Phishing Threats

Vawtrak Financial Malware

2015-03-22T16:42:00.002-07:00

Vawtrak Financial Malware
Vawtrak is a data stealing malware targeting financial transactions globally.
"Vawtrak has followed the success of previous financial bot malware like Zeus and Gameover to become one of the most popular crime kits around. Vawtrak’s owners are operating a highly successful business, running specific campaigns and adding new targets as demand requires.

Vawtrak was the second most popular malware distributed by web-based exploit kits (i.e., by malicious drive-by downloads) during September to November 2014, according to SophosLabs telemetry. It represented 11% of all malware SophosLabs saw distributed in this way during that time period."

http://blogs.sophos.com/2014/12/18/sophoslabs-research-spotlights-rising-threat-of-vawtrak-financial-malware/

Crimeware As a Service for custom targeting

2015-03-22T16:36:00.004-07:00

Crimeware As a Service (CWaaS) is helping fraudsters employing botnets to custom-target enterprises for malware infections and advanced persistent threats

They were used recently for targeting financial institutions:
"In the U.S., for example, the botnet targeted not only large banks such as Bank of America and Citigroup, but also smaller financial institutions not usually hit by cybercriminals -- such as Bank of Oklahoma, Cincinnati's Fifth Third Bank, the Columbus-based Huntington National Bank, and San Francisco's Bank of the West."
http://www.csoonline.com/article/2863193/malware-cybercrime/crimeware-as-a-service-offers-custom-targeting.html

Phishing Mails Strike PayPal Customers

2015-03-22T16:26:00.001-07:00

PayPal customers are again and again targeted by Phishing emails.

The mail reads:
""Subject: Your account has limitation! You can resolve this now," the fake electronic mail directs its recipient to validate his e-mail id to update to PayPal's system. It then states that once the validation is done, the recipient can use the id for getting payments from relatives and pals. Over and above, the recipient can make the id his key id for any business he may conduct with PayPal. A link 'Confirm My E-mail Address' is included with which the e-mail ends. - See more at: http://www.spamfighter.com/News-19523-Phishing-E-mails-Yet-Again-Strike-PayPal-Customers.htm#sthash.WNcKeqMI.dpuf "

http://www.spamfighter.com/News-19523-Phishing-E-mails-Yet-Again-Strike-PayPal-Customers.htm

Real-time File Extractor by Solera Networks

2012-02-29T21:35:00.001-08:00

Real-Time File Extractor---Real-time Malware Extraction and Analysis by Solera Networks

To counteract today's targeted attacks that use low profile, multi-vector malware, Solera Networks has announced Real-Time File Extractor as part of their DeepSea platform. This is claimed to identify zero-day exploits.

Some of the advertised features:
- Real-time malware file extraction based on deep packet inspection attributes such as transport protocol, file extension or mime pipe
- policy-based automated analysis of common threat vectors: PE (portable executable) files, PDFs, JavaScript, Java JAR files, Flash and Microsoft OLE documents

The focus is on 'files on the wire'.
http://www.net-security.org/malware_news.php?id=2020

Solera Network alerts on attack trends in 2012 is worth noting:
http://www.net-security.org/secworld.php?id=12213

-Joseph Ponnoly

Happy Valentines Day- Beware of eGreeting Cards

2012-02-09T09:06:00.000-08:00

Spammers and phishers have a heydey during Valentine's Day season as they have during Christmas or New Year.

Pandasecurity has listed some of the social engineering techniques employed by phishers through the medium of greeting cards. They have listed some of the worms and trojans that have been spread in the recent past:

Details are reproduced below from Pandasecurity.com

==Waledac.C: This worm spread by email trying to pass itself off as a greeting card. The email message included a link to download the card. However, if the user clicked the link and accepted the subsequent file download they were actually letting the Waledac.C worm into their computer. Once it infected the computer, the worm used the affected user’s email to send out spam.

I Love.exe you: This was a RAT (Remote Access Trojan) that gave attackers access to the victim’s computer and all their personal information. The Trojan allowed the virus creator to access target computers remotely, steal passwords and manage files.

Nuwar.OL: This worm spread in email messages with subjects like “I love You So Much”, “Inside My Heart” or “You in My Dreams”. The text of the email included a link to a website that downloaded the malicious code. The page was very simple and looked like a romantic greeting card with a large pink heart. Once it infected a computer, the worm sent out a large amount of emails, creating a heavy load on networks and slowing down computers.
Image available at: : http://prensa.pandasecurity.com/wp-content/uploads/2012/02/NuwarOL.jpg

Valentin.E: This worm spread by email in messages with subjects like “Searching for True Love” or “True Love” and an attached file called “friends4u”. If the targeted user opened the file, a copy of the worm was downloaded. Then, the worm sent out emails with copies of itself from the infected computer to spread and infect more users.
Image available at: http://prensa.pandasecurity.com/wp-content/uploads/2012/02/Valentin.E.jpg

Storm Worm: This worm spread via email by employing a number of lures, one of them exploiting Valentine’s Day. If the targeted user clicked the link in the email, a Web page was displayed while the worm was downloaded in the background. Web page displayed by Storm Worm.

For Anti-malware technologies:
http://press.pandasecurity.com/panda-technologies/

DMARC standard to fight domain spoofing in phishing mails

2012-02-04T14:35:00.000-08:00

Realizing the rising threat of phishing mails, the email providers and Facebook as also Paypal and Bank of America along with others are teaming up to fight phishing threats. http://searchenginewatch.com/article/2143128/Google-Microsoft-Facebook-Teaming-Up-to-Fight-Phishing They are focusing on implementing the DMARC Internet standard -- Domain-based Message Authentication, Reporting and Conformance. http://nakedsecurity.sophos.com/2012/02/02/dmarc-microsoft-facebook-google-unite-to-fight-phishing/ This would further require as first steps the implementation of SPF Sender Policy Framework and DKIM - Domain Keys Identified Mail standards. The question is: will this put a break on domain spoofing?

Spear Phishing Attack Plants Trojans

2012-02-03T14:18:00.000-08:00

Source: SANS NewsBites Vol. 14 Num. 010

SANS report is copied below:

" --Spear Phishing Attack Plants Trojan on Targeted Computers (February 1, 2012) A recently detected, sophisticated spear phishing attack disguises itself as conference invitations. The attack exploits unpatched flaws in Adobe Reader to place Trojans on vulnerable computers. The malware, once on the computer, manages to disguise itself as a Windows Update utility. The attack has been named MSUpdate Trojan. Researchers have evidence of similar attacks from what appears to be the same group of attackers, dating back to 2009. The Trojan steals information and sends it back to the command and control server, but the traffic is disguised as Windows Update traffic.

http://www.theregister.co.uk/2012/02/01/spear_phishing_rats/

http://www.eweek.com/c/a/Security/Trojan-Targets-Industry-Government-with-Fake-Conference-Invitations-542238/ "

Trend Micro Crimeware Report 2Q 2011

2012-01-31T20:01:00.000-08:00

Here is the Trend Micro Crimeware Report for 2Q 2011:
http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/reports/rpt_2q2011-crimeware.pdf

Major highlights:

*Crimeware toolkits Zeus and SpyEye continued to evolve. Zeus-SpeEye merger has resulted in new and improved ZBOT variants.
*Banking trojans are on the rise, MAL_BANKER topping the list, with BKDR_QAKBOT.SMG and BKDR_PAPRAS.SME.QAKBOT following.
*Stolen user information and banking credentials were hot commodities in the cyber underground.
*CARBERP variants targeted government offices, schools, universities and financial institutions hook network APIs in WININET.DLL enabling them to monitor user's browsing activities, to download configuration files and to receive malicious commands from remote servers.
*SpyEye 1.3.4.x enhancements include a MySQL database to store as blobs (binary large objects) the files uploaded by users.

In April 2011, the CoreFlood botnet was taken down by the FBI with help from security researchers.

-jp

Hungarian hacker's phishing, data theft, blackmail and arrest

2011-11-27T09:32:00.000-08:00

Department of Justice arrested a Hungarian national who used phishing mails to break into the computers of Marriott Hotels Corporation. He stole sensitive company data and blackmailed Marriott Hotels into giving him a job under threat of exposure of sensitive data.
He sent malicious code in phishing emails to few Hotel employees and that gave him a backdoor entry to the Marriot network and computers to steal the company's sensitive data including financial information.
He was arrested by the US Secret Service who laid a trap to interview him for the job and flew him from Hungary to Washington DC.
http://www.justice.gov/opa/pr/2011/November/11-crm-1534.html

Credit Cards of Xbox Live Users Stolen in Phishing Attacks

2011-11-26T19:47:00.000-08:00

The Guardian, UK, reports on fraudulent credit card transactions in the accounts of users of Xbox Live, Microsoft's online gaming service. The users buy Mcrosoft Points for downloading games from EA Sports using their credit cards.

Hackers con people into giving away their account details through phishing attacks. They set up official looking websites purporting to give away free Microsoft Points, but insist on users to give their information including credit card info. It appears the hackers obtained Xbox Live user account details from EA Sports online gaming services. It is suspected theat EA Sports FIFA 12 servers were compromised earlier. The users detected the fraud when they scrutinized their credit card statements.

This is a case of hackers targeting online gaming.
http://www.guardian.co.uk/technology/2011/nov/22/xbox-live-users-phishing-attacks?intcmp=239

McAfee Threats Report - 3Q 2011

2011-11-26T19:24:00.000-08:00

Some highlights from the McAfee Threats Report- 3Q 2011:

'2011 continues to be an year of change, challenge and chaos in information security'.
Increase in steath malware-- rootkits from the TDSS family, mobile malware targeting Android OS, spam and messaging threats,
Targeted spam (spear phishing) is getting sophisticated. 'Spearphishing is in many ways the stealth malware or rootkit of spam-- designed to bypass our mental filter using evasion and well-crafted lures'.
Malicious iFrame infection was the no. 1 global threat.
Botnets expanding globally
Significant activity in cybercrime, cyberwarfare and hacktivism with some law enforcement wins.
75 million unique malware samples expected by end of 2011.

Further details at:
http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q3-2011.pdf
The previous quarterly reports for 2011 can also be seen at:
http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q2-2011.pdf
http://www.mcafee.com/us/resources/reports/rp-quarterly-threat-q1-2011.pdf

-Joseph Ponnoly

Microsoft settles lawsuit against Czech hoster of Kelihos botnet

2011-11-21T17:05:00.000-08:00

(CNET, October 26, 2011)

Microsoft had filed lawsuit in a federal court in Virginia against Dominique Alexander Piatti and his company Dotfree Group SRO of Czech Republic and 22 others for hosting the Kelihos botnet. The botnet was responsible for sending pharmaceutical and other spam mails, for harvesting e-mails and passwords, for fraudulent stock scams and for promoting sites dealing with sexual exploitation of children. Subdomains were used to spread the MacDefender scareware. The botnet had about 41,000 infected computers worldwide and was capable of sending 3.8 billion spam mails per day.

The controllers of the Kelihos botnet leveraged the subdomain services of Dotfree Group.

In Microsoft's settlement with the domain owner, Piatti will delete or transfer to Microsoft all the subdomains used to operate the bonet. They agreed to prevent misuse of subdomains and to establish a secure top level domain (TLD).

Microsoft's Digital Crimes Unit has been responsible for shutting down three botnets--- Waledac, Rustock and Kelihos.

http://news.cnet.com/8301-27080_3-20126012-245/microsoft-settles-suit-against-alleged-botnet-hoster/

Blocking Port 25- Will it help to control spam emails?

2011-11-15T05:49:00.000-08:00

According to Cisco IronPort Senderbase Security Network, around 85% of all email is spam. However, there has been a decline of spam mails during 2011 as a result of the taking down of the Rustock botnet.
http://www.usenix.org/event/hotbots07/tech/full_papers/chiang/chiang_html/

South Korea's Internet and Security Agency has asked all ISPs to block SMTP port 25 and allow emails only from'official' email servers, with the idea to block spam mails. AT&T, Comcast and Verizon already do this.
http://www.zdnet.com/blog/networking/south-korea-proposes-restricting-all-e-mail-sending-to-official-e-mail-servers/1647
ISPs have to block the default SMTP port or port 25 from sending emails. Users will then be forced to use the ISP's mail servers to send emails.

Just blocking port 25 may not prevent spam mails. Botnet-infected Windows PCs are still the source of most spam. Even if the SMTP port 25 is blocked, the infected PCs could still send spam using SOCKS proxy servers and the Secure SMTP port- port 465. The current trend is that spammers are now moving from Windows PC botnets to compromised Web-mail accounts.

-Joseph Ponnoly

The Botnet War

2011-11-11T20:26:00.000-08:00

Tom Brewster's article of November 11, 2011 in ITPRO titled 'The War on Botnets' gives an interesting account of the fight against botnets and the cyber underworld, detailing recent successes following collaboration between law enforcement and the security industry, along with international cooperation.
http://www.itpro.co.uk/637312/the-war-on-botnets/

The recent success in bringing down 'DNS Changer' botnet follows a series of botnet discoveries and thier dismantling for eight years, since 2003. Botnet terminations have been followed by significant drop in spam mails, PC infections and cyber crimes.

Some of the major botnets that were discovered and dismantled since 2008 are:
McColo- 2008
Mariposa (infected 13 million PCs) 2009
Mega-D - 2009
Waledac - 2010
Bredolab (2010)

Coreflood -2011
Rustock - March 2011
Kelihos- October 2011
DNS Changer -November 2011

Only since 2008, there has been noteworthy international cooperation to fight botnets and cybercrime.
The security industry also has colloborated in the efforts. Microsoft was responsible for smashing Waledac, Rustoc and Kelihos botnets, as part of Project MARS (Microsoft Active Response for Security), with the objective to 'annihilate botnets and help make the internet a safe place'.
The MARS team worked with security companies such as Kaspersky and FireEye. For Kelihos, Kaspersky's live botnet tracking system was used by Microsoft and Kaspersky abs helped to reverse-engineer the bot malware and to deal with the P2P infrastructure used by the botnet.

Legal problems and the sub domain issue are the battles still to be fought. The sub domain issue concerns top level domains hosting thousands of subdomains that are used for malicious hosting by botnets.

-Joseph Ponnoly

http://www.itpro.co.uk/637312/the-war-on-botnets

Duqu Malware Detection Tool Released

2011-11-11T19:25:00.000-08:00

Information Week of November 11, 2011 reports that Duqu Detector Toolkit has been developed by CrySys Lab of the Budapest University of Technology and Economics.

The toolkit is designed to detect even dormant infections. The malware used in highly targeted attacks, is related to Stuxnet and has a dropper file (installer) to infect computers. The installer is a malicious Word document (.doc file).

Duqu malware was designed for industrial espionage, and is similar to Stuxnet.

Detection techniques include signature-based and heuristics-based scanning to find 'traces of infections', detecting suspicious files.

Duqu exploits zero-day vulnerability in the font parsing flaw in the TrueType engine in 32 bit Windows versions. Microsoft has issued security alert and is yet to issue a patch.
http://support.microsoft.com/kb/2639658

Further details of the toolkit at:
http://www.crysys.hu/duqudetector.html
http://www.crysys.hu/duqudetector-files/files/manual-v1_02.txt
http://www.informationweek.com/news/security/management/231902866

-Joseph Ponnoly

eCrime Trends Report - IID

2011-11-11T13:43:00.000-08:00

The 3Q-2011 eCrime Trend Reports from IID, indicates that DNS threats are emerging as cause for concern. Though phishing attacks were down during the quarter, malware distribution and DNS exploits picked up during the quarter.Zeus malware infection is an ongoing threat. During the preceding quarters of 2011, phishing attacks were on the rise.
Microsoft took down the Kelihos botnet with around 41,000 infected computers. Facebook and Google fought back against originating domains of massive phishing attacks

Further details at:
http://www.eweekeurope.co.uk/news/malware-soars-as-traditional-phishing-falters-44559
http://www.internetidentity.com/resources/trend-reports
http://www.internetidentity.com/images/stories/docs/ecrime_trends_report-q3-2011_by_iid.pdf

-Joseph Ponnoly

Spear Phishing / PoisonIvy backdoor trojan targeting Chemical and Defense Companies

2011-11-09T03:53:00.000-08:00

http://www.fiercegovernmentit.com/story/nitro-hackers-target-chemical-and-defense-companies-says-symantec/2011-11-02

Symantec Report of October 31, 2011 reports about a wave of spear phishing attacks targeting chemical and defense industry segments in US and Europe, where already 20 companies have been victimized.

The attacks are engineered through spear phishing emails with attachments containing the self-extracting PoisonIvy trojan executable.

PoisonIvy is a backdoor trojan, developed by a Chinese hacker. It sets up http communication channel over port 80 with the command and control (C&C) botnet server. The bot harvests IP addresses and cached passwords and targets intellectual property and other sensitive data.

Read more on the 'Nitro Attacks' report by Symantec:
http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the_nitro_attacks.pdf

Crimeware threats

2011-11-08T09:12:00.000-08:00

Phil Mellinger's article published in today's ComputerWorld (Nov 4, 2011) titled 'A Short History of Crimeware' points to the widespread proliferation of crimeware today. Crimeware is defined as ' the class of malware, specifically designed to automate large-scale financial crime'. Crimeware undermines today's technologies and sets at naught the concepts of privacy, anonymity and security, surpassing an 'Orwellian world'.

Crimeware that includes financial malware, stealth malware or banking trojans, traces its origins to 2003, defeating traditional internet defenses of SSL encryption, anti-virus and two factor authentication. Attack tools such as Zeus and Spyeye collect highly sensitive authentication and financial data. Online banking accounts are specially targeted. Variants of the crimeware are easily created and propagated to infect PCs.

Crimeware Technologies:
Crimeware relies on botnet controlers, sophisticated trojans and data collection technologies.
Some of the major advances since 2003 are listed:
1. Form grabbing within IE browsers, leading to harvesting of banking credentials. This led FFEIC in 2005 to recommend two factor authentication for online bank accounts. This is an advancement over keystroke logging techniques to steal credentials.
2. Stealth or anti-detection, anti-forensics technologies, preventing detection by signature-based anti-virus or behavior-based (IDS/IPS) techniques.
3. Web injects (Man-in-the browser) for PCs running IE/Windows, defeating two-factor authentication, enabling criminals to take over authenticated connections within compromised PCs, subverting key-entry based authentication techniques and enabling crimeware to control user's connection to the bank.
4. Crimeware expanding to other browsers and OS (Chrome, Firefox, Opera, Safari and Apple OS X)
5. Sourcecode availability for Zeus and SpyEye.
6. Disabling/Circumventing Anti-Crimeware, disabling anti-malware products.
7. Mobile device support (man-in-the-mobile)
subverting mobile devices banks used to validate online banking transactions with customers. Man in the mobile attacks covertly validate the transation without the user's awareness.
8. Anti-removal or persistence

It is all a question of trust in cyberspace.
As Phil Mellinger says, 'crimeare is devastating our security, our privacy and our anonymity. It has jumped across browsers, operating systems, and even devices, to endanger current technologies. He says that we are entering a new phase of security.

Further details at:
http://www.computerworld.com/s/article/9221499/A_short_history_of_crimeware

-Joseph Ponnoly

Zero day malware clearning with Sysinternals Tools

2011-11-02T06:13:00.000-07:00

Mark Russinovich's presentation at BlackHat 2011:
Zeroday Malware Cleaning with Sysinternals Tools
http://download.sysinternals.com/Files/SysinternalsMalwareCleaning.pdf
Some of the highlights/points:

1. Identifying malware processes
using Process Explorer v15 for identifying malware processes, network and disk activity, Process tree sort, Svchost and service threads info and for malware cleaning

Malware processes have no versioning
Malware commonly uses packing and encryptionto defeat antivirus signature matching
Malware often hides behind Svchost, Rundll32 (hosted DLL) and Dllhost (hosted COM server)
The services tab and process tabs give detailed info on services and processes.
Sigcheck can be used for scanning the system for suspicious executable images.
ListDlls will scan running processes for unsigned DLLs
Strings tab will show the process strings that can provide clues about unknow processes
String Utility can be used to dump strings

Malware hides as a DLL inside a legitimate process (Rundll32, Svchost), loading via autostart or through 'dll injection'.
DLL view shows more than just loaded DLLs to include .exe and 'memory mapped files'.

2. Terminating Malicious Processes:
Don't kill the process but suspend the malicious process.
Record full path to each malicious exe and dll.

3. Cleaning Autostarts
Start-Run-Msconfig
Autoruns:
Identiy malware autostarts

Deals with the Case of Son's Adware

760 large companies hacked!

2011-10-31T21:58:00.000-07:00

Source: CNN Money, 28 October 2011
760 Companies hacked!
A Command and Control Server of a Botnet that was breached, showed that it was controlling the computers of 760 companies (including 20 of the Fortune 100 Companies)!
For further details:
http://money.cnn.com/2011/10/27/technology/rsa_hack_widespread/

Phishing Activity Trends Report 2H 2010 - APWG

2011-10-29T04:55:00.000-07:00

Phishing Activity Trends Report 2H 2010
published by APWG

http://www.antiphishing.org/reports/apwg_report_h2_2010.pdf
Major highlights of APWG's Phishing Trends Report for the 2nd Half of 2010, are listed below:

Financial Services is the most targeted industry sector, followed by Payment Services.

Crimeware or data-stealing malicious code , is designed to collect information on the end-user to steal credentials. Phishing-based keyloggers have tracking components, and they monitor specific actions and specific organizations, to target specific information.

Data stealing and generic trojans contain the code designed to send information from the infected machine, control it and open backdoors on it. According to WebSense, downloaders are used (to download the trojans from phishing websites).

During 2H 2010, Panda Labs registered 10.4 million new malware samples making a total collection of 60 million. 55% of the new samples registered are trojans, the favorite weapon used by cybercriminals to infect computers. Countries mostly infected are Thailand (67%), China (63%), Taiwan (60%), Latvia (56%), Saudi Arabia (55%), Russian Federation (54%), Israel (53%).

The report mentions that 'cybercrimals constantly obfuscate and re-use the same samples over and over, employing polymorphism-- server-side or binary side-- subsequently increasing numbers of variants recorded'.

Rogue Anti-Malware Programs (from a few crimeware families such as SystemGuard2009, Malware Doctor, MS AntiSpyware2009, Animalware Doctor, Security Essentials 2010, Privacy Center etc) have also caused computer infections.

USA hosts 84% of the phishing websites hosting malicious code phishing-based keyloggers or trojans downloaders. In the 3rd Quarter of 2010, Sweden had topped the list of countries hosting phishing websites.

The report does not mention about the role of botnets in phishing.

http://www.antiphishing.org/reports/apwg_report_h2_2010.pdf

Safe Browsing API for applications and browsers from Google

2011-10-29T04:19:00.000-07:00

Safe Browsing API service is provided by Google for applications, enabling applications to check URLs against suspected phishing and malware pages list maintained by Google.

Safe Browsing API is an application client-side URL lookup.

The protocol is in use by Google Chrome and Mozilla Firefox browser.
http://code.google.com/apis/safebrowsing/

MBR Rootkits

2011-10-28T18:38:00.000-07:00

Malware (Rootkits) targeting control of the Master Boot Record (MBR) to get kernel-level privileges to control the system, are increasing:
http://forensicmethods.com/mbr-malware

Protection Against Phishing and Pharming- WhitePaper

2011-10-28T06:28:00.000-07:00

Here is a white paper on 'protection against phishing and pharming' (2009) published by EasySolutions.
http://www.apwg.org/sponsors_technical_papers/easysol_wp_phishing_pharming.pdf

This is targeted at the end-user (the weakest link) to create better awareness of the modus operandi of the attacks. The scenarios described pertain to 2008.

The DetectSafe Browsing solution is proposed for secure browsing.

Runtime Malware Forensics and Malware Clustering

2011-10-20T04:42:00.000-07:00

Defcon 18 presentation by Jeremy Chiu, Benson Wu and Wayne Huang on
Runtime Malware Forensics and Automated Malware Clustering for detection of known and unknown Zeus variants:
http://www.youtube.com/watch?NR=1&v=Y2IJFonuSaE