Amnesty Int'l site serving Java exploits...
FYI...
Amnesty Int'l site serving Java exploits...
- https://krebsonsecurity.com/2011/12/...-java-exploit/
December 22, 2011 - "Amnesty International‘s homepage in the United Kingdom is currently serving malware that exploits a recently-patched vulnerability in Java. Security experts say the attack appears to be part of a nefarious scheme to target human rights workers... The site’s home page has been booby trapped with code that pulls a malicious script from an apparently hacked automobile site in Brazil. The car site serves a malicious Java applet that uses a public exploit to attack a dangerous Java flaw*... The site remains compromised..."
- http://www.barracudalabs.com/wordpre...-on-activists/
Comment: Emerson Povey @ amnesty.org.uk - December 23, 2011 - "... we have been working with our hosting service to resolve the issue. They have cleaned our servers, rebooted the system and removed the script from the default page. At 2pm today they confirmed that the problem is now fixed."
- http://www.barracudalabs.com/wordpre...-on-activists/
December 22, 2011 - "... compromised on or before Friday, December 16... Amnesty International UK has been notified... Java content (stolen from the Metasploit project), which targets CVE-2011-3544. If the exploit is successful, malware is installed on the visitor’s system..."
VirusTotal Detections for Exploit
... a more up-to-date report (24/43) for this file:
- https://www.virustotal.com/file-scan...3a8-1324550847
File name: 542b24f1da13f0b1d647f3865b09e026bf00d4ef.bin
Submission date: 2011-12-22 10:47:27 (UTC)
Current status: finished
Result: 24/43 (55.8%)
VirusTotal Detections for Exploit Payload
... a more up-to-date report (22/43) for this file:
- https://www.virustotal.com/file-scan...023-1324397991
File name: f91dd927fd78a36176a68998304d70c8
Submission date: 2011-12-20 16:19:51 (UTC)
Result: 22/43 (51.2%)
* http://web.nvd.nist.gov/view/vuln/de...=CVE-2011-3544
Last revised: 11/24/2011
CVSS v2 Base Score: 10.0 (HIGH)
Current versions of Java here*:
* http://www.oracle.com/technetwork/ja...ads/index.html
:mad::fear:
Fraud schemes erase evidence of account theft...
FYI...
Post Transaction fraud schemes erase evidence of account theft ...
- https://www.trusteer.com/blog/gift-w...holiday-season
January 04, 2012 - "... During the final few weeks of 2011, we saw fraudsters take advantage of this trend with their latest fraud scheme... we’ve typically seen man-in-the-browser attacks take place at one of the three possible online banking phases... There is another, less discussed, form of man-in-the-browser attack – the post transaction attack... as the name implies, occur after the evil deed has already been done and the account holder has closed the online banking session. These are designed to conceal illegitimate activity for as long as possible to either allow money to transfer to its final destination – uninterrupted, or continue to control the account and perform further transactions... Just before the recent holiday season, we came across a SpyEye configuration which attacks banks in the USA and UK. Instead of intercepting, or diverting, email messages... the attack automatically manipulates the bank account transaction webpage the customer views... a post transaction attack is launched that hides fraudulent transactions from the victim..."
(More detail at the trusteer URL above.)
:mad:
Worm on Facebook steals 45,000 logins ...
FYI...
Worm on Facebook steals 45,000 logins ...
- http://blog.seculert.com/2012/01/ram...es-social.html
January 5, 2012 - "... Seculert's research lab has discovered that Ramnit recently started targeting Facebook accounts with considerable success, stealing over 45,000 Facebook login credentials worldwide, mostly from people in the UK and France... Recently, our research lab identified a completely new 'financial' Ramnit variant aimed at stealing Facebook login credentials. Since the Ramnit Facebook C&C URL is visible and accessible it was fairly straightforward to detect that over 45,000 Facebook login credentials have been stolen worldwide, mostly from users* in the United Kingdom and France...
* http://1.bp.blogspot.com/-F2YMFY8HB-...tbycountry.png
... We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further. In addition, cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks... With the recent ZeuS Facebook worm and this latest Ramnit variant, it appears that sophisticated hackers are now experimenting with replacing the old-school email worms with more up-to-date social network worms. As demonstrated by the 45,000 compromised Facebook subscribers, the viral power of social networks can be manipulated to cause considerable damage to individuals and institutions when it is in the wrong hands..."
:mad:
MS11-100 exploit released
FYI...
MS11-100 exploit released
- https://threatpost.com/en_us/blogs/e...et-flaw-010912
Jan 9, 2012 - "A few days after MIcrosoft released a patch to fix a vulnerability in ASP.NET that could enable a denial-of-service attack, someone has released exploit code for the vulnerability. The proof-of-concept exploit code was posted to the Full Disclosure mailing list.. the code is designed to exploit a recently discovered vulnerability in ASP.NET that's related to the way that the software handles certain HTTP post requests... The problem isn't actually specific to ASP.NET, but affects a variety of languages and applications. Microsoft shipped an emergency patch* for the flaw on Dec. 29, recommending that users install it as quickly as possible... The base cause of the problem is that when ASP.NET comes across a form submission with some specific characteristics, it will need to perform a huge amount of computations that could consume all of the server's rresources."
* https://technet.microsoft.com/en-us/.../ms11-100.mspx
- https://isc.sans.edu/diary.html?storyid=12355
Last Updated: 2012-01-09 19:21:27 UTC
:fear::sad:
BBB SPAM leads to 'Blackhole' ...
FYI...
BBB SPAM leads to 'Blackhole'...
- https://blogs.technet.com/b/mmpc/arc...edirected=true
12 Jan 2012 - "... BBB is aware of the spam and posted an alert on their site, and also offer the following suggestions:
'To verify the legitimacy of BBB complaints, contact Better Business Bureau locally. Consumers or businesses who have received the fraudulent emails are asked to report them to http://bbb.org/scam/report-a-scam ...'
The hyperlink in the message labeled "click here" pointed to an HTML page "index.html" on a compromised domain. I retrieved the index HTML page and its content was very minimal, yet suspicious, with links to a JavaScript file named "ajaxam.js"... The domains referenced in the script appear to have been compromised for this attack. Two of the links for the "ajaxam.js" script were dead but a third was not. That .JS file contained a simple one line document location instruction to yet another domain and server-side PHP script... This request results in the delivery of an obfuscated script file that, when run, attempts to exploit CVE-2010-1885. This particular vulnerability is also known as the "Help Center URL Validation Vulnerability", mitigated by Microsoft Security Bulletin MS10-042. On a vulnerable computer, this script exploit would have dropped and executed malware... This scheme of redirection and executing obfuscated script with these certain exploits was none other than the "Blackhole" exploit pack..."
:mad:
NY banks and Online Theft ...
FYI...
NY banks and Online Theft ...
- http://online.wsj.com/article/SB1000...598919896.html
Jan. 10, 2012 - "... initiatives are designed to encourage banks to work together to better protect against hackers, whose efforts to shut down electronic operations and steal money or customer data pose a growing concern for the industry... Online attacks have increased sharply over the past two years and financial institutions are among the most likely targets, according to a new survey by PricewaterhouseCoopers LLP, the consulting firm. Avivah Litan, an analyst with Gartner Research, expects financial companies to increase spending on fraud detection and customer authentication systems by as much as 12%, to $1 billion, over the next two years — a record... While many bank officials agree with the information-sharing in principle, some are concerned that doing so could provide rivals with too much insight into their operations... Sharing might be discouraged in other parts of banking, because of possible antitrust implications...
the chief technology officer of a large bank said "phishing" attacks used by cyber criminals to extract personal information were not a threat... 'If they are -not- a threat, why are you spending $2 million on software to protect against them?'... The executive's answer: "We don't want to talk about fraud in front of anyone."
Search: online bank frauds
- https://encrypted.google.com/
... about 109,000,000 results.
:mad: :sad:
IP's to block 2012.01.14...
FYI...
IP's to block...
- https://isc.sans.edu/diary.html?storyid=12400
Last Updated: 2012-01-14 21:40:30 UTC - "Antony Elmar owns quite a few domain names... lives in a lovely city called "Kansas, US"... with a phone number that is a tad odd for "Kansas, US" and has a dial prefix that looks more like Italy... Registrant Phone:+3.976639877...
His new domains currently point to 89.187.53.237, in Moldova... The IP used seems to change about once per week, until past Thursday, Antony's virtual HQ was at the neighboring IP, 89.187.53.238.
His latest new domains include:
cyberendbaj .in
cyberevorm .in
endbaj .in
endbajcomp .in
evorm .in
evormhost .in
evormcorp .in
... and provide a generous helping of malware to users unlucky enough to get redirected there via what appears to be poisoned ads on legitimate web pages..."
:mad: