Security threats Toolkit

Viruses get political

Tags:
Viruses,
Fathers 4 Justice,
Worm

Dan Ilet ZDNet.co.uk

Published: 26 Jan 2005 16:50 GMT

Two viruses slowly spreading over the Internet contain messages of support for the Fathers 4 Justice campaign.

Antivirus company Sophos has received reports of mass-mailing email viruses Mirsa-A and Mirsa-B -- two worms that contain messages warning the UK government to listen to the campaign, which describes itself as 'a new civil rights movement campaigning for a child's right to see both parents and grandparents'.

Fathers 4 Justice deny any link to the worm. "We know nothing about this. It's not really our style," said a campaign spokesperson.

The creation of these worms suggests that some individuals are turning to malware as a way of promoting causes they support, rather than just to cause disruption or to aid other criminal activities such as online fraud.

They travel as email attachments and use social engineering techniques to entice the reader to open them. Emails sent containing the Mirsa-A attachment claim to carry a CV, whereas Mirsa-B uses subject lines such as "How NOT to get Promotion", "Memorandom to all staff [sic]" and "Private and personal".

"Whoever wrote these viruses is clearly supportive of the Fathers 4 Justice campaign," said Graham Cluley, senior technology consultant for Sophos. "But rather than dressing up as Batman and clambering up the walls of Buckingham Palace to show his support, he has turned to computer crime. It is doubtful this will be the last time a virus will be used to spread a political message."

If the attached files are run, the worms replicate and email themselves to contacts stored in the Windows Address Book. It randomly attempts to turn off mouse and keyboard functionality and tries to shutdown the computer.

At the same time, Mirsa-B creates a desktop icon, which when opened displays two links -- the first linking to the Fathers 4 Justice Web site, and the second to a message created by the worm stored on the computer.

Cluley said that the virus was created by a group called the UK Binary Division, which had named the virus MRSA after a hospital virus.

"They wanted to call it 'MRSA'," said Cluley. "That's why we called it Mirsa. We don't call it the same as the virus writers because it strokes their egos too much."