New Phishing System Takes Advantage of JPEG Bug

New Phishing System Takes Advantage of JPEG Bug:
"Symantec Corp.'s Threat Analyst Team has discovered an exploit in the wild that utilizes the recently announced JPEG vulnerability in Microsoft Corp.'s GDI+ library to install a new and sophisticated phishing system.

eWEEK.com spoke with Oliver Friedrichs, senior manager of Symantec Security Response, who said the infected image is not able to attack a system from within Internet Explorer or Outlook, but only from within Windows Explorer, the file system browsing utility. Therefore, an attacker would likely need to entice a user to view the file from within the file system. Perhaps for this reason, Symantec says the spread of the attack is limited for now."

This was the most feared scenario for this vulnerability. Because of the nature of this particular attack, as a heap-based integer underflow vulnerability, implementations of the attack are likely to be specific to the application, perhaps even versions of the application, in which the image is viewed. Friedrichs says that it may not be possible to exploit the vulnerability from within Outlook or Outlook Express.

Once the user views the infected JPEG image, named ducky.jpg, the exploit code launches and downloads a file named ll.exe from the site maybeyes.biz. This file is saved as y.exe in the c:\ directory and executed. y.exe then downloads a second file from maybeyes.biz, upd.exe, and saves it as divxencoder.exe in the %SYSTEMROOT% directory (usually c:\windows) and executes it. This file then injects a DLL file embedded in it into Windows explorer.exe.

The DLL, now infecting Windows Explorer, contacts a different system on the same provider network as maybeyes.biz and downloads from it an XML-based template file. This file describes the phishing spam message to be sent from the infected system and the e-mail addresses to which it should be sent. Analysis on the DLL is not complete.…

http://www.eweek.com/article2/0,1759,1664909,00.asp?kc=ewnws100404dtx1k0000599