Virus Information News

[First]  [Previous] |    162     163     164     165     166     167     168     169     170     171    | [Next]  [Last] of 172 page(s)

Screenshots of the latest Twitter phishing attack

f-secure.com

March 21, 2010

Today there's a phishing run underway in Twitter, using Direct Messages ("DMs"). These are private one-to-one Tweets inside Twitter.

If you mistakenly give out your credentials, the attackers will start sending similar Direct Messages to your contacts, posing as you. The ultimate goal of the attackers is to gain access to a large amount of valid Twitter accounts, then use these account to post Tweets with URLs pointing to malicious websites which will take over users computers when clicked.

Finding Malware on your network via cached DNS entries

innismir.net

March 19, 2010

While staring at the ZeuS Tracker Domain Block list and trying my usual method of snipe hunting manually entering domains to query the firewalls, a moment of inspiration hit: I don't care about all the domains, just the domains that people visit. Who know

My first attempt was a simple script to take a pre-chewed version of the ZeuS Domain list, feed it through dig and pipe the output through grep. It worked, but I wanted something a touch more automated. Over the next couple of nights on the train, I whipped up a tool to automate the process a little more. The resulting tool is the ZeuS DNS Scraper. It's a simple script written in Perl and should work straight out of the box with the default modules included in a Perl distribution.

Botnet Brought Down, Three People Arrested

The Whir

March 12, 2010

According to a report published Thursday in the Globe and Mail, Internet security firms brought down a massive botnet, named Mariposa, this week, an effort that resulted in the arrest of three people by Spanish police, on charges related to cyber crime.

Emphasizing the involvement of the Canadian security firm Defense Intelligence (it being a Canadian newspaper), the Globe reports that the botnet controlled infected machines in approximately 190 countries, and appeared to be targeting government and corporate computers, with the aim of stealing sensitive data. The report quotes Chris Davis, founder of Defense Intelligence, as saying that infected machines were found in about 65 percent of Fortune 1,000 firms, as well as banks and government organizations from around the world, the offices of leaders in several Asian countries and more than 1 million computers in Iran.

Allaple Virus Author Sentenced

f-secure.com

March 11, 2010

An Estonian virus writer has been sentenced to jail in Harju, Estonia. The author of the Allaple virus family, 44-year old Mr. Artur Boiko pleaded not guilty. Nevertheless, he was found guilty and sentenced to 2 years and 7 months in prison.

Allaple is a complex worm using polymorphic encryption. It spreads over network shares and by modifying local HTML files. When such HTML files are uploaded to public websites, they spread the infection further. Apparently Mr. Boiko had been in a car accident and had ended up in dispute over his insurance claim with If Insurance. As a result, his worm launches DDoS attacks against [various sites from his insurance company].

The Morphing PDF

f-secure.com

March 5, 2010

Just when we thought SEO using Flash was as interesting as SEO poisoning can get, it seems it's getting even sneakier...

Imagine a PDF file posted by someone evil online. Of course, Google being Google, the file is recognized as a PDF. Three hours later... Google still says the file is a PDF. Brod (one of our geeky guys here) is attributing this to Google's cache. But is it really a PDF this time around?

Another Bot Bites the Dust?

f-secure.com

March 4, 2010

Remember Microsoft's action against 277 Waledac domains last week? Well, that's one way of going after a botnet... Another way of shutting down a botnet? Arrest the botmasters!

Three Spanish citizens have been arrested for running the "Mariposa" botnet. The three reportedly have no criminal records and have limited hacking skills. Mariposa is a Butterfly Kit based botnet, and the kit is no longer for sale. Details are available from the BBC and The Register. Kudos to those involved in the arrests.

SEO Poisoning Sites Use Flash for Redirection

f-secure.com

March 4, 2010

Another day, another news, and well... another SEO poisoning stint. Since a lot of websites use SWF, most users have already installed Flash support in their browsers, thereby also enabling support for the malware behavior. The SWF is of course the key to

Sprechen Sie SSL?

f-secure.com

February 23, 2010

Why is it that banking trojans are a problem when all online banks are HTTPS secured and many of them employ multi-factor authentication? The answer: Humans are not digital.

If malware can modify the memory of the browser, or some other application, it can gain control. This is not just a problem for online banking and not just with malware. For example, current MMORPG games typically do quite a bit of the computation needed on the client side. Not all of this computation is graphics processing. This creates the possibility for cheating in games by patching the client or its memory locally on the host (Greg Hoglund and Gary McGraw have written a book called "Exploiting Online Games: Cheating Massively Distributed Systems [2007]" on the subject). Another good example of this "client-side dilemma" is voting. Imagine sitting at home on your couch while using your web browser to vote in your local/state/national elections. If and when this becomes possible, malware may be used to rig votes.

New Zero-Day Threats and High Spam Levels: MessageLabs Report

WHIR Web Hosting Industry News

January 22, 2010

According to a report released last week by Symantec, 83.4 percent of spam at the end of 2009 originated from botnets. Around 900 million spam emails, originated from free webmail accounts, and more than 79 percent of webmail spam came from three well-kno

"Despite the best efforts of the webmail providers to prevent this abuse of their services, there is still a viable market in the underground economy for buying and selling legitimate and usable webmail accounts," Symantec Hosted Services MessageLabs Intelligence senior analyst Paul Wood said in a statement. Last month, a new zero-day vulnerability in a popular version of a .PDF viewer was found to target high-level individuals in the public sector, education, financial services and large international corporations. It arrives as a .PDF file containing embedded malicious Javascript code. The attack also had a social engineering aspect -- the attack varied according to the individual and organization being targeted, making it seem legitimate. MessageLabs Intelligence actually blocked the first versions in November 2009, protecting Symantec Hosted Services customers from the attack before it began.

Chinese Search Engine Baidu Sues Its US Web Host Over Hacking Incident

WHIR Web Hosting Industry News

January 20, 2010

Following a January 12 attack that left Baidu's main search engine inaccessible for several hours, Baidu announced on Wednesday that it had filed a lawsuit against register.com and that it was actively seeking a new hosting provider for its search engine.

"The fault of register.com led to the malicious and unlawful altering of the domain name of Baidu, which made thousands of people unable to visit baidu.com and brought serious losses to Baidu," the company stated. Last week, Baidu searches were reportedly redirected, and its homepage carried the message, "This site has been hacked by Iranian Cyber Army." This suggests that it was the same group that hacked social networking site, Twitter, last month.

[First]  [Previous] |    162     163     164     165     166     167     168     169     170     171    | [Next]  [Last] of 172 page(s)