Members
  • Total Members: 12811
  • Latest: nodrog
Stats
  • Total Posts: 28506
  • Total Topics: 8238
  • Online Today: 849
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: DNS Trojan poses as iPhone unlocking utility (Trojan-BAT-AACL, blackra1n.exe)  (Read 2789 times)

0 Members and 1 Guest are viewing this topic.

Samker

  • SCF Administrator
  • *****
  • Posts: 7206
  • KARMA: 291
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum


An application that offers to unlock iPhones is actually designed to hijack internet connections on compromised Windows PCs, security watchers warn.

Spam messages direct potential victims to a domain called iphone-iphone.info that offers links to download a Windows executable called blackra1n.exe. The application claims to offer an unlock utility but instead it changes default DNS settings on infected Windows PCs, hijacking internet connections in the process.

Romanian anti-virus firm BitDefender, which identifies the executable as Trojan-BAT-AACL: http://www.bitdefender.com/VIRUS-1000599-en--Trojan.BAT.AACL.html , explains that the malware comes as a Windows batch file packed alongside the iPhone jailbreaking application.

"The Trojan attempts to change the preferred DNS server address for several possible Internet connections on the users’ computers to 188.210.[REMOVED]," BitDefender explains. "This allows the malware creators to intercept the victims’ calls to reach internet sites and to redirect them to their own malware-laden versions of those sites.": http://www.malwarecity.com/blog/iphone-unlocking-tricks-get-pcs-into-trouble-791.html

A write-up on the threat with screenshots can be found in a blog post by independent security researcher Dancho Danchev here: http://ddanchev.blogspot.com/2010/04/iphone-unlocking-themed-malware.html

DNS-contaminating malware has been used in the past to redirect users to counterfeit versions of online banking sites. The precise purpose of the malware in this case seems to be to infect compromised Windows PCs with yet more crud, earning hackers affiliate revenues in the process. The Trojan affects only the host Windows PC, not any connected iPhone.

(ElReg.)

Samker's Computer Forum - SCforum.info





 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising