Page 55 of 70 FirstFirst ... 54551525354555657585965 ... LastLast
Results 541 to 550 of 694

Thread: SPAM frauds, fakes, and other MALWARE deliveries - archive

  1. #541
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down Amnesty Int'l site serving Java exploits...

    FYI...

    Amnesty Int'l site serving Java exploits...
    - https://krebsonsecurity.com/2011/12/...-java-exploit/
    December 22, 2011 - "Amnesty International‘s homepage in the United Kingdom is currently serving malware that exploits a recently-patched vulnerability in Java. Security experts say the attack appears to be part of a nefarious scheme to target human rights workers... The site’s home page has been booby trapped with code that pulls a malicious script from an apparently hacked automobile site in Brazil. The car site serves a malicious Java applet that uses a public exploit to attack a dangerous Java flaw*... The site remains compromised..."

    - http://www.barracudalabs.com/wordpre...-on-activists/
    Comment: Emerson Povey @ amnesty.org.uk - December 23, 2011 - "... we have been working with our hosting service to resolve the issue. They have cleaned our servers, rebooted the system and removed the script from the default page. At 2pm today they confirmed that the problem is now fixed."

    - http://www.barracudalabs.com/wordpre...-on-activists/
    December 22, 2011 - "... compromised on or before Friday, December 16... Amnesty International UK has been notified... Java content (stolen from the Metasploit project), which targets CVE-2011-3544. If the exploit is successful, malware is installed on the visitor’s system..."
    VirusTotal Detections for Exploit
    ... a more up-to-date report (24/43) for this file:
    - https://www.virustotal.com/file-scan...3a8-1324550847
    File name: 542b24f1da13f0b1d647f3865b09e026bf00d4ef.bin
    Submission date: 2011-12-22 10:47:27 (UTC)
    Current status: finished
    Result: 24/43 (55.8%)
    VirusTotal Detections for Exploit Payload
    ... a more up-to-date report (22/43) for this file:
    - https://www.virustotal.com/file-scan...023-1324397991
    File name: f91dd927fd78a36176a68998304d70c8
    Submission date: 2011-12-20 16:19:51 (UTC)
    Result: 22/43 (51.2%)

    * http://web.nvd.nist.gov/view/vuln/de...=CVE-2011-3544
    Last revised: 11/24/2011
    CVSS v2 Base Score: 10.0 (HIGH)

    Current versions of Java here*:
    * http://www.oracle.com/technetwork/ja...ads/index.html

    Last edited by AplusWebMaster; 2012-01-16 at 17:55.
    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  2. #542
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Exclamation .nl.ai domains ...

    FYI...

    .nl.ai?
    - https://isc.sans.edu/diary.html?storyid=12280
    Last Updated: 2011-12-28 00:51:54 UTC - "Now .. where is nl.ai ?? Dot-ai is Anguilla, a speck of land in the Caribbean, to the east of Puerto Rico. And probably has nothing at all to do with what follows. Dot-nl-dot-ai, on the other hand, appears to be a free domain name registrar.
    If you're into malware analysis, you've probably seen your fair share of .nl.ai domains recently. And not just these. Feeding "nl.ai" into RUS-CERTs Passive DNS collector http://www.bfk.de/bfk_dnslogger.html...1.cd.am#result gives us the name server for .nl.ai (one ns1.cd.am), which in turn shows a couple of other domains that are currently very familiar to the malware analyst. Like .c0m.li, and .cc.ai.
    If you are blocking domains on your gateway or DNS server, blackholing these few:
    .cc.ai
    .nl.ai
    .c0m.li
    .cd.am
    .coom.in
    ... might be a reasonable move, at least until someone in your business can show that they have a legitimate need to access one of the sub domains of these pseudo top level domains. Mind you, chances are that not all domains hosted there in fact are bad. But all the ones that I've seen in my logs so far: were."

    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  3. #543
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down QR code malware ...

    FYI...

    QR code malware ...
    - http://www.darkreading.com/taxonomy/...e/id/232301147
    Dec 29, 2011 - "... QR codes, hackers are starting to take advantage of these square, scannable bar codes as a new way to distribute malware. Like all mobile attack vectors, it is a new frontier that security researchers say is not extremely prevalent but which has a lot of potential to wreak havoc if mobile developers and users stand by unaware... Just point your mobile device's camera on the code, scan it and the reading will take you to the website or mobile app download that its promoter promises to provide... There are a number of ways they are already using malicious codes to perpetrate their scams. On iOS devices, for example, hackers are re-purposing jail-break exploits to send users to websites that will jailbreak the device and install additional malicious malware... attackers are using QR codes to redirect users to fake websites for phishing..."
    ___

    - http://community.websense.com/blogs/...-qr-codes.aspx
    9 Jan 2012

    Last edited by AplusWebMaster; 2012-01-10 at 15:43.
    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  4. #544
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down Web hijacks w/AJAX

    FYI...

    Web hijacks with AJAX
    - http://labs.m86security.com/2012/01/...cks-with-ajax/
    January 3, 2012 - "... a malicious site which loads parts of its attack using AJAX (Asynchronous JavaScript and XML), a method for client-side code to asynchronously exchange data with web servers. The following attack was observed on a currently running server located in China, which is serving malware... This code is very similar to code commonly used in so many web pages nowadays. The main difference is the extra parameters it accepts, which are used to “cut” certain parts from the accepted content, so it could be processed and executed as code later on... Using the exact same technique, this web page can load various browser or plugin exploit attempts. In this specific case, the page loads an SWF file exploiting CVE-2010-1297. Other pages on this server are exploiting CVE-2010-0806 and CVE-2010-0249. The main reason that malware authors use AJAX is the ability to write generic attack pages which look benign and become malicious only once the dynamic content is loaded. This provides an advantage which is also very useful for evading AV detection, since tiny bits of the attack can be loaded one at a time, thus making it very difficult to provide a signature..."

    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2010-0249 - 9.3 (HIGH)
    MS10-002 - IE "... as exploited in the wild..."
    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2010-0806 - 9.3 (HIGH)
    MS10-018 - IE "... as exploited in the wild..."
    - http://web.nvd.nist.gov/view/vuln/de...=CVE-2010-1297 - 9.3 (HIGH)
    Adobe Flash Player, Reader, and Acrobat "... as exploited in the wild..."

    Also: https://isc.sans.edu/diary.html?storyid=12313
    Last Updated: 2012-01-03 09:37:04 UTC - "... very nasty JavaScript... potentially malicious JavaScript files..."

    Last edited by AplusWebMaster; 2012-01-04 at 06:06.
    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  5. #545
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down Fraud schemes erase evidence of account theft...

    FYI...

    Post Transaction fraud schemes erase evidence of account theft ...
    - https://www.trusteer.com/blog/gift-w...holiday-season
    January 04, 2012 - "... During the final few weeks of 2011, we saw fraudsters take advantage of this trend with their latest fraud scheme... we’ve typically seen man-in-the-browser attacks take place at one of the three possible online banking phases... There is another, less discussed, form of man-in-the-browser attack – the post transaction attack... as the name implies, occur after the evil deed has already been done and the account holder has closed the online banking session. These are designed to conceal illegitimate activity for as long as possible to either allow money to transfer to its final destination – uninterrupted, or continue to control the account and perform further transactions... Just before the recent holiday season, we came across a SpyEye configuration which attacks banks in the USA and UK. Instead of intercepting, or diverting, email messages... the attack automatically manipulates the bank account transaction webpage the customer views... a post transaction attack is launched that hides fraudulent transactions from the victim..."
    (More detail at the trusteer URL above.)

    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  6. #546
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down Worm on Facebook steals 45,000 logins ...

    FYI...

    Worm on Facebook steals 45,000 logins ...
    - http://blog.seculert.com/2012/01/ram...es-social.html
    January 5, 2012 - "... Seculert's research lab has discovered that Ramnit recently started targeting Facebook accounts with considerable success, stealing over 45,000 Facebook login credentials worldwide, mostly from people in the UK and France... Recently, our research lab identified a completely new 'financial' Ramnit variant aimed at stealing Facebook login credentials. Since the Ramnit Facebook C&C URL is visible and accessible it was fairly straightforward to detect that over 45,000 Facebook login credentials have been stolen worldwide, mostly from users* in the United Kingdom and France...
    * http://1.bp.blogspot.com/-F2YMFY8HB-...tbycountry.png
    ... We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further. In addition, cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks... With the recent ZeuS Facebook worm and this latest Ramnit variant, it appears that sophisticated hackers are now experimenting with replacing the old-school email worms with more up-to-date social network worms. As demonstrated by the 45,000 compromised Facebook subscribers, the viral power of social networks can be manipulated to cause considerable damage to individuals and institutions when it is in the wrong hands..."

    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  7. #547
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Exclamation MS11-100 exploit released

    FYI...

    MS11-100 exploit released
    - https://threatpost.com/en_us/blogs/e...et-flaw-010912
    Jan 9, 2012 - "A few days after MIcrosoft released a patch to fix a vulnerability in ASP.NET that could enable a denial-of-service attack, someone has released exploit code for the vulnerability. The proof-of-concept exploit code was posted to the Full Disclosure mailing list.. the code is designed to exploit a recently discovered vulnerability in ASP.NET that's related to the way that the software handles certain HTTP post requests... The problem isn't actually specific to ASP.NET, but affects a variety of languages and applications. Microsoft shipped an emergency patch* for the flaw on Dec. 29, recommending that users install it as quickly as possible... The base cause of the problem is that when ASP.NET comes across a form submission with some specific characteristics, it will need to perform a huge amount of computations that could consume all of the server's rresources."
    * https://technet.microsoft.com/en-us/.../ms11-100.mspx

    - https://isc.sans.edu/diary.html?storyid=12355
    Last Updated: 2012-01-09 19:21:27 UTC

    Last edited by AplusWebMaster; 2012-01-10 at 10:39.
    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  8. #548
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down BBB SPAM leads to 'Blackhole' ...

    FYI...

    BBB SPAM leads to 'Blackhole'...
    - https://blogs.technet.com/b/mmpc/arc...edirected=true
    12 Jan 2012 - "... BBB is aware of the spam and posted an alert on their site, and also offer the following suggestions:
    'To verify the legitimacy of BBB complaints, contact Better Business Bureau locally. Consumers or businesses who have received the fraudulent emails are asked to report them to http://bbb.org/scam/report-a-scam ...'
    The hyperlink in the message labeled "click here" pointed to an HTML page "index.html" on a compromised domain. I retrieved the index HTML page and its content was very minimal, yet suspicious, with links to a JavaScript file named "ajaxam.js"... The domains referenced in the script appear to have been compromised for this attack. Two of the links for the "ajaxam.js" script were dead but a third was not. That .JS file contained a simple one line document location instruction to yet another domain and server-side PHP script... This request results in the delivery of an obfuscated script file that, when run, attempts to exploit CVE-2010-1885. This particular vulnerability is also known as the "Help Center URL Validation Vulnerability", mitigated by Microsoft Security Bulletin MS10-042. On a vulnerable computer, this script exploit would have dropped and executed malware... This scheme of redirection and executing obfuscated script with these certain exploits was none other than the "Blackhole" exploit pack..."

    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  9. #549
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down NY banks and Online Theft ...

    FYI...

    NY banks and Online Theft ...
    - http://online.wsj.com/article/SB1000...598919896.html
    Jan. 10, 2012 - "... initiatives are designed to encourage banks to work together to better protect against hackers, whose efforts to shut down electronic operations and steal money or customer data pose a growing concern for the industry... Online attacks have increased sharply over the past two years and financial institutions are among the most likely targets, according to a new survey by PricewaterhouseCoopers LLP, the consulting firm. Avivah Litan, an analyst with Gartner Research, expects financial companies to increase spending on fraud detection and customer authentication systems by as much as 12%, to $1 billion, over the next two years — a record... While many bank officials agree with the information-sharing in principle, some are concerned that doing so could provide rivals with too much insight into their operations... Sharing might be discouraged in other parts of banking, because of possible antitrust implications...
    the chief technology officer of a large bank said "phishing" attacks used by cyber criminals to extract personal information were not a threat... 'If they are -not- a threat, why are you spending $2 million on software to protect against them?'... The executive's answer: "We don't want to talk about fraud in front of anyone."

    Search: online bank frauds
    - https://encrypted.google.com/
    ... about 109,000,000 results.

    Last edited by AplusWebMaster; 2012-01-14 at 14:34.
    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

  10. #550
    Adviser Team AplusWebMaster's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    5,150

    Thumbs down IP's to block 2012.01.14...

    FYI...

    IP's to block...
    - https://isc.sans.edu/diary.html?storyid=12400
    Last Updated: 2012-01-14 21:40:30 UTC - "Antony Elmar owns quite a few domain names... lives in a lovely city called "Kansas, US"... with a phone number that is a tad odd for "Kansas, US" and has a dial prefix that looks more like Italy... Registrant Phone:+3.976639877...
    His new domains currently point to 89.187.53.237, in Moldova... The IP used seems to change about once per week, until past Thursday, Antony's virtual HQ was at the neighboring IP, 89.187.53.238.
    His latest new domains include:
    cyberendbaj .in
    cyberevorm .in
    endbaj .in
    endbajcomp .in
    evorm .in
    evormhost .in
    evormcorp .in
    ... and provide a generous helping of malware to users unlucky enough to get redirected there via what appears to be poisoned ads on legitimate web pages..."

    This machine has no brain.
    ....... Use your own.
    Browser check for updates here.
    YOU need to defend against -all- vulnerabilities.
    Hacks only need to find -1- to get in...
    .

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •