Saturday, February 21, 2009
TrendLabs | Malware Blog - by Trend Micro - 2 new articles
"TrendLabs | Malware Blog - by Trend Micro" - 2 new articles
Portable Document Format or Portable Malware Format?The Portable Document Format, or PDF for short, has always been a popular way of disturbing documents. It’s no surprise, then, that malware authors have tried to use it as a means of spreading malicious files. Yesterday, the Shadowserver Foundation underlined the severity of this problem when they released details about a new vulnerability in versions of both Adobe Acrobat and Adobe Acrobat Reader. Folks at Adobe assured users that they are working on a patch, to be released in March. Trend Micro already detects files that exploit the new vulnerability as TROJ_PIDIEF.IN. These specially crafted PDF files crash Acrobat and/or Acrobat Reader - but not before they drop malicious files onto the affected system. The exact malware that is dropped varies, but include backdoors like BKDR_NETCL.A, and other software exploits like EXPL_EXECOD.A. The potential of an exploit like this is only limited by the imagination malicious users. It spreads the same way normal PDF files can be distributed - either as an e-mail attachment, or downloaded from Web sites. Until Adobe patches this issue, users should exercise caution with PDF files that come from untrusted sources. Using third-party PDF readers such as Foxit will also reduce the threat. In addition, it is highly recommended to disable JavaScript rendering. Post from: TrendLabs | Malware Blog - by Trend Micro Portable Document Format or Portable Malware Format? When the Going Gets Tough, the Scammers Get GoingThe depths which cybercriminals choose to sink themselves into for the sake of financial gain is truly appalling. In the midst of the crisis brought by the global recession, they have managed to come up with illicit schemes that target those people, who despite the desperate times are trying to get through the crisis the proper, lawful way. Just recently, we have found spam emails posing to be from job search sites Huxley Associates and Jobs.com.  Figure 1.Sample spam email purporting to be from Jobs.com  Figure 2.Sample spam email purporting to be from Huxley Associates The email message comes on as a notification to the recipient that they did not get the job they supposedly applied for.  Figure 3.The malicious attachment Attached to the message is a .ZIP file, stated to be a copy of the recipients' application form. However, opening the file and executing it reveals that the said file is actually a worm detected by Trend Micro as WORM_PROLACO.C. WORM_PROLACO.C propagates via removable drives and P2P networks. It drops copies of itself in p2p-related shared folders using commonly searched file names of software cracks and ring tones. In such a dire condition with job losses at every corner, all prices going up, and the unpleasant greeting of "the worst is yet to come" type of predictions, people are left no choice but to scramble for every possible job opportunity they could get. Now, what more convenient way to seek more opportunities in such a short time, but to look for a job online? But with job openings rate decreasing, competition tightens, which leads people to become desperate, and more importantly—careless. This is what cybercriminals are counting on at this point, leveraging on the current need of people for a stable job despite the rocky economic conditions. The current global crisis creates a domino effect, which triggers a human vulnerability, now relentlessly exploited by cybercriminals. Users of the Trend Micro Smart Protection Network are protected from this threat, as both spam message and malicious file are now blocked and detected respectively. Other users are advised to ignore such email messages, and refrain from opening file attachments from unsolicited emails. Post from: TrendLabs | Malware Blog - by Trend Micro When the Going Gets Tough, the Scammers Get Going More Recent Articles |
Click here to safely unsubscribe now from "TrendLabs | Malware Blog - by Trend Micro" or change subscription settings
Unsubscribe from all current and future newsletters powered by FeedBlitz
| Your requested content delivery powered by FeedBlitz, LLC, 9 Thoreau Way, Sudbury, MA 01776, USA. +1.978.776.9498 |
Friday, February 20, 2009
[Lockergnome] Computer Security ~ February 20, 2009
Subscribe to:
Posts (Atom)
Subscribe via email
Blog Archive
-
►
2012
(71)
- 02/12 - 02/19 (8)
- 02/05 - 02/12 (11)
- 01/29 - 02/05 (10)
- 01/22 - 01/29 (12)
- 01/15 - 01/22 (9)
- 01/08 - 01/15 (12)
- 01/01 - 01/08 (9)
-
►
2011
(706)
- 12/25 - 01/01 (3)
- 12/18 - 12/25 (12)
- 12/11 - 12/18 (14)
- 12/04 - 12/11 (10)
- 11/27 - 12/04 (10)
- 11/20 - 11/27 (3)
- 11/13 - 11/20 (10)
- 11/06 - 11/13 (15)
- 10/30 - 11/06 (10)
- 10/23 - 10/30 (11)
- 10/16 - 10/23 (11)
- 10/09 - 10/16 (8)
- 10/02 - 10/09 (14)
- 09/25 - 10/02 (7)
- 09/18 - 09/25 (14)
- 09/11 - 09/18 (11)
- 09/04 - 09/11 (10)
- 08/28 - 09/04 (11)
- 08/21 - 08/28 (11)
- 08/14 - 08/21 (9)
- 08/07 - 08/14 (12)
- 07/31 - 08/07 (14)
- 07/24 - 07/31 (9)
- 07/17 - 07/24 (11)
- 07/10 - 07/17 (13)
- 07/03 - 07/10 (10)
- 06/26 - 07/03 (9)
- 06/19 - 06/26 (12)
- 06/12 - 06/19 (13)
- 06/05 - 06/12 (18)
- 05/29 - 06/05 (10)
- 05/22 - 05/29 (14)
- 05/15 - 05/22 (11)
- 05/08 - 05/15 (12)
- 05/01 - 05/08 (10)
- 04/24 - 05/01 (13)
- 04/17 - 04/24 (17)
- 04/10 - 04/17 (25)
- 04/03 - 04/10 (18)
- 03/27 - 04/03 (18)
- 03/20 - 03/27 (21)
- 03/13 - 03/20 (21)
- 03/06 - 03/13 (23)
- 02/27 - 03/06 (20)
- 02/20 - 02/27 (15)
- 02/13 - 02/20 (15)
- 02/06 - 02/13 (25)
- 01/30 - 02/06 (23)
- 01/23 - 01/30 (19)
- 01/16 - 01/23 (15)
- 01/09 - 01/16 (18)
- 01/02 - 01/09 (18)
-
►
2010
(1039)
- 12/26 - 01/02 (10)
- 12/19 - 12/26 (16)
- 12/12 - 12/19 (19)
- 12/05 - 12/12 (18)
- 11/28 - 12/05 (23)
- 11/21 - 11/28 (13)
- 11/14 - 11/21 (20)
- 11/07 - 11/14 (19)
- 10/31 - 11/07 (22)
- 10/24 - 10/31 (22)
- 10/17 - 10/24 (20)
- 10/10 - 10/17 (16)
- 10/03 - 10/10 (14)
- 09/26 - 10/03 (13)
- 09/19 - 09/26 (15)
- 09/12 - 09/19 (24)
- 09/05 - 09/12 (20)
- 08/29 - 09/05 (20)
- 08/22 - 08/29 (22)
- 08/15 - 08/22 (16)
- 08/08 - 08/15 (24)
- 08/01 - 08/08 (21)
- 07/25 - 08/01 (20)
- 07/18 - 07/25 (21)
- 07/11 - 07/18 (19)
- 07/04 - 07/11 (18)
- 06/27 - 07/04 (17)
- 06/20 - 06/27 (17)
- 06/13 - 06/20 (19)
- 06/06 - 06/13 (26)
- 05/30 - 06/06 (17)
- 05/23 - 05/30 (18)
- 05/16 - 05/23 (16)
- 05/09 - 05/16 (24)
- 05/02 - 05/09 (18)
- 04/25 - 05/02 (21)
- 04/18 - 04/25 (21)
- 04/11 - 04/18 (27)
- 04/04 - 04/11 (19)
- 03/28 - 04/04 (24)
- 03/21 - 03/28 (23)
- 03/14 - 03/21 (17)
- 03/07 - 03/14 (28)
- 02/28 - 03/07 (26)
- 02/21 - 02/28 (18)
- 02/14 - 02/21 (18)
- 02/07 - 02/14 (30)
- 01/31 - 02/07 (24)
- 01/24 - 01/31 (19)
- 01/17 - 01/24 (20)
- 01/10 - 01/17 (28)
- 01/03 - 01/10 (19)
-
►
2008
(1133)
- 12/28 - 01/04 (19)
- 12/21 - 12/28 (19)
- 12/14 - 12/21 (27)
- 12/07 - 12/14 (39)
- 11/30 - 12/07 (25)
- 11/23 - 11/30 (16)
- 11/16 - 11/23 (20)
- 11/09 - 11/16 (27)
- 11/02 - 11/09 (37)
- 10/26 - 11/02 (29)
- 10/19 - 10/26 (29)
- 10/12 - 10/19 (29)
- 10/05 - 10/12 (25)
- 09/28 - 10/05 (18)
- 09/21 - 09/28 (28)
- 09/14 - 09/21 (23)
- 09/07 - 09/14 (29)
- 08/31 - 09/07 (22)
- 08/24 - 08/31 (18)
- 08/17 - 08/24 (23)
- 08/10 - 08/17 (33)
- 08/03 - 08/10 (23)
- 07/27 - 08/03 (33)
- 07/20 - 07/27 (25)
- 07/13 - 07/20 (27)
- 07/06 - 07/13 (30)
- 06/29 - 07/06 (23)
- 06/22 - 06/29 (21)
- 06/15 - 06/22 (25)
- 06/08 - 06/15 (30)
- 06/01 - 06/08 (36)
- 05/25 - 06/01 (24)
- 05/18 - 05/25 (21)
- 05/11 - 05/18 (25)
- 05/04 - 05/11 (25)
- 04/27 - 05/04 (20)
- 04/20 - 04/27 (22)
- 04/13 - 04/20 (38)
- 04/06 - 04/13 (35)
- 03/30 - 04/06 (28)
- 03/23 - 03/30 (16)
- 03/16 - 03/23 (17)
- 03/09 - 03/16 (23)
- 03/02 - 03/09 (14)
- 02/24 - 03/02 (10)
- 02/17 - 02/24 (7)