Forgot your password?
typodupeerror
Security Government Politics Technology Your Rights Online

'Madi' Cyber Espionage Malware Hits Middle East Targets 45

Posted by timothy
from the just-can't-catch-a-break-sometimes dept.
DavidGilbert99 writes "Following the discovery of the highly-complex Flame virus in May, two security companies (Seculert and Kaspersky Lab) have uncovered a new cyber-espionage threat against the Middle East. Madi, or Madhi, is an information-stealing trojan which is technically a lot simpler than Flame or Stuxnet but is specifically targeting people in critical infrastructure companies, financial services and government embassies, which are mainly located in Iran, Israel and Afghanistan. The Madi creators use social engineering techniques to spread, embedding the malware in various documents including text files and PowerPoint presentations. It is unclear if the malware is state-sponsored or not, but it has already stolen several gigabytes of information and is still active."
This discussion has been archived. No new comments can be posted.

'Madi' Cyber Espionage Malware Hits Middle East Targets

Comments Filter:
  • by sandytaru (1158959) on Tuesday July 17, 2012 @01:57PM (#40676149) Journal
    The more I hear about these sophisticated spying viruses with the cute names, the more I imagine them as the digital equivalent of James Bond, little tuxedos and all. "My name is Bond. James Bond.zip. I'm an international attachment of mystery."
    • Re: (Score:2, Insightful)

      by rainmouse (1784278)
      Do Kaspersky get to name them? Being that they are seemingly the only security company in the world capable of detecting viruses written by Israel and paid for by US tax dollars... ahem sorry by anarchists.
      • You have to wonder if - based in Russia as they are - they are the only ones allowed to report this stuff. I'm not particularly surprised that Norton are useless here but there are two companies based in Germany who should be doing better work, assuming the viruses (virii?) show their elegant haaircuts in Germany.
        As to the GP, how do the viruses take their martinis? A tuxedo alone does not make a secret agent.

      • Flame got its name from itself, as it referenced itself in module and constant names as FLAME_

        See for example screenshots of its source here [news.com.au] and here [technoid.com.au]. Or do a Google picture search for Flame yourself.

    • Actually, you are not far off, being that it spreads via social engineering. That is the oldest spy tool in the book.

      . . . and look how James Bond used it very successfully with, . . . um . . ., "Pussy Galore" . . .

  • Iran again? (Score:2, Insightful)

    by tokencode (1952944)
    Given that the spear-phishing targets are mostly in Iran, I'm going to go out on a limb and say this is probably not the work of some 15 year old playing around or russia organized crime...
  • by davidwr (791652) on Tuesday July 17, 2012 @02:06PM (#40676255) Homepage Journal

    "embedding the malware in various documents including text files"

    I assume they mean word-processing or other "not quite plain text" files, or perhaps "text files that are really textual representations of computer instructions" e.g. text files that embed macros that are interpreted by the text-processing software.

    While it's theoretically possible for a carefully-crafted plain-text file to exploit a security vulnerability in a particular text-processing program, it would have to be a narrowly targeted attack and it would be easily defeated by now-alert customers who simply change to a different text-processing program.

    It's also theoretically possible that there is an exploit in the text-handing APIs of the operating environment in use by the intended targets.

    • by bhlowe (1803290)
      I was wondering about that too.. Only thing I could think of was batch or shell scripts...
      • by Znork (31774)

        See, that's where the aforementioned social engineering aspect comes in, the text file contains instructions to save it as funcatscript.sh, type chmod +x funcatscript.sh and then run ./funcatscript.sh to see some fun kittens happen. Of course, that will just mail the script to all mail addresses found in the users mailbox followed by a cat /bin/cat which, to the consternation of the user, simply isn't a very funny cat.

        • by davidwr (791652)

          With a name like funcatscript I expect the contents of stdin to wind up in stdout. Only in a fun, scripty way.

          Of course, if it's malware, I may wind up with a lot more than I bargained for in stdout.

    • by Baloroth (2370816) on Tuesday July 17, 2012 @02:19PM (#40676459)

      It's possible they mean files that appear as text to the user. Ars Technica [arstechnica.com] mentions they use "Right to Left Override" to make it look like executable files aren't (they might show up as a .jpg, for example, complete with a jpg icon) to the end user. If the creators are clever, they could even have it launch the appropriate viewer to make it look like they opened the kind of file they did. So it isn't hard to imagine they did the same with .txt files, although given the context with "PowerPoint" they probably did mean .doc files or the like.

    • by gmuslera (3436)
      If they used advanced enough social engineering techniques could be plain ascii txt files with an instruction to i.e. base64 decode them and execute it for a nice surprise. The main executable part in social engineering attacks is the people.
      • If they used advanced enough social engineering techniques could be plain ascii txt files with an instruction to i.e. base64 decode them and execute it for a nice surprise. The main executable part in social engineering attacks is the people.

        If it were really advanced, it would be something called README.TXT that says

        "To see pictures of cats, fax, email, or overnight-courier copies of all of your corporate secrets to ...."

  • So, does somebody think that their malware is actually a figure in islamic eschatology, are they engaging in some sort of wordplay for the lulz, or are the social engineers capitalizing on suspected mahdi-enthusiasm among their targets, in a way roughly analogous to the hilariously overt christianity of nigerian spammers?
  • He has ridden a worm, and changed the passwords of life! The Bene Gnusserit prophecy was true! He is the Mahdi!!

    MAHDI! MAHDI! MAHDI!!

  • by jpapon (1877296) on Tuesday July 17, 2012 @02:14PM (#40676393) Journal
    Oh no! Several GIGABYTES of information?

    That means they've stolen anywhere from half of a South Park season to several millions of pages of plain text!

    What a useful measure!

    • Oh no! Several GIGABYTES of information?

      That means they've stolen anywhere from half of a South Park season to several millions of pages of plain text!

      What a useful measure!

      Or half of The Fellowship of the Ring, Extended Edition.

      • They've stolen Frodo? Oh god no the humanity!
        • They've stolen Frodo? Oh god no the humanity!

          Just the boring part in the Shire. Reports just in that several top-level members of US intelligence have been found slumped dead at their desks after apparently being forced to endure the tedium of the first half of The Fellowship of the Ring, Extended Edition.

  • Could it be Sunununumbnut, again?

    http://www.huffingtonpost.com/2012/07/17/john-sununu-obama_n_1679803.html#comments [huffingtonpost.com]

    His strategies would ruin Americans' future faster than the Spanish flu. Sununu, the eternal numbnut.

If money can't buy happiness, I guess you'll just have to rent it.

Working...