New OpenOffice proof-of-concept widely noted
Odd payload, not spreading danger, brings attention to cross-platform worm.
A new proof-of-concept malware exploiting the OpenOffice document format has made headlines across the world,
despite little chance of affecting users in the wild. The worm, dubbed SB/BadBunny-A by Sophos, has gathered
wide media coverage thanks to its strange payload, a downloaded pornographic image of a man dressed in a furry
rabbit costume.
The free, open-source OpenOffice suite, backed by Sun
Microsystems, includes a macro language called StarBasic, which the worm uses to drop its payloads and
spread. Several attempts at writing malware for OpenOffice have been seen in the past, but this is thought to
be the first which is capable of spreading if run on different operating systems.
It is designed to act differently under Mac, Linux and Windows to ensure it can still
operate in each environment, dropping files written in Ruby, Perl or JavaScript and manipulating popular chat
systems. It also attempts to attack the websites of several anti-virus companies.
Like many proof-of-concept malware attempts, the worm is thought to have been submitted by its creators and is not
thought to have been seen by anyone outside a virus lab. Commentary on the discovery can be found at
Sophos here and
here, with more technical analysis
here.
23 May 2007
Tags:
macro, openoffice, proof-of-concept, virus, worm.
del.icio.us 
digg this
