English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1
Latest posting
By rating
By popularity

Join our blog

You can contribute to our blog if you have +100 points. Comment on articles and blogposts, and other users will rate your comments. You receive points for positive ratings.

0.2
 

It's the end of 2011 as we know it, and Microsoft feels fine finishing out the year with a handful of out-of-band holiday patches. This round is important not because the vulnerabilities directly impact massive numbers of customers and their online behavior on Windows laptops, tablets, and workstations, but because ASP.NET maintains vulnerable code enabling easy DoS of hosting websites, authentication bypass techniques, and stealth redirections to other websites (most dangerously those sites hosting phish and hosting client side exploits and spyware). All of this could curdle your eggnog in the coldest of weather.

Virus Watch|Android malware: new traps for users

Denis
Kaspersky Lab Expert
Posted December 29, 10:52  GMT
Tags: Mobile Malware
0.3
 

There is no secret that cybercriminals try to intimidate users very often in order to infect their machines. We’ve seen a lot of examples of cybercriminals using black SEO for redirecting users to web pages which emulate AV scanning. And there is no surprise that the results of such ‘scanning’ show that the user’s machine is infected with a lot of dangerous malicious apps and it is very essential to download and install a brand new ‘antivirus program’ which is actually fake AV.

But what about smartphones and mobile phones? Cybercriminals have started to use almost the same techniques in order to force users to download and install malware. But in this case we talk about SMS Trojans with fake AV rudiments. Here are some details.

When looking for some popular mobile apps (e.g. Opera Mini) in Google via a smartphone, several search results will redirect users to a web page which may look like this:

Or this:

Incidents|The Mystery of Duqu: Part Seven (Back to Stuxnet)

Aleks
Kaspersky Lab Expert
Posted December 28, 16:37  GMT
Tags: Targeted Attacks, Stuxnet, Duqu
0.5
 

We have been studying the Duqu Trojan for two months now, exploring how it emerged, where it was distributed and how it operates. Despite the large volume of data obtained (most of which has yet to be published), we still lack the answer to the fundamental question - who is behind Duqu?

In addition, there are other issues, mostly to do with the creation of the Trojan, or rather the platform used to implement Duqu as well as Stuxnet.

In terms of architecture, the platform used to create Duqu and Stuxnet is the same. This is a driver file which loads a main module designed as an encrypted library. At the same time, there is a separate configuration file for the whole malicious complex and an encrypted block in the system registry that defines the location of the module being loaded and name of the process for injection.

This platform can be conventionally named as ‘Tilded’ as its authors are, for some reason, inclined to use file names which start with "~d".

We believe Duqu and Stuxnet were simultaneous projects supported by the same team of developers.

Several other details have been uncovered which suggest there was possibly at least one further spyware module based on the same platform in 2007-2008, and several other programs whose functionality was unclear between 2008 and 2010.

These facts significantly challenge the existing "official" history of Stuxnet. We will try to cover them in this publication, but let us first recap the story so far.

Continue reading

comments      Link

Research|“Profile me” bot on Twitter

Dmitry Bestuzhev
Kaspersky Lab Expert
Posted December 25, 02:02  GMT
Tags: Botnets, Twitter
0.3
 

There is a bot activity in Twitter and at the moment is related to the new followers gaining only. What is happening is “profile me” bot is exploring all Twitpic hosted pictures replying to the authors with the same text phrase:

The bot started working on Friday, Dec 23 at 9 pm (GMT -05:00) with the highest peak on Saturday, 3 am the same GMT zone with 0.19% of all Twitter traffic.

In spite of the bot being used to gain followers and to promote porno content via bio user information, potentially it could be used for any other malicious purpose – like malware spreading via adding additional short URLs to the twits.

We’re monitoring it.

Comment      Link
0.1
 

Fabio Assolini talks about the explosion of banker Trojans in Brazil and explains why it is so difficult to fight back against cyber-crime in the Latin American region.

Comment      Link
0.2
 

This year cybercriminals haven’t been particularly active in exploiting the upcoming holiday season to snare victims with their scams. The first evidence of a growing trend of festive fraud only began to emerge about a week ago. Interestingly, this year’s attacks are somewhat different from previous years. This time round cybercriminals aren’t just going for hard cash – they are also looking for other assets that can be converted into money, such as air miles.

0.3
 

Several Eastern European banks have started notifying their customers in the beginning of last week that their cards have been blocked and will be replaced with new ones. Most of the banks did not give out any more details about what happened, and in many cases even failed to notify their customers prior to actually blocking their cards. Is it just another day in the payment processing business? Based on the rushed response from banks and the lack of information surrounding the case, I would say no.

It all started one week ago after the state-owned Romanian bank CEC Bank blocked ~17,000 cards in response to a security breach at one of VISA’s European payment processor.

The reaction of other banks followed soon. The Romanian branch of ING Bank also confirmed to have blocked compromised cards, but didn’t put out a number. They say they’ve only blocked a few cards, but are closely monitoring the situation.

A few days later, Serbian banks also started blocking thousands of cards for security reasons. Raiffeisen Bank, Komercijalna and Societe Generale confirm they have been informed by VISA about some of their customer’s cards being compromised. Very similar to what happened in Romania.

Rumors indicate the European branch of an electronic payment services provider, Euronet Worlwide, to be the source of this breach. This information has been going around Romanian business media (1, 2) – and though it hasn’t been confirmed officially, it would explain why customers from different banks in different countries were affected.

It’s very hard to assess the severity of this security breach, as the banks’ reaction to these events was very mixed. Some banks proceeded immediately to blocking and replacing all affected cads, while others decided to monitor the situation more closely.

Currently, it’s very hard to get a full picture of what is going on, but as it usually happens, these are unlikely to be isolated incidents. Actually, these stories could be just the tip of the iceberg. If you have recently received such a notification from your bank, we’d like to hear from you, especially if it’s outside Serbia and Romania.

Meanwhile, make sure to follow these 3 basic steps to make sure you don’t become a victim of credit card fraud:

  1. Check your statements as often as possible. Make sure all payments showing up are actually made by yourself. In case you suspect a fraudulent transaction, get in touch with your bank as soon as possible.
  2. Enable instant SMS notifications if your bank offers it. Some banks offer it for free, others charge for this option. No matter what, it’s worth it. You’ll be able to get instant reports of payments made with your cards.
  3. Make sure you keep most of your money in an account that has no card linked to it. Having to move money from an account to another on a weekly or monthly basis might seem annoying, but it can save you a great deal of pain in case your card gets compromised.

Last, but not least, we know it’s the holiday season and shopping is on everyone’s mind. So if you want to keep your money safe when doing online shopping, this insightful article we’ve put together is for you: Online shopping made safe and convenient.

comments      Link
0.5
 

Microsoft finishes out this year of patching with a heavy release that's all over place. While techs were notified of an anticipated 14 bulletins, 13 were released for the month of December. Headline grabbing events and code are addressed in one of them, and while fewer are labelled "Critical", are they any less important?

Many speculative bits have been spilled on the group behind Stuxnet and its precursor Duqu, with our own researchers posting at least a half dozen Securelist writeups on Duqu findings alone. MS11-087 patches up the delivery vector for Duqu itself. This kernel mode vulnerability was publicly identified and confirmed at the beginning of November, but could well have been used quietly in attacks around the world for a year or more.

0.1
 

On 3 December, we noted a rapid growth in the number of detections for exploits targeting the vulnerability CVE-2011-3544 in Java virtual machine. The vulnerability was published on 18 October, but malicious users have only recently begun to make active use of it. It can be used by exploits in drive-by attacks to download and launch malicious programs.


Number of unique detections of Exploit.Java.CVE-2011-3544

According to KSN data, most of the exploits targeting CVE-2011-3544 are used in the BlackHole Exploit Kit, which is currently the most popular exploit pack.

We analyzed the latest BlackHole kits. The sites that carry out drive-by attacks with the help of BlackHole turned up quite an old exploit – a PDF file that targets the vulnerability CVE-2010-0188, and a new Java exploit targeting the vulnerability CVE-2011-3544. The corresponding files are circled in red in the screenshot below.


A screenshot of the list of files intercepted when visiting websites where BlackHole is installed

Brian Krebs reports that the creators of BlackHole have successfully integrated the new exploit into their kit. According to KSN statistics, the new exploits attack users in Russia, the US, the UK and Germany. This appears to be related to the fact that new exploits that are integrated in BlackHole and target the vulnerability CVE-2011-3544, install the Trojan Carberp that steals banking data, as well as SMS blockers. SMS blockers are mostly used in Russia, while Trojan bankers attack users in developed countries.


Once again we see that malware writers are forging ahead and are continually improving their creations. It is, therefore, critical that all users install Java updates from Oracle in a timely manner. The patch for (among other things) the CVE-2011-3544 vulnerability can be downloaded here.

Comment      Link

Webcasts|Lab Matters - Java exploits percolate

Ryan Naraine
Kaspersky Lab Expert
Posted December 08, 09:04  GMT
Tags: Sun Java, Zero-day vulnerabilities
0.2
 

In this webcast, Kurt Baumgartner talks about the rise of exploits against vulnerabilities in Oracle’s Java software. The discussion centers around the exploitation of Java vulnerabilities in exploit kits and the poor state of patching on the Windows platform.

Comment      Link

Opinions|What to Do About Carrier IQ

Tim
Kaspersky Lab Expert
Posted December 07, 16:41  GMT
Tags: Google, Apple, HTC
0.4
 

There’s been a lot of talk about a piece of software installed on many mobile devices called Carrier IQ. The intended purpose of the software according to the manufacturer is to collect metrics to improve many functions of the device on which it’s installed. The uproar has been that this software has access to so much private user data.

Project|Malware Calendar Wallpaper for December 2011

David
Kaspersky Lab Expert
Posted December 07, 08:31  GMT
Tags: History of Malware
0.2
 

Here's the latest of our malware calendar wallpapers.


1280x800 | 1680x1050 | 1920x1200 | 2560x1600

Christmas brings many more people online since the Internet provides a quick and convenient way to buy Christmas gifts. This makes it the perfect time for cybercriminals to cash-in on online activity. So it's also a good time for a reminder about the basic things you can do to reduce the risk of cybercriminals spoiling your Christmas.

  1. Install Internet security software and keep it updated.
  2. Keep Windows and other applications up-to-date.
  3. Backup your data regularly to a CD, DVD, or external USB drive.
  4. Don’t respond to email messages if you don’t know the sender.
  5. Don’t click on email attachments if you don’t know the sender.
  6. Don’t click on links in email or IM (instant messaging) messages. Type the address directly into your web browser.
  7. Don’t give out personal information in response to an email or other message, even if it looks official.
  8. Only shop, bank or socialise on secure sites. Make sure the URL starts with ‘https://’.
  9. Use a different password for each web site or service you use. Don’t recycle them (e.g. ‘jackie1’, ‘jackie2’). Don’t make them easy to guess (e.g. mum’s name, pet’s name). Don’t tell anyone your passwords.

comments      Link

Virus Watch|Malicious Boot loaders

Fabio Assolini
Kaspersky Lab Expert
Posted December 06, 18:21  GMT
Tags: Malware Technologies
0.4
 

Cybercriminals are always looking for new ways to infect systems – ideally without being noticed until it’s too late. The sky is the limit for their creativity, as the latest wave of malicious boot loaders shows. The kit has been pioneered by Brazilian Trojan bankers who aim to remove security software.

This non-traditional infection only affects systems using ntldr, the default boot loader on Windows NT up to and including Windows XP and Windows Server 2003. This choice was no coincidence - XP is still the most popular OS in several countries, including Brazil, where it runs on nearly 47% of all machines.

0.1
 

Kaspersky Lab security researcher Tim Armstrong looks at the security posture of the Android platform and discusses current and future threats to Android-powered devices.

comments      Link