Slashdot Mirror
Syrian Government Uses Skype To Push Malware To Activists
judgecorp writes "The Syrian government is using Skype as a channel to infect activists' systems with malware, installing Trojans and backdoors, according to security firm F-Secure. The evidence comes from a hard drive sent for analysis. 'The activist's system had become infected as a result of a Skype chat. The chat request came from a fellow activist. The problem was that the fellow activist had already been arrested and could not have started the chat. Initial infection occurred when the activist accepted a file called MACAddressChanger.exe over the chat. This utility was supposed to change the hardware MAC address of the system in order to bypass some monitoring tools. Instead, it dropped a file called silvia.exe which was a backdoor — a backdoor called "Xtreme RAT." Xtreme Rat is a full-blown malicious Remote Access Tool.'"
it's 2012, don't accept any file from anyone unless the name and file type looks halfway legit and you can trust the person 100%
this is why the syrian army is dumping dead bodies in a river. the people are too dumb to exercise security
someone ask the greeks to teach them a lesson in security while revolting against an oppressive government
Meanwhile, the Obama administration is arguing that requiring warrants for cellphone records "cripples" investigators. No malware needed here in the U.S. Just fearmongering.
"Sufferin' succotash."
It is not Skype they use, but the gullibility of the users. Skype is only remotely involved...
How do you say "Big Brother" in arabic?
Initial infection occurred when the activist accepted a file called MACAddressChanger.exe over the chat.
Trust no one.
(In related news)
"Syrian Government Uses Social Engineering To Push Malware To Activists."
They could be using e-mail for the same thing. Or other IM channels that offer direct connect. Or Dropbox. Or any other channel.
The clever bit is trying to convince people to download and run an unknown tool by impersonating someone they've imprisoned.
is simple.
1. find current affair or topic of notice or interest to customers
2. find a vector for product placement
3. profit.
the article is perfect, it has no names or citations, no dates or other identifying information and cant have those used to refute it as it falls under the auspices of "well, its a war ya know." I wonder how many vodka tonics it took the guys at f-secure's marketing department before they came up with this crap.
the only thing this "report" serves to do is frighten the general public into purchasing anti virus software. on the bright side, it seems as though slashdot is getting better with slashvertisements!
Good people go to bed earlier.
This really is a very stupid, uninteresting story. .exe that contains malware.
Guy runs
I would like to read interesting things, not completely uninteresting stories like this one.
Comment removed based on user account deletion
*snarky MS comment on*
Well you knew this would happen shortly after Microsoft bought them....
*snarky MS comment off*
How do you know the person at the other end of a remote chat is actually human?
If they REFUSE TO DOWNLOAD AND RUN ANY DANG FILE you give them.
On this day and always.
A feeling of having made the same mistake before: Deja Foobar
This F-Secure post is not news. The EFF wrote this up on March 5th: https://www.eff.org/deeplinks/2012/03/how-find-syrian-government-malware-your-computer-and-remove-it
See above.
Comment removed based on user account deletion
Comment removed based on user account deletion
Trusting a friend isn't stupid, it's what most people would do.
I let all my friends know that I'm untrustworthy and stupid. I also tell my friends that I don't trust them and that I think they're dummer than a bag of hammers. I got this whole security thinging down, baby!
Of course now, i don't have to worry about being infected by worms from friends because I have no friends.
Comment removed based on user account deletion
Comment removed based on user account deletion
In order for this not to happen again do the following:
Stop using Windows and MacOSX.
Download and install Fedora F16.
When installing, encrypt the harddrive with a really hard to break password.
Install pidgin and off the record like this: 'yum install pidgin pidgin-otr'
Generate keys and verify them before communicating.
Be _very_ careful if who you usually talks to changes their key, they might have been arrested.
Never ever communicate in the clear.
Using this strategy you will not be immune, rubber-hose-cryptanalysis with still defeat this. Also you can be tracked so your oppresive government can see that you communicate, they will just not be able to read what you are saying. And not using major OSes will keep you away from the most common exploits and trojans.
Also, try to use TOR, HTTPS-everywhere and other good tools.
References:
https://fedoraproject.org/
http://fr2.rpmfind.net//linux/RPM/fedora/16/x86_64/pidgin-otr-3.2.0-4.fc15.x86_64.html
http://www.cypherpunks.ca/otr/
Good luck.
Comment removed based on user account deletion
Misunderstanding of what a MAC address is and how they work, that is the crux of the issue.
-Lod
'cause i'm wee-todd-ed!
Next, on Real TV: When script kiddies go bad -- Real bad.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Shouldn't that read: Syrian Government Uses Microsoft Products To Push Malware To Activists since Microsoft owns Skype?
Maybe it's time to drop the free as in beer when talking about opensource and use free as in speech.
Seeing how the Syrian uprising and violence attributed to the military is actually is a CIA/Blackwater/Mossad driven coup, I have a hard time believing that this was the Syrian government. Even if it was, they are likely trying to flush out that element.
Actually, two signatures. A real signature that would identify a person to the community. And a fake one that could be given away when he eventually gets caught and tortured. As soon as the community spots the fake one in use, they would know that the person has been detained.....
Don't try to be sly on the internet if you don't know how it works.
Is Microsoft, which owns Skype, colluding with the Syrian government to push malware to end users, or has Syria hacked into Skype to accomplish this?
Comment removed based on user account deletion
When I read the title, I am thinking a specific exploit in Skype was used to push the malware, when in reality all they did was send an executable and asked them to run it. As a Skype user, the former would be of great concern to me, while the later is not.
I think a better title would have been, "Syrian Government Uses Social Engineering To Push Malware To Activists."
Fanboy Status: Apache Flex, C#, Eclipse, KDE, Pirate Party, Ron Paul, Slackware, Windows 7
Have gnu, will travel.
In all fairness, the person who installed the malware might just be a guy off the streets who attended a rally. I hear there are occasionally thousands of them protesting.
.exe over skype. It's safer to assume he's not in the upper echelons of dissent.
The insination here is that the regime managed to infiltrate a fifth column styled group by getting a guy to accept an
Some of the protesters over at wall street might just have easily fell for such a ruse.
Why on Earth would you try to support an argument about information security practices with a reference to fiction?
And this--even if true--completely absolves the current régime in Damascus of any wrongdoing, right?
Il n'y a pas de Planet B.
This is no different than an email trojan vector. They've passed the file using skype but this is not any weakness in skype itself unless one thinks that skype should be scanning files that are transferred across it as part of the service.
blindly antisocialist = antisocial