To: Jim Bishop who wrote (68796 ) 10/27/2000 4:45:23 PM From: john Respond to of 150070 (COMTEX) B: F-Secure Warns Against Worm-Assisted Hacking Microsoft Ha B: F-Secure Warns Against Worm-Assisted Hacking Microsoft Hacked With QAZ Worm in a Huge Data Theft Case SAN JOSE, Calif., Oct 27, 2000 /PRNewswire via COMTEX/ -- F-Secure Corporation is warning the public against hacking attempts that can be automated with modern worm programs. Concern over such attacks is heightened due to the news on Thursday that the development unit of Microsoft Corporation has been hacked with a worm called QAZ. Worm-assisted hacking makes it relatively easy for an outsider to gain access to confidential data. After a target computer has been located by the attacker, he doesn't have to gain direct access to it. Instead, he infects any computer inside the target organization with a worm like QAZ and then waits for the worm to spread. When the worm eventually finds its Way to the target computer, it will report this back to the attacker, who can now access the computer to steal and modify any data on it using a backdoor. "We've been forecasting that worm-based industrial espionage would happen for quite some time and it looks like now it has happened big time," comments Manager of Anti-Virus research, Mikko Hypponen from F-Secure. "Although it looks like this case was done by a single rogue anti-Microsoft attacker, similar attacks could be used for traditional espionage." Apparently the attacker managed to steal source code belonging to Microsoft Windows and Microsoft Office applications. "When the largest software vendor in the world gets its most important software stolen, I'd say it's a pretty important case," continues Mikko Hypponen. The attacker is believed to have had access to Microsoft source code for months. Microsoft denies that any changes have been made to the source code. The attacker may have had the technical means to modify the source code. The QAZ worm is not new. It was first found during the summer of 2000 in China, and has since been located in various parts of the world. F-Secure Anti-Virus product detects and automatically blocks attack attempts made with the QAZ worm automatically. A technical description of the worm is available from the F-Secure virus description database at: f-secure.com . CONTACT: Michael Barash of Neale-May & Partners, 650-328-5555 ext. 139, or mbarash@nealemay.com, for F-Secure, Inc.; or Kathleen McVey of F-Secure, Inc., 408-350-2169, or kathleen.mcvey@f-secure.com SOURCE F-Secure Corporation