Related Resources • Invalid Description • Bogus Patches • Breach of Trust • Virus Encyclopedia • Glossary of terms

From Other Guides • Protect Mailto Links

Elsewhere on the Web • F-Secure Description

In March 2001, it was discovered that VeriSign, the foremost authority for digitally signed certificates, had erroneously awarded security certificates to an unauthorized person posing as a Microsoft® employee. VeriSign was able to provide little information about the person to whom the certificates had been awarded, leaving many to doubt the credibility of an organization devoted to protecting other's credibility. Now, a new worm has been discovered exploiting the very mess created by the VeriSign oversight. Dubbed Invalid, the worm emails itself disguised as a Microsoft® patch to resolve invalid SSL certificates. The email message (described below) arrives with an attachment named 'SSLPATCH.EXE'.

 From: "Microsoft Support" 
 Subject: Invalid SSL Certificate

 Hello,

 Microsoft Corporation announced that an invalid SSL certificate
 that web sites use is required to be installed on the user
 computer to use the https protocol. During the installation, the
 certificate causes a buffer overrun in Microsoft Internet
 Explorer and by that allows attackers to get access to your
 computer. The SSL protocol is used by many companies that
 require credit card or personal information so, there is a high
 possibility that you have this certificate installed.

 To avoid of being attacked by hackers, please download and
 install the attached patch. It is strongly recommended to
 install it because almost all users have this certificate
 installed without their knowledge.

 Have a nice day,
 Microsoft Corporation