By Joris Evers
Monday, June 06 2005 09:37 AM
URL: http://www.zdnetasia.com/news/security/0,39044215,39234709,00.htm

Details emerged Friday about an attempt to steal information from users of Microsoft's MSN Korea Web site.

Malicious code planted on the site, and originally discovered Sunday, tried to steal user login data for Lineage, a popular online game in Asia, security experts said.

The attackers attempted to steal the confidential information by adding an invisible frame, a so-called iframe, to the front page of the news section of MSN Korea, according to security company Websense. Anyone who visited the site with a vulnerable Web browser would be infected without any notice, Websense said.

Websense discovered on Sunday that the MSN Korea site had been hacked and contacted Microsoft, said Dan Hubbard, a senior director at the San Diego, Calif., company. Earlier this week, Microsoft said it fixed the site Tuesday and called in law enforcement to investigate the attack.

Though the site was hacked for at least several days, Microsoft said Thursday that it has no evidence users actually fell victim to the attack. Websense advises anyone who recently visited the MSN Korea news site to scan his or her computer for infections.

The code installed on the MSN site attempted to exploit multiple software vulnerabilities to install a Trojan horse, Websense said. The Trojan is detected by some antivirus products as Trojan-PSW.Win32.Lineage.ez and PWS-Lineage.dll, Websense said in an advisory.

The Trojan is designed to steal keystrokes from users of Lineage, Websense said. Lineage is an online medieval role-playing game popular in South Korea that boasts more than 4 million users.

Broadband and mobile Internet usage is popular in South Korea. The market is important to Microsoft's MSN group, which has trialed new services in the country.

Microsoft is confident that its other MSN Web sites are not vulnerable to the same type of attack. The Korean site, unlike the one in the U.S. and most other international MSN sites, was not hosted by Microsoft but by a partner. That partner likely did not completely secure the servers, Microsoft has said.