New Download.Ject Attack Serves Up Porn

A new version of June's Download.Ject attack is hitting users through a pair of instant-messaging services, planting backdoors on fully patched Windows XP PCs, and serving victims with a diet of porn ads.

According to Thor Larholm, a senior security researcher at online-security services firm PivX Solutions, the new attack is probably the work of the same group of hackers that launched the original Download.Ject assault in June.

In that brief but high-profile attack, Russians compromised numerous Web servers running Microsoft software, then used a variety of vulnerabilities in the Internet Explorer browser to drop password- and bank-account-stealing key loggers on systems whose users had simply surfed to sites hosted on the infected servers.

This attack, says Larholm, is different. "The attacks comes in via AIM or ICQ instant messages, either from random users or users you may know," he says. If the person clicks on the link that reads "My personal home page http://XXXXXXX.X-XXXXXX.XXX/" the server attempts to download the Trojan using several IE vulnerabilities, including Object Data, Ibiza CHM, and MHTML Redirect.

And rather than hijacking financial data, the object of the new attack appears to be to display porn advertising. "It's still a financial motivation," says Larholm. "And since there's a backdoor installed, it could be used for other purposes later."

The most noticeable impact of an infection is a modified IE home page and changed search pane. In place of the user's designated home page, the new Download.Ject plants a porn ad page.

The servers delivering the Trojan and backdoor are based in Russia, Uruguay, and the United States, he says. The U.S.-based server appears to be a compromised machine. The Russian servers, however, appear to be deliberating serving up pages linked in the IMs.

Larholm says that a fully patched edition of Internet Explorer 6 running on Windows XP SP1 can be compromised by this newest attack, but that machines that have been updated with Windows XP Service Pack 2 (SP2) are safe.

Although there's no definitive proof, Larholm suspects that the same Russian-based HangUP hacker team behind the original Download.Ject attack is also running this show.

"It's not like they use signatures, but there are a lot of similarities, including similar code and even identical file names," he says.

"It doesn't surprise me at all that there's been another Download.Ject attack," says Ken Dunham, the director of malicious code research at online-security vendor iDefense. "There are multiple ways to code attacks against IE's vulnerabilities, and I think we'll continue to see more through the summer and early fall, at least until they prove to be unsuccessful."