Pro-Palestinian e-mail virus could heighten conflict

JERUSALEM — A nondestructive e-mail virus sent around the world Tuesday to trumpet the cause of the Palestinians could lead to an escalation in the Israeli-Palestinian cyber-war, computer security experts said Tuesday.

The virus, called Injustice, carries an attachment that, once opened, drops a copy of itself into the Windows system directory and displays a message box titled: "Dear [e-mail address]/ Sir> Did you send the attached message, I was not expecting this from you!!"

"Please accept my apologies for disturbing you," says the attachment text.

"We need every possible help [sic]. Israeli soldiers killed in cold blood 12 year old Palestinian child Mohammad Al-Durra, as his father tried to protect him in vain… These criminal acts cannot be forgiven or forgotten!!! Help us to stop the blood shed!! [sic]"

The attachment then sends itself out to the first 50 addresses in the recipient's address book and to 24 Israeli government and political e-mail addresses such as the defense minister, the industry and trade minister, the Knesset speaker, the foreign minister, the police inspector-general and a nonprofit organization for Ehud Barak.

"As far as I know, this is the first politically motivated virus using mass-mailing techniques," said Jack Clark, the European product manager of the security applications service provider McAfee, which is already offering protection against the virus. "At the moment it is moving slowly, but it is on our radar."

Dagan Keysary of Hilan-Tech Solutions, which imports and distributes anti-virus solutions in Israel, said he is not sure all the government e-mail addresses that the virus is sending itself to actually exist. He also noted that the virus, once activated, tries to access pro-Palestinian Web sites using the recipient's Internet Explorer.

"We are not sure what they are trying to do, but it is quite polite; they have a notice set up in the code of the virus explaining what it is doing," said Keysary, whose company distributes a virus serum for Injustice.

It was not immediately clear how extensively the virus has spread. The Foreign Ministry, which has come under cyber-attack in the past, said it has not received any e-mails with the virus.

Classified as medium risk, the virus does not destroy files and is not likely to crash mail servers.

But Zac Gazit, marketing manager for the content security firm Finjan, said he is concerned that the worm virus will create a new front in the Middle East cyber-war. The Injustice worm could trigger an Israeli retaliatory virus that could carry an even deadlier message.

"It could escalate," said Gazit, whose software offers a proactive solution that protects computers from worm viruses such as Injustice. "This could be the beginning. Adding a destructive aspect to these worms is very easy, and it is enough for someone to decide that the Israeli side could do more, and then all hell will break loose."

The origin of the worm has not been detected, nor is it likely to be, since there is little motivation to track a virus that does no damage. What is more likely to happen, said Gazit, is that the creator will eventually announce himself.