Saturday, July 4, 2009
Friday, July 3, 2009
[Lockergnome] Computer Security ~ July 3, 2009
Security Alert: Waledac Independence Day Theme - New Campaign In The Wild
Websense Security LabsT ThreatSeekerT Network has detected yet another new Waledac campaign theme in the wild. The new variant uses an Independence Day theme as a social engineering mechanism. The United States of America celebrates Independence Day on July 4 each year.
The malicious emails that are sent use subjects and content related to Independence Day, Fourth of July and fireworks shows.
The malicious Web sites in the current attack also have a July 4 or fireworks theme within the domain name. ThreatSeeker has been monitoring the registration of these domains. Should the user click on the video, which is designed to appear to be a YouTube video, an .exe is offered. When downloaded the .exe would install the latest Waledac variant onto the user's machine.
Websense® Messaging and Websense Web Security customers are protected against this attack.
To view the details of this alert Click here
Protected by Websense Hosted Email Security — www.websense.com
TrendLabs | Malware Blog - by Trend Micro - 3 new articles
"TrendLabs | Malware Blog - by Trend Micro" - 3 new articles
Gumblar Invades Best BuyEarlier today, Trend Micro Technical Account Manager Fioravante Souza in Brazil spotted a (potentially harmful) URL that redirects users from the Best Buy domain site. Users who visit www.bestbuy.com, as it turns out, are redirected to the URL, hxxp://pics. bubbled.cn/gallery/ “If (the) requesting IP is from the Latin America Region (LAR), users are redirected to the ‘Choose English or Spanish’ page—and then bingo!” Macalintal says.
The landing page is found to display only if the requesting IP www.bestbuy.com is from LAR (see Figure 1). The source code (see Figure 2) of the landing page shows a garbled set of code found at the bottom of the script, a clear sign of code obfuscation. Beneath a 3-layer obfuscation, an iframe redirects the user to a Luckysploit-laden site. The Luckysploit web exploit kit and the obfuscation seen is reminiscent of that found in Gumblar.
The WHOIS screenshot of the .CN site (see Figure 3) states that it has been created just last June 4, 2009 by the same old criminals. Further investigation shows that the first .CN site (see Figure 4) is actually located in Germany and is used by attackers in Ukraine. Suffice it to say, the Russkranians are the culprits once again. Best Buy has been informed of the said URL redirections and is resolving the matter as of this writing. More information to follow. Hat tip to Advanced Threat Researcher Paul Ferguson for providing more information. Post from: TrendLabs | Malware Blog - by Trend Micro Spam Speculates Michael Jackson's MurderMichael Jackson has been dead for a week already, but there are still a lot of speculations regarding his death. The spam runs are plenty as well — a Michael Jackson-related spam was seen bearing the subject Who killed Michael Jackson?, coming from a sender named x-files. The spam message suggests that the icon was killed, and that information on who murdered him can be seen on the given URL.
Clicking the said link leads to a website, where the user is asked to execute a file, which supposedly contains secret information, in order to find out who killed Michael Jackson. But of course, the executable is not at all related to Michael Jackson’s murderer, or to Michael Jackson at all, as the file is really an data-stealer detected by Trend Micro as TROJ_ZBOT.AXY. The Trojan TROJ_ZBOT.AXY connects to a certain URL where it downloads a configuration file containing a list of banking-related websites. Once the user attempts to visit any of the listed sites, a spoofed site is displayed instead of the real one, thus any critical information entered on the spoofed site will be sent to a remote user. This threat however, doesn’t stand a chance against the Smart Protection Network as of its all components — spam, URL and file — are already either blocked or detected. Post from: TrendLabs | Malware Blog - by Trend Micro Spam Speculates Michael Jackson’s Murder Three Months Later: Where's DOWNAD?
Exactly three months ago, the whole IT sector was waiting with bated breath for April 1. The latest DOWNAD/Conficker variant–WORM_DOWNAD.KK–was poised to strike. We know that on that day, it would attempt to access 500 of 50,000 websites and download new malicious files. This led to fears–somewhat misplaced–that new, possibly damaging payloads could cause severe problems, not just for systems already affected by DOWNAD but the Internet as a whole. Many sectors assumed the worst. April 1 came and went, and… nothing happened. Several days later, another variant appeared, but without the Internet ending (as some of the worst reporting would have led readers believe) most people believed that DOWNAD, as a major threat, was gone. While it may no longer be as in the news at it was at its height, DOWNAD didn’t suddenly go away. Recent estimates from the Conficker Working Group place the number of unique IP addresses affected by the top 3 DOWNAD variants at well over 5 million. Even considering the group’s disclaimer of putting the number of actually infected systems at only 25-75% of that number, a minimum of 1.25 million infected systems is nothing to laugh at. The Trend Micro World Virus Tracking Center (WTC) numbers bear this out as well. Almost 790,000 systems were found to be infected with DOWNAD variants in the first three months of the year. In the three succeeding months, that number was almost 1.9 million. Clearly, DOWNAD did not decide to quietly go away. In addition, out of the public eye, DOWNAD went off and did something with all those infected systems: it went off and formed its own botnet. This was documented in mid-April by Advanced Threat Researchers Paul Ferguson and Ivan Macalintal. The short version, however, is simpler: DOWNAD was used to create a botnet. These can be used for the usual range of threats: spam, Denial of Service attacks, spreading FAKEAV malware, and so on. Like it or not, malware threats are part of what users have to deal with day in, day out. Like anything people deal with regularly, people become used to malware threats. What was once noteworthy and unusual becomes dull and ordinary. However, this in fact does not make the threat any less dangerous. If anything, it can be argued that it makes the threat more dangerous, as users are more likely to be caught unaware of a threat that may not be something they’re looking out for. In a very real way, threats like DOWNAD become part of the background noise that is a part of life on the Internet. While it may be unrealistic to expect individual users to keep in mind all threats, but good computing practices will help immensely. The most important one may be: keep your software up to date. This is particularly true for your operating system–a properly patched system would have been proof against most DOWNAD variants. Trend Micro users would have been protected via the Smart Protection Network, of course, but closing the underlying vulnerability would still have been essential. The price of using your computer freely in today’s Internet may well be constant and unceasing vigilance. Post from: TrendLabs | Malware Blog - by Trend Micro Three Months Later: Where’s DOWNAD? More Recent Articles |
Click here to safely unsubscribe now from "TrendLabs | Malware Blog - by Trend Micro" or change your subscription or subscribe
Unsubscribe from all current and future newsletters powered by FeedBlitz
| Your requested content delivery powered by FeedBlitz, LLC, 9 Thoreau Way, Sudbury, MA 01776, USA. +1.978.776.9498 |
Subscribe to:
Posts (Atom)
Subscribe via email
Blog Archive
-
►
2012
(71)
- 02/12 - 02/19 (8)
- 02/05 - 02/12 (11)
- 01/29 - 02/05 (10)
- 01/22 - 01/29 (12)
- 01/15 - 01/22 (9)
- 01/08 - 01/15 (12)
- 01/01 - 01/08 (9)
-
►
2011
(706)
- 12/25 - 01/01 (3)
- 12/18 - 12/25 (12)
- 12/11 - 12/18 (14)
- 12/04 - 12/11 (10)
- 11/27 - 12/04 (10)
- 11/20 - 11/27 (3)
- 11/13 - 11/20 (10)
- 11/06 - 11/13 (15)
- 10/30 - 11/06 (10)
- 10/23 - 10/30 (11)
- 10/16 - 10/23 (11)
- 10/09 - 10/16 (8)
- 10/02 - 10/09 (14)
- 09/25 - 10/02 (7)
- 09/18 - 09/25 (14)
- 09/11 - 09/18 (11)
- 09/04 - 09/11 (10)
- 08/28 - 09/04 (11)
- 08/21 - 08/28 (11)
- 08/14 - 08/21 (9)
- 08/07 - 08/14 (12)
- 07/31 - 08/07 (14)
- 07/24 - 07/31 (9)
- 07/17 - 07/24 (11)
- 07/10 - 07/17 (13)
- 07/03 - 07/10 (10)
- 06/26 - 07/03 (9)
- 06/19 - 06/26 (12)
- 06/12 - 06/19 (13)
- 06/05 - 06/12 (18)
- 05/29 - 06/05 (10)
- 05/22 - 05/29 (14)
- 05/15 - 05/22 (11)
- 05/08 - 05/15 (12)
- 05/01 - 05/08 (10)
- 04/24 - 05/01 (13)
- 04/17 - 04/24 (17)
- 04/10 - 04/17 (25)
- 04/03 - 04/10 (18)
- 03/27 - 04/03 (18)
- 03/20 - 03/27 (21)
- 03/13 - 03/20 (21)
- 03/06 - 03/13 (23)
- 02/27 - 03/06 (20)
- 02/20 - 02/27 (15)
- 02/13 - 02/20 (15)
- 02/06 - 02/13 (25)
- 01/30 - 02/06 (23)
- 01/23 - 01/30 (19)
- 01/16 - 01/23 (15)
- 01/09 - 01/16 (18)
- 01/02 - 01/09 (18)
-
►
2010
(1039)
- 12/26 - 01/02 (10)
- 12/19 - 12/26 (16)
- 12/12 - 12/19 (19)
- 12/05 - 12/12 (18)
- 11/28 - 12/05 (23)
- 11/21 - 11/28 (13)
- 11/14 - 11/21 (20)
- 11/07 - 11/14 (19)
- 10/31 - 11/07 (22)
- 10/24 - 10/31 (22)
- 10/17 - 10/24 (20)
- 10/10 - 10/17 (16)
- 10/03 - 10/10 (14)
- 09/26 - 10/03 (13)
- 09/19 - 09/26 (15)
- 09/12 - 09/19 (24)
- 09/05 - 09/12 (20)
- 08/29 - 09/05 (20)
- 08/22 - 08/29 (22)
- 08/15 - 08/22 (16)
- 08/08 - 08/15 (24)
- 08/01 - 08/08 (21)
- 07/25 - 08/01 (20)
- 07/18 - 07/25 (21)
- 07/11 - 07/18 (19)
- 07/04 - 07/11 (18)
- 06/27 - 07/04 (17)
- 06/20 - 06/27 (17)
- 06/13 - 06/20 (19)
- 06/06 - 06/13 (26)
- 05/30 - 06/06 (17)
- 05/23 - 05/30 (18)
- 05/16 - 05/23 (16)
- 05/09 - 05/16 (24)
- 05/02 - 05/09 (18)
- 04/25 - 05/02 (21)
- 04/18 - 04/25 (21)
- 04/11 - 04/18 (27)
- 04/04 - 04/11 (19)
- 03/28 - 04/04 (24)
- 03/21 - 03/28 (23)
- 03/14 - 03/21 (17)
- 03/07 - 03/14 (28)
- 02/28 - 03/07 (26)
- 02/21 - 02/28 (18)
- 02/14 - 02/21 (18)
- 02/07 - 02/14 (30)
- 01/31 - 02/07 (24)
- 01/24 - 01/31 (19)
- 01/17 - 01/24 (20)
- 01/10 - 01/17 (28)
- 01/03 - 01/10 (19)
-
►
2008
(1133)
- 12/28 - 01/04 (19)
- 12/21 - 12/28 (19)
- 12/14 - 12/21 (27)
- 12/07 - 12/14 (39)
- 11/30 - 12/07 (25)
- 11/23 - 11/30 (16)
- 11/16 - 11/23 (20)
- 11/09 - 11/16 (27)
- 11/02 - 11/09 (37)
- 10/26 - 11/02 (29)
- 10/19 - 10/26 (29)
- 10/12 - 10/19 (29)
- 10/05 - 10/12 (25)
- 09/28 - 10/05 (18)
- 09/21 - 09/28 (28)
- 09/14 - 09/21 (23)
- 09/07 - 09/14 (29)
- 08/31 - 09/07 (22)
- 08/24 - 08/31 (18)
- 08/17 - 08/24 (23)
- 08/10 - 08/17 (33)
- 08/03 - 08/10 (23)
- 07/27 - 08/03 (33)
- 07/20 - 07/27 (25)
- 07/13 - 07/20 (27)
- 07/06 - 07/13 (30)
- 06/29 - 07/06 (23)
- 06/22 - 06/29 (21)
- 06/15 - 06/22 (25)
- 06/08 - 06/15 (30)
- 06/01 - 06/08 (36)
- 05/25 - 06/01 (24)
- 05/18 - 05/25 (21)
- 05/11 - 05/18 (25)
- 05/04 - 05/11 (25)
- 04/27 - 05/04 (20)
- 04/20 - 04/27 (22)
- 04/13 - 04/20 (38)
- 04/06 - 04/13 (35)
- 03/30 - 04/06 (28)
- 03/23 - 03/30 (16)
- 03/16 - 03/23 (17)
- 03/09 - 03/16 (23)
- 03/02 - 03/09 (14)
- 02/24 - 03/02 (10)
- 02/17 - 02/24 (7)