Trojan Spoofs Firefox Extension, Steals IDs

By Gregg Keizer, TechWeb Technology News 

An identity-stealing keylogger that disguises itself as a Firefox extension
and installs silently in the background was discovered Tuesday by security
vendor McAfee. 
According to the Santa Clara, Calif.-based company, the "FormSpy" Trojan
horse monitors mouse movements and key presses to steal online banking or
credit card usernames and passwords, other login information, and URLs typed
into Firefox, the popular open-source browser. Another component of the
Trojan sniffs out passwords from ICQ and FTP sessions, and IMAP and POP3
traffic, said McAfee. All collected information is sent to an IP address
hard-coded into the Trojan. 

The scam starts with spam posing as a message from the billing support
department of mega-retailer Wal-Mart, said Craig Schmugar, the virus
research manager at McAfee's Avert Labs. "There's an order number in the
message, which matches the number of the attachment," said Schmugar. "When
someone opens the attachment, the Trojan downloads and installs two
components, a keylogger as well as a sniffer." As of Tuesday afternoon,
FormSpy had gained little traction. 

But it's the way that FormSpy gets onto a machine that's unique, Schmugar
said. FormSpy masquerades as a Firefox extension, or browser add-on. It
spoofs Numberedlinks 0.9, an extension that in its legitimate form lets
users navigate links with the keypad. FormSpy uses some of the actual
extension's code to put its hooks into Firefox. 

Normally, Firefox extensions -- which in Windows have the .xpi file
extension -- display a confirmation dialog that the user must acknowledge
before the add-on installs. The bogus Numberedlinks, however, skips that. 

"The Trojan writes files directly to the Firefox folders without putting up
the confirmation," said Schmugar. Users who have been infected won't realize
that the bogus extension has been added to Firefox unless they call on the
Tools|Extensions command (in Firefox 2 Beta 1, Tools|Add-ons) and spot
"Numberedlinks 0.9" in the list. 

Firefox's extensions have been criticized for lax security, in particular
that they're not digitally signed to vouchsafe their contents. Schmugar said
FormSpy's disguise argues for revisiting the topic. 

"The Trojan is using a mechanism to get its code executed when it hooks into
Firefox [spoofing an extension]," he said, "and from a security model, that
kind of functionality is all over the place." Still, "better extension
security should be considered by Mozilla," he concluded. 

Because of similar -- and long-standing -- threats posed by ActiveX
controls, Microsoft has made several changes to Internet Explorer, including
blocking of virtually all such add-ons by default in the upcoming IE 7, to
protect users. ActiveX controls, unlike Firefox extensions, are also
digitally signed. 

"Over time, malware writers will find a way to leverage Firefox to their
advantage," said Schmugar. 

"Quite a number" of the original spammed messages were reported to McAfee,
Schmugar, said, but there had been "very little field submissions" of
FormSpy Trojan, so for the moment the threat remained low-level. 

"In all likelihood, some of those who received the spam did run the
attachment. But how many were using Firefox, we don't know." 


Justification
Downloader-AXM has been deemed Low-Profiled due to media attention at the
following website:
<http://www.techweb.com/wire/security/191101268;jsessionid=ZSIPNB4RIMFWUQSND
LOSKH0CJUNN2JVN>

Read About It
Information about Downloader-AXM is located on VIL at:
<http://vil.nai.com/vil/content/v_140257.htm>

Detection
Downloader-AXM was first discovered on July 25, 2006 and detection will be
added to the 4815 Dat files (Release Date: July 26, 2006).

Though we consider this a low threat, An EXTRA.DAT file may be downloaded
via the McAfee AVERT Extra.dat Request Page:
<https://www.webimmune.net/extra/getextra.aspx>

If you suspect you have Downloader-AXM, please submit a sample to
<http://www.webimmune.net>

Risk Assessment Definition
For further information on the Risk Assessment and Avert Labs Recommended
Actions please see:
<http://www.mcafee.com/us/threat_center/outbreaks/virus_library/risk_assessm
ent.html>



Mike Grant
Bytware, Inc.
775-851-2900 

http://www.bytware.com


CONFIDENTIALITY NOTICE:  This e-mail message and any attachment to this e-mail 
message contain information that may be privileged and confidential.  This 
e-mail and any attachments are intended solely for the use of the individual or 
entity named above (the recipient) and may not be forwarded to or shared with 
any third party.  If you are not the intended recipient and have received this 
e-mail in error, please notify us by return e-mail or by telephone at 
775-851-2900 and delete this message.  This notice is automatically appended to 
each e-mail message leaving Bytware, Inc.