SecurityFeed.info » F-Secure Antivirus Research Weblog

« Expand/Collapse

F-Secure Antivirus Research Weblog (10 unread)

November 20, 2008
11:56
German, Finnish and Swedish
» ‎ F-Secure Antivirus Research Weblog

German, Finnish and Swedish versions of E:VOLUTION are now available on our YouTube Channel.

On 19/11/08 At 06:12 AM
11:56
Video - E:VOLUTION en francais
» ‎ F-Secure Antivirus Research Weblog

Bonjour. By popular demand, E:VOLUTION has been translated into several different languages. You can now find the French version via our YouTube Channel.

E:VOLUTION — French language version

Additional language versions will soon follow.
On 18/11/08 At 03:36 PM
11:56
VirusResponse Lab 2009
» ‎ F-Secure Antivirus Research Weblog

Last Friday, we came across a rogue application, VirusResponse Lab 2009, that used a fake 404 page as part of its social engineering attack.

Many rogue affiliate sites will use script to generate animated "online scans" and then attempt to convince the visitor into downloading the rogue installer file via a pop-up dialog.

404dnswebsite .com took a different approach. Rather than producing a fake scan and prompting for a download, it instead simply hosted a fake 404 error message:

If the victim fell for the trick, they would have downloaded what we detect as FraudTool.Win32.Agent.eh.

As you can see from the screenshot above, the fraud page is not at all dynamic. Even though we opened the page with Firefox on a Linux based system, the page displays the text "Internet Explorer".

The 404dnswebsite account is now suspended.

On 17/11/08 At 04:24 PM
11:56
Web Trail
» ‎ F-Secure Antivirus Research Weblog

One of our development teams would like you to try their beta application, Web Trail.

They want feedback before moving on to the RTM version.

You can download it from here.
On 13/11/08 At 04:49 PM
11:56
Termination of EstDomains, 24 November 2008
» ‎ F-Secure Antivirus Research Weblog

The termination of ICANN-accredited registrar EstDomains is to go ahead, effective 24 November 2008.

There are approximately 281,000 domain names managed by EstDomains, many of which shouldn't be touched with a ten-foot pole.

ICANN is now seeking expressions of interest from registrars to receive a bulk transfer of those domains. Anyone interested?

See our past posts here, here, and here for additional details.
On 13/11/08 At 03:54 PM
11:56
McColo Mole Wacked
» ‎ F-Secure Antivirus Research Weblog

Kudos to Brian Krebs, whose excellent investigative reporting produced some rather dramatic results.

What's the story? McColo Corp. — major source of spam — was knocked offline earlier this week. And now there's a large decrease in the amount of spam being distributed.

Why is that? Because McColo Corp. was hosting a large number of spam bot control and command servers. Knocking them offline has left the spam bots temporarily without masters.

Unfortunately the bots themselves are still out there, so the spam will eventually return.

You can download a very detailed report on McColo from hostexploit.com.

On 13/11/08 At 03:11 PM
11:56
We're on Security Focus
» ‎ F-Secure Antivirus Research Weblog

This is just a short note to mention that Security Focus is now syndicating our weblog posts:

You can find them, and others, at [www.securityfocus.com].

Cheers.
On 12/11/08 At 02:34 PM
11:56
Researchers Hack Storm Botnet for Economics Study
» ‎ F-Secure Antivirus Research Weblog

There's an interesting study on the economics of spamming, reported today at BBC and The Register.

Spamalytics: An Empirical Analysis of Spam Marketing Conversion was authored by researchers from the University of California, Berkeley, and UC San Diego.

Summary: the Storm botnet sends out spam leading interested parties to two sites, a malware-infected site designed to expand the botnet itself and a pharmacy site promoting "male enhancement drugs". It has been assumed that even a few people buying such products would be enough for spammers to make a huge profit, but few studies have been performed to investigate.

In this study, the researchers hacked into the Storm botnet's command and control system to modify a subset of spam already being sent out. The change redirected "any interested recipients to servers under [the researcher's] control, rather than those belonging to the spammer", where the researchers could track sales attempts. They could then use the data to figure out how many actual sales the entire spam operation would be likely to generate.

Interesting points from the analysis: even with a tiny conversion rate of "0.00001 per cent" from spam to sale, spammers can still net a fair bit of profit, but not as much as suggested. Since the conversion rate is so minuscule however, spammers can be really pressured by countermeasures that affect it, like anti-spam filters, blacklists and so on.

The study also clearly documented the reasoning the researchers used to handle the legal and ethical issues they faced, the key points being that they: 1) did not actively send out the spam itself, or create new spam; 2) none of the actions performed based on the methodology were "intrinsically objectionable"; and 3) where there was potential for harm, they worked to "strictly reduce" it.

Interesting stuff.
On 12/11/08 At 02:03 AM
11:56
Antivirus Professional 2008
» ‎ F-Secure Antivirus Research Weblog

Yesterday's post, Stupid Rogue Trick, took a look at antivirus-online-scanner .com and a rogue application called Antivirus Professional 2008.

The antivirus-online-scanner site was using GeoIP Lookup to customize the supposed threat that would be displayed to visitors. If you visited from Helsinki, Finland then the threat was called something such as Win32.IRC.Bot.Helsinki.

A nasty trick for the unsuspecting…

Taking a look today, we discovered that the site is offline. Good news, such sites are often difficult to get shutdown. So, who was the ICANN Registrar?

EstDomains. You remember Case EstDomains from two weeks ago don't you?

Hmm. The site was created back in June.

Well, at least it's suspended now.

On 11/11/08 At 04:38 PM
11:56
Stupid Rogue Trick
» ‎ F-Secure Antivirus Research Weblog

We came across a rogue today called Antivirus Professional 2008 that uses GeoIP Lookup as part of its scare tactics.

This site uses Flash and script to create the effect of an online scan, that then attempts to push an installer at the visitor.

The NoScript extension for Mozilla Firefox is an excellent way to mitigate against this kind of garbage.

But here's the interesting thing…

The "antivirus online scanner" site is using the visitor's IP address to customize the so-called threat.

Oh no. Trojan.Helsinki.Downloader.26. Right.

Refreshing the page regenerates the supposed threat.

On 10/11/08 At 02:02 PM

← Software Vulnerability Exploitation Blog Full Disclosure →

SecurityFeed.info » F-Secure Antivirus Research Weblog

Feeds

F-Secure Antivirus Research Weblog (10 unread)