There were no major malware incidents to talk about in December. However, throughout the month:
The tactics used by the cybercriminals remained the same. Surfing the web is still a dangerous pastime, while social engineering is routinely used to entice users into opening malicious links or downloading malicious or fraudulent programs.
November 2010 saw the beginning of domain name registration in the .рф (Cyrillic abbreviation for the Russian Federation) zone of the Internet. We decided to monitor how the cybercriminals would react to the new domain and we found that their malware of choice in this new area of the Internet was predominantly of a fraudulent nature.
Three types of malware are detected most of all on malicious sites in the .рф zone. The first is fake archives, which we have covered in quite a lot of detail recently, including in last month’s review. The second is the primitive script redirector Trojan.JS.Redirector.ki which simply redirects users to a malicious page using the command “document.location”.
The third – Hoax.Win32.OdnoklAgent.a – is quite an unusual sample. The program opens a window that closely resembles a login page for the Russian-language social networking site Odnoklassniki. The window even contains links to the social network and the site’s copyright information. But the program doesn’t actually do anything, even if the correct login and password are entered.
The window opened by Hoax.Win32.OdnoklAgent.a
So why would someone go to the trouble of creating a program like Hoax.Win32.OdnoklAgent.a? The thing is, the .рф zone is awash with lots of very similar sites offering “free communication services”. But these so-called services are anything but free: in order to access them the user has to send an SMS to a premium-rate number. After sending an SMS you receive a “service” that turns out to be the dummy program Hoax.Win32.OdnoklAgent.a.
On all these sites there is a section at the bottom of the main page that states that the site has nothing to do with the Odnoklassniki social network and the software that can be accessed is only intended as a joke.
This is the site owners’ way of protecting themselves against any claims of fraud. But in this case the joke is on those inattentive users who don’t notice the disclaimer and end up paying the cost of an SMS.
The amount of fake antivirus programs has decreased recently as the real McCoy successfully stems their spread to users’ computers. But the scammers behind these rogue programs have started using the Internet as an alternative. In this scenario the program doesn’t need to be downloaded to a computer; the cybercriminals just have to get the user to visit a specific page, which is a lot easier than bypassing real antivirus protection. Several of these new ‘Internet antivirus programs’ were among the leading malicious programs detected online in December, with two samples making it into our Top 20 at 18th and 20th places.
The screenshot below was generated by Trojan.HTML.Fraud.ct and gives an insight into how these fake antivirus programs work.
As you can see from the screenshot, the fake antivirus program generates an Internet page that closely resembles the My Computer window in a Windows operating system. The subsequent scenario is already a familiar one: it starts to simulate a scan of the computer and almost immediately claims it has detected malware. If the user agrees to clean up the system, a fake antivirus program is downloaded which then tells the user to purchase a license in order to remove the “malware”.
The majority of computers where this malicious program was detected were located in developed countries: the USA, Canada, the UK, Germany and France, with India most probably making it into the list due to the high number of English-speaking users in that country.
Services that shorten URLs have only just recently become popular. This may well be down to Twitter’s 140 character limit, but cybercriminals have been quick to make use of the services to mask malicious links.
During an attack on Twitter in December the top trends on the site’s main page included a number of entries that had made it into the list with the help of malicious programs. All the trends contained links that had been shortened using services such as bit.ly and alturl.com. After several redirects the links led to an infected web page that downloaded a malicious program to users’ computers without their knowledge. Google’s goo.gl service was also used by cybercriminals to spread malicious links on Twitter at the start of the month.
Another method used to mask malicious links was detected at the end of the month in an instant messenger mass mailing that contained links to a Facebook page warning users they were navigating away from the social networking site. The link had been crafted in such a way that after users clicked the ‘Continue’ button that appeared on the Facebook page they ended up on a malicious site.
Apart from organizing online attacks and relatively straightforward attacks via social networks, cybercriminals are still working on the “heavy artillery” in their arsenal. The authors of one of today’s most complex malicious programs – the TDSS rootkit – continue to perfect their creation. In December, the latest modification of the rootkit, TDL-4, started exploiting the vulnerability CVE-2010-3338 that was discovered in June 2010 while analyzing the Stuxnet worm.
In our November review we wrote about the explosive growth of the Trojan-Downloader.Java.OpenConnection family. Instead of using vulnerabilities to download malware to victims’ computers, these programs employ the OpenConnection method of a URL class.
Two representatives of Trojan-Downloader.Java.OpenConnection (2nd and 7th places) were among the Top 20 malicious programs detected on the Internet in December. At the height of their activity the number of computers on which these programs were detected in a 24-hour period exceeded 40,000.
As we just mentioned, all the representatives of the Trojan-Downloader.Java.OpenConnection family, instead of exploiting vulnerabilities, use standard Java functionality to download and run files from the web. This is currently one of the prime download methods for malicious programs written in Java. It appears that until Oracle closes the functionality this family uses to download files its popularity will continue to grow.
This is the first time we have seen malicious PDF documents that use Adobe XML Forms being spread en masse.
Topping the list of web-based threats, well ahead of its nearest rival, was AdWare.Win32.HotBar.dh, an adware program that includes HotBar, Zango, and ClickPotato. It also claimed 5th place in the Top 20 malicious programs detected on users’ computers. As a rule, this type of software is installed along with legitimate applications and then annoys the user by displaying intrusive advertising.
|Position||Change in position||Name||Number of distinct users|
|Position||Change in position||Name||Number of distinct users|