Virus Information News

[First]  [Previous] |    144     145     146     147     148     149     150     151     152     153    | [Next]  [Last] of 172 page(s)

Oxford Muses on Mac Flashback: Worst Outbreak Since Blaster

F-Secure Weblog

by Sean

May 2, 2012

So how bad was last month's Mac Flashback outbreak and who suffered the most?

Oxford University Computing Services' network security team (aka OxCERT) has written that they dealt "with what is probably the biggest outbreak since Blaster struck the Windows world all the way back in the summer of 2003." OxCERT dealt with around 1000 incidents for Blaster. They've seen several hundred Flashback incidents... "and they keep on coming."

Ransomcrypt Decryption Script

F-Secure Weblog

by Sean

April 19, 2012

Last week, we wrote about a ransom trojan called Trojan:W32/Ransomcrypt which encrypts documents, images, videos, et cetera and holds the files hostage for EUR50.

Ransomcrypt encrypts files using Tiny Encryption Algorithm (TEA). The key is formed from a "base key" which is modified based on the first character of the name of the file that is being encrypted to form a "file specific key". Both the base key and the file specific key are 16 bytes long. Our analysts have created a decryption script, written in Python, for our support team.

Trojan:W32/Ransomcrypt

F-Secure Weblog

by Sean

April 12, 2012

We are receiving reports of a ransom trojan, it's been circulating during the last two days.

When first run on the system, the ransomware will iterate all folders on the system. Every document, image, and shortcut (.lnk) file found will be encrypted and appended with an extension of .EnCiPhErEd. In each folder it will drop a text file called "HOW TO DECRYPT.TXT" which contains instructions on how to proceed. The bandit is demanding EUR50.

Mac Flashback Infections

F-Secure Weblog

by Sean

April 5, 2012

On Monday, we wrote about a variant of the Mac Flashback trojan that exploits a then unpatched Java vulnerability (CVE-2012-0507). Apple released its security update on Tuesday. If you have Java installed on your Mac - update now.

Yesterday, Dr. Web (a Russian based antivirus vendor) reported that Flashback may have infected over half-a-million Macs. Each installation of Flashback creates a unique User-Agent. Dr. Web's Ivan Sorokin later estimated that their sinkhole now estimates over 600,000 infections.

More Mac Malware (Word Exploit) Targeting NGOs

F-Secure Weblog

by Sean

March 28, 2012

Alienvault Labs has discovered more malware that targets human rights focused Non-Governmental Organizations (NGOs). This is in addition to last week's discovery. This time, it's an exploit taking advantage of a 2009 vulnerability in Microsoft Word.

Microsoft's Digital Crimes Unit Targets ZeuS

F-Secure Weblog

by Sean

March 26, 2012

Microsoft's Digital Crimes Unit expanded its legal arsenal against malicious botnets this past weekend when - in collaboration with financial services industry members - it took out servers belonging to ZeuS botnets.

Microsoft filed with the U.S. District Court for the Eastern District of New York on March 23rd. The successful application allowed Microsoft and its partners to do a coordinated seizure of some of the worst known Zeus C&Cs. And as you can see below, F-Secure Labs played its small part by providing the DCU with information and analysis.

China Targets Macs Used by NGOs #Tibet

F-Secure Weblog

by Sean

March 20, 2012

A new Mac backdoor exploiting CVE-2011-3544 (a Java vulnerability) is being reported. The backdoor appears to be connected to GhostNet.

The malware is being used in targeted attacks against non-governmental organizations (NGO). Greg Walton published details of targeted mails sent to NGOs related to Tibet. The message contains a link to: dns.assyra.com. AlienVault Labs has posted a technical report.

Joe's Garage (SMB): Most Likely to be Pwned by RDP

F-Secure Weblog

by Sean

March 19, 2012

Last week, we advised readers to apply Microsoft update MS12-020 sooner than later. For those of you that have - good work. And if you haven't yet applied the patch - stop delaying.

Ever since MS12-020 was released, there's been a flurry of activity attempting to "weaponize" the Remote Desktop Protocol (RDP) vulnerability. The race to an exploit is on and is in top gear. Lab Analyst Timo Hirvonen is tracking the situation on his Twitter account. So... just how many computer could be affected by this RDP bug? Well, researcher Dan Kaminsky scanned the Internet and estimates that there are millions of computers that are exposed.

Found Object: SpyEye Manual

F-Secure Weblog

by Sean

March 12, 2012

File this in the "we shouldn't be surprised" folder.

This morning, one of our analysts, currently researching SpyEye, came across a new component name. And so, he did a Google search for that component. He found a copy of the SpyEye Manual...

AV-TEST Results for Android Malware Protection

F-Secure Weblog

by Sean

March 6, 2012

AV-TEST published its "Anti-Malware solutions for Android" report today. Out of 41 products tested - we're proud to be in the top tier!

[First]  [Previous] |    144     145     146     147     148     149     150     151     152     153    | [Next]  [Last] of 172 page(s)