Slashdot Mirror
New Malware Variant Uses Google Docs As a Proxy To Phone Home
An anonymous reader writes "Windows 8 may block most malware out of the box, but there is still malware out there that thwarts Microsoft's latest and greatest. A new Trojan variant, detected as Backdoor.Makadocs and spread via RTF and Microsoft Word document marked as Trojan.Dropper, has been discovered that not only adds a clause to target Windows 8 and Windows Server 2012, but also uses Google Docs as a proxy server to phone home to its Command & Control (C&C) server."
must be an apple patent somewhere
(looking at picture in article) I really have to wonder why malware authors use command and control servers covered in rust...
#fuckbeta #iamslashdot #dicemustdie
So, what happens when google suspends the account?
"The malware interprets security as damage and routes around it."
Is it really a Google problem though? If it were I'd expect it to work on any OS.
Even when Microsoft makes something bulletproof..
Bulletproof? I thought the point here was that this particular bullet made its way through their defences.
Besides, Microsoft RTF documents as a Trojan vector *still*?
seriously. they've only had a couple of years to fix that one..
A google problem? Having a public server? Yeah whatever you shill.
I know it's trendy and hipster to hate on google. but... NOBODY MAKES YOU USE ANY OF THEIR PRODUCTS OR SERVICES. which are free and quite open for stuff put out by a business. How dare they offer stuff people want in a non annoying way for free!
Unlike ohhhhhhhh... just about any other company out there.
And since when has ANYTHING made by microsoft been bulletproof? Or even doesn't leak like a screen door... never.
funny... don't see any mention of there being a risk to linux users who also use google docs
Ballmer's knob tastes THAT good huh?
Not sure - we should get together and compare notes you have on Page.
Because of all the downtime on Google docs, the communication with the C&C server is intermittent and therefore difficult to pinpoint by law enforcement. Security by instability.
lucm, indeed.
Hmm.. if I read the article correctly, Google Docs is used to get around firewalls and communicate with C&C servers. Which is a violation of Google's terms of service. But I'll assume for the moment valid user credentials are (ab)used to access Google Docs.
But spreading via RTF and Word documents? That means this trojan only takes control through a vulnerability (or multiple ones?) in RTF and Word document handling. That would definitely be a Windows 8 problem.
Article itself is short on details unfortunately.
don't you mean Torvalds? i frankly don't give a shit about google... Page can burn and die for all I care
Also puts Google in a very wonderful spot because they can correct the problem by taking down said documents, and redirecting people to getting their PCs fixed.
LOL, I don't think virus designers much care about googles terms of service. That was the funniest thing I've ever read.
Even when Microsoft makes something bulletproof, these tech assholes have to blame a Google problem on Microsoft.
No.
It uses a vulnerability in RTF and Word documents to get into the system.
It only uses Google Docs as a fancy way to phone home.
WTF is microsoft giving system access to RTF files? I bet these MS idiots can make .txt vulnerable if you just give them the opportunity.
Sounds just like all the other malware which used to connect to IRC to take its orders. Only difference is the protocol now.
How does it work exactly, and does it affect XP users?
I am really not in the mood for trying to read the information in the article. What idiot webmaster thought it would be a good idea to put a giant frame on the left side of the screen so you'd have to scroll left and right repeatedly to read the information in the right frame?
Microsoft makes body armor now? Are they just small inserts like most motor sports body armor, of does it cover more of you? Is it Kevlar, ceramic, carbon fiber, or what? Maybe some of that memory foam that gets stronger than steel upon compression? I may be interested in some, if it's priced lower than Microsoft's stupid operating systems.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Well, if this stuff doesn't work on linux, then it is clearly a microsoft problem :D
Also puts Google in a very wonderful spot because they can correct the problem by taking down said documents, and redirecting people to getting their PCs fixed.
Which in turn is not only good citizenship but also great marketing.
Do it yourself, because no one else will do it yourself. [beta blockade 10-17 Feb]
Also puts Google in a very wonderful spot because they can correct the problem by taking down said documents, and redirecting people to getting their PCs fixed.
Which in turn is not only good citizenship but also great marketing.
Really? Do you realize that "marked as Trojan.Dropper" is a fucking generic name used by AV companies, not an actual Trojan? And now you want Google to go around snooping through your Docs and deleting them because they matched %someAVvendor_SignatureFile% ?
No thanks, I'll pass.
But Google could stop any and all communication with the C&C server, even without checking for the presence of the Trojan.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
But spreading via RTF and Word documents? That means this trojan only takes control through a vulnerability (or multiple ones?) in RTF and Word document handling. That would definitely be a Windows 8 problem.
No, its definitely not a windows 8 problem. Its clearly a problem with the software reading RTF and Word documents. Last I checked, user accounts on all OS's, including Windows, Linux, OS/X, and BSD, could open up a socket and start hitting the network with whatever rights the user has.
The only place where it is acceptable to not allow networking by default is the land of mobile devices, and only some of them are actually like that.
"His name was James Damore."
Which part of "Microsoft Product" did you not understand?
> A new Trojan variant, detected as Backdoor.Makadocs and
> spread via RTF and Microsoft Word document marked as Trojan.Dropper
Ahhh, hackers are following good coding conventions about meaningful names (Object) dot (Verb). This is reassuring.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
I had no idea what RTF is until I used Yahoo search. RTF stands for Rich Text Format that has been in use since around 1989. Do people still use RTF? Just asking because no one I know uses it. My friends and family use .doc and open office text .odt.
Yes, I am showing my age. lol
I wonder if Backdoor.Makadocs runs on older versions of Windows like Windows 7.
You know you love felching Page.
Is it really a Google problem though? If it were I'd expect it to work on any OS.
Yes. The document goes on Google Docs and then when it's accessed, the Google viewer sees the embedded link sends a request to the C&C server. It sounds like it's more a Google exploit than a MS exploit.
No, it uses Google to get around your (possibly existing) firewall. If you open the document from the Google server, the Google server sends a message to the C&C server.
What the C&C servers are? It doesn't help much if it doesn't.
Update at 4:30PM EST: “Using any Google product to conduct this kind of activity is a violation of our product policies,” a Google spokesperson said in a statement.
In a related development, Microsoft fixed all its vulnerabilities by issuing a very simple patch. It is basically a statement issued by its spokesperson:"Using the vulnerabilities in Microsoft software is a violation of the our product policies".
Yale lock company and the Chubb safe companies too issued a joint statement saying, "picking our locks is a violation of our product policies".
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
And how is this any different from any other system that allows user generated content to be shared online? The document in question is one you open locally in MS-Word... it uses gdocs as its' communication system.. so if you block outbound non-web ports, it still works... beyond this, it could just as easily used any of the many thousands of web forums and blog comment systems for this chatter. The difference being that gdocs is probably more reliable for the load that might be generated by said virus/malware.
Michael J. Ryan - tracker1.info
I could have nearly as easily used office 365, or skydrive as its' communications channel... this pretty much only says they trust google to not crumble under the load, or randomly go offline more than they do ms/azure.
Michael J. Ryan - tracker1.info
..and it can happen in EVERY data format. Including all flavours of XML and HTML. Maybe it is time for you to learn about stuff (virus tradecraft) before posting.
Apparently virus writers are reading on this site. People have been predicting C&C and ex-filtration traffic via Google Mail and Google Docs (and all similar services) for quite some time.
So - corporate network security must have the ability to inspect ANY SSL traffic going through the firewall (done via corporate certificate in the browser). Including your conversations via Google Talk and your communications with financial services. Employees charged with traffic inspection must handle all intelligence gathered responsibly and have to keep it a secret, as long as no misuse is detected. Collection/Inspection systems must be properly secured.
We all expect police and customs officers to do similar things, and as long as they are well-trained professionals it is quite universally accepted.
If you still don't like this - bring your own crap with a UMTS modem into your workplace.
you are a sad, sad little man
..then they will use a large number of (fake) Google user ids to facilitate their data extraction and C&C. Maybe they already have hundreds if users embedded in an encrypted fashion into the malware, to be used in future weeks. The same goes with the "documents" used.
Also, they will use TOR and other captured PCs to connect to Google Docs. Google can't even blacklist all TOR exit routers.
The C&C server will poll documents on Google docs which have been "filled" by the infected PCs. Sounds more you don't have a clue.
The already exploited box is the one putting information on google docs. It is used as a communication medium, like IRC or a p2p protocol.
http://soylentnews.org/~tibman
If you opened the google doc, nothing would happen. It is a communication medium between command & control and the infected machines.
http://soylentnews.org/~tibman
They don't have to look through your docs. They just look at the place the malware is phoning home to.
http://soylentnews.org/~tibman
Now where's that guy who wanted to move an old document system over to Google Docs?
The already exploited box is the one putting information on google docs. It is used as a communication medium, like IRC or a p2p protocol.
That isn't clear in the article.
If you understand how this works, it would be helpful if you explained the mechanics.
new idea, doesnt use man in the middle. But by now, i learned all i need to know from " the darkside" no point in making such kiddy toys
I will not disclose a 0 day again I will not disclose a 0 day again I will not disclose a 0 day again I will not disc
I have to admit I am impressed. Using Google Docs as an infection vector is ingenious. Why would anyone want to work out of "the cloud."
Funny, Anonymous Coward is having a conversation with himself!
Since Google Docs is blocked by the Great Firewall, those of us in China are safe!