2. Mahdi The “Messiah” (CPSC 620) Akash Mudubagilu Arindam Gupta

3. Agenda Computer Trojan Mahdi What makes it special Mahdi Targets Effects How to remove References

4. What is Trojan ? A Trojan is a program that may appear to be legitimate, but in fact does something malicious. Destructive program steals information or harms the system Does not replicate

5. Mahdi Also known as Madi Data-stealing Trojan Attack relies on social engineering techniques to get onto targeted computers. Records Keystrokes Screen shots Audio Steal text and image files

6. Contd.. The following is an email example which included a malicious PowerPoint attachment

7. Contd.. In another example the PowerPoint when opened, displays a series of video stills showing a missile destroying a jet plane

8. What makes it special ? Reference in the code to the word for the Islamic Messiah. Use of Farsi Language. Persian calendar format. It can update itself. The creators are still at work Always takes latest code definition.

9. Contd.. Communicates with command-and-control server Uploads stolen data Gets instructions from the server

10. Mahdi targets Critical infrastructure firms Engineering students, Financial services firms Government embassies located in Middle Eastern countries, with the majority of the infections in Iran. Also been found in countries like United States and New Zealand.

11. Mahdi Infections

12. Effects Google and Yahoo searches are redirected. Desktop background image and browser homepage settings changed. Slows down the computer considerably. Will get unwanted pop-ups. Also corrupts windows registry and uses it to deploy annoying pop-ups. Large amount of data uploaded. Might make the internet connection slow. Uploads sensitive information to server.

13. How to Remove Auto- Removal System Restore. Install a tool to remove the malware. Manual Removal Stop Mahdi process from Task Manager. Uninstall Mahdi from Control Panel, Add/Remove programs. Open windows registry, find and remove all Mahdi registry files. Delete all Mahdi related files from the computer.

14. References http://news.cnet.com/8301-1009_3-57503949-83/a-whos-who-of- mideast-targeted-malware/ http://news.cnet.com/8301-1009_3-57503949-83/a-whos-who-of- mideast-targeted-malware/ http://news.cnet.com/8301-1009_3-57474405-83/mahdi-messiah- malware-targeted-israel-iran-pcs/ http://news.cnet.com/8301-1009_3-57474405-83/mahdi-messiah- malware-targeted-israel-iran-pcs/ http://blog.seculert.com/2012/07/mahdi-cyberwar-savior.html http://www.symantec.com/connect/blogs/madi-attacks-series- social-engineering-campaigns http://www.symantec.com/connect/blogs/madi-attacks-series- social-engineering-campaigns http://www.nextgov.com/cybersecurity/2012/08/mahdi-spyware- operation-broadens-middle-east/57761/?oref=ng-channelriver http://www.nextgov.com/cybersecurity/2012/08/mahdi-spyware- operation-broadens-middle-east/57761/?oref=ng-channelriver http://www.reuters.com/article/2012/08/29/us-cybersecurity- middleeast-idUSBRE87S0EK20120829 http://www.reuters.com/article/2012/08/29/us-cybersecurity- middleeast-idUSBRE87S0EK20120829