Se afișează postările cu eticheta worm. Afișați toate postările
Se afișează postările cu eticheta worm. Afișați toate postările
duminică, 10 iunie 2012
marți, 29 mai 2012
'Flame' cyberespionage worm discovered on thousands of machines across Middle East
The UN's International Telecommunications Union and Kaspersky Labs revealed today that it has discovered Flame, a new trojan rivaling Stuxnet. Codenamed "Worm.Win32.Flame," the malware is currently being researched and it is described as "one of the most complex threats ever discovered." It is believed to be active across thousands of computers in the Middle East, primarily in Iran and Israel, as well as on some machines in North Africa.
Researchers believe that the trojan's primary function is cyberespionage: once Flame infects a computer, it is equipped to record audio from connected or built-in microphones, monitor nearby Bluetooth devices, take screenshots, and save data from documents and emails. All of this data, apparently stolen as part of a targeted attack, is constantly sent up to command and control servers.
Flame "has no major similarities with Stuxnet" or its malware family member Duqu, and is believed to be created and controlled by a separate group. The newly-discovered worm does share some aspects with Stuxnet and Duqu, however. Most disappointingly, Flame takes advantage of the same printer spooling hole and autorun.inf infection methods exploited by Stuxnet. According to Kaspersky Lab's reports, it's believed that Flame achieves its initial infection from users who are victims of phishing attacks, and then once it has made it onto a computer it can be spread over local area networks or via USB flash drives with other machines.
The bad news is that it's confirmed that the worm has spread over local area networks to fully-patched Windows 7 systems, but the good news is that you shouldn't have to worry about Flame breaking into your PC in its current form. As a cyberespionage tool, the trojan has been seen targeting some individuals, but also education and government organizations mainly in the Middle East. Additionally, the research says that the worm surveys a system and will then uninstall itself from machines it thinks are not interesting.
Why is Flame considered to be such a complex threat, then? Well, the malware itself can be up to as large as 20MB — about twenty times larger than Stuxnet. This size is part of what makes Flame unique. According to Kaspersky, most malware is as simple and small as possible, as that makes it easiest to hide the malicious code and get it onto unsuspecting machines. In this case, however, Flame's size made it hard to detect since no one was looking for it. Part of the reason why Flame is so large is because it has optional plug-ins that can be added after a machine is infected to try and get specific data. Different machines have different assortments of plug-ins on them; that 20MB maximum size includes all 20 different plug-ins that have been discovered. Unfortunately, that massive size is going to make it difficult for researchers to get their hands around Flame: Kaspersky says that since it took "several months" to understand Stuxet's 500KB of code, it's expected that Flame may require a year's worth of effort.
Researchers believe that the trojan's primary function is cyberespionage: once Flame infects a computer, it is equipped to record audio from connected or built-in microphones, monitor nearby Bluetooth devices, take screenshots, and save data from documents and emails. All of this data, apparently stolen as part of a targeted attack, is constantly sent up to command and control servers.
Flame "has no major similarities with Stuxnet" or its malware family member Duqu, and is believed to be created and controlled by a separate group. The newly-discovered worm does share some aspects with Stuxnet and Duqu, however. Most disappointingly, Flame takes advantage of the same printer spooling hole and autorun.inf infection methods exploited by Stuxnet. According to Kaspersky Lab's reports, it's believed that Flame achieves its initial infection from users who are victims of phishing attacks, and then once it has made it onto a computer it can be spread over local area networks or via USB flash drives with other machines.
The bad news is that it's confirmed that the worm has spread over local area networks to fully-patched Windows 7 systems, but the good news is that you shouldn't have to worry about Flame breaking into your PC in its current form. As a cyberespionage tool, the trojan has been seen targeting some individuals, but also education and government organizations mainly in the Middle East. Additionally, the research says that the worm surveys a system and will then uninstall itself from machines it thinks are not interesting.
Why is Flame considered to be such a complex threat, then? Well, the malware itself can be up to as large as 20MB — about twenty times larger than Stuxnet. This size is part of what makes Flame unique. According to Kaspersky, most malware is as simple and small as possible, as that makes it easiest to hide the malicious code and get it onto unsuspecting machines. In this case, however, Flame's size made it hard to detect since no one was looking for it. Part of the reason why Flame is so large is because it has optional plug-ins that can be added after a machine is infected to try and get specific data. Different machines have different assortments of plug-ins on them; that 20MB maximum size includes all 20 different plug-ins that have been discovered. Unfortunately, that massive size is going to make it difficult for researchers to get their hands around Flame: Kaspersky says that since it took "several months" to understand Stuxet's 500KB of code, it's expected that Flame may require a year's worth of effort.
theverge.com
duminică, 20 mai 2012
Flashback Operators Fail to Cash Out Their “Winnings”
Some time ago Symantec revealed that the masterminds behind the now-infamous OSX Flashback Trojan made bundles of money. Further analysis, however, has shown that they may have failed to collect as a result of their operations.
Previously, we had learned that the fraudsters made money by displaying ads on compromised computers. The figures show that they’ve displayed 10 million advertisements on the devices of the affected individuals over the course of three weeks.
Of those 10 million, 400,000 were actually clicked on, which normally meant that they would have received $14,000 (10,640 EUR) from the pay-per-click (PPC) providers.
However, according to Symantec, the PPC firms don’t just hand over money to anyone without performing a few checks, this being a perfect example of a situation in which the scammers failed to bypass the anti-fraud measures.
Firms that offer PPC services are more than happy to pay up if users actually see their ads, but in click fraud cases such as this one, the victims may not see the ads, and they’re certainly not interested in the content that's being displayed because in most cases it’s irrelevant.
Furthermore, the cybercrooks may have analyzed each PPC provider to see which one suits their needs, since 98% of the adverts originate from the same organization.
While it’s estimated that a total of 600,000 machines have been infected with Flashback, in reality only 2% (around 10,000) of them were compromised to serve the final payload, the one that actually earned money.
As the researchers highlighted, the campaign was a success, but it could have been even more so, a situation in which the fraudsters could have made millions of dollars in a year.
Fortunately, they failed to collect, which may discourage others from launching such campaigns. On the other hand, the failure may make them more determined to try harder next time.
softpedia.com
Worm Uses Facebook PMs and Instant Messaging Apps to Spread
Social media platforms and popular instant messaging (IM) apps are great mediums for cybercriminals to spread their malicious elements. Trend Micro experts provide a great example of a worm that’s making its way to computers using such methods.
The researchers report that the piece of malware, identified as Worm_Steckct.evl, is distributed via a link that’s sent in private messages on Facebook and IM programs.
The shortened links contained in the posts point to an archive called “May09- Picture18.JPG_ www.facebook.com.zip” which hides a file named “May09-Picture18.JPG _www.facebook.com.” The .com extension reveals that in fact this is an executable file.
Once it’s run, the worm steps into play and terminates all the processes and services created by security software, thus ensuring that antivirus applications cannot disrupt its evildoings.
Steckct.evl then downloads another worm, detected as Worm_Eboom.ac, which monitors the victim’s browsing sessions.
The worrying part is that it doesn’t only log the posts and private messages the customer creates or deletes on Facebook, MySpace, Twitter, WordPress, or Meebo, but it can also spread by utilizing the user’s active session on these sites.
“Facebook and IM applications are tools to share and connect. Cybercriminals’ use of these tools is nothing new, but there are users who fall prey to these schemes. We recommend users to be conscious with their online behavior, in particular on social media sites,” Cris Pantanilla, Threat Response Engineer at Trend Micro writes.
As the expert highlights and as we’ve highlighted numerous times before, internauts must be wary of links that point to shady-looking websites or suspicious files.
In this particular case, it’s clear that the alleged picture taken on “May09” is not a JPG file, but an executable that’s not even so cleverly masked.
softpedia.com
Abonați-vă la:
Postări (Atom)