Printers Across the US, India, Europe Succumb To Virus

[Anonymous]

Printers Across the US, India, Europe Succumb To Virus

Office printers across the US, India, Europe and South America are spewing out thousands of pages of nonsense, due to a malicious program called Milicenso. IT departments can’t be happy, and neither can office managers who will have to place orders to restock paper supplies.

Security firm Symantec wrote in a blog post that an outbreak of the Trojan.Milicenso has spread over the past two weeks, triggering massive print jobs typing up company resources. The hardest hit were businesses in the US and India, however certain regions in Europe and South America were also affected.

Trojan.Milicenso was first noticed in 2010, and has been adapted many times to cause different outcomes; the most recent outcome being office printers. As Trojan.Milicenso is somewhat of a malware-for-hire, it’s been used most recently to distribute adware to French speaking users and was reported as Adware.Eorezo.

Delivery of the malicious program comes in many forms. In many cases computers will become infected – and then transmit to printers – through email attachments, though visiting websites hosting malicious scripts also spreads the infectious program. “The latter often unintentionally occurs when a user clicks on a link in an unsolicited email,” Symantec posted on its blog.

The internet security company also said it has encountered a large number of samples that appear to be packaged as a fake codec, or program delivery. These are distributed as files with random file names, and a “.exe” or “.dll” extension. The encrypted name makes it difficult to identify. What makes it more difficult to identify and eliminate? “The decryption key itself is encrypted using a value that is unique to the compromised computer,” says the Symantec blog post. The post explains that the unique value is 16 bytes in length, and is generated using the time when the System and System Volume Information folders were created. The unique value is used to encrypt the main DLL decryption key, to add to the subterfuge, and make removal more difficult.

The Trojan.Milicenso is somewhat difficult to identify and remove because it uses adware as a decoy, which detracts attention from the infection itself. In many cases, according to Symantec, the malware is able to evade detection and in many cases be categorized as a low risk, and actually be dismissed by many virus protection programs. In the case of the this particular flavor of Trojan.Milicenso that makes office printers go through reams of paper and cartridges of printer ink, the malware has a devastating effect on business.

Office printers are affected by this case of Trojan.Milicenso, because of a new script written into the malicious code, according to Symantec. During the infection phase, a .spl file is created that looks something like [DRIVE_LETTER]system32/Spool/PRINTERS[RANDOM].spl. The .spl file is actually an executable file, which is detected as Adware.Eorezo. At this point, any files in that folder will trigger print jobs.

Symantec says it believes the garbled printouts appear to be a side effect of the infection vector.ICS Diary, the Internet Storm Center website that’s part of the SANS Technology Institute, also has reports on the virus, with details about top-level files names and some of the sites running drive-by downloads of the malware.“The beauty of this unexpected malware behavior is that it can easily be detected throughout the organization printers and servers, although at the expense of wasting precious paper, and trees as a consequence. Let’s save the planet! … and don’t forget this is a good opportunity to evaluate the security of your printing architecture,” the ICS Diary says in a blog post. The post identifies printing architecture security as network isolation, access controls and printer management.

[Author]

June 26, 2012 at 11:01 AM