You've probably seen strange comments under YouTube videos more than once. Spam can take unexpected forms, and some messages don't make any sense to a human. After two years of research, the folks at F-Secure published information about Janicab, a malware variant that communicates with its command-and-control servers through fake comments on YouTube.
Malware Does More Than Steal Data
Many users think they have nothing worth stealing, but stealing information is just one of many activities that malicious software can carry out. Hijacking an email account to send spam, turning your computer into a botnet zombie, injecting ads, or holding personal data hostage might not have much impact individually, but when millions of users enter the equation, the result changes completely. Another ability that certain malware variants have developed is using the infrastructure of large services, like social networks. Facebook and Twitter fight daily against malicious spam, but the case of Janicab, published by F-Secure, moves the interest to YouTube.
Small test videos appeared on the service with comments that adopt a format similar to “our 49741276945318th psy anniversary”. The presence of these strange comments has also spread to Google Plus, and without further data, they seem like nothing more than spam generated by an erratic bot. What F-Secure discovered is that the number in the comment hides the encrypted IP address of the command-and-control servers linked to Janicab.
How Janicab Infects Systems
F-Secure explains that Janicab enters a Windows computer through CVE-2012-0158, a buffer overflow in the ListView and TreeView controls of the MSCOMCTL.OCX file, which is triggered by a “custom-made” .DOC or .RTF file opened in Office 2003, 2007, and 2010. This vulnerability was patched by Microsoft years ago, and as an alternative, Janicab began infecting systems with an .LNK file that carries a bit of VBScript “extra” inside.
Janicab’s Purpose
Janicab’s function is to steal information. One of its variants even includes a copy of SnapIt to take screenshots. Another interesting fact is that Janicab also has some interest in OS X, which makes sense given the growth that Cupertino’s operating system has seen across the pond. The fact that malware uses external services to communicate isn’t new, but the concept of “hiding the tree in the forest” confirms a certain cleverness on the part of its developers. I imagine that with this information available, YouTube will take the necessary measures to interrupt the operation of Janicab and similar systems; however, we all agree that YouTube comments tied to Google Plus are a real disaster, so the problem might be directly a design issue.
