Computer security experts worked through the night Thursday beating back an alarming Internet nemesis which threatened to steal personal information from Web users, who had little chance to protect themselves. By Friday morning, the incident was contained, and a large-scale attack never really materialized, most experts said. Still, the danger from the new method is very real, according to Microsoft Corp. and government officials. Both are on the lookout for inevitable variations which are sure to follow.
The complex multi-stage attack was considered so dangerous because it could infect Internet users who simply browsed well-known Web sites. Computer intruders had broken into Web servers around the world, in a coordinated effort, and placed secret code on company Web pages that allowed visitors' computers to be hijacked.
Those who visited an infected Web site were secretly redirected to a Web page hosted in Russia. Then a Trojan horse program was installed on victims' computers -- one that allowed the computer intruders to copy user names, passwords, credit card information, and other data.
Three separate software flaws
In designing the attack, the intruders took advantage of three separate software flaws: two in Microsoft's Internet Explorer Web browser, which allowed hijacking of individual computers, and one in Microsoft's Internet Information Services software, which is used to host Web pages. One of the Internet Explorer flaws hasn't been patched yet, Microsoft said. (MSNBC is a Microsoft - NBC joint venture.)
"We do view this threat as very real," said Microsoft Security Program Manager Stephen Toulouse. "We worked through the night on this."
Initial reports Thursday night said that popular Web sites were infecting visitors. The sites were not named. But there was little evidence a wide-scale attack materialized.
Anti-virus firms indicated few consumers had been hit with the Trojan horse -- Symantec Corp. had received under 10 reports from customers. Network Associates' Craig Schmugar could only find about 5 sites that had been hit with the malicious code. Microsoft said the number of impacted Web sites was "in the dozens." Meanwhile, the government's computer security arm, the CERT Coordination Center, put the number at fewer than 100.
Still, among the list of the affected Web sites were "several sites that are very popular," Marty Lindner, said a senior member of CERT's technical staff. He declined to name the sites, or to indicate if they were among the Internet's 50 most popular sites.
On the other hand, Symantec's Alfred Huger said he hadn't heard of any top sites distributing the malicious code.
"Have any big sites been infected? Not that we know of," he said. "EBay and PayPal were in no way infected, as far as we know."
What consumers can do
Still, CERT and the Department of Homeland Security issued warnings about the incident on Thursday night, and companies were told to make sure their Web sites were patched against the Internet Information Services flaw.
The immediate threat from Thursday night's incident has largely passed; the Russian Web site which installed the Trojan horse has been taken offline. But experts expect copycat attacks.
"It's quite possible the bad guys are altering it and we'll just have another round of this later," Lindner warned.
Consumers who believe their computers may already be infected can search for the files “Kk32.dll” or “Surf.dat” and remove them using anti-virus software.
There is no patch yet for consumers to use to protect themselves against a copycat incident which might follow. But they can still protect themselves by strengthening the security settings in Internet Explorer. Microsoft recommends clicking on Tools/Internet Options and selecting the security tab, then setting the Internet zone security level to high. That will prevent a variety of code from being installed on a users' machines by Web sites. By default, the setting is placed on medium.
Another way to avoid the Trojan horse is to use non-Microsoft browsers such as Mozilla and Opera. Security experts also said that the infection does not affect Macintosh versions of Internet Explorer.
More details are available on a special site Microsoft has published with information about the attack.