Category: Malware

Targeted attacks on the rise

Posted on by admini

One significant element behind this growth in North America was the return of ‘pump and dump’ spam campaigns, which targeted would-be investors hoping to capitalise on all-time equity market highs.

Each quarter, the McAfee Labs team of more than 500 multidisciplinary researchers in 30 countries monitors the global threat landscape, identifying application vulnerabilities, analysing and correlating risks, and enabling instant remediation to protect enterprises and the public.

Koobface, a worm first discovered in 2008, had been relatively flat for the last year yet it tripled in the first quarter of 2013 to levels never previously seen.

McAfee’s latest analysis of the Citadel Trojan found that criminals have re-purposed the bank account threat to steal personal information from narrowly targeted victims within organisations beyond financial services.

New PC malware samples increased 28 percent, adding 14 million new samples to McAfee’s malware “zoo” of more than 120 million unique malware threats.

Link: http://networking.cbronline.com/news/targeted-attacks-on-the-rise

Read more

Malware’s typical network behaviour makes it easier to spot: Palo Alto

Posted on by admini

Palo Alto Networks has positioned its WildFire platform to resolve this issue, by providing what Williamson calls a “classify everything” view of all data coming into and going out of the network.

Other common signature behaviours of malware include visits to an unregistered domain (24.38% of cases), the sending of emails (20.46%), contacting an IP country different from the host top-level domain (6.92%), downloading a file with an incorrect file extension (4.53%), visiting a recently registered domain (1.87%), and more.

“”You can always create an exception if you need to, but you can also set a rule that says ‘if I see an HTTP post to new domains, that is something worth investigating’.

This confidence, says Palo Alto Networks’ ANZ country manager Armando Dacal, often translates into a better business-IT alignment because the security team can ensure the business will be protected through highly-granular control over applications and user behavior. Such control will pave the way for higher business and IT confidence around the influx of smartphones and tablets as companies, many grudgingly, give in to the realities of bring your own device (BYOD) policies.

“But users wanted to leverage the power in the devices – and now IT can have a discussion with the business around which users should have access to which applications, and how it can be done safely.” “We’re dealing with creative [malware authors],” Williamson says, “and we’re in a world where we’re going to have to be looking at what’s coming in – and be engaged, creatively, about what’s going on.

Link: http://www.cso.com.au/article/463079/malware_typical_network_behaviour_makes_it_easier_spot_palo_alto/

Read more

Hackers exploit Ruby on Rails vulnerability to compromise servers, create botnet

Posted on by admini

The resulting malware is a bot that connects to an IRC (Internet Relay Chat) server and joins a predefined channel where it waits for commands from the attackers.

Reports of malicious activity using this exploit were posted in recent days on several discussion boards and it also appears that some Web hosting providers were affected, Jarmoc said.

Users should update the Ruby on Rails installations on their servers to at least versions 3.2.11, 3.1.10, 3.0.19 or 2.3.15 which contain the patch for this vulnerability. However, the best course of action is probably to update to the latest available Rails versions, depending on the branch used, since other critical vulnerabilities have been addressed since then.

Link: http://www.arnnet.com.au/article/463093/hackers_exploit_ruby_rails_vulnerability_compromise_servers_create_botnet/

Read more

91% of targeted attacks start with spear-phishing email

Posted on by admini

Threats are not new and IT departments have already seen various kinds of advanced persistent threats (APTs) or malware-based espionage attacks that have been around for years. Trend Micro has not determined the total number of victims in the campaign but apparently, about 12,000 unique IP addresses spread over more than 100 countries were connected to two sets of command-and-control (C&C) infrastructures related to this threat and the average number of actual victims was counted at 71 per day.

As this threat identified by Trend Micro has the potential to affect people all across the world, enterprises should focus on detecting and mitigating attacks and leverage core components of a defence strategy as presented by the report.

Enterprises should also empower human analysts and also leverage technologies available today to gain visibility, insight, and control over networks to defend against targeted threats.

Once an attack is identified, the cleanup strategy should focus on determining the attack vector and cut off communications with the command-and-control (C&C) server.

Link: http://www.csoonline.com/article/734111/91-of-targeted-attacks-start-with-spear-phishing-email?source=rss_data_protection

Read more

Zeus variants are back with a vengeance

Posted on by admini

The difference in GameOver variant is that it opens a random UDP port and sends encrypted packets before sending DNS queries to randomized domain names.”

Configuration files are, as usual, subject to change depending on which information the attackers want to steal, and the malware still tries to prevent browsers from being able to visit security sites. What was previously put in one folder in Windows’%System% folder is now in to random-named folders in the%Applications Data% folder.

“What we can learn from ZeuS / Zbot’s spike in recent months is simple: old threats like Zbot can always make a comeback because cybercriminals profit from these,” the researchers warn and advise: “It is important to be careful in opening email messages or clicking links.

Link: http://www.net-security.org/malware_news.php?id=2504&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+HelpNetSecurity+%28Help+Net+Security%29

Read more