Skype spy Trojan escapes into wild

Compiled Trojan is detected by Symantec and Trend Micro

Only days after Swiss programmer Ruben Unteregger released the source code for a Trojan he wrote three years ago to hack Skype phone calls, the inevitable has happened -- someone has released it as a compiled piece of "faux" malware.

Unteregger posted the code on his website under a GLPv3 license, presumably in the hope that its publication would make it impossible to use against real users, having had second thoughts about the morality of his creation. He wrote the program in 2006 for a private company, ERA IT Solutions, which alledgedly sold it on to an agency of the Swiss government to use in remote surveillance activities.

[ Are you up to snuff in your security regimen? Get your defenses in tip-top shape with InfoWorld's Security Boot Camp, a 20-lesson course via e-mail that begins Sept. 21. | And learn how to secure your systems with Roger Grimes' Security Adviser blog and Security Central newsletter, both from InfoWorld. ]

Now Symantec and Trend Micro have reported that a Windows Trojan with remarkably similar characteristics has turned up in their detection systems, Trojan.PeskySpy in Symantec nomenclature, and Troj_Spayke.C to Trend. Neither company states openly that the Trojan detected is related to Unteregger's open source creation, but there are enough clues to forge a strong connection.

Symantec describes how the Trojan intercepts API calls to Skype, capturing and storing audio conversations as MP3 files with caller, date, day and time stamps to identify them, and SkypeOut and SkypeIn call designations. The Trojans then attempts to upload the recordings to pre-defined locations after detecting and attempting to bypass named firewall filters.

This design perfectly echoes Unteregger's 'Bundestrojaner', as it was dubbed when it first appeared in honour of its use by government. Trend's analysis also makes partially obfuscated reference to the domain used by Unteregger to distribute his code.

It is not clear whether the Trojan actually carries out all of the activities of which it is capable, or that it does anything that would count as illegal beyond infecting a PC without consent.

"This Trojan is an open-source application that can be downloaded from a certain website," notes a Trend Micro researcher on the company's threat website, coyly.

"This Trojan is intended as a proof-of-concept (POC) program but its code, which is now freely available, can be modified so that the information obtained from the Skype network are saved as audio files, such as .mp3s, and sent to a remote computer."

The Trojan is unlikely to have infected many computers, and will now be a fixture in the anti-virus signature database of many security software programs, so the threat posed it very low to non-existent. But Unteregger's Trojan will still gain a footnote in history as possibly the first working, professionally crafted piece of malware to be distributed later in its life under a GPL license.