Driveby downloads delivered...
FYI...
Driveby downloads delivered from ".sys" directories
- http://isc.sans.org/diary.html?storyid=8482
Last Updated: 2010-03-24 02:42:35 UTC - "... observed malware being delivered from the ".sys" directory of various web sites. The URL follows the scheme:
http ://evilexample .com/.sys/?action=... link being delivered via Facebook which of course makes the message more plausible and it is likely that users install the software thinking it came from a "Friend"... In response to clicking on the link, the user is asked to install the software... a specific block for ".sys".. web filter caught about 60% of these exploits. Once a user follows the link, additional exe files are downloaded from ".sys" directories. The file names... observed are p.exe, go.exe and v2captcha21.exe."
Comments: ... Mar 24 2010, 15:24
"... a bit more digging did show the Koobface connection..."
:mad:
Q2-2010 - 1.3M infected sites ...
FYI...
Q2-2010 - 1.3M infected sites ...
- http://blog.dasient.com/2010/09/cont...ware_9357.html
September 14, 2010 - "... our infection library has catalogued almost 200,000 different infections - up 58,000 from the previous quarter... In Q2 2010, we estimate that 1.3 million web sites were infected, based on data from our telemetry systems. Q2 was the first quarter in history for which we believe that over one million web sites were infected in a three month time period. As we have now been tracking web-based malware statistics for four quarters, we have plotted the estimated number of infected web sites over that time period below. While there was a slight dip in Q4 ‘09... the growth over the past couple quarters has been significant - growth by a factor of two over the past year... When attackers send drive-by-downloads, they seem to like to choose one letter file names and innocent looking names like updates.exe and file.exe. Sometimes the file name starts with MS to imitate Microsoft processes. There are also a class of attacks that choose a random file name with fixed number of characters... Temp and application data folders are the favorite choice of folders in which to store malicious executables. However, executables are sometimes copied to system directory after their initial storage, and run from there... Overall, three out of four drive-by-downloads have one letter filenames and are written to the User’s Application Data directory..."
:fear::fear:
Web-based malware infections double...
FYI...
Web-based malware infections double...
- http://blog.dasient.com/2010/11/normal.html
November 22, 2010 - "In Q3 Dasient continued to monitor millions of sites on the Internet for web-based malware infections and malvertisements. Based on the data gathered, we estimate that in Q3 over 1.2 million web sites across the Internet were infected, which is double our estimate from exactly one year ago... The web malware problem continues to grow dramatically as an increasing number of legitimate sites are getting infected. Looking at the major modes of communication used on the Internet, email was one of the first such major mode of communication, and we saw attackers take advantage of it by distributing viruses as email attachments. Over time, we saw that email became web-based with services such as Hotmail, Yahoo! Mail, and Gmail, and such services had to incorporate anti-virus software on their servers to scan email attachments for malware. As web page views continued to increase and web pages themselves became more and more interactive via Web 2.0 trends, cybercriminals took advantage of the advent of drive-by-download techniques to infect users without requiring the opening of attachments, thereby allowing them to exploit web pages as an increasingly pervasive malware distribution platform. While attackers continue to grow their use of almost every tool at their disposal (including spreading viruses via email attachment) and as the cybercriminal economy continues to thrive, our research indicates that the use of drive-by-downloads and rogue anti-virus schemes eclipse other modes of malware distribution..."
(Multiple charts and more detail available at the URL above.)
:mad::fear:
Malware on ad networks at Google, MS ...
FYI...
Malware on ad networks at Google, MS...
DoubleClick ADShufffle drive-by download malvertising
- http://www.pcworld.com/businesscente...h_malware.html
12.10.2010 10:00 pm - "... cybercriminals managed to infect Google's and Microsoft's online ad networks with malicious advertisements that attacked users' PCs, according to security consultancy Armorize*. The attacks started around Dec. 5 and lasted a few days, sending victims who clicked on the ads to malicious Web pages..."
* http://blog.armorize.com/2010/12/hdd...d-through.html
12.10.2010 - "... Over the past few days, we saw the quick spread of HDD Plus** - a malware that (somehow) gets installed on victim computers, and holds the computer hostage by displaying threatening message (that the system is failing), asking you to purchase a license so HDD Plus will fix the problems... one of the means for HDD Plus to spread, was via drive-by download malvertising through (at least) DoubleClick and rad.msn .com, which are both the world's largest ad serving platforms...
Known sites affected: Sites that incorporate DoubleClick or rad.msn .com banners, including for example Scout .com (using DoubleClick), realestate.msn .com, msnbc .com (using both), and mail.live .com. We'd like to note here it's very possible that multiple exchanges, besides those listed here, have been serving the fake ADShufffle's ads...
Malware installed: Over the past week, ADShufffle kept on changing the malware. Besides HDD Plus, other types of malware, such as backdoors, have been served...
Exploit packs used: Primarily a modified version of Eleonore. Neosploit was also used. With neosploit, malicious binaries are obfuscated on-the-fly before being served..."
(More detail and flow chart available at the blog.armorize.com URL above.)
** http://www.bleepingcomputer.com/viru...emove-hdd-plus
___
Q3'10... Web-Based Malware
- http://blog.dasient.com/2010_11_01_archive.html
November 22, 2010
Q1'10... Web-Based Malware
- http://blog.dasient.com/2010_05_01_archive.html
May 10, 2010
- http://news.cnet.com/8301-27080_3-20000898-245.html
March 22, 2010
- http://blog.avast.com/2010/02/18/ads...93-jsprontexi/
February 18, 2010
- http://blog.avast.com/wp-content/upl...texi_chart.png
:fear::mad::fear:
