The Not-So Malicious BadBunny Attacks OpenOffice

A new worm called BadBunny aims OpenOffice in attempts to install porn JPEG images from the Internet onto the infected computers. The infection occurs when users open and OpenOffice Draw file known as badbunny.odg. The malware tries to propagate by using different techniques. It uses viruses coded with JavaScript on Windows, Ruby on Mac, and Perl on Linux. The worm tries to send its copies to other PCs via XChat or MIRC file transfers.

SophosLabs director, Mark Harris observed that the worm tried to behave like old-school malware when their creators tried to flaunt their computer prowess. But the writer of this new worm appears to be less successful because Sophos could not find the malware to work. So Harris sent a message to the author asking him to perform a real job while not seek to be part of SophosLabs. Harris further added that the worm developer should think of a different career. ITWire reported this on May 22, 2007.

Sophos said they didn't find the worm 'in the wild' instead it came into picture only when its makers sent it directly to SophosLabs for analysis. The worm also downloads to show a porn picture of a woman in scanty dress together with a man in a rabbit's costume.

It seems those who had written BadBunny were not confident that it would spread automatically as they had sent it to SophosLabs, said Graham Cluley, senior technology consultant for Sophos. Hackers in the past had written quite a number of StarBasic malware, but the maximum this worm could get 'in the wild' is by showing an image of a furvert wandering in the forest, Cluley elaborated. ITWeek published Cluley's statement on May 21, 2007.

Graham Cluley further said that the traditional natured malware was apparently designed to flaunt proof-of-concept rather than sneak and steal information from users' computers. A hacker with a financial motive would have aimed at popularly used software and not added a quaint image as the sender of BadBunny has done. Cluley believes this malware would not spread in the wild unlike usual expectations, although it has used a picture of wildlife.

Related article: THE SPAM MAFIA

» SPAMfighter News - 5/29/2007