As the app is still in its beta testing, spying on a mobile device using this tool poses certain challenges. First, it should be installed onto the target device without the victim knowing about it. Second, potential attackers would need to setup their own FTP servers, which may be difficult for those with less advanced IT knowledge. However, the developers behind this tool are likely to release an updated version that may include features and improvements to make it easier to use.

Trend Micro users need not worry as their mobile devices are protected from this threat via Mobile Security Personal Edition. Users are advised to activate the lock function of their mobile devices for added security. When installing an app, users should always double-check the required permissions of the app, specially if it requests for permissions beyond its supposed function.

To know more on how to better protect yourself from threats related to your mobile devices, you may read our comprehensive e-guides below:

• When Android Apps Want More Than They Need
• 5 Simple Steps to Secure Your Android-Based Smartphones

With additional input from Noriaki Hayashi

Post from: TrendLabs | Malware Blog - by Trend Micro

Beta Version of Spytool App for Android Steals SMS Messages

In addition, I also spotted posts using URL shorteners such as bit.ly and goo.gl. When clicked, the shortened URLs/the fake posts lead to any of the following URLs:

• http://pinterest.co{BLOCKED}t.info/?419
• http://pinterest.com-{BLOCKED}key.info/Thank-You/fb/
• http://pinterest.co{BLOCKED}s.info
• http://pinterest.{BLOCKED}one.info
• http://pinterestgift.{BLOCKED}hing.info
• http://pinterests.{BLOCKED}onus.info

Upon clicking the link, users are redirected to a Pinterest-like webpage offering prizes, vouchers, gift cards and others:

And Via Email, Too

Another thing I’ve noticed is that the fake site requires an email address:

Pinterest has since removed some of the fake Pinterest posts. Trend Micro users are also protected from these scams by the web reputation technology in our Smart Protection Network™.

Post from: TrendLabs | Malware Blog - by Trend Micro

Bogus Pinterest Pins Lead to Survey Scams

This is not the first time that vulnerabilities have been found in popular webmail providers. We discussed almost a year ago that some of the major webmail providers – Gmail, Hotmail, and Yahoo! Mail – were all found to have some sort of vulnerability that compromised either the user’s email account or their system. It shouldn’t be a surprise that they’ve become targets as well: just about everyone uses these free services, and users don’t expect these services to have security problems of their own.

As we’ve highlighted before, vulnerabilities like these are used in targeted attacks. Whether it’s vulnerabilities in user software or cloud-based services like free webmail, vulnerabilities allow attackers to compromise systems without the target being aware that anything has happened. This is extremely useful to attackers as the content compromised email accounts can be stolen by attackers and the account can be used to launch further attacks against the victim’s contacts.

Post from: TrendLabs | Malware Blog - by Trend Micro

Cloud-based Services Vulnerabilities Also Used in Targeted Attacks

Once executed, this malware (detected as WORM_STECKCT.EVL) terminates services and processes related to antivirus (AV) software, effectively disabling AV software from detection or removal of the worm. WORM_STECKCT.EVL also connects to specific websites to send and receive information.

Another noteworthy routine is that this worm downloads and executes another worm, one detected as WORM_EBOOM.AC. Based on our analysis, WORM_EBOOM.AC is capable of monitoring an affected user’s browsing activity such as message posting, deleted posted messages and private messages sent on the following websites such as Facebook, Myspace, Twitter, WordPress, and Meebo. It is also capable of spreading through the mentioned sites by posting messages containing a link to a copy of itself.

Facebook and IM applications are tools to share and connect. Cybercriminals’ use of these tools is nothing new, but there are users who fall prey to these schemes. We recommend users to be conscious with their online behavior, in particular on social media sites. To know more on how you can prevent these threats targeting Facebook and other social media sites, you may read our comprehensive e-guide A Guide to Threats on Social Media.

Furthermore, with our recent partnership with Facebook, Trend Micro™ protects users via Smart Protection Network™, which blocks access to the related malicious link. The file reputation technology in Smart Protection Network™ detects and deletes both WORM_STECKCT.EVL and WORM_EBOOM.AC.

Post from: TrendLabs | Malware Blog - by Trend Micro

Worm Spreads via Facebook Private Messages, Instant Messengers

• 8883
• 8887
• 6151
• 1
• 2855
• 9151
• 9685
• 9684

In turn, affected users incur unnecessary charges for the said message. Unfortunately, paying fees for unauthorized messages is only half the problem for users. Choosing the said button also changes the display on the screen (see below), wherein choosing the top button may lead users to a malicious website.

Trend Micro protects your Android OS phones via Mobile Security Personal Edition app, which prevents access to these malicious sites and blocks the download of malicious .APK files into mobile devices.

To know more on how to better protects yourself from these rogue apps and other threats hovering Android OS, you may read our comprehensive e-guide “5 Simple Steps to Secure Your Android-Based Smartphones” .

Post from: TrendLabs | Malware Blog - by Trend Micro

Rogue Farm Frenzy 3 for Android Unearthed

The finding, which we were able to flag during our analysis of data processed by the Trend Micro™ Smart Protection Network™ definitely caught our attention.

Looking at data from the Smart Protection Network™, we were able to find 3 different binary files that appear to be downloaded from the following URLs:

• hxxp://br.msn.com/ChromeSetup.exe
• hxxp://www.facebook.com.br/ChromeSetup.exe
• hxxp://www.facebook.com/ChromeSetup.exe
• hxxp://www.globo.com.br/ChromeSetup.exe
• hxxp://www.google.com.br/ChromeSetup.exe
• hxxp://www.terra.com.br/ChromeSetup.exe

When we took a closer look at the downloads, we identified that all downloads are being redirected to two different IPs, instead of the legitimate IPs of the accessed domains. What’s more noteworthy is the fact were seeing access in clients from the Latin American region, mostly in countries Brazil and Peru.

An analysis of the file ChromeSetup.exe done by my colleagues Roddell Santos and Roland dela Paz verified that it is a multi-component BANKER malware detected as TSPY_BANKER.EUIQ.

Once running on a system, TSPY_BANKER.EUIQ sends information such as the infected system’s IP address and operating system name to a specific IP address. It also downloads a configuration file that contains information it uses to redirect access to fake banking pages whenever a user attempts to visit certain banking websites.

When a user opens a targeted bank’s site, TSPY_BANKER.EUIQ intercepts the page request and displays the following message, tricking users into thinking that the website is loading security software where in fact it is already redirecting users to the spoofed banking website:

Further Investigation

A more in-depth investigation allowed us to gain access on the page index where TSPY_BANKER.EUIQ downloaded configuration files from. The same index page hosted the three binary files that the malware used aside from the configuration file that we saw in the same location.

During the time the C&C panel was analyzed, we have observed an abrupt increase on the registered logs. In fact, the phone home logs jumped from around 400 to nearly 6000 in a span of 3 hours. These logs are comprised of 3000 unique IP addresses which translates to the number of machines infected by the malware.

Since the start of this analysis, we have also been seeing variations of the BANKER malware we analyzed during this investigation in the wild. The first few samples that we got installed the three components separately, but now we are getting new samples that are able to install the different components in one package. It looks like this malware is still under development and we may still see improvements in future variants. Roland also mentions that he came across a likely related C&C that surface last October 2011 which indicates that the perpetrators behind this threat aren’t new in the scene.

Missing Piece

While we may have a complete picture of this particular attack, the one missing piece now is the same thing that made us notice this malware from the millions of data that we have from our threat intelligence – how it is able to redirect user accesses from normal websites like Facebook or Google to its malicious IP to download malware. We will continue our investigation related to this incident and will update this blog with our findings.

Online threats will continue to evolve and find ways into systems. As such, traditional web blocking technologies may fail to block access to malicious URLs, especially when these are masked with the use of legitimate domains like those of Facebook or Google.

This is where a telemetry such as the Trend Micro™ Smart Protection Network™, which provides intelligence derived from a global network of threat data, becomes vital. This technology not only allows us to identify and correlate emerging attacks worldwide, but also lets us instantly deploy the proper threat mitigation solutions on customer environments.

Post from: TrendLabs | Malware Blog - by Trend Micro

Info Stealer Poses as Google Chrome Installer

How much digital clutter do users have? Quite a lot, as it turns out. On average, people have far more data – in the form of music, movies, and files – than they can use or consume. On average, they use only about a fifth of what they actually have. They have enough music for almost two full weeks of non-stop music listening.

The digital clutter extends to the mobile space and social media, too. If you’re on Facebook or Twitter chances are many of your friends and followers aren’t people you know, if they’re even people at all! Our full findings are in latest infographic Mapping Out Your Digital Life, which was featured on Mashable.

Post from: TrendLabs | Malware Blog - by Trend Micro

[INFOGRAPHIC] Mapping Out Your Digital Life

Celebrity news items, whether factual or not, have been a staple bait in cybercriminal attacks. Adam Yauch’s death is just one of the several web threats that took advantage of the death of famous music icons. Similar threats include the string of clickjacking attacks that used the demise of Whitney Houston, Amy Winehouse, and even Lady Gaga‘s supposed death.

Trend Micro users need not worry as they are protected via the Smart Network Protection™, which detects and deletes the related malware and blocks spam with malicious attachments with its file and email reputation technology. To know more about how attackers take advantage of noteworthy news items e.g. celebrity gossips and news and other social engineering tricks, you may read our comprehensive e-guide “How Social Engineering Works”.

Post from: TrendLabs | Malware Blog - by Trend Micro

News of Beastie Boy Adam Yauch’s Death Leads to Malware

We found a search result for the string “diablo 3 free download” leading to a survey scam — a scheme frequently seen deployed through Facebook.

The search result below (highlighted in yellow) directs to the a page which appears to be the download page for Diablo III:

Diablo 3 is not the first game used by cybercriminals for schemes, we’ve seen other popular games such as World of Warcraft and Grand Theft Auto being used in the past.

Trend Micro users are protected from the schemes reported above through the Trend Micro™ Smart Network Protection™.

Post from: TrendLabs | Malware Blog - by Trend Micro

Diablo 3 Scams Preempt Game Release

This webpage is also found to be hosted on Russian domains, similar to the fake Instagram and Angry Birds Space apps that we previously reported. To further entice users into downloading the fake Adobe Flash Player app, the text on the webpage claims that it is fully compatible with any Android OS version:

When users opt to download and install the said fake app, the site connects to another URL to download malicious .APK file, which Trend Micro detects as ANDROIDOS_BOXER.A. ANDROIDOS_BOXER.A is a premium service abuser, which means it sends messages to premium numbers without the user’s permission, thus leading to unwanted charges. This type of Android malware is just one of the types we were able to identify in our infographic, A Snapshot of Android Threats.

Upon further investigation, we have seen a bunch of URLs that are hosted on the same IP as this particular website. Based on the naming alone used in these URLs, it appears that Android is a favorite target for cybercriminals behind this scheme.

Trend Micro protects your Android phones from accessing these malicious sites and from downloading malicious .APK files on your phones via the Mobile Security Personal Edition app. Apart from blocking access to malicious sites, our app scans each app you install to ensure your safety.

For your reference, Adobe Flash Player from Adobe Systems can be downloaded via the Google Play store.

Post from: TrendLabs | Malware Blog - by Trend Micro

Malware Masquerades as Flash Player for Android