Earlier this week, Microsoft shipped an emergency out-of-band patch to block zero-day attacks against a code execution hole in the way Windows handles animated cursor (.ani) files. This gallery provides a visual look at elements of the hacker attacks, including malicious Web sites, the exploit in action and the adult-themed spam-run linked to the attacks.\r\n
\r\nAnimated cursors are a feature that allows a series of frames to appear at the mouse pointer location instead of a single image. The Animated Cursors feature is designated by the .ani suffix. \r\n
Image source: F-Secure.
Exploit Prevention Labs offers a LinkScanner service that pinpoints Web-based exploits. This image shows that a prominent news site was rigged with a .ani exploit.
Determina researcher Alexander Sotirov proved that .ani exploits could be launched against Firefox users. This shows an exploit against Firefox running on Windows Vista. \r\n
Image source: Determina.
Evidence shows that several Chinese sites were rigged with IFRAME exploits launching .ani attacks. \r\n
Source: Websense Security Labs.
A Chinese Web forum launches drive-by downloads on vulnerable Windows users.\r\n
Source Websense Security Labs.
More evidence of Chinese sites rigged with .ani exploits.\r\n
Source Websense Security Labs.
At the height of the attacks, e-mail spam lures promising “hot Britney pics” were being used.\r\n
\r\nSource: Websense Security Labs.
From the first public report by malware-test on March 27 until today, the day after MS07-017 was released, you can see nearly day on day doubling or worse.\r\n
Source: Arbor Networks.
On April 3, a week after the first attack reports surfaced, Microsoft shipped an out-of-band update that includes patches for seven vulnerabilities.
Ryan Naraine is a ServerWatch, eSecurity Planet, and eWEEK contributor.
