a number of Trojan Horses and malware examples targeting Israel that are apparently written in Iran, in part one of a two part article.

The malware, nicknamed "Madi" (presumably a reference to the Shiite messianic figure of the Madhi), is not sophisticated. Instead, it relies on tried and true methods of social engineering, relying on naive computer users to allow scripts to run in PowerPoint presentations, ignoring the warnings that Windows gives about potentially dangerous actions.

It is well known in the computer security world that people are too likely to fall for such schemes.



Another method used is to send what appear to be JPG images, but in fact they are programs as well, using a known Microsoft bug where Unicode characters in languages that are written right-to-left can create file names that appear to have the extensions of mere images but in fact are executable programs that can do anything to the computer (in this case, a screen saver):



Once the malware is loaded then the attackers can remotely do anything they want on the infected machines.

Again, these are not sophisticated attacks in the least; hackers have been doing things like this for years. But it only takes one stupid victim to click on that cute photo of nature or puppies to compromise an entire company or government department.

This specific malware can take screenshots at regular intervals and also make audio recordings from the victim's computer, which can then be uploaded to the attackers' machines.

The Jerusalem Post reports that Iran is the target of the malware, even though key parts were written by Farsi speakers. I find that hard to believe given that Hebrew in the Powerpoint above, although the people who created the Trojan are not necessarily the same as those that created the Powerpoint macro that calls the Trojan.

UPDATE: It appears I am right:
After analyzing initial data on the virus when it was first publicized Tuesday, Symantec released a report saying that nearly two thirds of the computers that have been infected by Mahdi are in Israel. That is in sharp contrast to initial assessments Tuesday that claimed that the majority of infected systems were in Iran itself. Computer security firm Kaspersky Labs reported on the Mahdi virus on Tuesday.

(h/t Yoel, Ian)

EoZTV Podcast

Podcast URL

Subscribe in podnovaSubscribe with FeedlyAdd to netvibes
addtomyyahoo4Subscribe with SubToMe

search eoz

Loading...

comments

Speaking

follow me

Follow by Email

Contact

Elder: elder -at- elderofziyon dot com
Mrs. Elder: mrs.elder -at- elderofziyon.com


translate

E-Book

For $18 donation








Sample Text

EoZ's Most Popular Posts Ever

Hasbys!

Elder of Ziyon - حـكـيـم صـهـيـون

Elder of Ziyon - حـكـيـم صـهـيـون
This blog may be a labor of love for me, but it takes a lot of effort, time and money. For over 11 years and over 23,000 articles I have been providing accurate, original news that would have remained unnoticed. I've written hundreds of scoops and sometimes my reporting ends up making a real difference. I appreciate any donations you can give to keep this blog going.

Donate!

Monthly subscription:
Payment options

One time donation:

subscribe via email

Follow EoZ on Twitter!

Tweets

Compliments

The Jerusalem Report:"A seemingly indefatigable one-man operation, armed only with a computer, chutzpa and stamina."

Algemeiner: "Fiercely intelligent and erudite"

Omri: "Elder is one of the best established and most respected members of the jblogosphere..."
Atheist Jew:"Elder of Ziyon probably had the greatest impression on me..."
Soccer Dad: "He undertakes the important task of making sure that his readers learn from history."
AbbaGav: "A truly exceptional blog..."
Judeopundit: "[A] venerable blog-pioneer and beloved patriarchal figure...his blog is indispensable."
Oleh Musings: "The most comprehensive Zionist blog I have seen."
Carl in Jerusalem: "...probably the most under-recognized blog in the JBlogsphere as far as I am concerned."
Aussie Dave: "King of the auto-translation."
The Israel Situation:The Elder manages to write so many great, investigative posts that I am often looking to him for important news on the PalArab (his term for Palestinian Arab) side of things."
Tikun Olam: "Either you are carelessly ignorant or a willful liar and distorter of the truth. Either way, it makes you one mean SOB."
Mondoweiss commenter: "For virulent pro-Zionism (and plain straightforward lies of course) there is nothing much to beat it."
Didi Remez: "Leading wingnut"

Interesting Blogs

Categories

Abbas liar Academic fraud administrivia al-Qaeda algeria American Jews Amnesty analysis anti-semitism apartheid arab refugees Arafat archaeology art ASHREI B'tselem bahrain bbc BDS BDSFail Bedouin Beitunia beoz book review breaking the silence Cardozo Chanukah Christians conspiracy theories Cyprus Daphne Anson Davis report DCI-P double standards Egypt Elder gets results ElderToons Electronic Intifada EoZNews eoztv Erekat EU Euro-Mid Observer Fake Civilians 2014 Fatah featured Features fisking flotilla Forest Rain free gaza freedom of press palestinian style future martyr Gary Spedding gaza Gaza Platform George Galloway George Soros gideon levy gilad shalit gisha Goldstone Report Good news Grapel Guardian gunness Haaretz hamas Hamas war crimes hasbara Hasby 2014 Hasby 2016 Hebron helen thomas hezbollah history Hizballah Holocaust denial honor killing HRW Human Rights Humanitarian crisis humor Hypocrisy ICRC Ilan Pappe impossible peace incitement Indonesia international law intransigence iran Iraq Islamic Judeophobia Islamism Israel Loves America Israeli culture Israeli high-tech J Street jabalya jeremy bowen Jerusalem jewish fiction Jewish Voice for Peace jihad jimmy carter John Kerry jokes jonathan cook Jordan Juan Cole Judea-Samaria Kairos Karl Vick ken roth khalid amayreh Khaybar Lebanon leftists Linkdump lumish mahmoud zahar Malaysia max blumenthal McGraw-Hill media bias Methodist Miftah Mohammed Assaf Mondoweiss moonbats Morocco music Muslim Brotherhood Nakba Natural gas Nazi News nftp NGO NIF norpac NYT Occupation offbeat Omar Barghouti Opinion oxfam PA corruption PalArab lies Palestine Papers pallywood pchr PCUSA Peter Beinart Petra MB poll Poster Preoccupied Prisoners propaganda Proud to be Zionist purimshpiel Qaradawi Qassam calendar Rafah Ray Hanania real liberals reference Richard Falk rogel alpher roger cohen roger waters Saudi Arabia saudi vice self-death self-death palestinians sex crimes SFSU shechita sheikh tamimi Shujaiyeh SodaStream South Africa Speech stamps Syria Tarabin Temple Mount Terrorism This is Zionism Thomas Friedman Tunisia Turkey UCI UK UN UNDP unesco unhrc United Arab Emirates Unity unrwa UNRWA hate unrwa reports UNRWA-USA Varda Vic Rosenthal Washington wikileaks work accident X-washing Yemen zahran zionist attack zoo Zvi

Blog Archive