SPAM frauds, fakes, and other MALWARE deliveries - archive

[AplusWebMaster]

FYI...

Zbot spreads thru fake email ...
- http://labs.m86security.com/2012/01/...ication-email/
January 13, 2012 - "... malicious SPAM campaign that is actively sent out by the Cutwail spam botnet. The suspicious email claims to be a bill summary from the New York-based energy company Con Edison, Inc. It may use the subject line “ConEdison Billing Summary as of <DATE>” and the attachment uses the filename format Billing-Summary-ConEdison-<random numbers>-<Date>.zip... The attached zip file contains an executable file, which unsurprisingly is a Zbot malware variant. When extracted, the malicious executable uses no disguise. It uses no fake icons of Adobe Reader or Microsft Word, no double file extensions, or excessive use of space in the file name to hide the .EXE extension... bill notifications do -not- usually arrive with an executable file - so emails like this should be treated with extreme suspicion. When you see these obvious signs of malware, just stop and delete the email..."

[AplusWebMaster]

FYI...

Zappos breach - 24M affected...
- https://www.computerworld.com/s/arti...er_data_breach
January 16, 2012 - "... Zappos.com is advising over 24 million customers to change their passwords following a data breach... Zappos employees received an email from CEO Tony Hsieh on Sunday*, alerting them about a security breach that involved the online shop's customer database... Even though he assured everyone that no credit card details had been compromised, Hsieh revealed that the attacker had accessed customer records including names; email, billing and shipping addresses; phone numbers, and the last four digits of their credit card numbers. The hacker also gained access to password hashes for the accounts registered on the website, prompting the company to reset everyone's access codes. Zappos is currently in the process of emailing its 24 million customers in order to notify them about the security breach and advise them to change their passwords..."
* http://blogs.zappos.com/securityemail

- https://isc.sans.edu/diary.html?storyid=12406
Last Updated: 2012-01-16 16:56:49 UTC

> http://www.reuters.com/article/2012/...80F1BD20120117
Jan 17, 2012 - "... hackers had not been able to access servers that held customers critical credit card and other payment data... Zappos... was recommending that customers change their passwords including on any other website where they use the same or similar password..."

- http://blog.eset.com/2012/01/17/zapp...essons-learned
Jan 17, 2012 - "... Although the goal would be to never have a breach in the first place, if it happens, there is a crisis of confidence among the customers. Acting quickly and decisively can work wonders toward restoring that confidence, as customers sense they are receiving current, relevant, and honest communication about the incident..."
___

(Yet -another- hAcK...) T-Mobile USA hacked
- http://h-online.com/-1414307
17 January 2012

[AplusWebMaster]

FYI...

Zeus variant - Gameover...
- https://www.trusteer.com/blog/post-t...ntion-controls
January 17, 2012 - "A recent FBI warning* on the Zeus variant called Gameover reveals that high detection accuracy of fraudulent transactions is not enough to prevent cybercrime. This new attack is specifically designed to circumvent post transaction fraud prevention measures... Some Post-Transaction Attacks are not targeted at the bank but rather at the user. One example uses SpyEye to execute man in the browser (MitB) attacks that hide confirmation emails in web email services or fraudulent transactions on the online banking site... these attacks can bring the entire fraud assessment process to a grinding halt..."
(More detail at the trusteer URL above.)
* http://www.fbi.gov/denver/press-rele...shing-campaign
"... The SPAM campaign is pretending to be legitimate e-mails from the National Automated Clearing House Association (NACHA), advising the user there was problem with the ACH transaction at their bank and it was not processed. Once they click on the link they are infected with the Zeus or Gameover malware, which is able to key log as well as steal their online banking credentials, defeating several forms of two factor authentication. After the accounts are compromised, the perpetrators conduct a Distributed Denial of Service (DDoS) attack on the financial institution. The belief is the DDoS is used to deflect attention from the wire transfers as well to make them unable to reverse the transactions (if found)..."

[AplusWebMaster]

FYI...

SOPA scams...
- http://blog.eset.com/2012/01/17/beware-of-sopa-scams
Jan 17, 2012 - "... on January 18, 2012, dozens of popular websites covering a diverse range of subjects will be blacking out their home pages in protest of the U.S. Stop Online Piracy Act (SOPA). Some of these websites are well-known... While we cannot be certain exactly what sort of scams may appear, keep in mind that the websites listed above will resume normal activity around their announced times. It is unlikely they will resume much earlier, and some may even be slightly delayed in returning to normal activity. If you see any pronouncements about sites returning to operation early or an option to bypass the blackout by visiting a new web site, ignore them and wait for the site to return at its preannounced time: The “new” site being promoted may have far more malicious actions in mind than pictures of kittens, discussions about ents, bacon and narwhals or jokes about arrows to the knee..."

[AplusWebMaster]

FYI...

Malicious SPAM scam "Re: Scan from a Xerox..."
- http://community.websense.com/blogs/...-new-face.aspx
18 Jan 2012 - "... malicious email scam with the subject "Re: Scan from a Xerox W. Pro #XXXXXXX" went wild. This scam has returned – this time, with a new face! Instead of making you attach a .zip file, as it did in the past, it now prompts you to click a download link - DON'T... This redirects the link to a malicious site that hosts a Blackhole exploit kit. Once the iframe is loaded, content from the Blackhole exploit kit (which contains a highly obfuscated script ) site is also loaded... Successful exploitation executes a shellcode that triggers the download and execution of malware... there is an administration option for this kit to use underground audio and video scanners for malware. This lets attackers tweak their malware samples to make them undetectable prior to launching their attack live... detected more than 3,000 messages in this campaign..."

[AplusWebMaster]

FYI...

SPAM / phish leads to malware...
- https://blogs.technet.com/b/mmpc/arc...edirected=true
19 Jan 2012 - "Our partners at the City of Seattle sent us a warning* today about a phishing campaign which targets users very close to home - specifically, Seattle Washington. They're seeing spam mail circulating that claims to be from Seattle Department of Motor Vehicles, stating that the victim is charged with a traffic offense, and requesting that they fill out a linked form... If the link is visited, the browser requests the page and loads an IFrame from yet another site, which was registered on January 16, 2012 and is hosted in the Ukraine at IP 93.190.44.171. This Ukrainian site contains an obfuscated JavaScript that attempts to exploit an issue in MDAC (Microsoft Security Bulletin MS06-014) that was mitigated by a Windows security update in 2006. If the exploit is successful, it will download and execute a file named "info.exe" from the domain “doofyonmycolg .ru”..." (!?)
* http://spdblotter.seattle.gov/2012/0...raffic-ticket/
"... The City of Seattle does not have its own Department of Motor Vehicles nor does the Seattle Police Department send email notifications of a traffic violations..."
___

Search for "QuickTime" Leads to Phishing Site...
- http://community.websense.com/blogs/...hing-site.aspx
19 Jan 2012 - "... if you were to search for the term "QuickTime" today, the 31st resulting entry would lead to a typosquatted URL, which pulls content from a phishing URL... Clicking this Google search entry sends you to a fake QuickTime download site... The "Download Now" button doesn't take you to the download page for QuickTime software. It directs you to a phishing site instead. This alleged music download site phishes your credit card information on the membership fee payment page. Be aware of the risks of using your credit card on random websites to avoid such phishing attacks."

[AplusWebMaster]

FYI...

Top 50 Bad Hosts... Q4 2011
- http://hostexploit.com/blog/14-repor...y-victims.html
24 January 2012 - "There is one common denominator in cybercrime – it is hosted, served, or trafficked by some host or network operator somewhere. It could be assumed that such a succinct, yet true, statement should yield, in return, an equally concise solution. In fact, it provides only a place to start... The aim is to encourage service providers to "clean up" and to be proactive in stopping the cybercriminal activities found on their servers... Some things have changed since our early reports. There is now more cooperation between the security industry, law enforcement and service providers and some pleasing results against some of the worst activities found on the net. Sadly, some things have -not- changed. Cybercriminals are still too easily making financial gain from the lax procedures by service providers, security vulnerabilities of organizations large or small and Internet users’ lack of awareness. 2011 showcased some data breaches of truly epic proportions with the year ending in the same vein in which it began..."
(Full report links @ the hostexploit URL above.)

[AplusWebMaster]

FYI...

Typosquatting back in use... 7,000+ sites
- http://community.websense.com/blogs/...ting-army.aspx
22 Jan 2012 - "... Typosquatting of social web sites that lead visitors to spam survey sites with a high Alexa ranking. With our on-going research, we discovered that cyber-criminals are carrying out even more work, and the campaign is more widespread than we originally thought. Their targets are not limited to social web, but also include popular and frequently-visited registered typosquatting domains in all areas ranging from Google to Victoria's Secret, or Wikipedia to Craigslist; the list goes on. The attacker registers a network of typosquatting domains and redirects visitors of these mistyped sites to a spam survey site... discovered over 7,000 typosquatting sites within this single network... These typosquatting sites redirect visitors to a suspicious URL via a URL shortening service. From there, they take them to a spam survey site... After visitors complete the spam survey, they are then taken to spam advertisement distributed sites where spam advertisements are displayed... An example of such advertisment is a free movie downloader... Currently, these spam advertisements are not -spreading- maliciously..."

- http://community.websense.com/blogs/...gin-forum.aspx
23 Jan 2012 - "... unofficial Google Chrome plugin forum Web page which is pulling in content from two malicious Web sites. We believe this Web page was compromised... The fake AdSense show_ads.js links to a typo-squatted URL where the whois record shows that it's clearly -not- a site owned by Google Inc... Notice the details*..."
* http://community.websense.com/cfs-fi...2D00_550x0.png

[AplusWebMaster]

FYI...

Top 10 web security threats...
- http://betanews.com/2012/01/25/the-t...-should-avoid/
2012.01.25 - "The compromised website is still the most effective attack vector for hackers to install malware on your computer with 47.6 percent of all malware installs occurring in that manner, says security firm AVG*. Another 10.6 percent are tricked into downloading exploit code - many times, without their knowledge - by clicking on links on pages to sites hosting malware. The Chelmsford, Mass. company announced its findings as part of a broader study of threats detected by its software... AVG warns that the security issues plaguing desktops are migrating to mobile devices..."
* http://aa-download.avg.com/filedir/p...rt_Q4_2011.pdf

- http://betanews.com/wp-content/uploa...7515917633.jpg

- http://betanews.com/wp-content/uploa...eats-q4-11.jpg

[AplusWebMaster]

FYI...

MS12-004 exploit in-the-wild
- http://blog.trendmicro.com/malware-l...ability-found/
Updated: Jan 30, 2012 - "... we encountered a malware that exploits a recently (and publicly) disclosed vulnerability, the MIDI Remote Code Execution Vulnerability (CVE-2012-0003)*. The said vulnerability is triggered when Windows Multimedia Library in Windows Media Player (WMP) fails to handle a specially crafted MIDI file, consequently allowing remote attackers to execute arbitrary code. In the attack that we found, the infection vector is a malicious HTML... This HTML, which Trend Micro detects as HTML_EXPLT.QYUA, exploits the vulnerability by using two components that are also hosted on the same domain. The two files are: a MIDI file detected as TROJ_MDIEXP.QYUA, and a JavaScript detected as JS_EXPLT.QYUA. HTML_EXPLT.QYUA calls TROJ_MDIEXP.QYUA to trigger the exploit, and uses JS_EXPLT.QYUA to decode the shellcode embedded in HTML_EXPLT.QYUA’s body... Microsoft has already issued an update to address this vulnerability during the last patch Tuesday, so our first advice to users is to patch their system with the Microsoft security update here**. It affects Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2..."
* http://web.nvd.nist.gov/view/vuln/de...=CVE-2012-0003
Last revised: 02/01/2012
CVSS v2 Base Score: 9.3 (HIGH)

** https://technet.microsoft.com/en-us/...letin/ms12-004
MS12-004 - Critical || Vulnerabilities in Windows Media Could Allow Remote Code Execution (2636391)
Updated: Wednesday, January 11, 2012
___

- http://www.securityfocus.com/bid/51292/info
Updated: Jan 27 2012
- http://www.securityfocus.com/bid/51292/exploit
"... Reports indicate this issue is actively being exploited in the wild."

- http://h-online.com/-1424576
30 January 2012

- http://labs.m86security.com/2012/01/...-to-infection/
Jan 31, 2012