SPAM frauds, fakes, and other MALWARE deliveries - archive

Android "GoldDream" malware server still alive

FYI...

Android "GoldDream" malware server still alive
- http://community.websense.com/blogs...lware-quot-golddream-quot-is-still-alive.aspx
12 Apr 2012 - "Many anti-virus vendors have reported on and dissected the suspicious and malicious Android "GoldDream" malware threat. The C&C server (lebar .gicp. net)... hosts this -malware-... this C&C server is still alive after several months and is still serving users with "GoldDream" malware... Websense... has blocked the malware server sites, out of the 19 vendors listed by VirusTotal*... The malware site mainly targets users in China, masquerading as a normal Android apps distribution site. The site makes use of a fake certificate and registration... information to lure more customers, and is placed at the bottom of the listed app sites in a bid to advertise itself as a good reputation site... We have analyzed all the available free Android apps on the site (23 in total). 18 of these apps contain "GoldDream" malware. These are normal game apps which are re-packaged to include malicious code... We strongly suggest that users refrain from downloading and installing apps from untrusted 3rd party sources..."
* https://www.virustotal.com/url/d4ea...c13ad697649f57c181412b8a3f507dacb51/analysis/
Normalized URL: http ://lebar .gicp .net/
Detection ratio: 1/25
Analysis date: 2012-04-12 09:32:49 UTC
___

- http://google.com/safebrowsing/diagnostic?site=gicp.net/
"... 222 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-04-12, and the last time suspicious content was found on this site was on 2012-04-12. Malicious software includes 206 scripting exploit(s), 121 exploit(s), 30 trojan(s). Successful infection resulted in an average of 2 new process(es) on the target machine. Malicious software is hosted on 90 domain(s)... 92 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site... This site was hosted on 15 network(s) including AS32475 (SINGLEHOP), AS4134 (China Telecom backbone), AS4837 (CNC)... Over the past 90 days, gicp.net appeared to function as an intermediary for the infection of 13 site(s)... It infected 9 domain(s)..."

- http://centralops.net/co/DomainDossier.aspx
... canonical name - gicp .net
aliases
addresses 74.82.185.218

Recommended add to BLACKLIST

:mad:
 
Last edited:
Ransomware - multiple types/discoveries

FYI...

Ransomware - multiple types/discoveries

1) http://blog.trendmicro.com/ransomware-takes-mbr-hostage/
Apr 12, 2012 - "We have encountered a ransomware unlike other variants that we have seen previously. A typical ransomware encrypts files or restricts user access to the infected system. However, we found that this particular variant infects the Master Boot Record (MBR), preventing the operating system from loading. Based on our analysis, this malware copies the original MBR and overwrites it with its own malicious code. Right after performing this routine, it automatically restarts the system for the infection take effect..."
(More detail at trendmicro URL above.)

2) https://www.f-secure.com/weblog/archives/00002347.html
April 12, 2012 - "We are receiving reports of a ransom trojan, it's been circulating during the last two days. When first run on the system, the ransomware will iterate all folders on the system. Every document, image, and shortcut (.lnk) file found will be encrypted and appended with an extension of .EnCiPhErEd. In each folder it will drop a text file called "HOW TO DECRYPT.TXT" which contains instructions on how to proceed. The bandit is demanding 50€. It drops a copy of itself in the system's temp folder with a random name. It creates registry entries to associate the .EnCiPhErEd extension with itself, so that the temp folder copy will be launched whenever those files are run, in order to demand the decryption password. After five attempts it will no longer accept passwords. And it then deletes itself, leaving your data encrypted. Our threat hunters think that the source of this ransomware may be from inserted malicious tags in sites, particularly in forums..."
(More detail at f-secure URL above.)

:mad:
 
Android malware poses as Angry Birds

FYI...

Android malware poses as Angry Birds...
- http://nakedsecurity.sophos.com/2012/04/12/android-malware-angry-birds-space-game/
April 12, 2012 - "Android malware authors have seized an opportunity to infect unsuspecting smartphone users with the launch of the latest addition to the immensely popular "Angry Birds" series of games. SophosLabs recently encountered malware-infected editions of the "Angry Birds Space" game which have been placed in -unofficial- Android app stores. Please note: The version of "Angry Birds Space" in the official Android market (recently renamed "Google Play") is *not* affected... With the malware in place, cybercriminals can now send compromised Android devices instructions to download further code or push URLs to be displayed in the smartphone's browser. Effectively, your Android phone is now part of a botnet, under the control of malicious hackers..."

:fear::mad:
 
Fake Verizon emails follow fake AT&T emails...

FYI...

Fake Verizon emails follow fake AT&T emails ...
- http://blog.commtouch.com/cafe/web-...ess-emails-follow-att-wireless-emails-attack/
April 16, 2012 - "Less than 2 weeks ago we reported* the use of perfectly formatted AT&T Wireless emails that included multiple links to malware infested sites. These have now been followed up with similar emails – but the “carrier” has switched to Verizon Wireless...
> http://blog.commtouch.com/cafe/wp-content/uploads/Verizon-wireless-link-to-malware-source-email.jpg
... The Verizon emails also lead to sites hosting malware – although there are far fewer links in the email – and the same compromised site is used repeatedly in each email (in the AT&T attack, up to 9 different sites were used). The same gang appears to be behind both attacks since the link structure is identical:
<compromised domain>/<8 random numbers and letters>/index.html.
The same vulnerabilities are once again exploited via the scripts on the sites. The fully functional homepage of the compromised site is shown below."
> http://blog.commtouch.com/cafe/wp-c...-wireless-link-to-malware-legitimate-site.jpg

* http://blog.commtouch.com/cafe/web-security/your-att-wireless-bill-may-link-to-malware/

:mad:
 
Trojan pilfers Hotel credit cards...

FYI...

Trojan pilfers Hotel credit cards...
- https://www.trusteer.com/blog/no-reservations-–-remote-access-trojan-pilfers-credit-cards-hotels
April 18, 2012 - "Our intelligence center researchers recently uncovered a fraud “package” being sold in underground forums that uses a remote access Trojan to steal credit card information from a hotel point of sale (PoS) application. This scheme, which is focused on the hospitality industry, illustrates how criminals are planting malware on enterprise machines to collect financial information instead of targeting end users devices. In this particular scenario, a remote access Trojan program is used to infect hotel front desk computers. It then installs spyware that is able to steal credit card and other customer information by capturing screenshots from the PoS application. According the seller, the Trojan is guaranteed not to be detected by anti-virus programs... This fraud package is being offered for $280. The purchase price includes instructions on how to set-up the Trojan. The sellers even offer advice on how to use telephone social engineering techniques via VoIP software to trick front desk managers into installing the Trojan... criminals are increasingly expanding the focus of their attacks from online banking targets to enterprises..."

:mad:
 
Last edited:
Fake LinkedIn reminders connect with malware ...

FYI...

Fake LinkedIn reminders connect with malware...
- http://blog.commtouch.com/cafe/emai...-reminders-help-users-connect-with-malware-2/
April 19th, 2012 - "Phony LinkedIn invitations are not a new phenomenon. What tends to change is the underlying delivery method used for the malware distribution – In this case compromised websites that unknowingly host malicious scripts. The LinkedIn reminders that are included in the attack include several variables such as names, relationships, and the number of messages awaiting response. As usual the giveaway that something strange is occurring is the link...
> http://blog.commtouch.com/cafe/wp-content/uploads/LinkedIn-malware-email-2.jpg
Recipients that click on the link reach a rather bland looking “notification” page that provides no further links or instructions...
> http://blog.commtouch.com/cafe/wp-content/uploads/LinkedIn-malware-website-fake-message-2.jpg
... In the background, several scripts seek out software with vulnerabilities that can be exploited including:
> Adobe reader and Acrobat:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0188 - 9.3 (HIGH)
> Microsoft Windows Help and Support Center in Windows XP:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-1885 - 9.3 (HIGH) ..."

:mad::spider:
 
Fake Skype encryption software cloaks DarkComet Trojan

FYI...

Fake Skype encryption software cloaks DarkComet Trojan
- http://blog.trendmicro.com/fake-skype-encryption-software-cloaks-darkcomet-trojan/
Apr 20, 2012 - "... We discovered a webpage that advertises a software that purports to provide encryption for Skype. This page is hosted in Syria... the same server that acted as a command-and-control (C&C) server for previous attacks. The webpage features an embedded YouTube video that claims to be from “IT Security Lab” and to encrypt voice communications... The downloaded file skype.exe, detected as BKDR_ZAPCHAST.HVN, is actually DarkComet version 3.3.... We were able to redirect the traffic in our test environment to confirm that it is indeed DarkComet... Note that Skype uses AES encryption on calls and instant messages, as well as its video conversations..."

:mad:
 
Bogus Olympics email w/malware

FYI...

Bogus Olympics email w/malware
- http://blog.trendmicro.com/bogus-olympics-2012-email-warning-blindside-users-with-malware/
Apr 22, 2012 - "... recently, we found an Olympics scam in the form of a lottery that promises a free travel package to the event. Some online crooks, however, played it differently this time. Instead of the typical Olympic-related scams wherein users supposedly won tickets to the event, this scam arrives as spam disguised as an email advisory... this scam comes in the form of email messages that warn recipients of fake websites and organizations selling tickets to the London Olympics 2012. The mail contains the official logo of the event to possibly deceive users of its legitimacy. Included in the message is an attached .DOC file that lists these bogus ticket sellers. The attachment, however, is actually a malicious file detected by Trend Micro as TROJ_ARTIEF.ZIGS. The malware takes advantage of the RTF Stack Buffer Overflow Vulnerability (CVE-2010-3333) to drop the backdoor BKDR_CYSXL.A. This backdoor may perform several malicious routines that include deleting and creating files and shutting down the infected system... As London Olympics 2012 draws near, we are expecting this type of threats to proliferate. Thus, users should make it a habit to check the legitimacy of -any- message before downloading the attachment or clicking links included in it..."

:mad:
 
Facebook emails with malware attachments

FYI...

Facebook emails with malware attachments...
- http://blog.commtouch.com/cafe/emai...t-three-facebook-friends-sent-it-to-me-today/
April 23rd, 2012 - "A series of emails with malware attachments have been widely distributed in the last few days. The emails alert the recipient about a picture of themselves (or an ex-girlfriend) that has been circulated online. The text from three of the messages is shown below:
> Sorry to disturb you , – I have a question- have you seen this picture of yours in attachment?? Three facebook friends sent it to me today… why did you put it online? wouldn’t it harm your job? what if parents see it? you must be way cooler than I thought about you man
> Hi there ,But I really need to ask you – is it you at this picture in attachment? I can’t tell you where I got this picture it doesn’t actually matter…The question is is it really you???.
> Sorry to disturb you , – I got to show you this picture in attachment. I can’t tell who gave it to me sorry but this chick looks a lot like your ex-gf. But who’s that dude??.
... The “image” is attached to the emails for convenience and the filename in all samples was identical: “IMG0962.zip”. The unzipped file displays a PDF icon – which may confuse recipients whose computers do not display file extensions (the extension in this case is .exe)... detected attached malware within seconds of the start of the outbreak... the scale of the attack on Saturday – from 4am (Pacific Time) till 3am on Sunday morning... At its peak the attack averaged around 100,000 messages per second..."

:mad:
 
Last edited:
Phishing and malware meet Check Fraud

FYI...

Phishing and malware meet Check Fraud
- https://www.trusteer.com/blog/catch-me-if-you-can-2012-phishing-and-malware-meet-check-fraud
April 24, 2012 - "... a SCAM in an underground forum that shows how data obtained through phishing and malware attacks can be used to make one of the oldest forms of fraud – check forging... The scam involves a criminal selling pre-printed checks linked to corporate bank accounts in the USA, UK and China. The criminal is selling falsified bank checks made with specialized printing equipment, ink and paper. For $5 each, he/she will supply checks that use stolen credentials (e.g. bank account) provided by the buyer. However, to purchase checks that use stolen credentials supplied by the counterfeiter the cost is $50 – a tenfold increase. This is a clear indicator that stolen credentials are a key enabler of check fraud. Check data fields include personal information (e.g. name, address and phone) and financial information (e.g. bank account, routing code and check number). To obtain all the required data fraudsters typically need to get their hands on a physical or scanned version of a real check in circulation. Many banking web sites provide access to scanned versions of paid and received checks. Online banking login credentials obtained through malware and phishing attacks can easily be used by fraudsters to access a victim’s account and collect all the required information to commit check fraud. In addition, before using the checks, fraudsters could potentially ensure account balance is sufficient to approve the transaction... Buyers are also encouraged to carry fake identification cards that match the stolen credentials on the check. The check counterfeiter offers to provide these as well. This is the latest example of the how criminals can use malware and phishing techniques to make traditional physical fraud schemes more effective..."

:mad: :sad:
 
SPAM Scams spoof Social Networking sites - peddle Malicious sites...

FYI...

SPAM Scams spoof Social Networking sites - peddle Malicious sites
- http://blog.trendmicro.com/email-scams-spoofing-social-networking-sites-peddle-malicious-sites/
Appr 25, 2012 - "... email messages disguised as notifications from popular networking sites, in particular LinkedIn, foursquare, MySpace, and Pinterest. These spam contain links that direct users to -bogus- pharmaceutical or -fraud- sites. They also use legitimate-looking email addresses to appear credible to recipients. Using famous brands like these sites are effective in luring users to the scheme as this gives credence to an otherwise obvious scam... We uncovered spammed messages masked as notifications from Foursquare, a popular location-based social networking site... The first sample we found pretends to be an email alert, stating that someone has left a message for the recipient. The second message is in the guise of a friend confirmation notification... Both messages use the address noreply @foursquare .com in the ‘From’ field and bear a legitimate-looking MessageID. Similar to previous spam campaign using popular social networking sites, attackers here also disguised the -malicious- URLs... also spotted sample messages that are purportedly from LinkedIn and Myspace... we have identified that the senders’ info were forged. We also did not find any pertinent details that could identify these messages as legitimate LinkedIn and MySpace email notifications. These mails also used cloaked URLs that redirect to the fake site 'Wiki Pharmacy'... we found fake Pinterest email notifications that contain a URL, a purported online article on weight-loss. Users who click this link are instead lead to sites that were previously found to engage in fraud activities... Users are advised to always be cautious of dubious-looking messages and avoid clicking links or downloading the attachment included in these."

:mad: :mad:
 
Blackhole obfuscated JavaScript...

FYI...

Blackhole obfuscated JavaScript
- https://isc.sans.edu/diary.html?storyid=13051
Last Updated: 2012-04-25 11:44:21 UTC - "... Most of the current obfuscation methods make heavy use of objects and functions that are only present in the web browser or Adobe reader. Since it is unlikely that a JavaScript analysis engine on, for example, a web proxy anti-virus solution can duplicate the entire object model of Internet Explorer, the bad guys are hoping that automated analysis will fail, and their JavaScript -will- make it past the virus defenses to the user's browser, where it will run just fine. Often, this actually works. The current wave of Blackhole (Blacole) exploit kits are a good example - it took Anti-Virus a looong time to catch on to these infected web sites. Even today, the raw malicious JavaScript block full of exploit attempts comes back with only 14/41 on Virustotal*..."
* https://www.virustotal.com/file/e1a...094bef2bb69762511eeeed9e/analysis/1335349187/
File name: b.js
Detection ratio: 14/41
Analysis date: 2012-04-25 10:19:47 UTC

:mad: :mad:
 
Yahoo phishing via compromised WordPress sites

FYI...

Yahoo phishing via compromised WordPress sites
- http://blog.commtouch.com/cafe/emai...hing-hides-in-compromised-wordpress-websites/
April 25, 2012 - "Yahoo users have been targeted in a phishing attack that starts with an “avoid account deactivation” email. Mousing over the link shows the non-Yahoo link – an easy way to know that something is amiss*...
* http://blog.commtouch.com/cafe/wp-content/uploads/Yahoo-phishing-email.jpg
... The phishing pages are very authentic looking. Once users have entered their login details (which are collected by the phisher), they are redirected to Yahoo Mail. A large number of compromised sites have been used to hide the phishing pages – all the samples collected by Commtouch Labs were based on WordPress**. In such cases the phishers seek out a particular plugin with a known vulnerability that can be repeatedly exploited on many sites..."
** https://wordpress.org/download/
April 20, 2012 - WordPress v3.3.2 released

:sad: :fear: :spider:
 
Brazilian banking malware...

FYI...

Brazilian banking malware ...
- http://blog.spiderlabs.com/2012/04/brazilian-banking-malware-pay-your-bill-slacker-.html
26 April 2012 - "... part of a Brazilian phishing attack... VirusTotal reports... the sample as being detected by 5/42*... the malware is a straightforward PE executable that is made to look like a word document. In addition to being named boleto.doc.exe, the file also comes with a Microsoft Word icon
> http://npercoco.typepad.com/.a/6a0133f264aa62970b016765bf6348970b-800wi
... This was actually one of the few instances where Google Translate failed... knowing the file size (1.5 MB) alone told me it was going to be packed with "goodies"... the malware is ensuring persistence by setting itself in the 'Run' registry key. This will cause the malware the run every time that user logs into their machine... look forward to the (hopefully) increased detection by antivirus in the coming days."
* https://www.virustotal.com/file/188...2ff9c5ba13c88b823d3b6a0b9f1d8b0c5be/analysis/
File name: 188477e8f2a9523b0a001040982942ff9c5ba13c88b823d3b6a0b9f1d8b0c5be
Detection ratio: 5/42
Analysis date: 2012-04-26 15:31:50 UTC

:sad::mad:
 
BlackHole SPAM runs underway...

FYI...

BlackHole SPAM runs underway
- http://blog.trendmicro.com/persistent-black-hole-spam-runs-underway/
Apr 30, 2012 - "... high-volume spam runs that sent users to websites compromised with the BlackHole exploit kit... spam runs that were part of this investigation used the name of Facebook, and US Airways. Other spam runs involved LinkedIn, as well as USPS. The most recent campaign we’ve seen that was part of this wave of attacks used the name of CareerBuilder:
> http://blog.trendmicro.com/wp-content/uploads/2012/04/blackhatspam1.jpg
> http://blog.trendmicro.com/wp-content/uploads/2012/04/blackhatspam2a.jpg
... conclusions about these each of these attacks are broadly similar:
• Phishing messages using the names of various organizations spread via email to targets predominantly in the United States. The content of these phishing e-mails were practically indistinguishable from legitimate messages.
• Links in these messages led to multiple compromised websites that redirected the user to various malicious sites. Collectively, these compromised sites numbered in the thousands.
• Users were eventually directed to sites containing the Black Hole exploit kit.
... more than 2,000 distinct URLs used in this attack, distributed over 374 domains. On average, each compromised domain hosted 5 separate malicious landing pages... The goal of these attacks is to install ZeuS variants onto user systems..."

:sad::mad::mad:
 
Service automates boobytrapping of Hacked Sites

FYI...

Service automates boobytrapping of Hacked Sites
- https://krebsonsecurity.com/2012/05/service-automates-boobytrapping-of-hacked-sites/
May 1, 2012 - "Hardly a week goes by without news of some widespread compromise in which thousands of Web sites that share a common vulnerability are hacked and seeded with malware... one aspect of these crimes that’s seldom examined is the method by which attackers automate the booby-trapping and maintenance of their hijacked sites... another aspect of the cybercriminal economy that can be outsourced to third-party services. Often known as “iFramers,” such services can simplify the task of managing large numbers of hacked sites that are used to drive traffic to sites that serve up malware and browser exploits... A huge percentage of malware in the wild today has the built-in ability to steal FTP credentials from infected PCs. This is possible because people who administer Web sites often use FTP software to upload files and images, and allow those programs to store their FTP passwords. Thus, many modern malware variants will simply search for popular FTP programs on the victim’s system and extract any stored credentials... Just as PC infections can result in the theft of FTP credentials, malware infestations also often lead to the compromise of any HTML pages stored locally on the victim’s computer. Huge families of malware have traditionally included the ability to inject malicious scripts into any and all Web pages stored on host machine. In this way, PC infections can spread to any Web sites that the victim manages when the victim unknowingly uploads boobytrapped pages to his Web site... the best way to avoid these troubles is to ensure that your system doesn’t get compromised in the first place. But if your computer does suffer a malware infection and you manage a Web site from that machine, it’s good idea to double check any HTML pages you may have stored locally and/or updated on your site since the compromise, and to change the password used to administer your Web site (using a strong password...)."

:fear::mad:
 
Ransomware - Fake G-Men attack Hijacks computers...

FYI...

Ransomware - Fake G-Men attack Hijacks computers ...
- https://www.trusteer.com/blog/fake-g-men-attack-hijacks-computers-ransom
May 01, 2012 - "... new use of the Citadel malware platform (a descendent of the Zeus Trojan) to deliver code ransomware that poses as the US Department of Justice and highjacks victims’ computers. This ransomware, named Reveton, freezes the compromised machine’s operating system and demands a $100 payment to unlock it. Reveton was observed a few weeks ago being used as a standalone attack, but has now been coupled with the Citadel platform... Citadel is able to target employees to steal enterprise credentials, and in this example targets victims directly to steal money from them, instead of their financial institution. The attack begins with the victim being lured to a drive-by download website. Here a dropper installs the Citadel malware on the target machine which retrieves the ransomware DLL from its command and control server. Once installed on the victim’s computer, the ransomware locks-up the targeted machine and displays a warning message notifying the user that they have violated United States Federal Law. The web inject screen* claims the IP address belonging to the infected machine was identified by the Computer Crime & Intellectual Property Section as having visited websites that contain child pornography and other illegal content.
* https://www.trusteer.com/sites/default/files/Fake Gmen blog.png
In order to unlock their computer, the victim is instructed to pay a $100 fine to the US Department of Justice using prepaid money card services. The payment service options presented to the victim are based on the geographic location of their IP address. For example, users with US IP addresses must pay using MoneyPak or Paysafecard... Independent of the Reveton ransomware secondary payload, Citadel continues to operate on the compromised machine on its own. Therefore it can be used by fraudsters to commit online banking and credit card fraud by enabling the platform’s man-in-the-browser, key-logging and other malicious techniques. It is clear from this and similar attacks we have discovered recently that financial malware has achieved a technological level of sophistication which enables it to be used to carry out virtually any type of cyber-attack. Through a combination of social engineering, data capturing and communication tampering these attacks are being used by criminals to target applications, systems and networks belonging to financial institutions, enterprises, and government agencies in order to commit fraud or steal sensitive information... cyber-crime and cyber-security protection begins with the endpoint now more than ever."

:mad: :mad:
 
Multi-Layer malware attack uses same exploit as Flashback - Atlas

FYI...

Multi-Layer malware attack uses same exploit as Flashback
- http://atlas.arbor.net/briefs/index#1402527155
Severity: Elevated Severity
Published: Monday, April 30, 2012 16:24
Yet another malware is using the recent Java flaw to exploit both OSX and Windows systems.
Analysis: The malware determines which OS is being attacked and then delivers the proper payload... case in point that there are many copycat attacks that take place when a serious flaw emerges and organizations must anticipate multiple threats rather than the threats that get the most media attention.
Source: http://nakedsecurity.sophos.com/2012/04/27/python-malware-mac/
> Python-based malware attack targets Macs - Windows PCs also under fire
April 27, 2012 - "... there may still be some users whose computers are not patched against the Java vulnerability - and are at risk of attack. The malicious Java code downloads further code onto the victim's computer - depending on what operating system they are using... The downloaded programs will then install further malicious code... This Python script acts as a Mac OS X backdoor, allowing remote hackers to secretly send commands, uploading code to the computer, stealing files and running commands without the user's knowledge... The backdoor Python script allows remote hackers to steal information... We have a free Mac anti-virus for home users*, if you think it's time to take your computer's security more seriously..."
* http://www.sophos.com/freemacav
> https://www.avira.com/en/avira-free-mac-security

OSX.Flashback.K – motivation behind the malware - $$$
- http://www.symantec.com/connect/blogs/osxflashbackk-motivation-behind-malware
Apr 30, 2012

:sad: :fear: :mad:
 
Bogus invoices set virus trap...

FYI...

Bogus invoices set virus trap
- http://h-online.com/-1567059
3 May 2012 - "Criminals are currently sending out a large number of bogus order confirmations that are designed to make recipients open the attached malware. The attackers appear to be using stolen online store customer data to address email recipients by their real names. The criminals pretend that the email recipient has placed an order worth several hundred euros at an online store. To make things difficult for spam filters, they vary the store names... Users who receive an order confirmation or invoice that they can't associate with a purchase should -not- open these file attachments under any circumstances. Unfortunately, virus scanners don't offer reliable protection in this case... it isn't just invoices in ZIP or EXE format that should make users suspicious: attackers have also been circulating bogus Deutsche Telekom and Vodafone invoices as PDF attachments that try to infect computers via an old security hole in Adobe Reader. This attack scenario is also possible using Office documents."
* https://www.virustotal.com/file/6e9...d07fad4e96b5c0673fbbabfae640560e294/analysis/
File name: Rechnungsdaten.zip
Detection ratio: 9/42
Analysis date: 2012-05-03 10:55:17 UTC

:mad:
 
Last edited:
Mapping cybercrime by country

FYI...

Mapping cybercrime by country
- http://hostexploit.com/blog/14-reports/3538-mapping-cybercrime-by-country.html
3 May 2012 - "All cybercrime is hosted and served from somewhere. A simple enough truism and yet little research, or even initiatives, emerge from this area. A new interactive web-based tool aims to provide deeper insights into this domain in search of solutions to a global problem. How much cybercrime is served by the hosting providers registered to, or routing through, an individual country? An interesting question that can now begin to be quantifiably answered thanks to a collaborative association between HostExploit, Russian Group-IB1 and CSIS2 in Denmark. The Global Security Map* displays global hot spots for cybercriminal activities based on geographic location... The Global Security Map* is the outcome of extensive research on Autonomous Systems (ASNs) – servers, ISPs, and networks routed publically via their respective IP (Internet Protocol) addresses. It has been the long-held vision of HostExploit, heading a group of respected independent community researchers, to be able to provide a tool to aid hosts, registrars, Internet Service Providers (ISPs), researchers, law enforcement, academics and other parties, interested in tracking Internet security-related issues worldwide. HostExploit established a method of rating levels of malicious activity on all ASes worldwide (currently 40,909), known as the HE Index, which is used to compile data for its widely respected quarterly reports. The statistics used for the ‘Top 50 Bad Hosts & Networks’ reports and tables are applied now to countries as a whole (based on registration information and routing locations) to create a ranking order by level of malicious activity (1,000 = highest). At the time of the report, Lithuania ranks at #1 with the highest levels of malicious activities in the world while Finland at #219 has the cleanest servers and networks. With this information in place, the next step is to consider realistic mitigation methods or plans that can help reduce levels of malicious activity..."
(More info at the hostexploit URL above.)

* http://globalsecuritymap.com/

> English report (PDF) here: http://hostexploit.com/downloads/vi...rts/39-global-security-report-april-2012.html

:fear::fear:
 
You must log in or register to reply here.
Back
Top