I'm here at Defcon watching the hacker masses share their information. As usual, it's incredibly crowded, but the new venue at the Rio hotel is a welcome upgrade. Las Vegas is as hot and crazy as ever. It's never a boring visit.

So far there have been some great talks, and I'd like to highlight a few favorites.

The talk by Moxie Marlinspike; "SSL and the Future of Authenticity" covering the shortcomings of the Certificate Authority system, was an eye-opening look into how broken this system is. As always, Moxie is an engaging and relevant speaker, and his solution is based around a distributed system with multiple authorities verifying the site you're connecting to. With a few kinks still to work out, it's an interesting idea, and certainly it's time to move away from the current model.

Another talk, by Daniel Garcia, called "UPnP Mapping" demonstrated an issue quite widespread on the internet. UPnP (Universal Plug and Play) is a interoperability system developed by Microsoft, with the idea that devices could added to a network with zero setup. It's never worked very well at best, and at worst, it can provide a remote party all sorts of information about your device from the Internet. Mr. Garcia demonstrated a tool where he was able to scan a network block, create a list of vulnerable routers, and then even issue commands. In some cases these routers could be used as an open proxy, or many other more malicious purposes.

A few days ago, we have notified you about malicious activities from the S.A.P.Z. botnet. And we provided evidence that this methodology of attack can be used to affect users of any Latin America bank, or any part of the world.

Now the S.A.P.Z. gang, which may be Peruvian, has resorted to another strategy. It is focusing on the theft of sensitive information, by spreading a variant of Palevo worm, detected by Kaspersky Lab as P2P-Worm.Win32.Palevo.cudq.

The key element of this is that with S.A.P.Z., the cyber-criminals have used the functionalities of an old web application created for the administration of stolen data, called Blackshades. As indicated in this image, now they’re not only focusing on Peruvian users, but also others countries such as Chile, Colombia, Spain and USA.

    This year the Virus Bulleting Conference, one of the most prestigious annual events in the anti-virus industry, took place in Vancouver, Canada.

It was a special event for Kaspersky Lab since we had a record-breaking total of seven speakers:  who covered the most interesting and hot topics such as mobile malware, on-line fraud and black markets, targeted attacks. Last, but not least, we were able to reveal some new details about Stuxnet in a joint presentation with Microsoft. The VB conference demonstrated again how important cooperation between researchers is. Between the joint work on Stuxnet and the Zeus-related arrests we saw how AV researchers from different countries; cultures and companies join forces to fight cyber crime and to make this world safer.

Every year the AV community gathers at VB - next year it will be in Barcelona, Spain and I hope we will also have good news to share again.

PS We will be posting the Kaspersky VB papers online over the next few days here http://www.kaspersky.com/VB_2010

During my recent research into PHP backdoors, bots and shells, I came across a few IRC servers which looked pretty suspicious. After lurking in these channels I noticed that most of them were all about controlling botnets, automated exploitation and credit card fraud. This isn’t news – channels and IRC servers like this have been a hot media topic for the last five years. The question is, though, how can we find them so we can shut them down?

Digging a bit deeper in some of the channels, and looking the websites people were talking about in these channels, I started to see patterns. For example, some of the websites use the same words, phrases and layout. By combining these terms and creating a simple rotation algorithm I could use search engines to find websites offering illegal stuff such as credit card data and skimming tools.

Just few hours ago Twitter officially announced the launch of their new iPhone application called “Twitter for iPhone”. The news quickly became a trendy topic in Twitter and as it used to be the criminals took advantage of this one more time. The difference this time is that the criminals behind this particular attack didn’t want to use Rogue AV malware but a Worm with dropper functions to deliver Trojan banker malware to the users machine.

This is an example of detected malicious twitts by us:

The initial Trojan is downloaded to the victim machine by a malicious Java archive file. It has several malicious features, for example: spreading through USB devices; it disables Windows task manager, the regedit application and also notifications from Windows Security Center. Also it creates a copy of itself in the system with the name of Live Messenger. The criminals even included an anti-virtualization feature. The worm checks if the hard drive of infected system is virtualized or not. If found to be in a virtual system, the malicious code won’t be executed.

As I mentioned the main goal of this Trojan is to steal on-line bank credentials of the victims!

This malware is very harmful since credit cards and on-line banking credentials are in the game. Please, be really careful specially with trend topics (searches) since in many cases they are being used by criminals.

Kaspersky Anti-Virus detects the threat as Worm.Win32.VBNA.b

This week I received a letter from American Express which stated that my credit card had been temporarily blocked because of potential fraudulent activity. It also said that I needed to call a number to confirm the recent transactions and get the card unlocked.

That seems like a very reasonable thing to do. However the number they asked me to call was not listed on the American Express web site. Though the letter seemed legit I did the only right thing – call their regular number and work things out from there. While digital phishing is the current hot thing to do there are still criminals forging good old snail mail letters to trick users.

It turned out that the number listed was a direct number to their fraud department which isn’t listed on the site. I’ve requested American Express to change their practices.