Slashdot Mirror
New Malware Variant Uses Google Docs As a Proxy To Phone Home
An anonymous reader writes "Windows 8 may block most malware out of the box, but there is still malware out there that thwarts Microsoft's latest and greatest. A new Trojan variant, detected as Backdoor.Makadocs and spread via RTF and Microsoft Word document marked as Trojan.Dropper, has been discovered that not only adds a clause to target Windows 8 and Windows Server 2012, but also uses Google Docs as a proxy server to phone home to its Command & Control (C&C) server."
must be an apple patent somewhere
"The malware interprets security as damage and routes around it."
I'm sure it's goats blood, or human blood, or whatever they use for their search engine magic...
This is Symantec we're talking about. Their entire business model is "Hey, that's a nice computer you got there. It'd be a real shame if something were to... happen... to it." And we all know the murderous rage that powers McAfee. So it's probably not animal blood...
#fuckbeta #iamslashdot #dicemustdie
Because of all the downtime on Google docs, the communication with the C&C server is intermittent and therefore difficult to pinpoint by law enforcement. Security by instability.
lucm, indeed.
Hmm.. if I read the article correctly, Google Docs is used to get around firewalls and communicate with C&C servers. Which is a violation of Google's terms of service. But I'll assume for the moment valid user credentials are (ab)used to access Google Docs.
But spreading via RTF and Word documents? That means this trojan only takes control through a vulnerability (or multiple ones?) in RTF and Word document handling. That would definitely be a Windows 8 problem.
Article itself is short on details unfortunately.
Also puts Google in a very wonderful spot because they can correct the problem by taking down said documents, and redirecting people to getting their PCs fixed.
The malware is not using Google Accounts at all. It is using Google Docs, literally, as a web proxy server. It is using the Google Docs Viewer (the one that can help view online PDFs and Docs in read only mode, without downloading it to your local system), to pass information to the C&C server. The only way Google can prevent this is, by using a captcha for suspicious requests.
Even when Microsoft makes something bulletproof, these tech assholes have to blame a Google problem on Microsoft.
No.
It uses a vulnerability in RTF and Word documents to get into the system.
It only uses Google Docs as a fancy way to phone home.
Sounds just like all the other malware which used to connect to IRC to take its orders. Only difference is the protocol now.
Dude, Microsoft gives system access to anything that asks for it. Sometimes, it pauses to ask the guy at the keyboard if he WANTS to give system access to 'allyourfilebelongtous.exe', but the boob at the board invariably clicks "yes".
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
I would LOVE to meet the idiots that decided that document formats (such as Word, Excel, PDF, RTF etc) need to support full programming languages with system level access.
Old office formats (Word Perfect, Lotus etc) got by just fine without programmability so why do modern formats need it?
A special place in hell should be reserved for the person who decided to merge 2 of the least secure mainstream programs known to man and add support for embedding a Flash file into a PDF file.
But spreading via RTF and Word documents? That means this trojan only takes control through a vulnerability (or multiple ones?) in RTF and Word document handling. That would definitely be a Windows 8 problem.
No, its definitely not a windows 8 problem. Its clearly a problem with the software reading RTF and Word documents. Last I checked, user accounts on all OS's, including Windows, Linux, OS/X, and BSD, could open up a socket and start hitting the network with whatever rights the user has.
The only place where it is acceptable to not allow networking by default is the land of mobile devices, and only some of them are actually like that.
"His name was James Damore."
Jonwil does have a point. It would have been useful if users were presented with a simple model of programs that process data. Documents would be inherently safe, programs would be something potentially harmful. Bij embedding programs in documents the distinction is blurred. If the same combination would be presented and treated as a program containing a document the situation would be clearer. A plain document would be associated with a launcher that loads the (let's say) word processing application but not a scripting engine, a program with an embedded document would be associated with a launcher that loads both the word processing application and a scripting engine. The word processor itself has no built-in ability to load the scripting engine. To make the distinction separate mime types and file name extensions are needed.
This makes it much clearer what you're dealing with if you receive a document, and it makes it much easier to explain to people what to trust and what to distrust and why, and I also like the idea of not loading a scripting engine at all when there should be no scripts to execute.
Is it really a Google problem though? If it were I'd expect it to work on any OS.
Yes. The document goes on Google Docs and then when it's accessed, the Google viewer sees the embedded link sends a request to the C&C server. It sounds like it's more a Google exploit than a MS exploit.
It have nothing to do with progress, RTF, PDF and DOC are mostly used to display formatted text with images or other media, why would anybody need any scripts there? We could easily abolish all those formats in favor of HTML + CSS + media files in folder or compressed container, as an added bonus we would not need google quick view than.