 Home Industry Press Releases Industry Press Release Article
|
Tuesday: March 8, 2005 |
|
Aladdin Knowledge Systems Using Multiple Propagation Tactics New "Lirva.a" Trojan Can Disable Firewalls, Desktop Antivirus Applications, and Steal Passwords eSafe customers protected without signature updates CHICAGO, January 9, 2003 - Aladdin Knowledge Systems Ltd. (NASDAQ: ALDN) today announced its Content Security Research Team (CSRT) has raised the threat level for the latest mass-spreading Trojan, Win32.Lirva.a, from low to medium. This complex, multi-threat worm named after pop star Avril Lavigne, is quickly spreading by employing most known mass propagation tactics and a variety of surreptitious human engineering come-ons in its subject line. For more information: http://www.ealaddin.com/home/csrt/valerts2.asp?virus_no=11021 According to Aladdin's CSRT, eSafe Gateway, Mail and Appliance customers were protected proactively by XploitStopper™ which immediately blocked the MIME-type vulnerability Lirva.a exploits without requiring a signature update. About Lerva.a Also known as WORM_LIRVA.A, W32/Avril-A, or W32/Lirva.b@MM, Lirva.a is a mass-mailing worm which, in addition to propagating via email, is also capable of spreading over shared folders, instant messages, KaaZa peer-to-peer networks, and IRC (Internet Relay Chat). Upon infection of unprotected systems it attempts to terminate security-related applications and attempts to send the dial-up password on Win 9x and Win ME machines to its creator. The arriving email masks itself behind a variety of innocuous subject headers like "Avril Lavigne - the best, Re: Admission procedure," and others referring to messages information technology professionals might open like "Reply on account for IIS Security and Reply on account for Incorrect MIME-header." When the worm is executed it attempts to terminate a long list of executable process files, terminate open application windows with strings like "anti," "virus," "McAfee," or "Norton" in their title bars. It copies itself to the temporary folder, to the recycle bin on all drives, to peer-to-peer shared folder and finally to the Windows System folder. Lervil.a then creates a registry key which will execute the worm on every startup. To spread itself, the worm uses the system-defined outgoing mail server. It gathers mailing addresses from the Microsoft Outlook address book as well as any files with the following extensions: MBX, WAB, HTML, EML, HTM, TBB, SHTML, NCH, and IDX. Aladdin's Content Security Response Team already reports numerous infection attempts have been blocked proactively without the need for any update. Because it can create files, send email, enable information theft, stop firewall and anti-virus processes, and spread itself with human engineering ploys, it could wreak havoc and cause significant damage if it infiltrates an organization's network. "eSafe's proactive technology continues to prove its value," says Shimon Gruper, Aladdin's executive vice president, Internet Technology. "With a multi-faceted and well-engineered threat like Lirva.a, traditional anti-virus technologies that rely on scanning and updates won't be able to automatically stop its exploit-based attack. Our motto that 'Signature updates are too late' is proven with this latest threat." About eSafe eSafe's industry-leading content inspection features stop threats and increase employee productivity while reducing the load on corporate bandwidth. Picked as PC Magazine's Editors' Choice in July, 2002 and selected by the magazine as "Best Product of 2002 (Networking Category)" in January 2003, Aladdin's eSafe product suite includes eSafe Gateway, eSafe Mail and eSafe Appliance. eSafe is the only comprehensive suite of content security solutions on the market to provide proactive protection at the gateway against all forms of malicious content including viruses, vandals and worms. Much more than anti-virus protection, eSafe stops access to Web sites with inappropriate or malicious content such as hate literature or pornography, and can be configured to restrict outgoing emails that contain classified or prohibited content. Unique features found only in Aladdin's eSafe solutions include: XploitStopper™ - prevents exploitation of Internet Explorer, Outlook and other Internet applications' security holes by hackers, viruses and malicious code GhostMachine™ - catches encrypted and polymorphic viruses that use mutation and stealth techniques MacroTerminator™ - stops known and unknown Microsoft Office macro viruses SmartScript™ filtering - blocks known and unknown malicious VB and Java scripts attached or embedded in HTML formatted emails or web pages For more information on eSafe please visit http://www.esafe.com Aladdin Knowledge Systems Aladdin (Nasdaq: ALDN) is a leader in digital security, providing solutions for software commerce and Internet security since 1985. Aladdin serves over 30,000 customers worldwide. Aladdin's products include: the USB-based eToken device for user authentication and e-commerce security; the eSafe line of content security solutions that protect PCs and networks against malicious, inappropriate and nonproductive Internet-borne content; HASP and Hardlock, hardware-based software security systems that protect the revenues of developers; and Privilege, a software licensing and distribution platform. Please visit Aladdin's Web site at www.eAladdin.com. #### All trademarks and registered trademarks are the property of their respective holders. Press Contact: Steven E. Kuehn Aladdin Knowledge Systems, Inc. 847.637.4033 Aladdin Investor Contact: Evan Smith KCSA Worldwide 212-896-1209/212-896-1251 |