By Sharon Gaudin, InformationWeek
Can't wait to find out what happens to Harry Potter when the final
book in the series comes out this month? Be careful where you get your
spoilers from.
Security researchers are warning people not to be lured in by online
promises of information about the outcome of the final battle at
Hogwarts. Sophos Inc. reported that a new worm is taking advantage of
the Potter mania that is starting to build around the world.
The worm, which is hidden in USB drives, isn't particularly damaging,
according to Allysa Myers, a researcher with McAfee Avert Labs. In her
blog, Myers said the worm "doesn't try to steal any system
information, diddle with your data, or own your box -- it just makes
system changes such that your system becomes largely unusable."
With the millions of people waiting with bated breath for the final
Harry Potter novel, and the premiere of the new movie coming in less
than two weeks, hackers will be tempted to take advantage of the
excitement, Graham Cluley, senior technology consultant for Sophos,
said.
"There is a real danger that muggles will blindly allow their USB
flash drives to auto-run and become infected by this worm," he said in
a written statement. "Using such social engineering at this time is a
trick dastardly enough for Lord Voldemort himself."
The final installment in J.K. Rowling's seven-book series, "Harry
Potter and the Deathly Hallows," is set to be released on July 21. The
previous book was the fastest-selling book in U.S. history, selling
6.9 million copies in the United States in the first 24 hours,
according to a report on CNN.
The W32/Hairy-A worm is set up to automatically infect a PC when users
plug-in USB drives, which carry a file posing as a copy of the
novel. If users allow USB drives to "auto-run" they will see a file
called HarryPotter-TheDeathlyHallows.doc. Inside the Word file is the
simple phrase, "Harry Potter is dead." Sophos researchers report the
worm then looks for other removable drives to infect.
After infecting Windows computers, the worm creates a number of new
users, namely the book's main characters -- Harry Potter, Hermione
Granger and Ron Weasley. After logging in, users are shown the
following message via a batch file: "read and repent; the end is near;
repent from your evil ways O Ye folks; lest you burn in hell ... JK
Rowling especially."
Cluley explained in an interview that the malware writer originally
embedded the worm on a USB memory stick and then simply got it into
the hands of an unsuspecting user. The malware spreads when a user
shares the stick with a friend or colleague who wants to access a file
on it. A user might go to a meeting and share the stick with everyone
in the room, spreading the worm further. The trick, said Cluley, is
not to use a memory stick that you just pick up somewhere.
"This is an 'old school' virus, written to give the author a platform
to show off rather than to steal identities or cash," said
Cluley. "This person isn't being driven by the desire to inflate his
or her bank account, but by a loathing for JK Rowling and her
incredibly popular books."
Copyright 2007 CMP Media LLC.
Sharon Gaudin, Information Week (cmp@telecom-digest.org)