SecurityFeed.info » F-Secure Antivirus Research Weblog

« Expand/Collapse

F-Secure Antivirus Research Weblog (10 unread)

September 08, 2008
12:49
Inside-Out Improvements
» ‎ F-Secure Antivirus Research Weblog

Our 2009 consumer products were official launched last Wednesday and there are a number of technological enhancements within.

The lab has been busy working with core improvements inside our scanning engines for several months now, and we are very satisfied to see it yielding results so soon.

We scored very well in AV-Test.org's latest results. More importantly, we're improving on our own already good results.

2009's scanning engines detect more, and do it faster.

From AV-Test.org:

"Outside" improvements have been implemented as well.

Our marketing team did some research for the 2009 packaging and developed a better box.

Dr. Tuula Pohjola of the Helsinki University of Technology was approached to perform a life cycle assessment (LCA). Keep an eye on the pressroom for the full details, coming soon.

For now, the basic details are as such — on-demand digital production techniques, local raw materials, plant-based inks, and it's easily recycled. Very nice.

It looks very nice too, as seen in this photo with two of our Helsinki office employees, Weronika and Niina.

You can find more pictures (of the boxes) from our marketing pages.
On 08/09/08 At 11:49 AM
September 05, 2008
19:47
abuse@human-rights.org
» ‎ F-Secure Antivirus Research Weblog

Digital security is something that human rights activists are concerned about, and they should be…

Here in the lab, we see many examples of targeted malware attacks focused on human rights organizations. Here's one example from September 3rd that ironically uses "digital security training" as the hook.

The spoofed message is very well done; the content uses real names, organizations, e-mail addresses, phone numbers, et cetera.

It looks very legitimate at first glance.

The message was sent to a human rights activist based in the USA. There was a Word document attached.

It too uses real names, locations, and so on.

Fortunately, the recipient of this message was knowledgeable enough to avoid opening the attachment. Instead of opening it, he forwarded it to the lab for analysis.

Yep. It was a trap. The Word document had an exploit.

The only thing about this case that seems to indicate "hackers" rather than "spies" is the document's author.

…perhaps the spies are paying the hackers?

Front Line Defenders, mentioned in the e-mail message actually has some very good security advice on their site.

They should perhaps add one more topic — targeted malware attacks.

You can read more on the topic from Wired.com.

P.S. Front Line's Software Installation guide suggests uninstalling ALL unused Windows applications. Great idea.

Human Rights Organizations really concerned with digital security might also consider going one step further by giving something such as Ubuntu a try. It's free, has all of the needed applications, and none of the current exploits being used against activists.
On 05/09/08 At 08:26 PM
19:47
It's Time for 2009
» ‎ F-Secure Antivirus Research Weblog

Today is the official launch day for our 2009 consumer lineup. Lots of work has gone into the launch, and plenty more has gone into the development. We'll have some details on the technology for you later.

In meantime, check out our Online Wellbeing campaign.

On 03/09/08 At 03:51 PM
19:47
Google Chrome and Security
» ‎ F-Secure Antivirus Research Weblog

So Google's Chrome web browser has been released.

For a change it's nice to see a browser that does not eat all of your memory.

Chrome is going to become popular. That means it will also become an interesting target for malware authors.

Google knows this.

Chrome features sandboxing of each tab, built-in web reputation service, special privacy mode and so on.

For example, here's what it looks like when you try access a known malicious site with Chrome:

However, one security vulnerability has already been found, based on the WebKit engine used inside Chrome.

There will be more issues, especially related to plugins.

We expect Chrome to quickly gather a sizable market share, mostly from existing Firefox users.
On 03/09/08 At 06:54 AM
19:47
Video - E:VOLUTION
» ‎ F-Secure Antivirus Research Weblog

The Lab's YouTube channel has been updated:

E:VOLUTION

This "white" video is a sequel to last year's "black".

RE:SOLUTION

Enjoy.
On 01/09/08 At 10:26 AM
August 28, 2008
10:51
Western Union MTCN #2989115571
» ‎ F-Secure Antivirus Research Weblog

Fake airplane tickets, greetings cards and credit card receipts…

There's plenty of ZIPped trojans being spammed around. The one that's being seeded right now claims to be a bounced Western Union money transfer.

And the malware inside the ZIP is a ZBot banking trojan variant.

On 28/08/08 At 11:10 AM
10:51
Space Based Malware
» ‎ F-Secure Antivirus Research Weblog

An online games password-stealer has reportedly made its way onto the International Space Station.

Fortunately for the space station, there's no direct Internet connection, and so therefore no online games to steal from (one hopes). The malware most likely made its way onto the infected ISS laptop via an infected USB drive.

Autorun.inf worms is another way of categorizing such malware. Worm.Win32.AutoRun.bhx is our detection name for their particular variant. Read more about it from the AutoRun.BHX description page.

BBC News has additional details.
On 27/08/08 At 02:58 PM
10:51
Somebody Doesn't Like Us in Denmark
» ‎ F-Secure Antivirus Research Weblog

This morning we saw several spam runs in the country of Denmark. The messages are in Danish and they are sent to Danish e-mail addresses.

The e-mail claims to be from us. It's not.

Here's what the e-mail looks like:


   From: supportupdate@f-secure.com
   Date: 26. August 2008 08:31
   Subject: Data er tillagt og sendt med denne meddelelse.

   Käre kunder!

   Regning

   Data er tillagt og sendt med denne meddelelse.

   Jeg bruger gratis F-secure antispamversion, som allerede har fjernet 338 spambreve.

   Antispam er helt gratis for private brugere.

   Attachment: f-secure.rar


The attachment contains a file called update26.08.2008.exe, which, when run, drops a file called dcbcg.exe (Unker related trojan) that connects to a server in Ukraine.

We detect this trojan as Trojan:W32/Agent.FVO. More information in the virus description.

The spam run must have been fairly large, as we've received more than 13,000 bounces to supportupdate@f-secure.com from non-existent e-mail addresses alone.

Watch out and pass the word.

Update: Agent.FVO is a downloader.

Yesterday, its C&C server was quiet so there were no additional components for download. Today, the C&C server is pushing out a BZub variant which has been detected as Trojan-Spy.Win32.Bzub.fbm since our 2008-08-25_07 database update.

BZub is a trojan-spy interested in banking details.
On 26/08/08 At 09:44 AM
10:51
An Unexpected Demonstration of Mobile Security
» ‎ F-Secure Antivirus Research Weblog

Encountering a mobile phone worm "in the wild" has never been a common event. But even less common must be encountering one in the wild while you're giving a presentation on mobile phone security.

Erkki Mustonen (Eki) is a Technical Service Manager here at F-Secure. He's very knowledgeable and frequently handles requests for comment from Finnish journalists regarding AV technologies.

Earlier this week Eki was visiting a customer's premises and was giving a presentation to approximately twenty people. As he was discussing the topic of mobile malware, a quite unexpected demonstration took place. Some of the phones within the room started to flicker simultaneously. Very soon it was determined that connection attempts were being made from a phone located somewhere nearby (but not in the room itself).

What was the source of the commotion? It was Commwarrior.B sending a copy of itself to open Bluetooth connections. Three years old and the worm is still kicking around.

The customer's phones were all Symbian S60 3rd Edition phones with F-Secure Mobile Security installed. So there were no infections and no problems. Commwarrior.B will not install on a S60 3rd Edition phone. Regardless, it wasn't even given the chance.

And the nearby S60 2nd Edition phone with the Commwarrior.B infection? Eki thinks that the phone's owner really should consider installing a security solution…

Here are some screenshots from Eki's Nokia E61i:

On 22/08/08 At 07:36 PM
August 18, 2008
11:23
Drops, Dumps, CVVS, WMZ, WU, et cetera...
» ‎ F-Secure Antivirus Research Weblog

Underground forums are always full of chatter around various activities related to online crime.

You keep reading about things like dumps (stolen credit card information), carding (using those cards), WU (Western Union), WMZ (Webmoney), CVVs (card verification value) and drops.

So what's a drop?

A drop is a remailing location. Many online shops refuse to send expensive items (think laptops, video cameras and so on) to faraway countries. So criminals use stolen credit cards to purchase items and have them mailed to a local drop, where someone else picks up the gear and forwards it to the final destination. Alternatively the dropkeeper will simply sell the goods in online auctions and then credits the carder with part of the profits.

Here's an example from an underground forum where an individual is advertising his website, providing such services. He offers 25% of the profits of the carder items to the carder — keeping 75% to himself.

And here's his website. Nice one.

On 18/08/08 At 11:41 AM

← Software Vulnerability Exploitation Blog Full Disclosure →

SecurityFeed.info » F-Secure Antivirus Research Weblog

Feeds

F-Secure Antivirus Research Weblog (10 unread)