Researcher: Small attack triggered Microsoft emergency patch

Trojan that prompted out-of-cycle Windows update infected 200 machines

The Trojan horse whose attacks convinced Microsoft to issue an emergency patch for Windows had infected only about 200 computers prior to the fix's October 23 release, a security researcher said Tuesday.

Joe Stewart, director of malware research at SecureWorks, tracked down "Gimmiv," the Trojan that started the rush to patch. By accessing three control servers used by Gimmiv's makers, downloading log files and then decrypting the encrypted data, Stewart was able to pinpoint its origin, the first evidence of its spread and the overall number of infected PCs.

Twelve days ago, Microsoft warned of a critical vulnerability in the Windows Server service, which is used by all versions of the operating system, including client editions, to connect to file and print servers on a network. Hackers were already exploiting the bug in what Microsoft called "limited, targeted attacks," the company said as it issued a patch outside its normal second-Tuesday-of-the-month schedule.

Gimmiv, which Microsoft tagged as "Win32/MS08067.gen!A" instead, was identified as the malware that prompted the emergency patch.

It first popped up August 20 and was probably written by a South Korean hacker, said Stewart. According to the log files, however, the Trojan was present at only two IP addresses in August, and then only briefly. "One of these IP addresses, located in Korea, we can tell was running Gimmiv in a VMware virtual machine, exactly the kind of thing you might expect someone testing a piece of malicious mobile code to do," said Stewart.

Not until September 29, however, did Gimmiv show up "in the wild" as log files noted an infected PC in Hanoi, Vietnam. All told, approximately 200 machines in 23 countries were successfully attacked by Gimmiv between September 29 and October 23, when Microsoft released its out-of-cycle fix. Many of the machines were on two networks in Malaysia, and few systems outside of Asia were compromised.

The log files recorded just one hacked machine in North America, for instance.

"But we had just as many questions after this as before," said Stewart, who ticked off a long list of unusual characteristics of Gimmiv. "They weren't the worst programmers ever, but it seemed like this was put together quickly. It almost felt like a half-finished program."

Stewart found lots of debug code in Gimmiv, as well as code that led nowhere. "Sections were supposed to do something, but never did," he said. "For example, it pings a Web site in China and then if that's not available, Google. It sends a special pattern in the ping but doesn't do anything with the results.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags microsoft patchestrojan

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Ada Chan

Dynabook Portégé X30L-G

I highly recommend the Dynabook Portégé® X30L-G notebook for everyday business use, it is a benchmark setting notebook of its generation in the lightweight category.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?