Rogue AV/AS prolific

Rogueware growth - 2009

FYI...

Rogueware growth - 2009 ...
- http://www.darkreading.com/shared/printableArticle.jhtml?articleID=218700073
July 29, 2009 - "All told, 374,000 new versions of rogueware samples were released in this year's second quarter - and that number is expected to nearly double to 637,000 in the third quarter. PandaLabs researchers, who have been tracking the spread of this latest trend in cybercrime, say rogueware is easier for the bad guys than traditional banking Trojan attacks... the numbers have been spiking during the past year:
In the fourth quarter of 2008, PandaLabs found more than 50,000 rogueware samples for a total of 92,000 for the year*. "And there were two times as many in Q2 versus Q1," PandaLabs' Carrons says. "Last year, they were using typical malware distribution channels, with links that were trying to distribute the fake AV. In the second quarter of 2009, we had predicted there would be 220,000 samples [of rogueware], but it turned out to be 374,000." But now social networks, such as Facebook, MySpace, and Twitter, are the latest vehicle for spreading rogueware. Attackers hijack user accounts and go after their friends with a video link... These fake antivirus programs alert victims that they are "infected" and lure them to click and clean their machines; when they do, they are prompted to purchase a license for the phony security application... So the bad guys are now automatically generating new, unique samples that AV engines can't recognize, according to the researchers. PandaLabs found in its research two main tiers in the rogueware business model: the creators, who develop the rogue applications and provide back-office services, such as payment gateways, and the affiliates, who distribute the fake AV. Affiliates are mostly Eastern Europeans..."
* http://www.pandasecurity.com/homeusers/security-info/tools/reports#Monographs

Following the Money: Rogue Anti-virus Software
- http://voices.washingtonpost.com/securityfix/2009/07/following_the_money_trail_of_r.html
July 31, 2009

:fear::mad:
 
Last edited:
Q2-2009 - $34m in Rogueware per month...

FYI...

Q2-2009 - $34m in Rogueware per month...
- http://www.theregister.co.uk/2009/08/07/scareware_market/
7 August 2009 - "Fraudsters are making approximately $34m per month through scareware attacks, designed to trick surfers into purchasing rogue security packages supposedly needed to deal with non-existent threats. A new study, The Business of Rogueware*, by Panda Security researchers Luis Corrons and Sean-Paul Correll, found that scareware distributors are successfully infecting 35 million machines a month. Social engineering attacks, often featuring social networking sites, that attempt to trick computer users into sites hosting scareware software have become a frequently used technique for distributing scareware. Tactics include manipulating the search engine rank of pages hosting scareware. Panda reckons that there are 200 different families of rogueware, with more new variants coming on stream all the time... Luis Corrons, PandaLabs' technical director: "By taking advantage of the fear in malware attacks, they prey upon willing buyers of their fake anti-virus software, and are finding more and more ways to get to their victims, especially as popular social networking sites and tools like Facebook and Twitter have become mainstream." In Q2 2009, four times more new strains were created than in the whole of 2008, primarily in a bid to avoid signature-based detection by genuine security packages..."
* http://www.pandasecurity.com/homeusers/security-info/tools/reports#Monographs
"... results:
• We predict that we will record more than 637,000 new rogueware samples by the end of Q3 2009, a tenfold increase in less than a year.
• Approximately 35 million computers are newly infected with rogueware each month (approximately 3.50 percent of all computers).
• Cybercriminals are earning approximately $34 million per month through rogueware attacks..."

:fear::mad:
 
Cybercrime Hub in Estonia

FYI...

Cybercrime Hub in Estonia
- http://blog.trendmicro.com/investigations-on-a-cybercrime-hub-in-estonia/
Aug. 26, 2009 - "... this company has been serving as the operational headquarters of a large cybercrime network since 2005. From its office in Tartu (Estonia), employees administer sites that host codec Trojans and command and control (C&C) servers that steer armies of infected computers. The criminal outfit uses a lot of daughter companies that operate in Europe and in the United States. These daughter companies’ names quickly get the heat when they become involved in Internet abuse and other cybercrimes. They disappear after getting bad publicity or when upstream providers terminate their contracts. Some of the larger daughter companies survived up to 5 years, but got dismantled after they lost internet connectivity in a data center in San Francisco, when webhosting company Intercage went dark in September 2008, and when ICANN decided to revoke the company’s domain name registrar accreditation. This caused a major blow to the criminal operation. However, it quickly recovered and moreover immediately started to spread its assets over many different webhosting companies. Today we count about 20 different webhosting providers where the criminal Estonian outfit has its presence. Besides this, the company owns two networks in the United States. We gathered detailed data on the cyber crime ring from Tartu and found that they control every step between driving traffic to sites with Trojans and exploiting infected computers. Even the billing system for fake antivirus software that is being pushed by the company is controlled from Tartu. An astonishing number of 1,800,000 Internet users were exposed to a bogus “you are infected” messages in July 2009 when they tried to access high traffic pornography sites."

(Screenshots available at the URL above.)

:fear::mad::fear:
 
Last edited:
Rogue AV goes Green

FYI...

Rogue AV goes Green
- http://securitylabs.websense.com/content/Blogs/3469.aspx
09.02.2009 - "Given the world's ever-increasing environmental concerns, it’s easy to see why malware authors are monetizing via an eco-friendly strategy. Just as the scare tactics of rogue AVs have already taken their toll, yet another ingenious twist appears - this time resorting to a friendlier, “greener” tone. Green-conscious people, beware! The latest scheme states that, for every fake AV you buy, a donation will be made to an environmental care program. It’s very simple and direct – buy the software and save the planet. Unlike other rogue AV campaigns that offer “free trial versions,” this ploy actually requires the user to buy the malware with a credit card, all the while assuring the user that a donation will be made to a green cause. This social engineering scheme appears to be picking up steam—as stories of fake AV grief from victims posted on the Web continue to pour in." (including search engine poisoning w/links to the rogue software)

(Screenshots available at the URL above.)

:fear::mad:
 
FakeAV for 9/11

FYI...

FakeAV for 9/11
- http://blog.trendmicro.com/fakeav-for-september-11/
Sep. 10, 2009 - "As the anniversary of the horrible September 11 attacks in The United States approaches, Trend Micro researchers donned their research coats and waited for the people behind FAKEAV to make their move. Predictably, they did not disappoint. Through SEO poisoning, users searching for any reports related to September 11 may find themselves stacked with Google search results that lead to a rogue AV malware... several malicious Web sites that can all be found in the poisoned Google search results... The people behind FAKEAV still show no sign of slowing down. With the holiday season coming up, users are also advised to refrain from visiting unknown sites returned in Search Engine results and rely on reputable news agencies instead."
(Screenshot available at the URL above.)

- http://www.sophos.com/blogs/gc/g/2009/09/11/scareware-scammers-exploit-911
September 11, 2009

:mad:
 
Last edited:
NY Times pushes Fake AV malvertisement

FYI...

NY Times pushes Fake AV malvertisement
- http://countermeasures.trendmicro.eu/new-york-times-pushes-fake-av-malvertisement/
Sep. 14, 2009 - "...the New York Times issued a warning over Twitter and also on the front page of the web site. The newspaper advised visitors that they had had reports from “some NYTimes .com readers” relating to a malicious pop-up window while browsing the site... In the warning, the influential newspaper stated their belief that the pop-ups were the result of an “unauthorised advertisement”... it looks as though the problem may have been ongoing for upwards of 24 hours. The pop-up window itself... was the all-too-familiar sight of rogue antivirus software informing the NYTimes reader that their computer is infected with random, spurious, non-existent malware and promising “Full System Cleanup” for a fee of course... The malicious software being punted in this case, is the same as we were seeing in much of the black-hat SEO around the 9/11 attacks, as reported previously on the TrendLabs malware blog*. In this particular example, the malicious site and sofware is being hosted by a German provider, Hetzner AG, which has a colourful track record when it comes to spewing dodgy content, having hosted literally hundreds of malicious URLS. Here’s a really simple tip to remember. If you *ever* see a pop-up windows that arrives uninvited, telling you your PC is infected, ignore it, it is a scam. Close the window, empty your browser cache... UPDATE: Troy Davis was fortunate enough to be able to examine the attack in real-time and provides an excellent code level analysis here**".

* http://blog.trendmicro.com/fakeav-for-september-11/

** http://troy.yort.com/anatomy-of-a-malware-ad-on-nytimes-com

:fear::mad:
 
Fake A/V hacks for another celebrity death...

FYI...

Fake A/V hacks for another celebrity death...
- http://www.sophos.com/blogs/gc/g/2009/09/15/patrick-swayzes-death-exploited-scareware-hackers/
September 15, 2009 - "Patrick Swayze, the star of movies such as "Dirty Dancing" and "Ghost", has died after fighting cancer of the pancreas for two years. Although the entertainment world mourns his loss, heartless hackers are taking advantage of the hot news story by creating malicious webpages that lead to fake anti-virus (also known as scareware) alerts... This is the same tactic used by cybercriminals after the death of Natasha Richardson and when they exploited interest amongst the public in the anniversary of the 9/11 terrorist attack last week. Clearly the cybercriminals are no slackers when it comes to jumping on a trending internet topic, and are more professional than ever before in spreading their fake anti-virus scams..."

:fear::mad:
 
Rogue Anti-Virus SEO Poisoning

FYI...

Rogue Anti-Virus SEO Poisoning...
- http://securitylabs.websense.com/content/Blogs/3479.aspx
09.16.2008 - "SEO poisoning is fast becoming a trend in spreading rogue anti-virus software. This type of attack coupled with relevant news items that might be of interest to users from all walks of life is a lethal combination. Search terms related to the recent MTV Video Music Awards brouhaha and President Obama’s off-the-record comments about Kanye West, as well as updates on murdered Yale graduate student Annie Le, are the latest targets... Upon visiting these search results, visitors would be presented with the standard fake / rogue AV Web site. To make matters worse, (real) anti-virus have very poor detection rates..."

- http://www.virustotal.com/analisis/...faa8d66b8d748617dd8466f4829ef59896-1253125434
File setup_build6_195.exe received on 2009.09.16 18:23:54 (UTC)
Result: 1/41 (2.44%)

- http://www.virustotal.com/analisis/...bb46e481da454d9abe7f24d01aa7b3610e-1253125440
File Soft_71.exe received on 2009.09.16 18:24:00 (UTC)
Result: 3/41 (7.32%)

(Screenshots of the fake AV Web site, as led to by the search engine, available at the Websense URL above.)

- http://isc.sans.org/diary.html?storyid=7144
Last Updated: 2009-09-17 07:36:18 UTC

:fear::mad::fear:
 
Last edited:
Fake Twitter accounts for Fake AV

FYI...

Fake Twitter accounts for Fake AV
- http://www.f-secure.com/weblog/archives/00001773.html
September 20, 2009 - "We're seeing more and more fake Twitter accounts being auto-generated by the bad boys. The profiles look real. They have variable account and user names (often German) and different locations (US cities). They even upload different Twitter wallpapers automatically... All the tweets sent by these accounts are auto-generated, either by picking up keywords from Twitter trends or by repeating real tweets sent by humans. And where do all the links eventually end up to? Of course, they lead to fake websites trying to scare you into purchasing a product you don't need..."

(Screenshots available at the URL above.)

- http://www.sophos.com/blogs/gc/g/2009/09/21/fake-antivirus-attack-twitter/
September 21, 2009

:fear::mad:
 
Last edited:
Fake Malwarebytes...

FYI...

Fake Malwarebytes - Bogus Sponsored Link Leads to FAKEAV
- http://blog.trendmicro.com/bogus-sponsored-link-leads-to-fakeav/
Sep. 24, 2009 - "Apart from SEO poisoning, cybercriminals have found another avenue to proliferate FAKEAV malware - bogus sponsored links (sitio patrocinados in Spanish). Just recently, Trend Micro researchers were alerted to malicious search engine ads that appeared in Microsoft’s Bing and AltaVista, among others, when a user searches the string “malwarebytes.” (Malwarebytes is a free antivirus product, but of course, not a FakeAV.) Clicking the malicious URL points the user to an executable file named MalwareRemovalBot.exe-1 (detected by Trend Micro as TROJ_FAKEAV.DMZ). Upon execution, the rogue antivirus displays false information that the system is infected with files that do not even exist... In the past, cybercriminals employed the same tactic when it hitchhiked on Trend Micro. Some Google searches then showed banner ads that led to a fraudulent Trend Micro website. Though the ads may not appear in all regions, all users are still strongly advised to be extra careful when clicking links in search engines..."

(Screenshots available at the URL above.)

:fear::mad:
 
Tropical Storm leads to FAKEAV

FYI...

Tropical Storm leads to FAKEAV
- http://blog.trendmicro.com/tropical-storm-leads-to-fakeav/
Sep. 29, 2008 - "Cybercriminals leveraged on the tropical storm, Ondoy (International name: Ketsana) that hit the Philippines and killed around 140 people... several malicious sites that appeared each time the users search the strings, “manila flood,” “Ondoy Typhoon,” and “Philippines Flood,” among others. The said sites emerged as one of the top search results. Once the user clicks the URL, they will be redirected to several landing pages where they are asked to download an EXE file, soft_207.exe. Trend Micro detects it as TROJ_FAKEAV.BND. This attack does GeoIP checks, which mean it only targets specific regions or location... Although riding on tragic events is not exactly new, what is notable is it employed once again blackhat SEO to lead users to a FAKEAV..."

(Screenshots available at the URL above.)

:fear::fear:
 
Rogue downloader uses Firefox warning screen lookalike

FYI...

Rogue downloader uses Firefox warning screen lookalike
- http://sunbeltblog.blogspot.com/2009/09/rogue-downloader-uses-firefox-warning.html
September 29, 2009 - "... The rogue Alpha AntiVirus page used to hijack a browser copies the Firefox warning screen... Looks like the Firefox warning page ( in Internet Explorer ), but with a difference... What makes research on these rogues very challenging is the fact that they swap the download web sites about every six hours..."

(Screenshots available at the URL above.)

:mad:
 
Rogue AV growth 2009-H1 585 percent

FYI...

Rogue AV growth 2009-H1 585 percent
- http://www.theregister.co.uk/2009/10/02/crimeware_plague/
2 October 2009 - "The prevalence of scareware packages has reached epidemic proportions, with 485,000 different samples detected in the first half of 2009 alone. The figure is more than five times the combined figure for the whole of 2008, according to statistics from the Anti-Phishing Working Group (APWG). The huge figures are explained by the hacker practice of changing the checksum of every file. The tactic is designed to foil less sophisticated anti-malware defences... More than half (54 per cent) or 11.9 million of the computers scanned by Panda Security, which contributed to APWG's report, were infected with some form of malware. Banking trojan infections detected by the group almost tripled (up 186 per cent) between Q4 2008 and Q2 2009. APWG's report can be found here*."
* http://www.antiphishing.org/reports/apwg_report_h1_2009.pdf

:fear::mad::fear:
 
Scareware SPAM - Conficker.B infection alerts

FYI...

Scareware SPAM - Conficker.B infection alerts
* http://ddanchev.blogspot.com/2009/10/scareware-serving-confickerb-infection.html
October 20, 2009 - "A fake "conficker.b infection alert" spam campaign first observed in April, 2009 (using the following scareware domains antivirus-av-ms-check .com; antivirus-av-ms-checker .com; ms-anti-vir-scan .com; mega-antiviral-ms .com back then) is once again circulating in an attempt to trick users into installing "antispyware application", in this case the Antivirus Pro 2010 scareware. This campaign is directly related to last week's Microsoft Outlook update campaign, with both of these using identical download locations for the scareware..."

(Screenshots and extensive list of domains involved available at the URL above*.)

:fear::mad:
 
Scareware warning from the FBI...

FYI...

Scareware warning from the FBI
- http://www.us-cert.gov/current/#fbi_releases_warning_about_scareware
December 14, 2009 - " The Federal Bureau of Investigation (FBI) has released a warning to alert users about an ongoing threat involving pop-up security messages that appear on the Internet. These pop-up messages may contain seemingly legitimate antivirus software. Users who click on these pop-up messages to purchase and install the bogus software may become infected with malicious code or to become victims of a phishing attack. US-CERT encourages users and administrators to do the following to help mitigate the risks:
• Review the FBI Press Release* titled Pop-Up Security Warnings Pose Threats.
• Install antivirus software, and keep the signature files up to date.
• Use caution when entering personal and financial information online.
• Install software applications from only trusted sources."
* http://www.fbi.gov/pressrel/pressrel09/popup121109.htm

> http://www.ic3.gov/media/2009/091211.aspx
"... The FBI is aware of an estimated loss to victims in excess of $150 million..."

- http://sunbeltblog.blogspot.com/2009/12/biggest-rogue-family-third-generation.html
December 11, 2009 - "A new rogue security product called IGuardPC... is the 50th clone of the WiniGuard family of rogue security products. That makes WiniGuard the largest rogue family ever detected by Sunbelt researchers. The WiniGuard family began in September of 2008. Operators behind it have added variants.. sorted into three generations. The latest generation gets a new clone about every 48 hours to stay ahead of public awareness and anti-malware detections..."
(Screenshots available at the URL above.)

:fear::mad::fear:
 
Rogue AV - Data Doctor 2010 encrypted files

FYI...

Rogue AV - Data Doctor 2010 encrypted files...
- http://sunbeltblog.blogspot.com/2010/01/data-doctor-2010-encrypted-files-we.html
January 06, 2010 - "Our analyst Dimiter Andonov has developed a tool to decrypt files encrypted by Data Doctor 2010 that at least one blog reader found very useful:
http://www.sunbeltsecurity.com/DownLoads.aspx
Update 01/07:
We've just posted a page with detailed directions for using the Data Doctor 2010 file decrypter:
http://www.sunbeltsecurity.com/DownLoads.aspx ..."

- http://www.f-secure.com/weblog/archives/00001850.html
January 8, 2010

:fear::mad:
 
Rogue AV exploits Haiti earthquake

FYI...

Rogue AV exploits Haiti earthquake
- http://isc.sans.org/diary.html?storyid=7987
Last Updated: 2010-01-14 18:45:02 UTC - "Just when you think they couldn't possibly go any lower ... The bad guys behind the Rogue AV scam (see my old diary at http://isc.sans.org/diary.html?storyid=7144 about Rogue AV) are heavily using SEO techniques to make links to their sites appear high on search engines. For example, when using Google to search for "haiti earthquake donation" top 6 hits (!) lead to compromised web sites which in turn check the referrer (they verify if you are coming from a search engine) and, if that is true, redirect you to another web site... At the moment they are redirecting to scan-now24 .com which appears to be taken down. As posted on numerous places yesterday – if you plan on donating be very careful about sites you visit."

- http://www.us-cert.gov/current/#haitian_earthquake_disaster_phishing_attacks
January 14, 2010

- http://www.fbi.gov/pressrel/pressrel10/earthquake011310.htm
January 13, 2010

- http://sunbeltblog.blogspot.com/2010/01/hacked-sites-used-to-redirect-to.html
January 14, 2010 - "We continue to find hacked sites popping up on web searches for Haiti relief donations-related strings. Among other things, we’ve found a rogue security product being pushed. VIPRE detected that one as Rogues.Win32.FakeVimes... sites all -redirect- to scan-now24 .com (registered Dec. 28), which we recommend blocking...""

:fear::mad:
 
Last edited:
Scammers offer "Live Support"...

FYI...

Scammers offer "Live Support"
- http://www.informationweek.com/shared/printableArticle.jhtm?articleID=222900276
Feb. 13, 2010 - "... The Live PC Care "virus scan" screen now includes a yellow online support button that affords those reluctant to part with their money the opportunity to banter with fraud support. "If a potential victim clicks on the online support button they are brought to a live support chat session," said Symantec security researcher Peter Coogan in a blog post*. "The authors of Live PC Care have taken advantage of a legitimate freeware live chat system called LiveZilla. This system allows Live PC Care victims to chat online with so-called 'support agents.'" Based on the interactions between Symantec researchers and the live support people, Coogan says that there really are people answering questions, and not automated scripts. Their goal, he says, is to allay suspicions and encourage the belief that the fake malware detected needs to be repaired. Coogan says that the involvement of live support people shows just how big the business of fake antivirus scams has become. Symantec says that between July 1, 2008 and June 30, 2009, 250 different fake antivirus programs made 43 million installation attempts. The company says that the cost of being victimized can go beyond the $30 to $100 price for useless software to include additional fraud arising from credit card theft."
* http://www.symantec.com/connect/blogs/fake-av-talking-enemy

Trojan.FakeAV
- http://www.symantec.com/security_response/writeup.jsp?docid=2007-101013-3606-99&tabid=2
Updated: October 10, 2007 5:08:11 PM
Type: Trojan
Infection Length: 7,680 bytes
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

:fear::mad::fear:
 
Last edited:
VirusTotal - fake rogue site

FYI...

VirusTotal - fake rogue site
- http://sunbeltblog.blogspot.com/2010/02/not-real-virustotalcom.html
February 26, 2010 - "VirusTotal.com [ http://en.wikipedia.org/wiki/VirusTotal.com ] is a brilliant site that helps both public and researchers alike determine if an executable file they have is potentially malicious or not... somebody decided to cash in on the good name of the site with the following domain:
virus-total(dot)in
...we have some Rogue Antivirus advertising in the house, to the tune of “Your computer is infected by viruses” complete with the now familiar fake image of your drives and folders... Should you download and run the executable file offered up by the site, you’ll end up with the rogue Security Tool on your system... the REAL domain for VirusTotal is http://www.virustotal.com/ . Don’t fall for this scam!"

(Screenshots available at the Sunbeltblog URL above.)

:mad::fear::mad:
 
MS warns: fake Security Essentials

FYI...

MS warns: fake Security Essentials
- http://www.theregister.co.uk/2010/02/26/microsoft_security_essentials_rogue/
26 February 2010 - "Microsoft has warned Windows users to be on their guard against a piece of rogue antivirus software passing itself off as Microsoft Security Essentials. Security essentials 2010 is a piece of software Microsoft said installs a fake virus scanner on your machine and monitors and blocks processes it doesn't like. The software will also block access to websites of antivirus and malware companies and flag up a warning message. You can see the list of blocked sites here*... Adding insult to injury, Security essentials 2010 charges you to scan and remove files on your machine, claiming the version you will have initially downloaded is just a trial edition. Microsoft's Security Essentials is available without charge to PC users running a genuine copy of Windows..."
* http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:Win32/Fakeinit

:fear::mad::fear:
 
You must log in or register to reply here.
Back
Top