Open source software security

Holy Klez Batman!

30 November -0001
By: Justin
04/30/2002

What is the Klez virus? The Klez virus is an insideous little program that uses fake "From:" and "Subject:" fields in email to spread itself by attachment. I first noticed the Klez virus because I was getting mail bounced to my address that I did not send. At first I thought I might be infected by the Klez virus (it uses and old vulnerability in Outlook and Internet Explorer (if you haven't already, head to http://windowsupdate.microsoft.com, and click on 'Product Updates' to check the list for available Microsoft Office updates and PATCH YOUR SYSTEMS)). The Klez virus spreads as an attachment that doesn't necessarily need to be opened to run (if you've got an unpatched system). The attachment downloads the virus payload to your computer and begins to use it to send bogus and virus laden emails to various addresses stored on your hard drive. The bounces I was getting were failed attempts to spoof mail from me to potential recipients. Be wary of any strange emails these days (especially vicious is one variant of the Klez virus that purports to be bounced email with the original attached). Here's a Klez message opened with Notepad, note the signature Subject "japanese lass' sexy pictures":

[Begin Infected Message]

ࡱ                >  	                                       







            	      
         
                                       







R o o t   E n t r y                                                  
           F             WS         _ _ n a m e i d _ v e r s i o n 1 . 0                           (                         =S ѰS            _ _ s u b s t g 1 . 0 _ 0 0 0 2 0 1 0 2                         *                                         0       _ _ s u b s t g 1 . 0 _ 0 0 0 3 0 1 0 2                         *                                               (       
                !   "   #   $   %   &   1   9   :   ;   <   =   >   ?   @   A   B   C   D   G   M   N   


V)MU|  
            F           F                           ?                                          X - U I D L    X - R C P T - T O                                                                                                                                                                                                                ?                                                            wV                                                          _ _ s u b s t g 1 . 0 _ 0 0 0 4 0 1 0 2                         *                                        &       _ _ s u b s t g 1 . 0 _ 1 0 0 2 0 1 0 2                         *                                                     _ _ s u b s t g 1 . 0 _ 1 0 0 F 0 1 0 2                         *                                               _ _ s u b s t g 1 . 0 _ 1 0 1 6 0 1 0 2                         *                                                      _ _ s u b s t g 1 . 0 _ 1 0 1 7 0 1 0 2                         * 	                                                 _ _ s u b s t g 1 . 0 _ 1 0 1 8 0 1 0 2                         *                                                _ _ s u b s t g 1 . 0 _ 0 0 1 A 0 0 1 E                         *                                              	       _ _ s u b s t g 1 . 0 _ 0 0 3 7 0 0 1 E                         *                                     	   '       IPM.Note                                                        Re:jkeane,japanese lass' sexy pictures                          SMTP:INFO@THOMASCIRCLESINGERS.ORG                               Re:                                                                 ?+?n T    Justin Keane SMTP jkeane@saint-vitus.com                                                                Justin Keane                                                        ?+?n T   info SMTP info@thomascirclesingers.org  _ _ s u b s t g 1 . 0 _ 0 0 3 B 0 1 0 2                         * 
                                          
   "       _ _ s u b s t g 1 . 0 _ 0 0 3 D 0 0 1 E                         *                                               _ _ s u b s t g 1 . 0 _ 0 0 3 F 0 1 0 2                         * 
                                             A       _ _ s u b s t g 1 . 0 _ 0 0 4 0 0 0 1 E                         *                                        
       _ _ s u b s t g 1 . 0 _ 0 0 4 1 0 1 0 2                         *                                              ?       _ _ s u b s t g 1 . 0 _ 0 0 4 2 0 0 1 E                         *                                               _ _ s u b s t g 1 . 0 _ 0 0 4 3 0 1 0 2                         *                                              A       _ _ s u b s t g 1 . 0 _ 0 0 4 4 0 0 1 E                         *                                        
       info                                                                ?+?n T     Justin Keane SMTP <BR>jkeane@saint-vitus.com                                                                 Justin Keane                                                     SMTP:JKEANE@SAINT-VITUS.COM<BR>                                     SMTP:JKEANE@SAINT-VITUS.COM                                      SMTP                                                           info@thomascirclesingers.org                                     _ _ s u b s t g 1 . 0 _ 0 0 5 1 0 1 0 2                         *                                                     _ _ s u b s t g 1 . 0 _ 0 0 5 2 0 1 0 2                         *                                               _ _ s u b s t g 1 . 0 _ 0 0 6 4 0 0 1 E                         *                                                     _ _ s u b s t g 1 . 0 _ 0 0 6 5 0 0 1 E                         *                                               _ _ s u b s t g 1 . 0 _ 0 0 7 0 0 0 1 E                         *                                               '       _ _ s u b s t g 1 . 0 _ 0 0 7 5 0 0 1 E                         *                                               _ _ s u b s t g 1 . 0 _ 0 0 7 6 0 0 1 E                         *                                                     _ _ s u b s t g 1 . 0 _ 0 0 7 7 0 0 1 E                         *                                               Re:jkeane,japanese lass' sexy pictures                          SMTP                                                            jkeane@saint-vitus.com                                          SMTP                                                            jkeane@saint-vitus.com                                          Received: from mail2.virtualscape.com [66.40.255.150] by Mail4.Virtualscape.com with ESMTP 
  (SMTPD32-6.06) id A82DCB300FE; Wed, 24 Apr 2002 22:21:33 -0400 
 Received: from Tvg [208.59.78.147]_ _ s u b s t g 1 . 0 _ 0 0 7 8 0 0 1 E                         *                                                     _ _ s u b s t g 1 . 0 _ 0 0 7 D 0 0 1 E                         *                                              _ _ s u b s t g 1 . 0 _ 0 C 1 9 0 1 0 2                         *                                           '   ?       _ _ s u b s t g 1 . 0 _ 0 C 1 A 0 0 1 E                         *                                     (           by mail2.virtualscape.com<BR>
   (SMTPD32-6.06) id A6DCAE100D6; Wed, 24 Apr 2002 22:15:56 -0400<BR>
From: info <info@thomascirclesingers.org> 
To: jkeane@saint-vitus.com<BR> 
Subject: Re:jkeane,japanese lass' sexy pictures 
MIME-Version: 1.0<BR> 
Content-Type: multipart/alternative; 
	boundary=NRnewm09KsgpS 
Message-Id: <200204242215734.SM00215@Tvg> 
Date: Wed, 24 Apr 2002 22:16:00 -0400 
X-RCPT-TO: <jkeane@saint-vitus.com> 
X-UIDL: 268856706<BR> 
Status: U<BR>  

     ?+?n T   info SMTP info@thomascirclesingers.org  info                                              SMTP:INFO@THOMASCIRCLESINGERS.ORG                                SMTP                                                             info@thomascirclesingers.org        <BR>                                                                                                                                                            jkeane@saint-vitus.com                                           jkeane,japanese lass' sexy pictures                            _ _ s u b s t g 1 . 0 _ 0 C 1 D 0 1 0 2                         *    $                                       )   "       _ _ s u b s t g 1 . 0 _ 0 C 1 E 0 0 1 E                         *                                     *          _ _ s u b s t g 1 . 0 _ 0 C 1 F 0 0 1 E                         * !   #                                       +          _ _ s u b s t g 1 . 0 _ 0 E 0 2 0 0 1 E                         *                                     ,          _ _ s u b s t g 1 . 0 _ 0 E 0 3 0 0 1 E                         * "   (                                       -          _ _ s u b s t g 1 . 0 _ 0 E 0 4 0 0 1 E                         *                                     .          _ _ s u b s t g 1 . 0 _ 0 E 1 D 0 0 1 E                         * %   '                                       /   $       _ _ s u b s t g 1 . 0 _ 1 0 1 3 0 0 1 E                         *                                     0   s       <HTML><HEAD></HEAD><BODY>
<iframe src=cid:X4kcJ39766b height=0 width=0>
</iframe>
<FONT></FONT></BODY></HTML>
              <200204242215734.SM00215@Tvg>                                   O̥gHJO:_]l                                                mail.saint-vitus.com                                            00000001jkeane@saint-vitus.com                                 268856706                                                       <jkeane@saint-vitus.com>                                        _ _ s u b s t g 1 . 0 _ 1 0 3 5 0 0 1 E                         *  &   *                                       2          _ _ s u b s t g 1 . 0 _ 3 0 0 B 0 1 0 2                         *                                     3          _ _ s u b s t g 1 . 0 _ 8 0 0 1 0 0 1 E                         * )   ,                                       4          _ _ s u b s t g 1 . 0 _ 8 0 0 2 0 0 1 E                         *                                     5           _ _ s u b s t g 1 . 0 _ 8 0 0 3 0 0 1 E                         *  +   .                                       6   
       _ _ s u b s t g 1 . 0 _ 8 0 0 4 0 0 1 E                         *                                      7          _ _ p r o p e r t i e s _ v e r s i o n 1 . 0                   0 -   /                                       8   0      _ _ r e c i p _ v e r s i o n 1 . 0 _ # 0 0 0 0 0 0 0 0         :  1                        WS WS                                          @ 0   0}S@ 0   0}S                   0ѧw                  E        E                 	       &             6             7    (      @ 9     09$;    "     ?    A      @    
      A    ?      B          C    A      D    
      Q         R          d           e           p    '       u           v           w           x           }            ?                  "                         @                   s       5         0         ?   o       `b                                                
                 =              $    E                                                                                   ?+?n T   jkeane@saint-vitus.com SMTP jkeane@saint-vitus.com                                                      _ _ s u b s t g 1 . 0 _ 0 F F 6 0 1 0 2                         *                                     E          _ _ s u b s t g 1 . 0 _ 0 F F F 0 1 0 2                         * 0   3                                       F   K       _ _ s u b s t g 1 . 0 _ 3 0 0 1 0 0 1 E                         *                                     H          _ _ s u b s t g 1 . 0 _ 3 0 0 2 0 0 1 E                         *  2   5                                       I          jkeane@saint-vitus.com                                          SMTP                                                            jkeane@saint-vitus.com                                          SMTP:JKEANE@SAINT-VITUS.COM                                                           K      0          0          0         0                  0       I~1                                                                                                                         _ _ s u b s t g 1 . 0 _ 3 0 0 3 0 0 1 E                         *                                      J          _ _ s u b s t g 1 . 0 _ 3 0 0 B 0 1 0 2                         * 4   6                                       K          _ _ p r o p e r t i e s _ v e r s i o n 1 . 0                   0                                      L                                                                               
<p>
<FONT></FONT></BODY></HTML>

Obviously suspicious, the <iframe> tag is really worrisome since that's a favorite way to bypass Outlook security. If you're using a text based mail client (like Madirish webmail) you're safe of course. The best way to protect yourself from Klez is to make sure you've got an up to date virus checker. Symantec has also released a Klez checker tool and instructions for use at:

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

For more information on the Klez virus take a look at:

http://www.tripwire.com/press/integrity_alerts/ia030602b.cfm

http://antivirus.about.com/library/blklez.htm

http://www3.ca.com/solutions/collateral.asp?CT=65&ID=1705

http://www.wired.com/news/technology/0,1282,52174,00.html