WastedTimes

[hbgator]

Here's a new way to get micros0ft to pay attention to you: Slip a brief message into the malicious Trojan horse program you just wrote.

That's what an unnamed Russian hacker did recently with a variation of Win32/Zlob, a Trojan program victims are being tricked into installing on their computers.

The message is surprisingly cordial, given that micros0ft's security researchers spend their days trying to put people like Zlob's author out of business. "Just want to say 'Hello' from Russia. You are really good guys. It was a surprise for me that micros0ft can respond on threats so fast," the hacker wrote, adding, "Happy New Year, guys, and good luck!"

Zlob is one of the most common types of Trojan programs used to attack Windows these days. In a typical Zlob scam, the victim is sent a link to what looks like an interesting video. When the link is clicked, the user is told to install a multimedia codec file in order to watch the video. That file is actually malicious software.

It's not clear whether the author of this message is the creator of Zlob, according to Joe Stewart, a researcher with SecureWorks. That's because "Zlob is one of those things that gets mislabeled by AV companies a lot," he said via e-mail. "Basically any time they see malware being spread by 'you need this video codec...' messages in multimedia files, it gets the Zlob label."

This isn't the first time this particular hacker has sent a note to micros0ft's security group. Last October he wrote a slightly creepy message, saying, "I want to see your eyes the man from Windows Defender's team."

Unlike the October message, this latest note wasn't caught by micros0ft. It was found Friday by a French security researcher using the hacker handle S!Ri.

According to this latest message, it may be the Zlob hacker's last note to micros0ft. "We are closing soon," he wrote. "So, you will not see some of my great ideas in that family of software."

"It warms my heart that they're 'closing soon,'" wrote micros0ft spokesman Tareq Saade in a blog post Friday.

All things considered, hiding messages in source code may not be the most effective way of reaching the Windows Defender team. "Considering the enormous amount of malware we go through every day, it can be difficult to track follow up samples like this," Saade wrote.

The hacker also claimed that micros0ft had once offered him a job to help improve Windows Vista's security. micros0ft hired a large number of outside security consultants to test Vista's code before it was released in late 2006. "It's not interesting for me," the hacker concluded. "Just a life's irony."

[Mop]

Sad lot , those hackers.

Crating havoc on PC's all over the world with the click of the mouse.

I hope a lot of them get caught and locked up.

And no use of any PC while in there of course...just damn hard work that will get their soft work-wary hands full of blisters....

[peiratns]

Mop, look-up the meaning of hacker at http://en.wikipedia.org/wiki/Hacker_(computer_security).
Those people you are referring to are called "crackers".

[jkf]

I was just thinking... its always the opposite of what we want it to be...

as most of us find software that is cracked by hackers useful,
but avoid code hacked by crackers because its dangerous...

[Mop]

I try to stay clear of that sort of software lately...I heard too many bad stories about them...)