Malware targeted at Syrian activists can operate webcam, disable AV, keylog, steal passwords

A fake PDF purporting to contain information on "the formation of the leadership council of the Syrian revolution" is circulating. As the Electronic Frontier Foundation's Eva Galperin and Morgan Marquis-Boire report, it's bad news for people who install it.

The latest surveillance malware comes in the form of an extracting file which is made to look like a PDF if you have file extensions turned off. The PDF purports to be a document concerning the formation of the leadership council of the Syrian revolution and is delivered via Skype message from a known friend. The malware installs a remote administration tool called DarkComet RAT, which can capture webcam activity, disable the notification setting for certain antivirus programs, record key strokes, steal passwords, and more. It sends this data back to the same IP address in Syrian IP space that was used in several previous attacks, including the attacks reported by CNN in February, the Xtreme RAT Trojan EFF reported in March, and this sample from March 21st.
Syrian Internet users should be extremely cautious about clicking on suspicious-looking links, or downloading documents over Skype, even if the document purportedly comes from a friend.

Campaign Targeting Syrian Activists Escalates with New Surveillance Malware

I write books. My latest is a YA science fiction novel called Homeland (it's the sequel to Little Brother). More books: Rapture of the Nerds (a novel, with Charlie Stross); With a Little Help (short stories); and The Great Big Beautiful Tomorrow (novella and nonfic). I speak all over the place and I tweet and tumble, too.

MORE: arab spring • malware • security • syria • web theory

More at Boing Boing

Eurovision 2013: An American in London

The technology that links taxonomy and Star Trek

http://www.facebook.com/people/Christopher-Lee/100001074475538 Christopher Lee

And yet STILL the default behavior for Windows is to hide file extensions. Yeesh.
- http://disqus.com/Kimmoth/ Kimmo
  
  Thankfully, changing that option is the first step in a zillion how-tos of almost any kind relating to files…
  
  A small part of me feels like anyone who doesn’t know what a file extension is in 2012 is pretty much digital cannon fodder anyway…
- http://aqfl.net Ant
  
  Macs do this too. :(
Justin L

Pro-Tip: If Windows says something with a PDF icon is a screen saver then it prolly isn’t a PDF.

And yeah, windows should stop hiding file extensions by default. Not that I think it would make much difference…
- http://twitter.com/incarnedine_v Dan Hibiki
  
  not that the extension will help. Stupid people will still click it.
henrygee001

hola, this is so true.
spejic

I agree about the stupidity of not seeing extensions given Windows uses that information for its behavior. But in most Explorer views, you can still see this is a screen saver, not a data file, and screen savers are frequent vectors of malware. What people need to know are the types of files Windows treats as programs besides the common .exe.
Ipo

I guess Syrian activists would be better off using Anonymous-OS.
catherinecc

Hmm, IP address is known? Perhaps a nice and happy target for a ddos…