RE: New Trojan on the block [CIA Trojan]

[email protected] GCIA
pgpFingerPrint:9CE4 227B B9B3 601F B500  D076 43F1 0767 AF00 EDCC
Give a man a fish feed em for a day. Teach em to phish and feed em till
people quit falling for phishing attempts. 

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Nick 
> FitzGerald
> Sent: Sunday, August 29, 2004 5:08 PM
> To: [email protected]
> Subject: Re: [Intrusions] New Trojan on the block [CIA Trojan]
> 
> 
> Chris Norton wrote:
> 
> > As far as CIA goes thats what the group who coded it is 
> calling it [not
> > refering to the government agency] as taken from the readme 
> file CIA 1.23 PB
> > 1 ( Public Beta 1 ) ...
> 
> This being but one of dozens of obvious reasons why intelligent anti-
> malware folk do not name things as their makers wish...
> 
> <<rest snipped>>
> 
> I'm intrigued that, according to your first post, you 
> "submitted it to 
> the fine folks at ISC" and later seem 
> surprised/upset/concerned that no 
> AV detect it yet:
> 
>    As of this writing there are no known AV signatures available to
>    detect this new trojan and there have been over 2,800 downloads...
> 
>    ...but the actual client program that infects the machines still
>    goes by undetected.
> 
> I have no reason to believe the "fine folks at ISC" will not have, 
> eventually, forwarded samples to their antivirus contacts, 
> but sending 
> such suspect code to a network traffic reporting group, where malware 
> research would seem to be at least a secondary priority, is surely 
> introducing at least one, if not several, unnecessary delays to the 
> process of getting AV detection for something new and perhaps already 
> deployed to close to three thousand machines.

The "fine folks at ISC" do infact submit malware to the av vendors. 
They also have a malware team that does analysis of NEW malware. If you
provided contact infomation they usually follow up.


> 
> For your future reference, here is my standard list of 
> well-known major 
> AV developer suspect file submission addresses.  Note that 
> nowadays it 
> is probably advisable to use the submission method listed for 
> NAI/McAfee for all these addresses (and mention in the accompanying 
> message body that the .ZIP is encrypted and what the password is).
> 
>    Authentium (Command Antivirus)  <[email protected]>
>    Computer Associates (US)        <[email protected]>
>    Computer Associates (Vet/EZ)    <[email protected]>
>    DialogueScience (Dr. Web)       <[email protected]>
>    Eset (NOD32)                    <[email protected]>
>    F-Secure Corp.                  <[email protected]>
>    Frisk Software (F-PROT)         <[email protected]>
>    Grisoft (AVG)                   <[email protected]>
>    H+BEDV (AntiVir, Vexira engine) <[email protected]>
>    Kaspersky Labs                  <[email protected]>
>    Network Associates (McAfee)     <[email protected]>
>      (use a ZIP file with the password 'infected' without the quotes)
>    Norman (NVC)                    <[email protected]>
>    Panda Software                  <[email protected]>
>    Sophos Plc.                     <[email protected]>
>    Symantec (Norton)               <[email protected]>
>    Trend Micro (PC-cillin)         <[email protected]>
>      (Trend may only accept files from users of its products)
> 
> Most of these addresses are monitored either by 24x365 
> malware support 
> and analysis teams, or have distributed processing around the globe 
> providing (close to) 24x365 coverage.  Several have automated code 
> analysis systems that get the "first look" at submitted files, 
> classifying them for further attention or simply sending back canned 
> reports of the "we detect it in the DEF update that should 
> ship at X or 
> you can download a pre-QA copy at Y".  Depending on the nature of the 
> files you submit, you should get several quite prompt responses, at 
> some of which you'll have to ignore (e.g. a downloader detection is 
> pretty meaningless as the target of a downloader is usually 
> considered 
> to be a non-code variable and ignored by any semi-intelligent 
> detection 
> of that downloader, so the same downloader can be used multiple times 
> configured to snag stuff from different URLs and will always be 
> detected as the same downloader and variant).
> 
> 
> -- 
> Nick FitzGerald
> Computer Virus Consulting Ltd.
> Ph/FAX: +64 3 3529854
> 
> _______________________________________________
> Intrusions mailing list
> [email protected]
> http://www.dshield.org/mailman/listinfo/intrusions
> 
> 
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions