Chris Mosby at myITforum.com

This post is made on behalf of my colleague Mat Nisbet, Malware Analyst for Symantec Hosted Services.

As of November 18, we have noticed a huge jump in the number of spam e-mails that contain a link to Twitter. Normally there is a tiny fraction of a percent, but on November 18 it jumped to 4 percent of all spam. This new surge is entirely from the DonBot botnet.

The apparent aim of these e-mails is to get people to fall for “get rich by working at home” schemes where the victim is encouraged to pay an initial fee for a trial and then sit back and watch the cash come in. Though easily stopped by us, this new run of spam uses a number of techniques to attempt to get past basic filters. Firstly, the body of the e-mail is simply an image (of a fake newspaper article), to try and get past text-based signatures.

Second, the image itself is a link to a Twitter account, an attempt to get past link signatures as Twitter is a legitimate site that couldn’t be stopped without stopping a huge amount of perfectly innocent e-mails as well. The Twitter update that it links to is a short message telling people they could earn a certain amount of money per day, and provides a link to follow. A large number of Twitter accounts are used and they seem to be a mixture of hijacked accounts (quite old, and have genuine looking updates) and false accounts set up purely for the purpose of spamming (not very old, only contain spam-like links).

There are a few websites links at the end of the trail and all are similar containing a story explaining how the victim could make large amounts of money for very little effort, then a step by step list of things to do in order to start making this money. The first of which is to fill out a form and give a small “trial” fee. Some of these websites even include a photo of a “happy customer” holding a check for more than $29,000. This tactic attempts to increase the credibility of the scam.

We have also seen this scam being run through hijacked Facebook accounts, where the scammers have used a legitimate Facebook account which does not belong to them to post updates to the account’s ‘friend’ list. These updates contain links to the same Twitter accounts that are used by the e-mails.

Any website or e-mail claiming to have an offer to make easy money that seems too good to be true, almost certainly is. Don’t be fooled!

We are monitoring new malicious attacks that look similar to the fake "Microsoft Outlook reconfigure" spam campaign messages we have been observing for the last couple of months. That malicious campaign was followed by attacks on social networking sites, transforming from malicious code attacks into URL-based phishing attacks. These new attacks have similar traits, such as the spoofed “From” headers, which aggressively target and baffle enterprise users, and a subject line that is intended to cause panic (for obvious reasons—have a look at the example image below).

As seen in the message above, the mail attachment is a zipped file named “utility.zip” that extracts an executable detected as Trojan.Dropper by Symantec antivirus. Using HTTP, this threat contacts a known C&C server for Zeus/Zbot in Ukraine. (The Zeus/Zbot family of threats is known to distribute malware using attachments and URLs in spam campaigns.)

These attacks seem to be around in rotation and are intended to confuse users with variations in alert types. Users should not open suspicious attachments because no legitimate site will send an executable to reactivate a mailbox, especially as a zipped file. As observed in the past, these attacks return with URLs instead of attachments in the days following the initial email. Users need to be careful before clicking URLs and/or downloading an application that wrongfully claims to restore/repair/activate their mailbox.

A new exploit targeting Internet Explorer was published to the BugTraq mailing list yesterday. Symantec has conducted further tests and confirmed that it affects Internet Explorer versions 6 and 7 as well. The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future.  When this happens, attackers will have the ability to insert the exploit into Web sites, infecting potential visitors.  For an attacker to launch a successful attack, they must lure victims to their malicious Web page or a Web site they have compromised. In both cases, the attack requires JavaScript to exploit Internet Explorer.

The exploit targets a vulnerability in the way Internet Explorer uses cascading style sheet (CSS) information. CSS is used in many Web pages to define the presentation of the sites’ content. Symantec currently detects the exploit with the Bloodhound.Exploit.129 antivirus signature and is working on new signatures now. Symantec IPS protection also currently detects this exploit with signatures HTTP Microsoft IE Generic Heap Spray BO and HTTP Malicious Javascript Heap Spray BO. A new IPS signature, HTTP IE Style Heap Spray BO, has also been created for this specific exploit. To minimize the chances of being affected by this issue, Internet Explorer users should ensure their antivirus definitions are up to date, disable JavaScript and only visit Web sites they trust until fixes are available from Microsoft.