I used to do the same stuff, we didn't even see it as malicious back then, just a "prank" really. Most the people we "infected" were via IRC and ICQ, embedding the exe client into a JPG (or just changing the exe icon to a JPG one) and DCC'ing it to them.
Once infected, we'd screw around, make errors pop up on their screen like "Computer Is Low On Coffee, Please Insert Coffee Cup" then make CD tray eject, etc. Then we'd chat to them, and they usually had a good laugh, and we'd tell them how to not get infected in the future, then self-destruct the client.
We didn't really investigate it much or ponder the deeper implications behind it, so it took us a fair while to realise the level of maliciousness that was possible, which scared us off, so we stopped messing with it (we'd already been in trouble for other stuff so didn't want to push it!)
The fake resume idea is brilliant. How could I have overlooked that back in the days. All I did as a script kiddie was scanning IP ranges and playing with infected accounts. Good times.
You can add the contents of the .exe to the JPG but when the computer opens it then it isn't going to try and execute the code (it will try and render it as a graphic and probably fail) unless there is some unpatched exploit in the image viewer.
It would create a .exe file that was a simple image viewer and give it the standard .jpg icon. You would name it something like picture003.jpg.exe and most people's computer would conveniently hide the true file extension.
Comments
I used to do the same stuff, we didn't even see it as malicious back then, just a "prank" really. Most the people we "infected" were via IRC and ICQ, embedding the exe client into a JPG (or just changing the exe icon to a JPG one) and DCC'ing it to them.
Once infected, we'd screw around, make errors pop up on their screen like "Computer Is Low On Coffee, Please Insert Coffee Cup" then make CD tray eject, etc. Then we'd chat to them, and they usually had a good laugh, and we'd tell them how to not get infected in the future, then self-destruct the client.
We didn't really investigate it much or ponder the deeper implications behind it, so it took us a fair while to realise the level of maliciousness that was possible, which scared us off, so we stopped messing with it (we'd already been in trouble for other stuff so didn't want to push it!)
How did you embed the exe client into a jpg (rather than just changing the icon)?
IIRC, Sub7 had a tool which did this. You could also 'pack' the executable.
My infection vector of choice was embedding it into fake resumes and sending it to job ads...ahh, the memories...
The fake resume idea is brilliant. How could I have overlooked that back in the days. All I did as a script kiddie was scanning IP ranges and playing with infected accounts. Good times.
You can add the contents of the .exe to the JPG but when the computer opens it then it isn't going to try and execute the code (it will try and render it as a graphic and probably fail) unless there is some unpatched exploit in the image viewer.
It would create a .exe file that was a simple image viewer and give it the standard .jpg icon. You would name it something like picture003.jpg.exe and most people's computer would conveniently hide the true file extension.