Crisis malware infects virtual machines

Security researchers are studying malware that can infect virtual machines from the host operating system.

Intego first discovered the Crisis Trojan in July. The malware was found to infect Mac OS X computers and could record keystrokes, webcams, track web traffic, take screenshots and steal data.

But now researchers at Symantec have revealed that a worm-like version of the malware also targets Windows. As with the Mac version, this malware installs itself onto a victim's PC if they visit a compromised website, subsequently downloading a malicious JAR file.

The malware then looks through the victim's device for virtual machines and makes copies of itself so it can mount the virtual image and infect it.

"The threat uses three methods to spread itself: one is to copy itself and an autorun.inf file to a removable disk drive, another is to sneak onto a VMware virtual machine, and the final method is to drop modules onto a Windows Mobile device," said Takashi Katsuki, a researcher at Symantec.

The threat searches for a VMware virtual machine image on the compromised computer and, if it finds an image, mounts the image and then copies itself onto the image by using a VMware Player tool.

Katsuki said that the malware does not use a vulnerability in the VMware software itself, but takes advantage of an attribute of all virtualisation software: namely that the virtual machine is simply a file or series of files on the disk of the host machine.

"These files can usually be directly manipulated or mounted, even when the virtual machine is not running as is the case above," said Katsuki.

But researchers are still puzzled by what the modules actually do. "We currently do not have copies of these modules and hence we are looking for them so we can analyse them in greater detail," Katsuki added.

Researchers have said less than 50 machines are currently infected with the malware.