SPAM frauds, fakes, and other MALWARE deliveries - archive

US SEC SPAM leads to exploit and stealer

FYI...

US SEC SPAM leads to exploit and stealer
- http://www.gfi.com/blog/us-securities-and-exchange-commission-spam-leads-to-exploit-and-stealer/
March 2, 2012 - "... received an email** in his GMail inbox that purports to originate from the U.S. Securities and Exchange Commission (SEC)... Clicking the link leads users to ftp(dot)psimpresores(dot)com(dot)ar/QH1r1tTd/index(dot)html, which then -redirects- them to trucktumble(dot)com/search(dot)php?page=d44175c6da768b70... This page contains a Blackhole exploit kit that targets the following vulnerabilities:
CVE-2010-0188, an old Adobe Reader and Acrobat vulnerability (patch already available)
CVE-2010-1885, an old Microsoft Windows Help and Support vulnerability (patch already available)
Based on the deobfuscated script, this exploit can also target other vulnerabilities on Java, Adobe Flash, and Windows Media Player. Once vulnerabilities of these software were successfully exploited, users are then led to the website, trucktumble(dot)com/content/ap2(dot)php?f=e0c3a, where the file about.exe can be downloaded... about.exe was found to be a variant of ZBOT, that infamous information stealer, and we detect it as Win32.Malware!Drop. Only 12 AV vendors* detect the variant as of this writing..."
* https://www.virustotal.com/file/bc4...b5a5b1fc6d890f09267db03728ef8d27c4a/analysis/
File name: about.vxe
Detection ratio: 12/43
Analysis date: 2012-03-02 05:19:43 UTC

** http://www.gfi.com/blog/wp-content/uploads/2012/03/email01.png

:fear: :mad:
 
Flashback Mac -malware- using Twitter as C&C center

FYI...

Flashback Mac -malware- using Twitter as C&C center
- http://blog.intego.com/flashback-mac-malware-uses-twitter-as-command-and-control-center/
Mar 5, 2012 - "... Flashback... uses an interesting method of getting commands: it uses Twitter. And rather than use a specific Twitter account, which can be removed, it queries Twitter for tweets containing specific hashtags. These hashtags aren’t as simple as, say, #Flashback or #MacMalwareMaster, but are seemingly random strings of characters that change each day. Intego’s malware research team cracked the 128-bit RC4 encryption used for Flashback’s code and discovered the keys to this system. The hashtags are made up of twelve characters. There are four characters for the day, four characters for the month, and four characters for the year... In addition, in order to ensure that people checking logs don’t spot the malware, it uses a number of different user agents... It’s worth noting that the people behind the Flashback malware most likely to not send commands every day, and certainly delete their tweets, as Intego has found no past tweets in its searches. However, the malware clearly sends these HTTP requests, looking for such tweets..."

:fear::mad:
 
Ransomware attacks...

FYI...

Ransomware attacks...
- http://blog.trendmicro.com/ransomware-attacks-continue-to-spread-across-europe/
Mar 8, 2012 - "Ransomware attacks are growing in popularity these days. French users were a recent target of an attack that impersonated the Gendarmerie nationale. A few months ago, Japanese users were also hit by ransomware in a one-click billing fraud scheme targeted for Android smartphones... the more recent ransomware variants appear to be targeting other European countries. They are disguised as notifications from country-specific law enforcement agencies such as eCops of Belgium and Bundespolizei of Germany... a majority of the top eight countries infected with ransomware are from Europe:
- http://blog.trendmicro.com/wp-content/uploads/2012/03/ransomware_countries.jpg
... While ransomware are also being distributed through affiliate networks like FAKEAVs, these attacks operate using payments outside of traditional credit card payments, specifically via Ukash and Paysafecard vouchers. Ukash and Paysafecard are widely used online payment methods that do not require personal details. Such level of anonymity has naturally earned the attention of cybercriminals and, as we can see, is now being abused for the ransomware business... based on feedback taken from the past 30 days."

- https://www.f-secure.com/weblog/archives/00002325.html
March 9, 2012 - "... reports of Finns being targeted by ransomware which is localized in Finnish language and claims to be from Finnish police..."

Police Themed Ransomware continues
- https://www.f-secure.com/weblog/archives/00002344.html
April 4, 2012 - "Over the last several weeks, we've been monitoring a rash of ransomware campaigns across Europe, in which messages, supposedly from the local police, are displayed demanding that a fine must be paid in order to unlock the computer... easiest way to manually disable it is as follows:
1 – Press Ctrl-O (that's the letter O, not the number zero).
2 – Select "Browse", go to c:\windows\system32 and open cmd.exe.
3 – Type "explorer.exe" into the newly opened window. You should now be able to use the desktop again.
4 – Browse to your Startup folder. The path will vary depending on the language settings and Windows version. The screenshot below shows the path on the English version of Windows XP. You will also have to replace "Administrator" with your user name in the path (unless you're already using the Administrator account, but lets not get started on that…).
> https://www.f-secure.com/weblog/archives/ransomware_startup.png
5 – Delete any entries you don't recognize. The names of the malicious entries may be different than the ones shown in the screenshot. If you are unsure, you can remove all entries, but at the risk of disabling other valid applications from automatically starting.
6 – Reboot the computer.
After this the threat is disabled but malicious files still remain on the computer. Scanning the computer with an antivirus product is highly recommended.
The steps may vary slightly depending on the variant... Microsoft provides information in their description*.
* http://www.microsoft.com/security/p...spx?Name=Trojan:Win32/Reveton.A#recovery_link
Updated to add on April 5th: Our description for Trojan:W32/Reveton includes removal instructions."
** http://www.f-secure.com/v-descs/trojan_w32_reveton.shtml

:mad:
 
Last edited:
Bogus prescription drug trade...

FYI...

Bogus prescription drug trade...
- https://krebsonsecurity.com/2012/03/half-of-all-rogue-pharmacies-at-two-registrars/
Mar 12, 2012 - "Half of all “rogue” online pharmacies - sites that sell prescription drugs without requiring a prescription — got their Web site names from just two domain name registrars... but at least one-third of all active rogue pharmacy sites are registered at Internet.bs, a relatively small registrar that purports to operate out of the Bahamas and aggressively markets itself as an “offshore” registrar. That’s according to LegitScript*, a verification and monitoring service for online pharmacies... Anti-spam and registrar watchdog Knujon (“nojunk” spelled backwards) also released a report (PDF**) on rogue Internet pharmacies today, calling attention to Internet.bs, AB Systems and a host of other registrars with large volumes of pharma sites..."
* http://legitscriptblog.com/2012/03/...ted-cybercrime-bogus-prescription-drug-trade/

** http://krebsonsecurity.com/wp-content/uploads/2012/03/rogue_registrars_2012_DRAFT.pdf

> https://krebsonsecurity.com/wp-content/uploads/2012/03/LSregistrars.png

:fear::mad:
 
Mobile phones - weak link in Online Bank Fraud scheme

FYI...

Mobile phones - weak link in Online Bank Fraud scheme
- https://www.trusteer.com/blog/sim-p...-weak-link-latest-online-banking-fraud-scheme
March 13, 2012 - "... two online banking fraud schemes designed to defeat one time password (OTP) authorization systems used by many banks... in these -new- scams the criminals are stealing the actual mobile device SIM (subscriber identity module) card...
> In the first attack, the Gozi Trojan is used to steal IMEI (international mobile equipment identity) numbers from account holders when they login to their online banking application. The bank is using a OTP system to authorize large transactions. Once they have acquired the IMEI number, the criminals contact the victim’s wireless service provider, report the mobile device as lost or stolen, and request a new SIM card. With this new SIM card, all OTPs intended for the victim’s phone are sent to the fraudster-controlled device...
> The second attack combines online and physical fraud to achieve the same goal. We discovered this scheme in an underground forum. First, the fraudster uses a Man in the Browser (MitB) or phishing attack to obtain the victim’s bank account details, including credentials, name, phone number, etc. Next, the criminal goes to the local police department to report the victim’s mobile phone as lost or stolen. The criminal impersonates the victim using their stolen personal information (e.g., name, address, phone number, etc.). This allows the fraudster to acquire a police report that lists the mobile device as lost or stolen. The criminal then calls the victim to notify them that their mobile phone service will be interrupted for the next 12 hours. In the meantime, the criminal presents the police report at one of the wireless service provider’s retail outlets. The SIM card reported as lost or stolen is -deactivated- by the mobile network operator, and the criminal gets a new SIM card that receives all incoming calls and OTPs sent to the victim’s phone number. This allows the fraudster authorize the fraudulent transactions he/she executes...
Since accounts protected by OTP systems typically have higher transfer limits and are less scrutinized, they are more lucrative. This explains why criminals are willing to go to great lengths to gain access to them. The one common thread in both schemes is that they are made possible by compromising the web browser with a MitB attack to steal the victim’s credentials. By combining stolen personally identifiable information with clever social engineering techniques, criminals using these attacks don’t need to trick users into verifying fraudulent transactions. They are able to bypass out of band authentication mechanisms like SMS-delivered OTPs by authorizing these transactions themselves."

- https://en.wikipedia.org/wiki/Man_in_the_Browser

:fear::mad:
 
Unsolicited support calls - iYogi ...

FYI...

Unsolicited support calls - iYogi ...
- https://krebsonsecurity.com/2012/03/aghast-at-avasts-iyogi-support/
March 14, 2012 - "The makers of Avast antivirus software are warning users about a new scam involving phone calls from people posing as customer service reps for the company and requesting remote access to user systems. Avast is still investigating the incidents, but a number of users are reporting that the incidents followed experiences with iYogi, the company in India that is handling Avast's customer support. A follow-up investigation by KrebsOnSecurity indicates that Avast (among other security companies) is outsourcing its customer support to a third-party firm that appears engineered to do little else but sell expensive and unnecessary support... Unfortunately, Avast is not the only security and antivirus firm that has outsourced its support to this company. iYogi also is the support service for AVG, probably Avast’s closest competitor."

- https://blog.avast.com/2012/03/12/you-call-us-we-wont-unsolicited-call-you/
Mar 12, 2012 - "... we -never- phone our customers (unless they specifically ask us to of course) and none of the partners we work with do either..."

- https://encrypted.google.com/
Unsolicited support calls
... About 7,230,000 results...
___

Avast Antivirus drops iYogi support
- https://krebsonsecurity.com/2012/03/avast-antivirus-drops-iyogi-support/
March 15, 2012

- https://blog.avast.com/2012/03/15/iyogi-support-service-removed/
March 15, 2012 - "... we have removed the iYogi support service from our website and shortly it will be removed from our products... users can receive support via the other support options provided on our website. We will also work to ensure that any users that feel they have been misled into purchasing a premium support receive a full refund..."

:fear::spider:
 
Last edited:
Brute force attacks - WordPress sites

FYI...

Brute force attacks - WordPress sites...
- http://blog.sucuri.net/2012/03/brute-force-attacks-against-wordpress-sites.html
Mar 15, 2012 - "... Lately we have been seeing many WordPress sites being attacked and hacked through the use of brute force. The administrator leaves the default “admin” user name and chooses a simple password, and -never- changes it... There is a technique known as brute-force attack... access is gained to your environment through brute force. Often conducted by bots, these attacks will run through a compiled list of common passwords and their permutations (i.e., password, Pa$$w0rd, p@ssw0rd, etc..)... the attackers know that you substitute ‘A’ for an ‘@’ and ‘S’ for a ‘$’. Using this method the attackers are gaining access to your wp-admin, this then allows them to serve spam via your posts, deface your home page like we recently saw with ServerPro, and inject any one of the other types of malware... in the last few days we detected more than 30 IP addresses trying to guess the admin password on our test WordPress sites (wp-login.php). Each one of those tried from 30 to 300 password combinations at each time. Sometimes they would mix that with a few spam comments as well. Example:
146.0.74.234 – 32 attempts
212.67.25.66 – 47 attempts
176.31.253.139 – 211 attempts
91.226.165.164 – 39 attempts
95.79.221.169 – 105 attempts
91.217.178.235 – 40 attempts
And many more IP addresses. We will adding all of them to our IP blacklist* and Global Malware view**..."
* http://sucuri.net/sucuri-blacklist

** http://sucuri.net/global
___

WordPress Page is Loading... an Exploit
- https://www.f-secure.com/weblog/archives/00002328.html
March 15, 2012 - "... Spam appears to be the driver of these campaigns. Various websites have already been identified to be redirecting to Blackhole exploit kit... Currently, these sites redirect to the following domains that host Blackhole exploit kit:
• georgekinsman.net
• icemed.net
• mynourigen.net
• synergyledlighting.net
• themeparkoupons.net ..."

:mad::spider:
 
Last edited:
Mobile malware - ATLAS briefs...

FYI...

iPhone malware - CrossTalk ...
- http://atlas.arbor.net/briefs/index#1608668149
Tue, 13 Mar 2012 18:54:02 +0000
Those tasked with the defense of smartphones could benefit from this detailed document.
Source: http://secniche.blogspot.com/2012/03/crosstalk-iphone-malware-paradigm.html

Attempts to Spread Mobile Malware in Tweets ...
- http://atlas.arbor.net/briefs/index#-815968668
Tue, 13 Mar 2012 18:54:02 +0000
Yet more attempts to spread mobile malware are being seen, this time Twitter is the spreading platform of choice.
Source: http://www.symantec.com/connect/blogs/attempts-spread-mobile-malware-tweets

Android Malware Stealing Online Banking Credentials
- http://atlas.arbor.net/briefs/index#-1589555277
Friday, March 16, 2012 01:36
... Android malware continues with multi-factor financial credential theft and remote update capabilities.
Analysis: As mobile devices proliferate, cybercrime goes where the money is. While the style of this attack is not new, extra capabilities are being seen and it is likely just a matter of time before very sophisticated malware targeted towards mobile devices becomes a larger problem. Additionally, malware awareness and safe browsing on handhelds may not be as common as on dekstop or notebook systems in enterprises with security policies. If mobile devices are not yet part of the organizational security policy, such threats may quicken this change.
Source: https://threatpost.com/en_us/blogs/android-malware-stealing-online-banking-credentials-031512

:fear::fear:
 
Last edited:
Fake Linkedin e-mails lead To Cridex

FYI...

Fake Linkedin e-mails lead To Cridex
- http://www.gfi.com/blog/fake-linkedin-mails-lead-to-cridex/
March 16, 2012 - "... there are fake Linkedin invitation reminders in circulation sending users to a BlackHole exploit which attempts to drop Cridex* onto the PC. Cridex is a rather nasty piece of work that does everything from target banks and social networking accounts to a little bit of CAPTCHA cracking... This particular run shares the IP address 41(dot)64(dot)21(dot)71 with various BBB and Intuit spam runs from recent weeks. If in doubt, go directly to Linkedin and check your invites from there."
* http://community.websense.com/blogs...-shows-captcha-is-still-a-security-issue.aspx

> http://www.gfi.com/blog/wp-content/uploads/2012/03/LinkedIn_exploit.png

- http://labs.m86security.com/2012/03/the-cridex-trojan-targets-137-financial-organizations-in-one-go/
March 1, 2012

:sad::mad:
 
Last edited:
2012 Data Breach Investigations Report - Verizon

FYI...

2012 Data Breach Investigations Report - Verizon
- http://www.wired.com/threatlevel/2012/03/hacktivists-beat-cybercriminals/
March 22, 2012 - "... The report combines data from 855 incidents that involved more than 174 million compromised records, an explosion of data loss compared to last year’s 4 million records stolen. The increase is due largely to the massive breaches perpetrated by activists... Most breaches Verizon tracked were opportunistic intrusions rather than targeted ones, occurring simply because the victim had an easily exploitable weakness rather than because they were specifically chosen by the attacker. And, as with previous years, most breaches — 96 percent — were not difficult to accomplish, suggesting they would have been avoidable if companies had implemented basic security measures. Verizon noticed a difference between how large and small organizations are breached. Smaller organizations tend to be breached through active hacking, involving vulnerabilities in websites and other systems and brute force attacks. Larger companies are more often breached through social engineering and phishing attacks — sending e-mail to employees to trick them into clicking on malicious attachments and links so that the intruders can install malware that steals employee credentials. Verizon surmises that this is because larger organizations tend to have better perimeter protections, forcing intruders to use human vulnerabilities to breach these networks instead."
Charted: http://www.wired.com/images_blogs/threatlevel/2012/03/Chart_Verizon-Data-Breach-Report-2012.jpg

PDF: http://www.wired.com/images_blogs/threatlevel/2012/03/Verizon-Data-Breach-Report-2012.pdf

:fear::fear:
 
SPAM - IRS themed e-mails w/malicious attachment

FYI...

SPAM - IRS themed e-mails w/malicious attachment
- http://blog.webroot.com/2012/03/22/...ils-serving-client-side-exploits-and-malware/
March 22, 2012 - "Cybercriminals are currently spamvertising with IRS themed emails, enticing end -and- corporate users into downloading and viewing a malicious .htm attachment.
> https://webrootblog.files.wordpress.com/2012/03/irs_exploits_malware.png
More details: Spamvertised subject: Your tax return appeal is declined...
Malicious attachment: IRS_H11832502.htm *
Malicious iFrame URL found in the attachment...
Upon downloading and viewing the malicious attachment, an iFrame tag attempts to load, ultimately serving client-side exploits such as the Libtiff integer overflow in Adobe Reader and Acrobat (CVE-2010-0188), and Trusted method chaining remote code execution (CVE-2010-0840)... the malicious iFrame is hosted within a fast-flux botnet, and is therefore currently responding to multiple IPs, in an attempt by cybercriminals to make it harder for security researchers to take it down. End users are advised to ensure that they’re not running outdated versions of their third-party software and browser plugins, as well as to avoid interacting with the malicious emails..."
* https://www.virustotal.com/file/d85...3765f218a874d374efc0564cfa628d4f65e/analysis/
File name: IRS_U774510.htm0
Detection ratio: 13/43
Analysis date: 2012-03-23 09:17:40 UTC

:mad:
 
1x1 pixel drive-by-malware...

FYI...

1x1 pixel drive-by-malware...
evilcode.class
- https://isc.sans.edu/diary.html?storyid=12838
Last Updated: 2012-03-25 17:04:16 UTC - "Exploit authors sometimes like to be cute... A Java archive called "fun.jar" containing an "evilcode.class" file that runs as an applet of 1x1 pixels size ... well, this can't be anything good. And it indeed isn't. This code snippet was lurking on quite a few web sites over the past days. Sending fun.jar to Virustotal shows* that only 10 of 43 anti-virus tools actually recognize the exploit code, whereas 27/43 recognize the d.exe malware file** that the exploit currently downloads and runs. Evilcode.class exploits the Java Rhino Engine vulnerability (CVE-2011-3544), published back in October 2011 and affecting -all- Java Runtime Engines up to JRE 1.6_27. The exploit still seems to work well enough for the bad guys that they don't see any need to re-tool to newer exploits. In slight modification of Oracle's own words: 'We highly recommend users remove all older versions of Java from your system. Keeping old and unsupported versions of Java on your system presents a serious security risk...' ..."
* Latest: https://www.virustotal.com/file/a42...292d52d22fd51d954d26157ceea330a2a38/analysis/
File name: kr.jar
Detection ratio: 11/43
Analysis date: 2012-03-26 12:09:54 UTC
** Latest: https://www.virustotal.com/file/b7e...3ddac647f68ccb5f6963173db11fa0a0cf6/analysis/
File name: 60685cf9afc3e4f95097aa219ecb6da0
Detection ratio: 28/40
Analysis date: 2012-03-27 16:01:57 UTC

- http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3544 - 10.0 (HIGH)

Critical Java hole being exploited on a large scale ...
- http://atlas.arbor.net/briefs/index#-1937641784
Severity: High Severity
Published: Wednesday, March 28, 2012 19:20
Java security vulnerability patched in February is now being used widely by criminals to install malware.
Analysis: Patch! Watch for outdated Java on the network as the presence of old Java User-Agents is often a sign that a system has been exploited and Java is now doing the attackers bidding, typically downloading something evil.
Source: http://h-online.com/-1485681
Update 29-03-12: "... Until an update is released that addresses the vulnerability, Mac OS X users can turn off Java. Users can disable Java via Java Preferences (Applications > Utilities > Java Preferences) by unchecking the installed version. Alternatively, users can disable Java in each of their browsers; in Apple's Safari browser, this can be done by unchecking the "Enable Java" and "Enable JavaScript" under the Security tab in Safari's Preferences..."
* http://www.h-online.com/open/news/i...ge-scale-Update-1485681.html?view=zoom;zoom=2

:mad:
 
Last edited:
MacOS X targeted w/MS Office exploit in the wild...

FYI...

MacOS X targeted w/MS Office exploit in the wild...
- http://labs.alienvault.com/labs/ind...-x-seen-in-the-wild-delivers-mac-control-rat/
March 27, 2012 - "... The doc files seem to exploit MS09-027 and target Microsoft Office for Mac. This is one of the few times that we have seen a malicious Office file used to deliver malware on Mac OS X... An attacker who successfully exploits this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
> When the victim opens the malicious Word file using Office for Mac, the shellcode writes the malicious payload on disk and executes it, and then opens a benign office file... The C&C server this time is:
- 2012 .slyip .net: 173.255.160.234
173.255.160.128 – 173.255.160.255
Black Oak Computers Inc – New York – 75 Broad Street...
> The second trojan found is a new one never seen. We have found several versions compiled for different architectures (ppc, i386..). We have also found a version that has paths to debugging symbols... The C&C domain resolves to:
- freetibet2012 .xicp .net: 114.249.207.194
114.240.0.0 – 114.255.255.255
China Unicom Beijing province network...
All the samples we have found have 0/0 rate antivirus detection, it includes the malicious doc files..."
___

- http://www.intego.com/mac-security-...ed-word-documents-installs-backdoors-on-macs/
March 29, 2012 - "... These Word documents exploit a Word vulnerability that was corrected in June, 2009, but also take advantage of the fact that many users don’t update such software. Word 2004 and 2008 are vulnerable, but the latest version, Word 2011 is not. Also, this vulnerability only works with .doc files, and not the newer .docx format..."

:mad:
 
Last edited:
Blackhole exploits...

FYI...

Blackhole exploits ...
- https://www.f-secure.com/weblog/archives/00002342.html
April 2, 2012 - "... an exploit for CVE-2011-0559*, which is one of the two Flash exploits being used by Blackhole currently. Compared to other exploits, this one has been used by Blackhole for quite some time and yet the coverage using different security products is very low**.
** https://www.f-secure.com/weblog/archives/vt_scan.png
With very -low- antivirus coverage, -no- Metasploit module, and PoCs being extremely difficult to find, this increases the chances of exploitation. Blackhole targets to exploit Adobe Flash 10.0 and earlier versions, 10.1, and 10.0.x (where x is later than 40). The vulnerability has been patched since March 2011. Detection has been added to F-Secure Anti-Virus as Exploit:W32/CVE-2011-0559.A..."
* http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0559 - 9.3 (HIGH)
Last revised: 01/27/2012

- http://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit-19/
March 29, 2012 - "... over the past 12-18 months we have seen Blackhole become the most prevalent and notorious of the exploit kits used to infect people with malware..."

:mad:
 
Android bot attacks rooted smartphones

FYI...

Android bot attacks rooted smartphones
- http://h-online.com/-1499244
3 April 2012 - "Antivirus company NQ Mobile has discovered a variant of the DroidKungFu Android malware called DKFBootKit* that targets users who have rooted their smartphones. The malware piggybacks on apps that would otherwise ask for root privileges anyway – and, once the user has agreed, sets up camp deep in the smartphone's boot sequence and replaces commands such as ifconfig and mount to help ensure it is started early in the boot sequence..."
* http://research.nq.com/?p=391
"... DKFBootKit makes use of the granted root privilege for other malicious purposes, namely comprising the system integrity... the malware itself contains a bot payload that phones home to several remote C&C servers and waits for further commands...
1) Only download applications from trusted sources...
2) Never accept application requests from unknown sources...
3) Be alert for unusual behavior on the part of mobile phones and be sure to download a trusted security application that can scan the applications being downloaded onto your mobile device..."
(More detail at the URLs above.)

- http://www.darkreading.com/taxonomy/index/printarticle/id/232800310
Apr 04, 2012
___

android malware
- https://encrypted.google.com/
... About 29,400,000 results

:mad:
 
Last edited:
Credit Card fraud/malware attacks Facebook users

FYI...

Credit Card fraud/malware attacks Facebook users
- https://www.trusteer.com/blog/faceb...re-injects-fake-page-commit-credit-card-fraud
April 03, 2012 - "... new configuration of the Ice IX malware that attacks Facebook users after they have logged in to their account and steals credit card and other personal information... discovered a “marketing” video used by the creators of the malware to demonstrate how the web injection works. The global reach and scale of the Facebook service has made it a favorite target of fraudsters... This latest attack uses a web injection to present a fake web page in the victim’s browser. The form requests the user provide their cardholder name, credit/debit card number, expiry date, CID and billing address. The attackers claim the information is needed to verify the victim’s identity and provide additional security for their Facebook account... This pop up* presents virtually the same message used in the Ice IX configuration our researchers discovered and analyzed. The only difference is the version in the video requests a social security number and date of birth, in addition to the information mentioned earlier... We contacted Facebook to advise them that they would be mentioned in this blog. Facebook requested that we pass on some information about their site’s security measures. Here’s a summary of their response:
i) Facebook actively detects known malware on users' devices to provide Facebook users with a self-remediation procedure including the Scan-And-Repair malware scan. To self-enroll in this check point please visit – on.fb.me/AVCheckpoint
ii) Please advise your readers to report to Facebook any spam they find on the Facebook site, and remember Facebook will never ask for your credit card, social security, or any other sensitive information other than your username and password while logging in."
* http://www.trusteer.com/sites/default/files/Faceb.png
___

- http://google.com/safebrowsing/diagnostic?site=facebook.com/
"... Part of this site was listed for suspicious activity 336 time(s) over the past 90 days... Of the 113053 pages we tested on the site over the past 90 days, 186 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-04-03, and the last time suspicious content was found on this site was on 2012-04-03. Malicious software includes 63 trojan(s), 62 exploit(s), 60 scripting exploit(s). Successful infection resulted in an average of 7 new process(es) on the target machine... Malicious software is hosted on 138 domain(s)... 28 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site... Over the past 90 days, facebook.com appeared to function as an intermediary for the infection of 56 site(s)... It infected 8 domain(s)..."

:sad: :mad:
 
Last edited:
Olympic SPAM arrives...

FYI...

Olympic SPAM arrives...
- http://blog.trendmicro.com/cybercriminals-race-to-the-2012-olympics/
Apr 5, 2012 - "... Users dreaming of watching the closing ceremonies of the London 2012 Olympics live may find the said offer hard to resist as Visa Golden Space is supposedly inviting users to join a lottery for a chance to win a travel package for the said event. Note that the said offer is non-existent. We also spotted a malware that arrives as a file named Early Check-In 2012 London Olympics.doc. This file, detected as TROJ_ARTIEF.XPL, exploits the RTF Stack Buffer Overflow Vulnerability found in several versions of Microsoft Office components. If it’s successful, it drops several other -malware- on your system, which Trend Micro detects as TROJ_DROPHIN.A and TROJ_PHINDOLP.A. This is not the first scam that uses this event to get users clicking. As early as 2008, Trend Micro has spotted a spammed message purporting to be a lottery drawn by the London 2012 Olympics committee. In May 2011, we also reported on a -spam- campaign that used London 2012 Olympics as bait. In addition, our social engineering e-guide mentions seasons and events as jump off points used by crooks. Online deals that look like they’re too good to be true, suspicious email messages promoting great but non-existent offers are also some of the tools used to lure users. All these tactics may lead to you inadvertently giving out your personal information, or for malware to be downloaded on your computer. Your personal information is not worth the risk of a chance to win a non-existent chance to win a lottery. Before clicking on that email link, investigate."
___

Fake AT&T wireless bill links to malware
- http://blog.commtouch.com/cafe/web-security/your-att-wireless-bill-may-link-to-malware/
Apr 5, 2012 - "Large outbreaks of phony AT&T wireless emails* have been distributed in the last 2 days. The emails describe very large balances ($943 in example), that are sure to get aggravated customers clicking on the included links... Every link in the email leads to a different compromised site that has malware hidden inside. In the example below** this means -9- (!) different URLS – most emails with links to email limit themselves to one or two links.
** http://blog.commtouch.com/cafe/wp-c...s-email-links-to-malware-compromised-site.jpg
The index.html file tries to exploit at least the following known vulnerabilities:
Libtiff integer overflow in Adobe Reader and Acrobat – CVE-2010-0188
Help Center URL Validation Vulnerability – CVE-2010-1885
Recipients who are unsure whether the email they have received is genuine or not (the malicious version is a very accurate copy) should mouse-over the links. Genuine emails from AT&T will include AT&T website links. For example the “att.com” link will be the same in both places that it appears in the email – unlike the malicious version which uses 2 very different URLs. The fully functional homepage of one of the compromised sites is shown below. For more information about compromised websites see Commtouch’s report*** compiled in association with StopBadware."
* http://blog.commtouch.com/cafe/wp-content/uploads/ATT-wireless-email-links-to-malware.jpg

*** http://www.commtouch.com/compromised-websites-report-2012
___

Verizon-themed SPAM emails lead to ZeuS
- http://blog.webroot.com/2012/03/29/...-now-available-emails-lead-to-zeus-crimeware/
March 29, 2012

:mad:
 
Last edited:
Fake HP scan SPAM email leads to malware

FYI...

Fake HP scan SPAM email leads to malware
- http://blog.dynamoo.com/2012/04/scan-from-hewlett-packard-scanjet-spam.html
6 April 2012 - "Another fake HP scan spam email leading to malware. This one follows the new technique of putting a malicious HTML (HP_Scan.htm) file inside a ZIP file to reduce the risk of it being blocked, and then it has multiple payload sites to try to get a higher infection rate. Nasty.
'Date: Fri, 6 Apr 2012 08:29:34 +0200
From: "Hewlett-Packard Officejet 70419A" [JaysonGritten@ estout .com]
Subject: Scan from a Hewlett-Packard ScanJet #02437326
Attachments: HP_Document-12-Z1380.zip
Attached document was scanned and sent
to you using a Hewlett-Packard HP Officejet 45211A.'
The payload can be found at:
hxxp :// 211.44.250.173 :8080/navigator/jueoaritjuir.php
hxxp :// 62.85.27.129 :8080/navigator/jueoaritjuir.php
hxxp :// 219.94.194.138 :8080/navigator/jueoaritjuir.php
hxxp :// 78.83.233.242 :8080/navigator/jueoaritjuir.php
... Anti-virus detection* is pretty poor at the moment...."
* https://www.virustotal.com/file/fa2...53f0fb5b8e22d4a61f08d559234b872fb09/analysis/
File name: HP_Scan.htm
Detection ratio: 10/42
Analysis date: 2012-04-06 10:24:37 UTC
___

- http://blog.webroot.com/2012/03/31/...ils-lead-to-client-side-exploits-and-malware/
March 31, 2012
> https://webrootblog.files.wordpress.com/2012/03/scan_hewlett_packard_exploits_malware_01.png
* https://www.virustotal.com/file/816...c33c3646e4e6bfe3bf60e5336cb919365f0/analysis/
File name: Invoice_NO_Mailen.htm
Detection ratio: 21/42
Analysis date: 2012-04-02 05:40:03 UTC

:mad:
 
Last edited:
EU tax invoice trojan ...

FYI...

EU tax invoice trojan...
- http://blog.mxlab.eu/2012/04/08/tax-invoice-of-the-european-comissions-office-contains-trojan/
April 8, 2012 - "... started to intercept a new trojan distribution campaign by email with the subject “invioce” and is sent from the spoofed address “European Commissions’s Office<info@infoeu.eu>” and has the following body:

Please open the attached file for your income tax invoice.From the European
Commission’s office .This message is for all the European Union citizens.
Note: European Union citizens Tax invoices are provided Once a year.
please refer to your tax Confirmation email. Attachment: Tax Invoice.
For Better Understanding.
Regards
Mr Jeff Black

The attached file is named invoice.exe and is approx. 170 kB large. The trojan is known as a variant of Win32/Injector.PWG (NOD32), W32/Obfuscated.D!genr (Norman), Trojan.Win32.Generic.pak!cobra ( VIPRE). At the time of writing, only 6 of the 42 AV engines did detect the trojan at Virus Total*..."
* https://www.virustotal.com/file/327...859cb1b51c71211f2f0ba1b4/analysis/1333886755/
File name: invoice.exe
Detection ratio: 9/41
Analysis date: 2012-04-08 12:05:55 UTC

:mad:
 
Dutch phishing emails target domains in Belgium/Netherlands

FYI...

Dutch phishing emails target domains in Belgium/Netherlands
- http://blog.mxlab.eu/2012/04/10/dut...eting-domains-in-belgium-and-the-netherlands/
April 10, 2012 - "... increase of phishing emails, compared to the previous days, weeks and month, in the Dutch language that is sent to domains .be and .nl in Belgium and the Netherlands. The phishing emails are sent on behalf of ABN Amro and ING.
Here are some subjects for ING phishing emails:
- Mijn ING Breidt
- Belangerijk Mijn ING Nieuws
- Je hebt 1 ongelezen beveiligd Alert.
Here are some subjects for the ABN AMRO Bank:
- Beveiliging Message Alert van ABN AMRO Bank
- 2012 ABN AMRO VERIFICATIE ..."
(Examples of complete phish text at the URL above.)

:mad:
 
You must log in or register to reply here.
Back
Top