3 ms·

I worked at a very large company that had a email virus move quickly through the ranks... The subject of the email was "Please see attached documens" in which

by r0m4n0 11y ago

I worked at a very large company that had a email virus move quickly through the ranks... The subject of the email was "Please see attached documens" in which a PDF was attached that upon opening would hijack your email account and send the same. Over the first day, I had about 100 emails from coworkers in my inbox. After our "IT Security" team sent out an email claiming they stopped the threat, the following day more emails came from coworkers that was a slight variant but had more typos. I still wonder what sort of breach occurred and whether our internal teams performed a true investigation... obviously a foreign intrusion and they managed to at least gain control of quite a few internal machines. I still get a laugh out of using the same subject in an occasional email to coworkers...

FlyingLawnmower 11y ago
As someone totally ignorant in this space, how does opening a .PDF document allow for email hijacking (assuming it was actually a PDF)? I think I'm stuck at how code is able to execute when opening a document inside a PDF viewer or something of the sort. Thanks for sharing your story!
- aaronbasssett 11y ago
  PDFs support scripting as well as the ability to embed other media such as Flash files. http://www.malwaretracker.com/pdfthreat.php http://www.malwaretracker.com/pdfthreat.php
- cocolos 11y ago
  If it's a pdf it could be a bug in Adobe Reader that allows the hackers to spread a virus
- CiPHPerCoder 11y ago
  Usually some variant of: The PDF file contains binary data somewhere within it that will cause a particular PDF reader to misallocate memory. Because data and code are jammed next to each other when you run a program, a clever memory misallocation can be used to rewrite the program (the PDF reader) as it executes in order to execute whatever malicious commands the author of said PDF file intends. The typical defenses against these attacks include: * Exploit mitigation tools, such as EMET * Writing applications to be more memory-safe * Various other tactics, many of them disingenuous.

by r0m4n0 11y ago

FlyingLawnmower 11y ago

As someone totally ignorant in this space, how does opening a .PDF document allow for email hijacking (assuming it was actually a PDF)? I think I'm stuck at how code is able to execute when opening a document inside a PDF viewer or something of the sort. Thanks for sharing your story!

aaronbasssett 11y ago
PDFs support scripting as well as the ability to embed other media such as Flash files. http://www.malwaretracker.com/pdfthreat.php http://www.malwaretracker.com/pdfthreat.php
cocolos 11y ago
If it's a pdf it could be a bug in Adobe Reader that allows the hackers to spread a virus
CiPHPerCoder 11y ago
Usually some variant of: The PDF file contains binary data somewhere within it that will cause a particular PDF reader to misallocate memory. Because data and code are jammed next to each other when you run a program, a clever memory misallocation can be used to rewrite the program (the PDF reader) as it executes in order to execute whatever malicious commands the author of said PDF file intends. The typical defenses against these attacks include: * Exploit mitigation tools, such as EMET * Writing applications to be more memory-safe * Various other tactics, many of them disingenuous.