Category: Malware

Hackers’ StealRat botnet turns 85,000 unique IPs into malware-spreading tools

Posted on by admini

The infected machine acts as a liaison between the spam server and the compromised website,” wrote De La Torre.

“As there is no interaction between the spam and server, it will appear the email has originated from the infected machine. In essence, they have separated the core functions and minimised interactions among them to cut off any threads that could link them to each other.”

The tactic has reportedly proven effective, with Trend estimating the attackers are using 85,000 unique IP addresses or domains to send out spam to seven million chosen email addresses.

Link: http://www.v3.co.uk/v3-uk/news/2283924/hackers-stealrat-botnet-turns-85-000-unique-ips-into-malwarespreading-tools

Read more

Business users visit most malicious websites, security academics find

Posted on by admini

Just 2 per cent of malicious websites visited by Australian users were actually hosted in Australia, while 62 per cent originated in the United States – lending support to earlier reports that notorious malware host China was actually losing its one-time dominance.

The project “allows us to apply large scale analytics techniques to analyse massive volumes of Trend Micro malware sensor data,” said Professor Yang Xiang, director of the Network Security and Computing Lab within the Deakin University School of Information Technology, in a statement.

Interestingly, many of the hosts were unaware of their infection with malware: of 24 servers compromised by the Blackhole Exploit Kit and noted by the research team, 12 were still delivering the malware-compromised pages a week later.

Link: http://www.cso.com.au/article/520498/business_users_visit_most_malicious_websites_security_academics_find/

Read more

New EU laws approve tougher sentences for cyber criminals

Posted on by admini

For example, the Srizbi botnet, estimated to be either the world’s largest, or second-largest botnet, is thought to be made up of around half a million machines.

Botnet creators add machines to their networks through spam emails and malware, often building up networks before renting or selling it to other criminals. Anyone found setting up a botnet will face a minimum of three years in jail, and if the system is used to threaten national infrastructure then again, the minimum sentence rises to give years.

Member states have two years to sign the new directives into law, with only Denmark choosing to opt out in favour of its own rules.

Link: http://www.independent.co.uk/life-style/gadgets-and-tech/new-eu-laws-approve-tougher-sentences-for-cyber-criminals-8690635.html

Read more

Combating attacks with collaborative threat intelligence

Posted on by admini

Once an attacker has targeted any member of a collaborative platform, command-and-control servers are easily identified by their IP addresses throughout the network. This means that attackers can no longer benefit from the isolation of their targets; they must use a new IP for each attack that they launch. Instead of being able to launch thousands of attacks from a single IP, they have to pay the cost of acquiring a number of IPs that is proportional to the number of attacks they wish to mount.

Additionally, an attacker’s tools and tactics become much less effective when defenders collaborate to protect themselves from the attacker.

Link: http://www.net-security.org/article.php?id=1857&p=2

Read more

Attackers sign malware using crypto certificate stolen from Opera Software

Posted on by admini

Hackers penetrated network servers belonging to Opera Software, stole at least one digital certificate, and then used it to distribute malware that incorrectly appeared to be published by the browser maker. “The attackers were able to obtain at least one old and expired Opera code signing certificate, which they have used to sign some malware,” Wednesday’s advisory stated. It is possible that a few thousand Windows users, who were using Opera between June 19 from 1.00 and 1.36 UTC, may automatically have received and installed the malicious software.”

Missing details include when the attackers first gained access to the servers, precisely when the stolen digital certificate expired, and whether there’s reason to believe other certificates may also have been obtained. It would also be useful to know how hackers got access to an official Opera digital certificate, which is supposed to cryptographically prove that the software that bears its seal could only have come from the company.

The Opera post urged users to “update to the latest version of Opera as soon as it is available, keep computer software up to date, and to use a reputable antivirus product on their computer.”

At some point soon, though, officials should provide a more thorough account of what happened, who was affected, and what steps have been taken to prevent similar attacks from succeeding in the future.

Link: http://arstechnica.com/security/2013/06/attackers-sign-malware-using-crypto-certificate-stolen-from-opera-software/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29

Read more

Phishing attacks up 87 per cent: Report

Posted on by admini

“The more popular a website is, the more frequently malicious users copy it and, as a result, there is a higher probability that a user will run into a fake version as he surfs the web,” says the report.

In its report, Kaspersky also pointed out that 12 per cent of the phishing attacks are carried out through emails. In the same month, cyber criminals hacked into the current account of industrial conglomerate RPG Group of companies and stole Rs 2.4 crore. The report says the US tops the list of countries from which the maximum number of hostile phishing attacks emerge – 18.67 per cent of all attacks.

Link: http://businesstoday.intoday.in/story/phishing-attacks-up-87-per-cent/1/196061.html

Read more