23 Oct Hack In The Box 2013 KUL
06 Sep Mule Flood in Japan
27 Apr CeCOS VII
17 Apr Boston Aftermath
19 Sep The unstolen Matrix
Join our blog
You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings.
Recently we attended “Hack In The Box 2013” at the Hotel Intercontinental in Kuala Lumpur http://conference.hitb.org/hitbsecconf2013kul/. This conference has its roots in a small gathering of Malaysian security specialists back in 2002 and since then has also been held in the Netherlands, Dubai and Bahrain.
It was nicely crowded (~550 people) and more than 40 speakers from around the world shared their work on a nice variety of different topics.
We attended only the two-day conference part of the event, which also included a hands-on “HITB LABS” section, a “Capture The Flag”(CTF) battle …
and a “Lock Picking Village”, amongst other things.
Money mule recruitment emails are nothing new, for years these have been spammed out all over the globe. What is new though is the recent wave aimed at “English-speaking Japanese residents”. It started at the end of July and we have received hundreds of such themed spam emails since then.
The content typically promises an easy job, just requiring some hours per week with very few other requirements.
Kaspersky Lab congratulates the royal couple on the birth of their new baby boy and wish them all well for the future. It is truly joyous news that is being celebrated in the UK and in the rest of the world.
However because it is such big news, it didn't take long for malicious elements to misuse it as follows: "The Royal Baby: Live updates" promises an email arriving at our spam traps today. A link named "Watch the hospital-cam" is the contained trap which leads to ... nowhere because it seems that it has already been cleaned. By the looks of it, it may be a compromised legitimate website which got cleaned.
But we are still interested in what the malicious content could be and we didn't need to search for long. Exactly _one_ hit for our web search was shown at the time of writing this article.
The Counter eCrime Operations Summit VII (CeCOS VII) engages questions of operational challenges and the development of common resources for the first responders and forensic professionals who protect consumers and enterprises from the electronic-crime threat every day.
The annual event, organized by the Anti-Phishing Working Group (APWG) is this time held in Buenos Aires, Argentina.
While many are still in shock after the Boston Marathon bombings on 16 April, it didn't take long for cyber criminals to abuse that tragic incident for their dirty deeds.
Today we already started receiving emails containing links to malicious locations with names like "news.html". These pages contain URLs of non-malicious youtube clips covering the recent event. After a delay of 60 seconds, another link leading to an executable file is activated.
The malware, once running on an infected machine, tries to connect to several IP addresses in Ukraine, Argentina and Taiwan.
Kaspersky Lab detects this threat as "Trojan-PSW.Win32.Tepfer.*".
MD5sums of some of the collected samples:
Our thoughts and prayers are with our colleagues in Massachusetts and others affected by the tragic events in Boston.
After having handled thousands and thousands of phishing emails/webpages, they usually don’t actually reach me in any way or form. They are processed and added to our detection list in what is now a merely routine task. But recently I got a mail which was different because it appeared to be sent from my bank.
”The 15th Cyber Crime Symposium, Shirahama" with theme "Cloud Security" was held on
May 26th - 28th at the "Big U" Information Exchange Center in Wakayama Prefecture, Japan. Approximately 220 people, including government delegates, information security researchers, lawyers, law enforcement and academia attended the event. Experts were presenting about topics like benefits and security risks of cloud computing as well as other related technical matters.
During the presentations, which were also broadcasted via ustream, tweets tagged with #sccs2011 were shown cycling on a separate screen. This yearly event is targeting Japanese audience and no translation services were offered. If you plan to attend this event in the future, be sure to brush up your Japanese, it most certainly is worth it. Past content of the same event covered themes like “Threat of Malware/Virus” (2009) and “How can we protect the children and ourselves from harmful contents” (2010).
The earthquake and tsunami related crisis in Japan is still far from over - so is the appearance of new cyber threats trying to exploit that same crisis.
Tens of thousands of people in Japan have lost their homes, and many their loved ones too. On top of that, radiation leaks are still a major concern for the country and its observers , while new tremors remind everyone of nature’s power on an almost daily basis. (At time of writing, a Magnitude 6.2 quake shook the place!).
Today we investigated another malicious webpage. This one states in Portuguese: "Novo tsunami atinge a região de Sendai e Japão declara estado de emegência em usina nuclear", which roughly translated means "New tsunami reaches the area of Sendai, Japan declares state of emergency at nuclear power plant".
As was predicted by many, email scams soliciting donations for Japan are appearing in user’s inboxes. We took a closer look at one of these messages and identified the following details:
Since the beginning of August, our Japan office has seen 900+ mails of a certain kind in their spam traps.
We noticed two common patterns in all of the mail. First, the links in these spammed messages all point to compromised servers. Also, the file names of the redirectors are all dictionary words followed by two digits. The files redirect the users to online pharmacy sites and fake watch stores. Here is a screen capture of a directory hosted on one of these online sites:
You might wonder why this caught our attention. The answer is simple: about half of these files contained links to 'gumblar.x' servers.
The upper red link points to a pharmacy site, the lower one is a gumblar.x URL.
So basically an unsuspecting (and unprotected) user who will click these links in their mail will experience a typical 'gumblar-attack' while browsing a pill catalog. The recent peak of such hybrid attacks may be a sign that the cybercriminal(s) who’ve been slowly but surely growing the Gumblar botnet worldwide, and who up until now have been keen to fly under the radar, are now starting to monetize it. The first test runs of mixed pharmacy/gumblar pages were actually identified by our experts as early as April 2010, when we noticed a few mails of this kind, with subjects like "Twitter 61-213".
On further investigation of the involved servers, it turned out that plenty of them have additional malicious code injected directly into their www root. We counted mostly gumblar.x but also some 'pegel.*' and other obfuscated code containing iframers or other redirectors.
Additionally, almost ALL of these domains contained a link to 'hxxp://nuttypiano.com/*.js' at the end of the file.
There are more than 300 different .js files in circulation on such servers, the content of these is obfuscated and similar to known 'pegel' threats. To make our researchers' task more difficult, the malicious code will only be sent once to the same IP address. However, we have managed to download several samples from the same locations and identified polymorphic-like structures.
These are redirecting to other :8080 locations, which in turn try to push more malware onto the victim's machine.
Here is a quick summary of such injected sites, sorted by country: #1 is the US, followed by FR, DE, TR and JP. Affected webmasters should consider changing their compromised ftp credentials, clean the machines which led to the leak, and investigate their server logs for more details.