ICQ/MSN Messenger Fraud

Printable View

May 6th, 2003, 07:40 PM
nebulus200

ICQ/MSN Messenger Fraud

Haven't seen any mention of it here, so I thought I would post to make sure people are aware of it.

Taken from here

Quote:

We received notice about fraudulent messages sent via ICQ and MSN Messanger,
urging users to visit various websites to download Windows patches. While these
websites resemble 'official' Microsoft sites, the patch is in fact a trojan
horse. If installed, the trojan horse will connect to an IRC server and
participate in a "botnet" which could be used to portscan or to launch DDOS
attacks.

Quote:

We do recommend blocking access to the following IPs and sites used in this
scam:

200.152.5.119
212.78.206.150
209.126.216.36

upon joining the IRC channel, the 'bots' are currently instructed to 27374 and
1243. The installed binary is 'scan.exe'. While scan.exe is not currently
detected as a virus, it will uncompress itself and extract several components
which are detected by virus scanners.

Just a reminder: there are likely variations of this basic scheme. Please do
NOT take these instructions too specific. More generic, outbound IRC traffic,
and outbound scans of port 27374 and 1243 are always suspicious.

Keep it in mind for those of you who have a large number of less-savvy, but well intentioned users.

/nebulus
May 6th, 2003, 07:56 PM
gore

oh man, lamers never change. I remember back 3 years ago when i first got a computer there were all kinds of trojans and **** for ICQ, its sad. i mean its cool people found a way to get a trojan out of ICQ but i mean damn, lol this doesnt seem anything more than a social engineer attempt from somenoe who doesnt actually have the skills you need to be good at it.
May 6th, 2003, 07:58 PM
instronics

Hmm, the mentioned ports are the defualt ports for sub7....... Sub 7 is known to communicate with irc bots, telling the owner when an infected victim goes online. In addition to the irc, notifications can be made via messenger, email, and some versions of ICQ. My advice is to NOT download anything, if the links are provided in a chatroom, a form of messenger, or from an email where you are not 100% sure of the sender's soure or identidy. Sub7 is only one of the trojans that can notify/act this way. There are many other trojans, that act very similar. For now till more information is provided about this thread, i recomend getting the cleaner from www.moosoft.com, aswell as updating your antivirus scanners.

Cheers.
May 6th, 2003, 08:39 PM
phishphreek

Quote:

Keep it in mind for those of you who have a large number of less-savvy, but well intentioned users.

All the more reason to prohibit the use of IM, java chat and IRC services in the workplace...

:firedevil Muhahaa Muhahaa Muhahaa :firedevil

I guess the home users would be more vulnerable to this type of social engineering.

Ah well... I'll send out an e-mail to everyone anyway.
May 7th, 2003, 10:16 PM
Plastic

Sub7 and BackOrifice, and other similar trojans really piss me off... it's the easy way in, and, as phish said, makes it easy for the social engineer to get what he/she wants.