Badtrans

Badtrans is a computer worm that was first identified in November 2001, targeting Microsoft Windows systems and spreading primarily through email by exploiting vulnerabilities in Internet Explorer.

History

Badtrans, also known as BadTrans or Badtrans.A, emerged as a notable malware threat in late 2001, shortly after the widespread Nimda worm. It was first detected on November 20, 2001, and quickly gained attention due to its ability to propagate without requiring users to open an email attachment explicitly. The worm leveraged a vulnerability in Internet Explorer’s MIME header processing (the same vulnerability used by Nimda), allowing the malicious code to execute when the email was previewed in Outlook or Outlook Express. Within days of its discovery, Badtrans had infected tens of thousands of computers globally, prompting advisories from major antivirus vendors and computer emergency response teams.

Technical Details

Badtrans is a Windows-based worm written in the Microsoft Visual C++ programming language. It does not infect files on the host system but rather operates as a standalone executable that runs in memory. The worm is approximately 30 KB in size when compiled and is typically disguised as a seemingly innocuous file attachment, such as a screen saver (.scr) or program information file (.pif). Once executed, it installs itself in the Windows system directory and modifies the Windows Registry to ensure automatic execution upon system startup. It also drops a copy of itself as a hidden file named "KERNEL32.EXE" in the Windows system folder, though this is not a system file.

Infection Vector

The primary infection vector for Badtrans is email. The worm exploits a known vulnerability in Internet Explorer (MS01-020, also known as the "MIME header vulnerability") that allows an executable file attached to an email to be executed automatically when the email is opened or previewed in vulnerable versions of Microsoft Outlook or Outlook Express. The email appears as a reply to a message that has been previously sent, with a subject line that typically begins with "Re:" followed by a random string. The body of the email contains a generic text, such as "Hi!" or "I forgot to send you the attached file." The attachment name is randomized but often ends with ".pif" or ".scr". Badtrans also spreads through file-sharing networks and network shares by copying itself to directories with writable permissions.

Payload

Badtrans carries several malicious payloads. It installs a keylogger component that records keystrokes on the infected machine and saves them to a file named "IKERNEL.EXE". This captured data can be used to steal passwords, credit card numbers, and other sensitive information. Additionally, the worm attempts to collect cached passwords from the victim's system, including dial-up, network, and web passwords. It then attempts to send these stolen credentials to a predefined email address (hardcoded in the worm's code) using Simple Mail Transfer Protocol (SMTP). Badtrans also modifies the Windows system file "WS2_32.DLL" (a Windows Sockets API library) to intercept outgoing network traffic and facilitate the transmission of stolen data. Furthermore, the worm creates a backdoor by opening TCP port 10080 on the infected machine, allowing remote attackers to connect and issue commands.

Impact and Mitigation

The widespread distribution of Badtrans led to significant disruption in email communication and compromised the security of many computer systems. Organizations and individual users faced the risk of data theft, particularly of passwords and personal information. The worm's ability to propagate automatically through email previews made it particularly difficult to contain without patching the underlying vulnerability. Microsoft released a security patch (MS01-020) prior to the worm's emergence, but many systems remained unpatched. Antivirus software vendors quickly updated their signature databases to detect and remove Badtrans. Mitigation required applying the Internet Explorer patch, deleting the worm’s files and registry entries, and resetting any compromised passwords. System administrators also needed to block port 10080 at firewalls to prevent remote access.

Legacy

Badtrans is remembered as one of the early examples of a worm that combined mass-mailing with exploitation of a browser vulnerability to achieve automatic propagation. Its use of keylogging and password theft presaged later, more sophisticated malware families. The worm also highlighted the importance of prompt patch management and the risks inherent in viewing HTML email. While Badtrans itself is now easily detected and removed by modern security software, its techniques influenced subsequent malware development and contributed to the evolution of email security practices.