Chris Mosby at myITforum.com

Has Elvis Left the Building? – Symantec Security Blogs

Has Elvis Left the Building?

July 3rd, 2009

Filed under: Endpoint Protection (AntiVirus), Malicious Code, Vulnerabilities & Exploits, Security, Security Response

I know people are getting sick of malware, attacks, and blogs associated with recent celebrities’ deaths, especially over the past week. But, here we go again. Even a week after Michael Jackson's death was announced, some people refuse to accept that he is gone. Well, after 32 years, even some fanatic followers believe Elvis Presley is still alive.

Security Response has found a suspiciously titled PDF file named “Elvis_Presley_is_alive!!!.pdf.” Maybe Elvis really is still alive, but this particular Elvis has hellhounds with him in the form of exploit code and malware.

When the malicious PDF file is opened, users won’t see any pictures or articles on the aging “King of Rock 'n' Roll,” but instead the file tries to exploit three separate PDF vulnerabilities:

• Adobe Acrobat and Reader Collab 'getIcon()' JavaScript Method Remote Code Execution Vulnerability (BID 34169)

• Adobe Reader 'util.printf()' JavaScript Function Stack Buffer Overflow Vulnerability (BID 30035)

• Adobe Acrobat and Reader Multiple Arbitrary Code Execution and Security Vulnerabilities (BID 27641)

Upon a successful exploit attempt a malicious file (load.exe) is downloaded. We detect the file as Infostealer.Bancos. The malicious PDF file is detected as Trojan.Pidief.C. If exploit attempts fail, the user will see the following PDF page:

imagebrowser image

Well, ladies and gentlemen, and good boys and girls out there, Elvis has left the building!

Posted Friday, July 03, 2009 2:51 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Internet Hacks, Spam\Phishing, Cybercrime, Software Vulnerabilites

BCP/DRP – SANS Internet Storm Center

BCP/DRP

Published: 2009-07-03,
Last Updated: 2009-07-03 17:31:03 UTC
by Adrien de Beaupre (Version: 1)

0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=6721&rss'; digg_title = 'BCP/DRP'; digg_skin='compact'; digg_topic = 'security';

acebook

witter

Question, what do Bing.com and Authorize.net have in common? Who would have guessed that they both have servers located in a data center that has had a fire? Or that they may have to put more into the planning portion of Disaster Recovery and Business Continuity? Authorize.net has been completely down for several hours now. Bing.com/travel had this to say: "A fire occurred at Fisher Plaza in downtown Seattle just after midnight on Friday morning. The blown transformer knocked out power to the entire building, which is home to the Bing Travel servers. We're hard at work to restore service following this unexpected event. Our current estimate for re-establishing Bing Travel functionality is 5pm PST, July 3rd." Perhaps they should have read one of our SANS papers on BCP/DRP planning. http://www.sans.org/reading_room/whitepapers/recovery/ More information is available at this twitter http://twitter.com/authorizenet where Authorize.net are tweeting. The media are also following the story, KOMO a local station was knocked offline but are broadcasting from a backup site.

Cheers,
Adrien de Beaupré
EWA-Canada.com

Teaching SANS Cutting-Edge Hacking Techniques in Ottawa this September.

Posted Friday, July 03, 2009 2:50 PM by cmosby | with no comments

Filed under: Internet News, Internet Applications

@BlogAudience: MoTB Follows Limited Disclosure Approach to Twitter Vulnerabilities – Symantec Security Blogs

@BlogAudience: MoTB Follows Limited Disclosure Approach to Twitter Vulnerabilities

Shunichi Imano

July 3rd, 2009

Filed under: Endpoint Protection (AntiVirus), Evolution of Security, Vulnerabilities & Exploits, Security, Security Response

As previously promised, Security Researcher Aviv Raff officially launched the Month of Twitter Bugs (MoTB) website on July 1. Aviv will be posting a “Twitter bug a day” on MoTB in order to raise awareness of Twitter APIs and to warn end users of potential problems with the software and systems they use.

MoTB will be following a limited disclosure approach. On the bright side for Twitter, third-party service providers and Twitter themselves are notified of high-risk vulnerabilities at least 24 hours in advance, giving service providers time to create patches before the information goes public on MoTB. When a vulnerability notification is issued, it is hoped that having a deadline will push the affected provider to take action, and the resulting solution will protect end users. On the other hand, if the provider cannot—or will not—come up with a solution in time, the vulnerability information will be posted on MoTB and the bad guys are likely to be quick to thrust swords through the chinks in the Twitter armor.

Patch quality is important, too. Mistakes will be made (we’re all human, right?) and more so in high-pressure situations. Imagine how those working on security patches will be impacted by the sudden shift in pressure levels. The rush to release patches is likely to reduce the time available for testing and quality assurance, and although we are not suggesting that this is done on purpose, it may well be the case that we see issues with the pressure-cooked code.

So far, this method of limited disclosure seems to have worked according to plan. The first set of vulnerabilities posted belonged to the bit.ly URL-shortening service—all four were cross-site scripting (XSS) bugs, and all four of them have already been patched. Another XSS vulnerability, this time in HootSuite, a third-party application for managing Twitter accounts, was fixed just two hours after it was reported.

Symantec Security Response will be monitoring entries on MoTB very closely. We might even create a Twitter account and tweet about them ourselves.

Note: My thanks to colleague Henry Bell, co-author on this post.

Posted Friday, July 03, 2009 2:13 PM by cmosby | with no comments

Filed under: Internet News, Internet Applications, Software Vulnerabilites

Authorize.net down – SANS Internet Storm Center

Authorize.net down

Published: 2009-07-03,
Last Updated: 2009-07-03 16:50:12 UTC
by Adrien de Beaupre (Version: 1)

0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=6718&rss'; digg_title = 'Authorize.net down'; digg_skin='compact'; digg_topic = 'security';

acebook

witter

The credit card payment gateway authorize.net is currently down. A fire at their data center is apparently the cause. Thanks to Joey, Tommy, and Jonathan for writing in.

Cheers,
Adrien de Beaupré
EWA-Canada.com

Posted Friday, July 03, 2009 2:12 PM by cmosby | with no comments

Filed under: Internet News, Internet Applications

Waledac Independence Day Theme - New Campaign In The Wild – Websense Alerts

Waledac Independence Day Theme - New Campaign In The Wild

Date:07.03.2009

Threat Type: Malicious Web Site / Malicious Code

Websense Security Labs™ ThreatSeeker™ Network has detected yet another new Waledac campaign theme in the wild. The new variant uses an Independence Day theme as a social engineering mechanism. The United States of America celebrates Independence Day on July 4 each year.

The malicious emails that are sent use subjects and content related to Independence Day, Fourth of July and fireworks shows.

The malicious Web sites in the current attack also have a July 4 or fireworks theme within the domain name. ThreatSeeker has been monitoring the registration of these domains. Should the user click on the video, which is designed to appear to be a YouTube video, an .exe is offered. When downloaded the .exe would install the latest Waledac variant onto the user's machine.

Screenshot of the malicious Web site:

Websense® Messaging and Websense Web Security customers are protected against this attack.

Posted Friday, July 03, 2009 2:11 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Internet Hacks, Spam\Phishing, Cybercrime

Gumblar Invades Best Buy – TrendLabs Malware Blog

Jul2

Gumblar Invades Best Buy

4:49 pm (UTC-7) | by Jovi Umawing (Technical Communications)

Earlier today, Trend Micro Technical Account Manager Fioravante Souza in Brazil spotted a (potentially harmful) URL that redirects users from the Best Buy domain site.

Users who visit www.bestbuy.com, as it turns out, are redirected to the URL, hxxp://pics. bubbled.cn/gallery/
hardcore/?23c4f60c1b9f604d6ffb21cba599301f (hxxp = http, and without the spaces). The compromised page in the domain is found to be the landing page where visitors can choose the language to be used as they browse within the site. Threat Research Manager, Ivan Macalintal, further identifies that a GEO-IP check happens prior to displaying the said landing page.

“If (the) requesting IP is from the Latin America Region (LAR), users are redirected to the ‘Choose English or Spanish’ page—and then bingo!” Macalintal says.

The landing page is found to display only if the requesting IP www.bestbuy.com is from LAR (see Figure 1).

The source code (see Figure 2) of the landing page shows a garbled set of code found at the bottom of the script, a clear sign of code obfuscation. Beneath a 3-layer obfuscation, an iframe redirects the user to a Luckysploit-laden site. The Luckysploit web exploit kit and the obfuscation seen is reminiscent of that found in Gumblar.

The WHOIS screenshot of the .CN site (see Figure 3) states that it has been created just last June 4, 2009 by the same old criminals.

Further investigation shows that the first .CN site (see Figure 4) is actually located in Germany and is used by attackers in Ukraine. Suffice it to say, the Russkranians are the culprits once again.

Best Buy has been informed of the said URL redirections and is resolving the matter as of this writing.

More information to follow.

Hat tip to Advanced Threat Researcher Paul Ferguson for providing more information.

Posted Friday, July 03, 2009 2:10 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Internet Hacks, Spam\Phishing, Cybercrime

Bait Files – F-Secure Weblogs

<<<

Friday, July 3, 2009

Bait Files	Posted by Mikko @ 09:50 GMT \| postCount('00001715'); Comments

It's always interesting to browse through the bait document files used in targeted attacks. These are files that have been used to infect specific individuals in different organizations in order to gain access to their computer.

All the documents shown below contained exploits that installed backdoors. Targets of these attacks are not known.

This is just a quick sampling; we get a lot of these.

Posted Friday, July 03, 2009 1:59 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Spam\Phishing

Spam Speculates Michael Jackson’s Murder – TrendLabs Malware Blog

Jul2

Spam Speculates Michael Jackson’s Murder

9:42 am (UTC-7) | by Aljerro Gabon (Anti-spam Research Engineer)

Michael Jackson has been dead for a week already, but there are still a lot of speculations regarding his death. The spam runs are plenty as well — a Michael Jackson-related spam was seen bearing the subject Who killed Michael Jackson?, coming from a sender named x-files.

The spam message suggests that the icon was killed, and that information on who murdered him can be seen on the given URL.

Clicking the said link leads to a website, where the user is asked to execute a file, which supposedly contains secret information, in order to find out who killed Michael Jackson.

But of course, the executable is not at all related to Michael Jackson’s murderer, or to Michael Jackson at all, as the file is really an data-stealer detected by Trend Micro as TROJ_ZBOT.AXY. The Trojan TROJ_ZBOT.AXY connects to a certain URL where it downloads a configuration file containing a list of banking-related websites. Once the user attempts to visit any of the listed sites, a spoofed site is displayed instead of the real one, thus any critical information entered on the spoofed site will be sent to a remote user.

This threat however, doesn’t stand a chance against the Smart Protection Network as of its all components — spam, URL and file — are already either blocked or detected.

Posted Thursday, July 02, 2009 4:27 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Spam\Phishing

Cold Fusion web sites getting compromised – SANS Internet Storm Center

Cold Fusion web sites getting compromised

Published: 2009-07-02,
Last Updated: 2009-07-02 19:49:27 UTC
by Bojan Zdrnja (Version: 1)

0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=6715&rss'; digg_title = 'Cold Fusion web sites getting compromised'; digg_skin='compact'; digg_topic = 'security';

acebook

witter

There have been a high number of Cold Fusion web sites being compromised in last 24 hours. We received several e-mails about this.

It appears that the attackers are exploiting web sites which have older installations of some Cold Fusion applications. These applications have vulnerable installations of FCKEditor, which is a very popular HTML text editor, or CKFinder, which is an Ajax file manager. The vulnerable installations allow the attackers to upload ASP or Cold Fusion shells which further allow them to take complete control over the server.

The attacks we've been seeing in the wild end up with inserted <script> tags into documents on compromised web sites. As you can probably guess by now, the script tags point to a whole chain of web sites which ultimately serve malware and try to exploit vulnerabilities on clients.

What's interesting is that the group behind this is probably connected (if not the same) as the group that performed a lot of similar attacks back in March. I wrote several diaries about them – see http://isc.sans.org/diary.html?storyid=6001 and http://isc.sans.org/diary.html?storyid=6010

Back in March, once they gained access to the server, they used a local privilege escalation exploit for a vulnerability that was, at that time, unpatched. If your servers are up to date with Microsoft patches, the vulnerability has been patched but they still can modify local web site files in a lot of cases (and sometimes even more, depending on Cold Fusion's configuration).

We'll be carefully monitoring the situation with this, of course. In the mean time, make sure that all applications you are running are up to date and fully patched. Another thing you might want to do is check for any old software you might have on your servers – it is very common for applications to leave old, vulnerable parts that are not used any more hanging around. And such applications are just waiting to be compromised.

Thanks to Adam for giving us an early heads up.

--
Bojan

Posted Thursday, July 02, 2009 3:43 PM by cmosby | with no comments

Filed under: Patch Management, Internet Hacks, Security, Software Vulnerabilites

FakeAlerts Uncovered – McAfee Avert Labs Blog

FakeAlerts Uncovered

Thursday July 2, 2009 at 9:32 am CST
Posted by Prashanth PR

Trackback

It has been almost a year since the rogue antivirus products, a.k.a. scareware, became rampant. These Trojan families are typically spread via Drive by downloads, SEO poisoning, Spam campaigns and clever social engineering.
Having these methods discussed in earlier blogs, today we will look into the protection mechanisms adopted by these fake alerts Trojan families to evade detection from antivirus vendors.

Code obfuscation using junk instructions

In the above screenshot, lots of junk code is visible between valid instructions. Usage of junk instructions is being used widely across Fake Alert families.

Fake API calls

The screen shot shows the usage of API called SetArcDirection which is not necessary in the code. These kinds of unnecessary APIs are used by malware to defeat emulation. Sometimes, API calls that don’t exist are also used by these families to check if they are being emulated.

Customized packer

Lot of fake alert families uses their own custom packers, encryption routines. Some of the families patch the existing packers.

Use of XMM and MMX instruction sets

Usage of XMM, MMX and FPU instructions which are not needed in the code along with the other junk code are also utilized by most of the fake alert families.

The techniques discussed above are not something very new and has been used in notable malware. But fake alert Trojans use these evasion techniques to there full potential with every new variant. Just when we thought we’re seeing a decline in adware and spyware – fake alert Trojans families have stepped in to claim the scum of the Internet tag.

Posted Thursday, July 02, 2009 3:39 PM by cmosby | with no comments

Filed under: Security and Anti-Virus

SMS remote code execution vulnerability in iPhone – F-Secure Weblog

<<<

Thursday, July 2, 2009

SMS remote code execution vulnerability in iPhone	Posted by Patrik @ 18:30 GMT \| postCount('00001714'); Comments

Charlie Miller, a well-known security researcher who specializes in Mac and iPhone security, yesterday revealed information about a new vulnerability in iPhone that allows remote code execution via SMS. Not a lot is known about the vulnerability, which was announced at the SyScan conference in Singapore, except that Charlie is working with Apple to get it fixed as soon as possible.

(picture from apple.com)

This is about as bad as it gets as the vulnerability seems to allow unsigned code to run which circumvents a core part of iPhone's security model as it's usually only able to run signed code, i.e. Apps that have been approved by Apple. No user-interaction required which is unlike current mobile malware. InfoWorld has the original story here.

PS. I’m shift manager for one of our three daily response shifts this week and I'm tweeting about what we’re doing in the shift over at http://twitter.com/patrikrunald

Posted Thursday, July 02, 2009 2:24 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Mobile\Wireless, Software Vulnerabilites

Getting the EXE out of the RTF – SANS Internet Storm Center

Getting the EXE out of the RTF

Published: 2009-07-02,
Last Updated: 2009-07-02 02:44:50 UTC
by Daniel Wesemann (Version: 1)

0 comment(s) acebook witter

Recently, when the targeted attack with malicious RTF attachments was making the rounds, I wondered how to best get the embedded EXE extracted from the RTF for further analysis. On a Windows system, you would most likely simply copy/paste the embedded object from within RTF to an Explorer window, and end up with the original file. Since I do my malware analysis on Unix, this wasn't an option. Looking at the file, it appeared as if RTF was using some sort of hexadecimal encoding:

Now, as a command line Perl addict, hex is something I know how to deal with :-).

$cat detail.rtf | sed -e '1,3d' | perl -ne 's/(..)/print chr(hex($1))/ge' > detail.bin
$cat detail.bin | hexdump -C | more

Sweet, we get something printable! The “sed” command deletes the first three lines, because they don't contain hex and would confuse the Perl statement that follows. The Perl code eats up two digits at once and converts them to the corresponding ASCII character, iterating through the entire file. I'm using “perl -ne” combined with “print” instead of “perl -pe” because the former makes it easier to ignore the pesky CR/LF line end markers that make Windows text so annoying on Unix. The output gets piped into “hexdump -C”, because we expect this content to be an embedded EXE file, and thus it likely contains a lot of non-printable characters that would not be fun to look at in “vi” or “more”.

A bit further down in the output, there was indeed the tell tale “MZ” marker of the beginning of a MSDOS PE header.

00000170 6c 20 63 6f 6e 74 65 6e 74 2e 73 63 72 00 00 e0 |l content.scr..à|
00000180 00 00 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff |..MZP.........ÿÿ|
00000190 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 |..¸.......@.....|
000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

Easy, I thought. Let's carve out the file beginning with the MZ and we should have the EXE:

$ dd if=detail.bin of=detail.exe bs=1 skip=386
61870+0 records in
61870+0 records out
61870 bytes (62 kB) copied, 0.269451 s, 230 kB/s
$ file detail.exe
detail.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit

“if” and “of” are the input and output files of the “dd” command. “bs=1” sets the step size to one byte, and “skip”, well, skips the given number of bytes at the beginning of the file. 386 is the decimal equivalent of 0x182, the offset of MZ visible in the hexdump above.

While the “file” command confirmed that I had indeed carved out an executable, something was wrong – the file didn't want to run in the emulator, and when I uploaded it to threatexpert.com, their service called it “invalid”. I quickly figured out that the RTF has a lot of crud at the end as well, which also needs to be cut off, but I still couldn't reliably determine the correct length, and hence didn't know where the last byte of the embedded executable was.

Well, time for the malware reverse engineering equivalent of the “known plaintext attack”. I used a Windows PC to embed a copy of notepad.exe into an otherwise empty RTF document of my own, and then went about analyzing this RTF until I was able to carve out the original notepad.exe. The main “AHA!” moment was when I realized that the bytes between the filename and the “MZ” header actually are the length of the embedded file. If we use our hexdump from before

00000170 6c 20 63 6f 6e 74 65 6e 74 2e 73 63 72 00 00 e0 |l content.scr..à|
00000180 00 00 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff |..MZP.........ÿÿ|
00000190 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 |..¸.......@.....|
000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

the length of the file in this case is 0x00E000, which is 57344 in decimal. Back to the sample:

$ dd if=detail.exe of=detail-fixed.exe bs=1 count=57344
57344+0 records in
57344+0 records out
57344 bytes (57 kB) copied, 0.268809 s, 213 kB/s
$ file detail-fixed.exe
detail-fixed.exe: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
$ md5sum detail-fixed.exe
82a44254c1ce2019936a8428c93f5354 detail-fixed.exe

This time, the emulator, ThreatExpert and VirusTotal were all happy with the file, and while anti-virus coverage at the time was poor, the EXE/SCR embedded within the RTF attachment was quickly confirmed as unfriendly.

Keywords: forensics malware analysis

Posted Thursday, July 02, 2009 11:07 AM by cmosby | with no comments

Filed under: AntiVirus Information, Security

China's Dam Delay – F-Secure Weblogs

<<<

Thursday, July 2, 2009

China's Dam Delay	Posted by Sean @ 13:22 GMT \| postCount('00001713'); Comment (1)

The Wall Street Journal reports that Beijing has delayed its mandate to have Green Dam Youth Escort filtering software installed on all new Windows computers sold in China. The deadline was originally July 1st.

PC World's take is that implementation of Green Dam is only a matter of time.

Our take?

If China wants to require anti-pornography filtering software that's China's business, not ours.

But the same software on EVERY computer sold in China? That's monoculture.

And as we've noted before, monoculture's are subject to catastrophic failure in the event of a successful attack.

—————

More: China's Web filtering starts in the West

Posted Thursday, July 02, 2009 10:49 AM by cmosby | with no comments

Filed under: In the News, Internet News

Michael Jackson Spam Inhibits the Independence Day Spam Spur – Symantec Security Blogs

Michael Jackson Spam Inhibits the Independence Day Spam Spur

Samir Patil

July 1st, 2009

Filed under: Endpoint Protection (AntiVirus), Spam, Security, Security Response

In the United States, Independence Day is a federal holiday celebrated on July 4 that commemorates the adoption of the Declaration of Independence on July 4, 1776, which declared independence from the Kingdom of Great Britain. The day is typically celebrated with fireworks, parades, barbecues, carnivals, and various other public and private events to remember the history and traditions of the United States.

In order to track the prevalence and volume change of Fourth of July spam, we have been supervising the probe network traffic for this type of spam over the past couple of weeks. Surprisingly, it looks as if spammers are less passionate about spawning Independence Day spam this year. The probable reason for this neutrality could be the spam spike related to the death of pop star Michael Jackson.

In the spam samples that are related to Independence Day, we’ve observed messages inviting users to experience the so-called “best 4th of July fireworks display in Miami.” A link is provided that directs users to a Web form where personal information such as names, email addresses, and number of accompanying guests is collected. A map to the venue is also provided to give a genuine look to the fake offer.

When we did bit of searching online we noticed that this event is in fact happening at one of the hotels in Miami. So, we analyzed the message closely and found various fraudulent details. The email originates from a recently registered domain that has no connection with the hotel authority. The IP address visible in the email headers is notorious for sending out spam and is present in IP blacklists. The email is unsolicited, with a questionable opt-out process. Needless to say, spammers are abusing the event to gather personal information for subsequent fraudulent activity or future spam campaigns.

Below is a snapshot sample of this particular spam email:

From: VIP LIST - The <removed> Hotel <info@<removed>.com>
Subject: Experience the Best 4th of July in Miami at The <removed>

imagebrowser image

The subject lines for these spam messages seem legitimate and are often the subject lines used in valid promotional emails. So, users need to take extra care while opening any email with this type of subject line/content. Because Independence Day is still a few days away, we expect that spammers might continue pushing such fake-but-catchy offers into users’ inboxes.

Posted Thursday, July 02, 2009 10:48 AM by cmosby | with no comments

Filed under: Security and Anti-Virus, Spam\Phishing

Three Months Later: Where’s DOWNAD? – TrendLabs Malware Blog

Jul1

Three Months Later: Where’s DOWNAD?

11:32 pm (UTC-7) | by Jonathan Leopando (Technical Communications)

Exactly three months ago, the whole IT sector was waiting with bated breath for April 1. The latest DOWNAD/Conficker variant–WORM_DOWNAD.KK–was poised to strike. We know that on that day, it would attempt to access 500 of 50,000 websites and download new malicious files. This led to fears–somewhat misplaced–that new, possibly damaging payloads could cause severe problems, not just for systems already affected by DOWNAD but the Internet as a whole. Many sectors assumed the worst.

April 1 came and went, and… nothing happened. Several days later, another variant appeared, but without the Internet ending (as some of the worst reporting would have led readers believe) most people believed that DOWNAD, as a major threat, was gone.

While it may no longer be as in the news at it was at its height, DOWNAD didn’t suddenly go away. Recent estimates from the Conficker Working Group place the number of unique IP addresses affected by the top 3 DOWNAD variants at well over 5 million. Even considering the group’s disclaimer of putting the number of actually infected systems at only 25-75% of that number, a minimum of 1.25 million infected systems is nothing to laugh at.

The Trend Micro World Virus Tracking Center (WTC) numbers bear this out as well. Almost 790,000 systems were found to be infected with DOWNAD variants in the first three months of the year. In the three succeeding months, that number was almost 1.9 million. Clearly, DOWNAD did not decide to quietly go away.

In addition, out of the public eye, DOWNAD went off and did something with all those infected systems: it went off and formed its own botnet. This was documented in mid-April by Advanced Threat Researchers Paul Ferguson and Ivan Macalintal. The short version, however, is simpler: DOWNAD was used to create a botnet. These can be used for the usual range of threats: spam, Denial of Service attacks, spreading FAKEAV malware, and so on.

Like it or not, malware threats are part of what users have to deal with day in, day out. Like anything people deal with regularly, people become used to malware threats. What was once noteworthy and unusual becomes dull and ordinary. However, this in fact does not make the threat any less dangerous. If anything, it can be argued that it makes the threat more dangerous, as users are more likely to be caught unaware of a threat that may not be something they’re looking out for.

In a very real way, threats like DOWNAD become part of the background noise that is a part of life on the Internet. While it may be unrealistic to expect individual users to keep in mind all threats, but good computing practices will help immensely. The most important one may be: keep your software up to date. This is particularly true for your operating system–a properly patched system would have been proof against most DOWNAD variants. Trend Micro users would have been protected via the Smart Protection Network, of course, but closing the underlying vulnerability would still have been essential.

The price of using your computer freely in today’s Internet may well be constant and unceasing vigilance.

Posted Thursday, July 02, 2009 9:16 AM by cmosby | with no comments

Filed under: Security and Anti-Virus, Internet Hacks, Spam\Phishing

Curiosity killed the cat – Viruslist.com

Curiosity killed the cat

Maria

July 02, 2009 | 07:45 GMT

comment

If you’re reading this, you’re probably not a cat, so curiosity won’t kill you. But it can result in someone getting hold of your confidential data.

In my blog about Michael Jackson, I mentioned that Britney Spears had her Twitter account hacked and news of her death posted on her own site. The vulnerability which was exploited has been fixed, the post was deleted, and Britney (or one of her staffers!) has posted saying the singer is alive and well. (I was glad to see that message, because Britney is giving a concert in Russia soon, and tickets are selling fast!)

Britney’s post hasn’t stopped the spammers though – we just picked up the message shown below:

Another prime example of spammers exploiting that vulnerability called “curiosity”. Anyone who’s foolish enough to open the attachment is going to find themselves saddled with Trojan-Spy.Win32.Zbot, a program designed to steal personal data.

Patching technical vulnerabilities is easy; eliminating human vulnerabilities is a lot more difficult.

Posted Thursday, July 02, 2009 9:08 AM by cmosby | with no comments

Filed under: Security and Anti-Virus, Spam\Phishing

Microsoft Security Bulletin Major Revisions - Issued: July 1, 2009

********************************************************************

Title: Microsoft Security Bulletin Major Revisions

Issued: July 1, 2009

********************************************************************

Summary

=======

The following bulletins have undergone a major revision increment.

Please see the appropriate bulletin for more details.

* MS03-011

* MS02-069

* MS02-052

* MS02-013

* MS00-081

* MS00-075

* MS00-059

* MS00-011

* MS99-045

* MS99-031

Bulletin Information:

=====================

* MS03-011

- http://www.microsoft.com/technet/security/bulletin/ms03-011.mspx

- Reason for Revision: V2.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating: Critical

- Version: 2.0

* MS02-069

- http://www.microsoft.com/technet/security/bulletin/ms02-069.mspx

- Reason for Revision: V2.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating: Critical

- Version: 2.0

* MS02-052

- http://www.microsoft.com/technet/security/bulletin/ms02-052.mspx

- Reason for Revision: V2.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating: Critical

- Version: 2.0

* MS02-013

- http://www.microsoft.com/technet/security/bulletin/ms02-013.mspx

- Reason for Revision: V3.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating: Critical

- Version: 3.0

* (MS00-081)

- http://www.microsoft.com/technet/security/bulletin/ms00-081.mspx

- Reason for Revision: V2.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating:

- Version: 2.0

* (MS00-075)

- http://www.microsoft.com/technet/security/bulletin/ms00-075.mspx

- Reason for Revision: V2.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating:

- Version: 2.0

* (MS00-059)

- http://www.microsoft.com/technet/security/bulletin/ms00-059.mspx

- Reason for Revision: V2.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating:

- Version: 2.0

* (MS00-011)

- http://www.microsoft.com/technet/security/bulletin/ms00-011.mspx

- Reason for Revision: V3.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch Availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating:

- Version: 3.0

* (MS99-045)

- http://www.microsoft.com/technet/security/bulletin/ms99-045.mspx

- Reason for Revision: V3.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see Patch Availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating:

- Version: 3.0

* (MS99-031)

- http://www.microsoft.com/technet/security/bulletin/ms99-031.mspx

- Reason for Revision: V3.0 (July 1, 2009): Removed download information because Microsoft Java Virtual Machine is no longer available for distribution from Microsoft. For more information, see New Version Availability.

- Originally posted:

- Updated: July 1, 2009

- Bulletin Severity Rating:

- Version: 3.0

Posted Thursday, July 02, 2009 8:53 AM by cmosby | with no comments

Filed under: Patch Management, Microsoft Windows

Scammers Utilizing Free Web Hosting Services – Symantec Security Blogs

Scammers Utilizing Free Web Hosting Services

Mayur Kulkarni

June 30th, 2009

Filed under: Endpoint Protection (AntiVirus), Spam, Security, Security Response

We know that 419 scammers aren’t the least bit concerned with email headers and will continue using free Webmail services to send spam. However, they recognize the fact that most anti-spam filters are using the body characteristics of scam emails to effectively bar these messages from reaching a user’s inbox. So, they feel they must always change their storyline, as far as the message body is concerned anyway. In recent times, spammers have been regularly using text-based attachments (.rtf, .doc, and .txt) in an attempt to evade anti-spam filters. A new tactic observed is the use of URLs, where the actual message is posted on a free Web-hosting site for the recipient to read.

Here is a snapshot of one of these types of URL spam messages:

imagebrowser image

As shown in the above example, a URL is added at the end of the message. If a user clicks on the URL, they will see the page below. The page displays a typical 419-scam story, with some Mr. Millionaire naming the recipient as a beneficiary to his will and leaving behind millions of dollars.

imagebrowser image

Spammers advertising pharmacy and replica products generally use these types of free Web-hosting sites to redirect users to the actual site selling the products. 419 scammers have picked up on this tactic and have begun hosting 419 messages on the Web in the hopes that the spam recipients will read them.

Some advantages of using free Web-hosting services for scammers are listed below:

1. A free service means no restrictions on the use of these services.
2. There is no scarcity of free Web hosting service providers on the Internet.
3. Use of multiple site locations in the messages brings in some variety.

For now, we will continue to monitor this trend and keep readers well informed of any changes to this spam approach. Also, as a best practice, do not answer these types of unsolicited spam emails.

Posted Wednesday, July 01, 2009 3:48 PM by cmosby | with no comments

Filed under: Spam\Phishing

Private Browsing – F-Secure Weblog

<<<

Wednesday, July 1, 2009

Private Browsing	Posted by Sean @ 15:46 GMT \| postCount('00001712'); Comments

Firefox 3.5 was released yesterday. I've been waiting to try out the Private Browsing Mode, so I installed it today.

Here are the privacy settings from my installation of Firefox 3.0.1.

And when I installed Firefox 3.5 the Private Browsing option was disabled. What?

Seems that the installation recognized my 3.0.1 settings as the equivalent of Private Browsing and preconfigured 3.5 to "Automatically start Firefox in a private browsing session".

Very nice work.

So, nothing changed at all. Except now I have easy options to reconfigure por… paranoi… err, Private Browsing if I opt to do so.

Time to experiment.

Signing off,
Sean

Posted Wednesday, July 01, 2009 2:20 PM by cmosby | with no comments

Filed under: Browser Wars, Firefox, Internet Applications

We All Knew It Was Coming: A Michael Jackson Mass Mailing Worm – Symantec Security Blogs

We All Knew It Was Coming: A Michael Jackson Mass Mailing Worm

Symantec Security Response

June 30th, 2009

Filed under: Endpoint Protection (AntiVirus), Malicious Code, Spam, Security, Security Response

Symantec Security Response has discovered a mass-mailing worm using Michael Jackson's death as a bait. The worm sends out spam emails with the subject “Remembering Michael Jackson” and an attachment named “Michael songs and pictures.zip.” The .zip file contains another file called “MichaelJacksonsongsandpictures.doc.exe,” which is a copy of the worm that is executed on the user’s machine when the file is opened.
Symantec has detection for this worm as W32.Ackantta.F@mm. It is important to keep in mind that W32.Ackantta.F@mm spreads not only through email, but also via removable drives using autorun.inf.
Below is a snapshot of the email that W32.Ackantta.F@mm sends out:

imagebrowser image

Posted Wednesday, July 01, 2009 2:16 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Spam\Phishing

Celebrity Deaths and What to Expect in Cyberspace – Symantec Security Blogs

Celebrity Deaths and What to Expect in Cyberspace

Symantec Security Response

June 26th, 2009

Filed under: Endpoint Protection (AntiVirus), Spam, Security, Security Response

This week has seen the tragic deaths of three iconic American super stars: Ed McMahon, Farrah Fawcett, and Michael Jackson. As always, events such as these seem to be prime targets for spammers and malicious code authors alike.

Internet users should expect to see a flurry of threats seeking to play upon the emotions and curiosity of the public around these events. If you’re looking for news, videos, pictures, or any information regarding these individuals and their lives, Symantec recommends that you only visit sites you’re familiar with and trust. Don’t click on every link you see related to this story and always keep your security solutions up-to-date.

For example, Symantec has observed spam that appears to be a spoof on CNN that actually contains a link to a malicious Web page.

Users that click on the link will be redirected to a page that prompts users to download and run a file on a fake Flash Player, which actually installs malicious code.

Here are some of the additional spam and online tactics Symantec does expect to see as attackers seek to further take advantage of these tragedies:

· Spam with subject lines related to any of these deaths trying to peddle fake medicines

· Spam with subject lines related to any of these deaths leading to misleading applications, such as fake antivirus software

· Spam with subject lines related to any of these deaths leading to fake codecs

· Spam with subject lines related to any of these deaths with malware attached

· Search engine poisoning campaigns injecting malicious sites into the top search engine results related to any of these deaths

· Sites claiming to host videos of the last moments of these individuals lives, but actually peddling fake goods or malware

· Links to fake videos of these stars that actually attempt to infect users with malware

· Social networking site messages related to these deaths that could link to malware such as W32.Koobface

· Twitter tweets about these deaths with links to all sorts of malicious Web sites

Perhaps Michael Jackson is one popular figure that even the scammers won’t seek to abuse. Only time will tell whether the bad guys are bigger fans of the “King of Pop” or money.

Posted Wednesday, July 01, 2009 2:11 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Spam\Phishing

Phishing, All-In-One – Symantec Security Blogs

Phishing, All-In-One

Eric Park

June 29th, 2009

Filed under: Endpoint Protection (AntiVirus), Online Fraud, Spam, Security, Security Response

A typical phishing email message tries to represent (falsely) a single institution. For example, a spammer sends a phishing message, forging the email to appear as if it’s from a financial institution. The recipient is then asked to enter personal information for some fictional reason (for example, “verify your identity”). In an effort to obtain as much information as possible about the unsuspecting user, the spammer usually asks for more information than what is asked at a legitimate website. While a legitimate site may only ask for username and password, a phishing site usually seeks additional information such as a credit card or pin number, mother’s maiden name, and/or a social security number. Once the user hits the “submit” button, the private information is sent into the hands of criminals.

Symantec has recently observed a spam message that is pretending to be from HM Revenue & Customs in the United Kingdom. The message is very similar to a tax refund phishing message that involved the Internal Revenue Service earlier this year. The difference, however, is that the message contained different links to target multiple financial institutions rather than being limited to one. As part of the false portal, users are able to click the logos of their bank which then takes them to a phishing site.

With this attack, the spammers chose to replicate the legitimate page as best as possible, even if that meant gathering information that may be insufficient for a complete identify theft. For example, one link takes the user to a page where it immediately prompts the user for personal information:

However, another link takes the user to the page where the user can only enter their Internet banking user ID:

Upon entering the prompted information, the link asks for two more pieces of information:

Hitting the “continue” button simply redirects the user to the legitimate homepage of the targeted bank. Symantec has confirmed that both of these websites were designed to mimic the login process at the respective (and legitimate) banking websites. In the latter example, users are asked for a user ID, date of birth, and security number. These can provide a partial identity to the scammer, leading us to believe that the spammer may try to log in to the user accounts using the acquired credentials, or he or she may be harvesting the login credentials for some other future use.

* Note: Many thanks to my colleague, Danyang Wang, who was a key contributor to this blog.

Posted Wednesday, July 01, 2009 2:07 PM by cmosby | with no comments

Filed under: Spam\Phishing, Cybercrime

Torrentreactor Website compromised – Websense Alerts

Torrentreactor Website compromised

Date:07.01.2009

Threat Type: Malicious Web Site / Malicious Code

Websense Security Labs™ ThreatSeeker™ Network has detected that Torrentreactor, one of the oldest and most reliable torrent search engines on the Web, has been compromised and injected with malicious code. The site has been injected with an IFrame leading to a site laden with exploits. The exploits on the payload site include Internet Explorer (MDAC) and Microsoft Office Snapshot Viewer, as well as Adobe Acrobat Reader and Adobe Shockwave.

If the user's browser is successfully exploited, a malicious file is downloaded and run from the exploit site. The malicious file has an extremely low AV detection rate. The file (MD5: 24bd24f8673e3985fc82edb00b24ba73) is a Trojan Downloader and connects to a Bot C&C server at IP 78.109.29.116. After connecting to the IP, the file downloads a Rootkit installer from the same IP.

Screeenshot of the injected site:

Screeenshot of the injected code:

Screeenshot of the malicious file download stream from the exploit site:

Websense® Messaging and Websense Web Security customers are protected against this attack.

Posted Wednesday, July 01, 2009 2:02 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Patch Management, Microsoft Windows, Microsoft Office, Internet Hacks, Spam\Phishing, Cybercrime

New VMWare Security Advisory – SANS Internet Storm Center

New VMWare Security Advisory

Published: 2009-07-01,
Last Updated: 2009-07-01 07:50:05 UTC
by Bojan Zdrnja (Version: 1)

0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=6694&rss'; digg_title = 'New VMWare Security Advisory'; digg_skin='compact'; digg_topic = 'security';

acebook

witter

VMWare released a new security advisory about a vulnerability in the krb5 (Kerberos) package. The vulnerability allows a remote attacker to cause a DoS or potentially execute arbitrary code on the ESX server.

According to the advisory available at http://lists.vmware.com/pipermail/security-announce/2009/000059.html all ESX versions are affected (ESXi is not affected), however, the Kerberos package is not installed by default.

In any case, I'd like to remind you to firewall and isolate your ESX servers as much as possible.

Posted Wednesday, July 01, 2009 1:58 PM by cmosby | with no comments

Filed under: Patch Management, Virtualization, Software Vulnerabilites

King Of Pop SMSes – F-Secure Weblog

<<<

Wednesday, July 1, 2009

King Of Pop SMSes	Posted by Alia @ 02:10 GMT \| postCount('00001711'); Comments

With all the talk of Michael Jackson spam and Michael Jackson malware going on, it was mildly interesting today when a Fellow in our KUL Lab received an SMS - with link - that mentioned the King of Pop as well:

The IP appears to be registered in Malaysia but fortunately the link doesn't seem to work.

Posted Wednesday, July 01, 2009 1:55 PM by cmosby | with no comments

Filed under: Mobile\Wireless

Mobile phone trojans – SANS Internet Storm Center

Mobile phone trojans

Published: 2009-07-01,
Last Updated: 2009-07-01 13:16:40 UTC
by Bojan Zdrnja (Version: 2)

0 comment(s) digg_url = 'http://isc.sans.org/diary.html?storyid=6691&rss'; digg_title = 'Mobile phone trojans'; digg_skin='compact'; digg_topic = 'security';

acebook

witter

Couple of days ago one of our readers, Frank Wolff, sent a screenshot of an unsolicited message he received through ICQ. The message was full of garbled characters but included a link to a .JAR (Java ARchive).

The JAR file contained a malicious MIDlet, which is a Java program using the application framework for MIDP (Mobile Information Device Profile). This framework is normally used on mobile phones supporting Java (almost all phones today support Java).

As JAR files are actually just ZIP archives, it's trivial to unpack them. After unpacking a JAR archive, besides class files, the most important information is in the MANIFEST.MF file, in the META-INF directory. This file defines which class gets executed first and some other information. Below is the content of the extracted MANIFEST.MF file:

Manifest-Version: 1.0
Ant-Version: Apache Ant 1.7.1
Created-By: 1.5.0_09-b03 (Sun Microsystems Inc.)
MIDlet-1: foto,/icon.png,Midlet
MIDlet-Vendor: Sun Microsystems, Inc.
MIDlet-Version: 1.0
MIDlet-Name: foto
MicroEdition-Configuration: CLDC-1.0
MicroEdition-Profile: MIDP-1.0

The class called "Midlet" is the main class so that's where the analysis should start. Since Java uses bytecode, it is possible to decompile the class files into source files – these source files are not exactly what the developer wrote, but are close enough to allow us to analyze what's going on.

After starting, this particular Trojan created a thread which sent some SMS messages. The content and the numbers were obfuscated and stored in another file embedded in the JAR archive. The obfuscation algorithm was relatively simple (just logical AND with couple of other tricks). Finally, after all deobfuscation steps, the following text came out:

7122 vin 10199|*132 vis=10199|8.55 vis ,0199|83(5 vis 1-199|713/ vis 10,99|8355=vis 101$9|

The messages are separated with the "|" character, however it appears that the deobfuscation algorithm (or obfuscated data) had some errors. In any case, the Trojan tries to send 6 SMS messages as above.

However, after doing all this work, there are couple of questions that I still could not answer. First, I would be interested to hear from our readers if someone can confirm whether Trojans like this can send SMS messages from the mobile phone without any user interaction. If they can, then the overall risk is indeed higher.

If you can recognize numbers and/or messages above please let us know what the purpose of the Trojan is (probably make some money for the attacker).

As the Trojan was distributed as a link through ICQ messages, it's clear that another malware was used for this, since the Trojan analyzed here has no spreading capabilities. Does this imply that a lot of ICQ users use their mobile phones? Or the attackers are just blindly shooting.

Finally, AV detection was less than good with only 14 AV (out of 41) products detecting the JAR file successfully (VirusTotal). That being said, it's clear that the time when we will have to run AV programs on our phones is quickly coming.

UPDATE

We received quite a bit interesting submissions about this -- thanks to everyone who contributed.

It appears that the majority of mobile phones will allow an application (or an applet) to send SMS messages without the user controlling this process. Even if there are some controls around, the user is usually asked only first time when the application starts. This is indeed worrying since such malicious applications use a lot of social engineering to fool the victim. Karim wrote in to confirm this on un-managed BlackBerry phones as well -- while BB's require the code to be signed it appears that it is relatively easy to obtain code signing keys from RIM.

--
Bojan

Posted Wednesday, July 01, 2009 1:53 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Mobile\Wireless

Tweet’n’earn – Viruslist.com

Tweet’n’earn

Maria

June 30, 2009 | 13:42 GMT

comment

We love social networking sites, and phishers are no exception. They’ve been sending out fake Twitter notifications for a while now. The one we’ve just received doesn’t have much in common with previous phishing attacks.
The message looks like this:

Lots of suspicious things about this message: the word “twitter” comes at the end of the link, rather than the beginning, and the English is a bit dodgy as well. None of the addresses in the “From” fields have any strong associations with Twitter:

From: "Donald" VanceShade@qoodly.com
From: "Michael" KirbySchulte@filepages.net
From: "Jeff" JeremiahSilver@savingssavingsandmoresavings.net

Click on the link (aren’t people getting tired of all this clicking?) and you end up on a site which is very generously offering to let you into the secret of how to make money on Twitter. All you have to do is enter your details.

And once you’ve done that, you get asked for your credit card details:

So here’s the $64,000 question: is it really a good idea to enter your credit card details on a site telling you how to make money from home, a site that you reached by clicking on a spam link? (On second thoughts, no prizes, because we should all know the answer by now!)
But the story doesn’t end here – out of sheer curiosity, I put http://www.digilinks.mobi/facebook into my browser (instead of http://www.digilinks.mobi/twitter/) and got this:

And then got redirected to a site telling me I’d won a stack of money. Great news – why should I put in time ‘earning’ money on Twitter when I can just win the lottery? All I need to do is give them my details...

We love social networks for some of the oddities they throw up. And phishers love them too, because there’s always someone who’s willing to click, and click, and click again.

Posted Wednesday, July 01, 2009 1:30 PM by cmosby | with no comments

Filed under: Spam\Phishing, Cybercrime

MSN Bot Plays on Controversy over Michael Jackson’s Death – TrendLabs Malware Blog

Jun26

MSN Bot Plays on Controversy over Michael Jackson’s Death

11:36 am (UTC-7) | by Jovi Umawing (Technical Communications)

Following the sudden and shocking death of The King of Pop, Senior Threat Researcher Loucif Kharouni reports that a slew of malicious links related to Michael Jackson’s last moments in the hospital before his death are now being proliferated in the wild via the instant messaging (IM) application, MSN. Below is a sample screenshot of an MSN IM window containing various templates of the said malicious links:

Screenshot

When recipients of such messages click on any of these links, they are prompted to save a file named PIC-IMG029-www.hi5.com.exe (with an MD5 checksum of 031429fc14151f94c8651a3fb110c19b), instead of being led to an image site or gallery. Initial analysis shows that the said file is a variant of the SDBOT family.

More updates shortly. Stay tuned.

Update as of 27 June 2009

The botnet is said to push the templated messages through an IRC to the client to be spammed. Below is a sample screenshot of the botnet’s activity:

The malware responsible for this is detected as WORM_IRCBOT.GAT. It opens a certain port on the affected system then listens for remote commands. Kharouni reports that commands to download certain files are received and executed by the affected system, ultimately leading to the download a PUSHDO variant. PUSHDO is a botnet responsible for a huge amount of spam activity. More information on PUSHDO can be found here:

A whitepaper showing findings by the research of Trend Micro analysts on PUSHDO/CUTWAIL is also available and can be downloaded here.

Trend Micro clients are rest assured that all URLs are already blocked through the Smart Protection Network.

Posted Wednesday, July 01, 2009 1:28 PM by cmosby | with no comments

Filed under: Security and Anti-Virus, Spam\Phishing, Cybercrime

Michael Jackson News Affects Web Traffic – McAfee Avert Labs Blog

Michael Jackson News Affects Web Traffic

Friday June 26, 2009 at 1:58 pm CST
Posted by Paula Greve

Trackback

The announcement of Michael Jackson’s death has caused immediate effects on the Web 2.0 world. The impact ranged from the interruption on Facebook of coverage of Farrah Fawcett’s death to a surge experienced by Twitter. The Web 2.0 world is definitely abuzz with traffic regarding his passing.

Within hours the percentage of “long-tail” URL traffic associated with Michael Jackson was growing. It peaked around 1 p.m. Eastern time today and now seems to be dropping. These URLs contained mostly generic information about Jackson–blogs, posts, tributes, photos, and collections of his entertainment past. And, yes, some even contained links to malware or rogue anti-virus software.

How do people find these URLs? We’ve seen spam, tweets, blog postings, group postings, and even mobile phone alerts. In addition, as predicted by Avert Labs, we’ve seen search-engine optimization (SEO) in action. There were several attempts to capitalize on redirecting users to known malware-serving sites associated with other SEO campaigns. We found it interesting during our research to see how fast some of the search engines seemed to respond to this. One popular keyword search done around 9 p.m. yesterday showed seven of the top 10 links going to some of these well-known malicious servers. That same search done an hour later showed only one of the top 10 involved.

As the entertainment industry continues to pay tribute and homage to Jackson, we expect that spam and SEO efforts will grow over the weekend. Eventually a new piece of news will replace this event, and there will be a new story–with much the same results.

Posted Wednesday, July 01, 2009 10:47 AM by cmosby | with no comments

Filed under: Spam\Phishing

New Anti-analysis Technique for Script Malware – TrendLabs Malware Blog

img {max-width:650px;width: expression(this.width > 650 ? 650: true);border-style:none; behavior: url(../iepngfix.htc); }

Jun28

New Anti-analysis Technique for Script Malware

1:42 pm (UTC-7) | by Jonathan San Jose (Threats Analyst)

Recently, we came across JS_VIRTOOL which uses certain Javascript techniques so that encrypted code may not be decrypted and analyzed by a malware analyst.

Here is how this is done:

It retrieves the URL where the malicious script is located.
It retrieves its own function and adds the string of the URL.
It computes the CRC of the function plus the URL.
It decrypts an encrypted code in the script body using the CRC that was computed.
It executes the decrypted code using the eval() function.

Figure 1. Obfuscated code of JS_VIRTOOL

It uses its function and URL location as a decryption code. In this case, the encrypted code which is the real routine of the malware will not execute if the function is tampered and/or the URL is not correct.

If a malware analyst only has the script file sample without knowing where the file was downloaded from, he will not be able to know the malware’s actual routines since the URL is necessary for the decryption to take place. In addition, if this script is placed on another website aside from the “correct” one, it will not be successfully decrypted.

Currently, we have multiple samples that all use this particular technique, but have different encrypted contents. We suspect that they have the same decrypted data, the only difference being the URL location which will decrypt each sample. We believe that this as a technique which is intended to make it more difficult to track the source and cause of infection. This could potentially increase the time before these malicious scripts are detected and the appropriate solutions are released to users.

Posted Wednesday, July 01, 2009 10:38 AM by cmosby | with no comments

Filed under: Security and Anti-Virus, Internet Hacks, Spam\Phishing, Cybercrime

Search

Tags

News

Unique Visitors

Navigation

Archives

Microsoft Links

SMS Links

Great Blogs

My Links

Security Links

Anti-Virus Links

Things I Have Done or I Am Involved In

Published Works

Has Elvis Left the Building?

@BlogAudience: MoTB Follows Limited Disclosure Approach to Twitter Vulnerabilities

FakeAlerts Uncovered

Michael Jackson Spam Inhibits the Independence Day Spam Spur

Curiosity killed the cat

Scammers Utilizing Free Web Hosting Services

We All Knew It Was Coming: A Michael Jackson Mass Mailing Worm

Celebrity Deaths and What to Expect in Cyberspace

Phishing, All-In-One

Tweet’n’earn

Michael Jackson News Affects Web Traffic