03 Mar CODE BLUE in Tokyo
23 Oct Hack In The Box 2013 KUL
06 Sep Mule Flood in Japan
27 Apr CeCOS VII
17 Apr Boston Aftermath
Join our blog
You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings.
On February 17th (MON) - 18th (TUE), 2014 we were at an event in Tokyo called “CODE BLUE”, a new international information security conference originating from Japan.
Even though this conference was being held for the first time, no less than 400 visitors attended, with people coming from about 10 different countries.
The overall atmosphere at the event was kind and friendly and everything seemed to go smooth and swiftly.
Topics on the first day were the keynote by Jeff Moss, followed by presentations about “The Current State of Automotive Security”, “A Security Barrier Device”, “Remote linux exploits” and hard-/software related hard disk matters.
For the Japanese speakers among you there’s a more detailed review of the event here.
Recently we attended “Hack In The Box 2013” at the Hotel Intercontinental in Kuala Lumpur http://conference.hitb.org/hitbsecconf2013kul/. This conference has its roots in a small gathering of Malaysian security specialists back in 2002 and since then has also been held in the Netherlands, Dubai and Bahrain.
It was nicely crowded (~550 people) and more than 40 speakers from around the world shared their work on a nice variety of different topics.
We attended only the two-day conference part of the event, which also included a hands-on “HITB LABS” section, a “Capture The Flag”(CTF) battle …
and a “Lock Picking Village”, amongst other things.
Money mule recruitment emails are nothing new, for years these have been spammed out all over the globe. What is new though is the recent wave aimed at “English-speaking Japanese residents”. It started at the end of July and we have received hundreds of such themed spam emails since then.
The content typically promises an easy job, just requiring some hours per week with very few other requirements.
Kaspersky Lab congratulates the royal couple on the birth of their new baby boy and wish them all well for the future. It is truly joyous news that is being celebrated in the UK and in the rest of the world.
However because it is such big news, it didn't take long for malicious elements to misuse it as follows: "The Royal Baby: Live updates" promises an email arriving at our spam traps today. A link named "Watch the hospital-cam" is the contained trap which leads to ... nowhere because it seems that it has already been cleaned. By the looks of it, it may be a compromised legitimate website which got cleaned.
But we are still interested in what the malicious content could be and we didn't need to search for long. Exactly _one_ hit for our web search was shown at the time of writing this article.
The Counter eCrime Operations Summit VII (CeCOS VII) engages questions of operational challenges and the development of common resources for the first responders and forensic professionals who protect consumers and enterprises from the electronic-crime threat every day.
The annual event, organized by the Anti-Phishing Working Group (APWG) is this time held in Buenos Aires, Argentina.
While many are still in shock after the Boston Marathon bombings on 16 April, it didn't take long for cyber criminals to abuse that tragic incident for their dirty deeds.
Today we already started receiving emails containing links to malicious locations with names like "news.html". These pages contain URLs of non-malicious youtube clips covering the recent event. After a delay of 60 seconds, another link leading to an executable file is activated.
The malware, once running on an infected machine, tries to connect to several IP addresses in Ukraine, Argentina and Taiwan.
Kaspersky Lab detects this threat as "Trojan-PSW.Win32.Tepfer.*".
MD5sums of some of the collected samples:
Our thoughts and prayers are with our colleagues in Massachusetts and others affected by the tragic events in Boston.
After having handled thousands and thousands of phishing emails/webpages, they usually don’t actually reach me in any way or form. They are processed and added to our detection list in what is now a merely routine task. But recently I got a mail which was different because it appeared to be sent from my bank.
”The 15th Cyber Crime Symposium, Shirahama" with theme "Cloud Security" was held on
May 26th - 28th at the "Big U" Information Exchange Center in Wakayama Prefecture, Japan. Approximately 220 people, including government delegates, information security researchers, lawyers, law enforcement and academia attended the event. Experts were presenting about topics like benefits and security risks of cloud computing as well as other related technical matters.
During the presentations, which were also broadcasted via ustream, tweets tagged with #sccs2011 were shown cycling on a separate screen. This yearly event is targeting Japanese audience and no translation services were offered. If you plan to attend this event in the future, be sure to brush up your Japanese, it most certainly is worth it. Past content of the same event covered themes like “Threat of Malware/Virus” (2009) and “How can we protect the children and ourselves from harmful contents” (2010).
The earthquake and tsunami related crisis in Japan is still far from over - so is the appearance of new cyber threats trying to exploit that same crisis.
Tens of thousands of people in Japan have lost their homes, and many their loved ones too. On top of that, radiation leaks are still a major concern for the country and its observers , while new tremors remind everyone of nature’s power on an almost daily basis. (At time of writing, a Magnitude 6.2 quake shook the place!).
Today we investigated another malicious webpage. This one states in Portuguese: "Novo tsunami atinge a região de Sendai e Japão declara estado de emegência em usina nuclear", which roughly translated means "New tsunami reaches the area of Sendai, Japan declares state of emergency at nuclear power plant".
As was predicted by many, email scams soliciting donations for Japan are appearing in user’s inboxes. We took a closer look at one of these messages and identified the following details: