SecurityFeed.info » TrendLabs | Malware Blog

« Expand/Collapse

TrendLabs | Malware Blog - by Trend Micro (10 unread)

November 19, 2008
9:08
PayPal Spam Warns of Fraud, Installs Worm Instead
» ‎ TrendLabs | Malware Blog - by Trend Micro
A new fake PayPal email message is being spammed — this time, it is not the typical PayPal phishing email that everyone is accustomed to. Instead of including links asking for the recipient’s personal information, this spammed message asks users to open a .ZIP attachment.

Here’s a sample email:

Figure 1. This supposed PayPal email message warns users that their accounts may have been compromised.

It informs recipients that their PayPal accounts were hacked, and that some fraudulent activity may have occurred. As part of security measures, “PayPal” is asking users to review the “report” in the .ZIP file and then contact the company if anything unusual is discovered.

The attachment that arrives with this spam, however, does not contain a report or any similar information.

Inside the .ZIP archive is a worm that infects the recipient’s computer upon execution.

Figure 2. Users expecting a document may be surprised to see that file contains an executable.

Detected by Trend Micro as WORM_POISON.LA, this malicious executable has routines that are related to the (now infamous) peer-to-peer file-sharing application Kazaa.

Other PayPal-related spam runs include the following:
- PayPal’s 10th Year Anniversary Phished
- Phishers Spoof ‘The PayPal Blog’
The Trend Micro Smart Protection Network already blocks the spammed PayPal message, keeping users’ PCs away from its malicious attachment. It also detects WORM_POISON.LA and provides solutions for its cleanup and removal. Users are strongly advised to refrain from downloading and executing files found in unsolicited email messages.
9:00
Phishers Take Aim at Slingshot
» ‎ TrendLabs | Malware Blog - by Trend Micro

The Trend Micro Content Security Team just discovered a phishing attack targeting Slingshot Communications, Inc. A phishing email pretends to update a customer’s existing account. It also includes the legitimate contact number of the company to make it seem authentic.

Figure 1. Phishing email sent to users

Figure 2. The Slingshot phishing site

Slingshot Communications, Inc. is the company that pioneered the business of prepaid Internet service. It is best known for its unique, stored value pay-as-you-go format of giving high-speed wireless Internet service to its customers. With these kind of services, unknowing users who might think that this is a legitimate notification from Slingshot, may volunteer their credentials and by that, phishers can now take advantage by using their accounts.

The malicious URLs used in this phishing attack are now blocked by the Trend Micro Smart Protection Network.
November 18, 2008
8:05
New Malware Threatens Mac Users
» ‎ TrendLabs | Malware Blog - by Trend Micro
Trend Micro Advanced Threats Researcher Ivan Macalintal reports of a new malware affecting Mac OS. Detected as OSX_LAMZEV.A, this malicious file could allow hackers to take control of an infected system.

Mac users may be infected when they access remote websites hosting this backdoor. The backdoor may also be disguised as a legitimate application and may be installed and executed on systems.

When executed, OSX_LAMZEV.A prompts users to select an application and a port above 1024. These are Internet Assigned Numbers Authority (IANA) registered ports and are used by vendors for proprietary applications.

The backdoor creates the file /tmp/com.apple.DockSettings and copies this file in the location ~/Library/LaunchAgents. This file is then deleted once it has been loaded to allow this backdoor to execute everytime the system starts up. The application selected by the infected user is copied by this backdoor to a certain location too. It then creates another backdoor component that executes whenever the said Mac application is executed.

These malware routines compromise security, as remote malicious users may gain access to an affected system. OSX_LAMZEV.A also has autostart features, so turning one’s infected Mac on automatically runs the backdoor.

Interestingly in November last year, another notable Mac malware hit users. Detected by Trend Micro as OSX_DNSCHAN.A, this older Trojan dropped malicious script files and came in two versions, one for Windows and another for Mac, depending on the Web browser and operating system used to download it.

There are not many but their number keeps growing. Other Mac threats are documented in the following blog entries:
- Rogue App Sweeps Mac
- Scareware software makes its second round on Mac O/S
The Trend Micro Smart Protection Network already detects OSX_LAMZEV.A and provides solutions for its cleanup and removal.
November 15, 2008
10:25
Spam Volume Plummets as ISPs Pull the Plug on McColo
» ‎ TrendLabs | Malware Blog - by Trend Micro

It looks like spam volume has taken a turn for the better, at least for now.

After a couple of years of playing a shell game with security researchers, spam giant McColo Corp. was finally disconnected. Hosting major operations related to porn, credit card theft, fraud and other nefarious criminal activities, McColo posed as a legitimate corporate entity and conducted its business operations in Silicon Valley. On a global level, McColo is reportedly accountable for anywhere from 50 to 75 percent of all spam activity on the planet.

Trend Micro contributed research & intelligence to the HostExploit.com Cyber Crime Report, which detailed the criminal activity occurring inside of McColo for the past two years. Advanced Threats Researcher Paul Ferguson worked with other security researchers to compile the necessary information on those activities, which compelled their upstream ISPs to terminate connectivity to McColo after this information was made public.

McColo’s Internet Service Providers - Global Crossing and Hurricane Electric, were alerted by these investigators of their criminal activities, and once presented with details of this investigation, the ISPs immediately ceased their connectivity services with McColo.

This event definitely is a big blow to spam in general, however, it may be a very short-lived victory. The criminal operatives affected by these actions will most certainly make every attempt to move their operations elsewhere — we are watching.

The Trend Micro Email Reputation Services (ERS) detected a 40% drop in spam activity immediately following the termination of McColo’s connectivity:

Not only have we seen a dramatic drop in spam inside of Trend Micro’s back-end correlations systems, but the rest of the world continues to see the dramatically lower volumes of spam:

This small victory will most likely be short-lived, as it is almost certain that these obviously profitable criminal operations are too valuable for these criminal operations to be abandoned.

But Trend Micro customers won’t be without protection — the Trend Micro Smart Protection Network will block spam messages even before they reach users’ inboxes, and we are doing continual due diligence to ensure that all of the badware associated with these criminal operations is blocked before you ever see it.

With additional editorial input by Paul Ferguson, Advanced Threats research.

Update: 15 Nov 2008, 21:42 PST: It appears that McColo is back “on the air” as of this afternoon, so we’ll have to see what happens next.

Update: 16 Nov 2008, 09:30 PST: McColo is once again “off the air” as of this morning.
November 13, 2008
18:25
Facebook Picture Joke Connives with Email Harvester
» ‎ TrendLabs | Malware Blog - by Trend Micro
Listen to Rik Ferguson talk about this threat attack on BBC Radio 4

Just recently, I received an intriguing post on my Facebook wall from a friend, someone I know and trust. The post contained the following message:

Has anyone messaged you to let you know your face book pictre is all over {BLOCKED}.com

To be honest, even the spelling and grammar sounded like my friend, but I’m fairly certain that was purely coincidental. Given that the days when I might have had a shot at a modelling career (hands only) are now firmly behind me, I was skeptical that my picture might be all over anywhere.

Once I had let my friend know that their PC was probably compromised by some kind of information stealing malware, I thought I had better go and investigate this website.

So in a clean test-environment, (don’t try this at home folks) I followed the link to the website, only to be greeted by an alarming pop-up:

Figure 1. A quite odd nonetheless alarming popup

I didn’t upload any photos that I remember; so I clicked through to find out more. What do I get? A computerised voice that immediately intones Attention please. Your profile picture has been detected on this website. Attention please. Your profile picture has been detected on this website and this page displayed on the browser:

Figure 2. The displayed page contains a rather ironic disclaimer

I love the little disclaimer at the top: Privacy note: We never send SPAM to your email address. We never sell your personal info. This is NOT a MySpace or Facebook login page. MySpace/Facebook users are not authorised to participate on this website.

So anyway, back to my personal pictures. I need to see them and ask that they be removed surely? So I give them my name and email address and click Submit:

Figure 3. A password request to view the alleged pictures

Now they are asking me to create a password in order to be able to view “my pictures”. The small print here is helpfully telling me that I shouldn’t use the same password I may have previously used on this site, or the same password I use to access other sites, but of course this is entirely the behaviour the scammer is hoping for. I see a box asking for my password, I think “I’m going to need to remember this password. I know I’ll use my standard one” in it goes, and I click Submit again:

Figure 4. Don’t worry about Dave Daveness, that’s the name I entered in the previous pop-up

OK, I understand, a little market research, no problem, I click OK:

Figure 5. Users are asked to choose the website that reffered them

Well I got this from Facebook so I choose that link, and what a shame:

Figure 6. Facebook and Myspace users are not served

Looks like I’ll never get to see those pictures. But I’m really concerned about them. I’ll just hit the Back button in my browser and pretend not to be a Facebook user:

Figure 7. The name of my friend I typed at Figure 2 is stated.

I click on OK and there goes that voice again “Attention please. You must participate to retrieve your final results. Attention please. You must participate to retrieve your final results.”

And yet another pop-up, saying that my good friend reserved a special offer for me, as well as finding these pictures I need to see:

Figure 8. The picture seems to be unavailable

It looks like the content of that window isn’t available right now though, and if I use another browser window to look at the origin of where the content is supposed to be coming from, all I get is a page with a single word on it profitsource. Interesting.

So I’ll try to close the currently broken window down to finally get to my picture:

Figure 9. Another pop-up?

Here we go, here’s what all the fuss was about…

Figure 10. Finally! My picture!

I’m clicking, I can hardly wait!

Figure 11. Obviously not me

So what happens if I found that whole process so funny I can hardly wait to share it:

Figure 12. Harmless? Really?

Some interesting points relating to all of this:
- The person who is registered as owning the domain name I was originally sent to in that Facebook wall post, also owns several hundred other domain names. Now I haven’t tried them all, but I have tried a good few, and they all lead back to this same email address harvesting site.
- Interestingly, the email address of the registered owner (the only part of the registration information I really give much credence to in this case) is listed as bulletinpics@xxxxxxxx.com. Bulletinpics is a slightly older Spam & Scam campaign with shady international links. Here is a graphic example of the kinds of “service” Bulletinpics carry out, where he recruits CAPTCHA cracking cybercriminals:
  
  Figure 13. Forum post by CAPTCHA-cracking criminals
- Finally, all of those different domains registered to the person with the bulletinpics email address, when I visit them; show up in the browser address bar as one particular domain name. If I do a search to see which sites link out to that one particular domain name, I only get one result, a Chinese “Pay to Click” MLM site, that on investigation, doesn’t have the rosiest of reputations.
- Another thing those different domains appear to all have in common is the registrar Moniker Online Services Inc. who appear to have a very interesting history all of their own.
18:02
Bogus Federal Reserve Sites Deliver PDF Exploit
» ‎ TrendLabs | Malware Blog - by Trend Micro
A new round of PDF exploits are being pushed by websites pretending to be the US Federal Reserve. Several spammed email messages were intercepted starting last week advertising these fake Federal Reserve pages.

Figure 1. Sample email message.

This spam run is still continuing as of this writing, and it is now advertising more bogus sites. So far, the said malicious sites are using following domains:
- 1federalreservebank.com
- 1federalreservebank.net
- connection-secure.net
- fdicbanks.net
- fdicorp.org
- fdic-secure.org
- fed-reserve.com
- fed-reserve.net
- federalreserveus.com
- federalreserveus.net
- fedreservebank.net
- fedreservesystem.com
- fedreservesystem.net
- tdbanks.net
- treasurydepartment.net
- us-bankconnect.net
- us-bankers.com
- us-bankers.net
- us-securebanking.net
- usbanker.org
- usbanksecurities.net
These domains resolve to a single IP address with a relatively short TTL (time to live) of 3600 seconds. What’s peculiar with the above domains is that when one is using OpenDNS and browses to the prepared site, OpenDNS will report that the site is not loading. However the DNS requests over other ISP’s nameservers loaded the bogus Fed pages.

Figure 1.Bogus US Federal Reserve website.

The fraudulent site redirects to a porn search page a few seconds after loading, and a PDF exploit is downloaded into the system. This particular script hosting the exploit has some anti-detection routines which attempts to prevent its contents, particularly the PDF JavaScript, from being seen by nosy researchers.
Though with a little fiddling with Adobe Acrobat Pro, I was able to disable its “protection” and I readily saw the PDF JavaScript.

The PDF JavaScript is designed with downloaders of downloaders that come from different internet locations.The final component (at the end of downloader chain) the trojan infects and automatically restarts the victim PC.
After restart, the infected machine lounches out regularly malformed HTTPS transactions (with an interval of 6.5 seconds) to a certain server. The transaction can be considered malformed because the SSL handshake, used by normal SSL websites, is missing in this particular HTTPS traffic. Even though, the traffic is somehow still encrypted. This type of HTTPS bot has been spotted a few months earlier.

The regularity of the HTTPS traffic suggests that this is a botnet having a Web-based C&C. This is certainly an improvement over the Web-based bots of old, where traffic are seen in plaintext. The botherders have actually made it a point to hide the network actions of their bots from IDSes (intrusion detection systems) by encrypting their network traffic. Makes one wonder what else the bad guys have in store for us.

Trend Micro Smart Protection Network already blocks the spammed message as well as the malicious URLs involved in this and previous PDF exploit threats.

Updates as of November 17, 2008 1AM PST: Trend Micro detects the PDF exploit as TROJ_PIDIEF.DN. It connects to a remote website to download another malicious file detected as TROJ_INJECT.NI.
November 12, 2008
19:01
Popular Wi-Fi Encryption Mode may be Cracked
» ‎ TrendLabs | Malware Blog - by Trend Micro

A flaw has been found in Wi-Fi Protected Access (WPA), currently the most widespread mode of Wi-Fi encryption, and some analysts are painting a gloomy picture. PC World reports that security researchers Erik Tews and Martin Beck have found a hole in the WPA encryption protocol that malicious users could exploit to steal data sent from routers to Wi-Fi-enabled computers. This same flaw may be used to send unsolicited data online, which may in turn lead to the downloading of malware, phishing scams, and all sorts of nasty Web-based threats.

However, Trend Micro Advanced Threats Researcher Paul Ferguson believes that WPA is not yet lost. “I think the security of WPA itself is still somewhat secure - this exploit is highly reliant on very susceptible situations,” he says. The exploit itself does not allow malicious users to steal information sent by computers to routers.

WPA was developed after several flaws in its predecessor Wired Equivalent Privacy (WEP) was identified. WPA was developed to accommodate two different ways to protect data, Temporal Key Integrity Protocol (TKIP) and Advanced Encryption System (AES). The flaw discovered by Tews and Beck only works on TKIP, which was partially based on WEP.

Other modes of Wi-Fi encryption are believed to be more secure than TKIP, which was the first solution created to improve highly non-secure WEP. WPA2 for example, usually allows both TKIP and AES encryption methods. So in essence, using WPA2 authentication with AES encryption still secures users’ Wi-Fi transactions.

Further, Ars Technica has quoted Tews saying, “If you used security features just for preventing other people from using your bandwidth, you are perfectly safe.” A long network key, a short rekeying time, and a busy network can also handily defeat this exploit.

Users shouldn’t be too scared of having their air-borne Wi-Fi data messed with. At least not yet. There’s no harm in switching to WPA2, though.
November 11, 2008
10:17
Adobe Reader Vulnerability: Actively Being Exploited
» ‎ TrendLabs | Malware Blog - by Trend Micro
Several active exploits targeting a vulnerability in Adobe Reader are now in the wild.

Patch now.

Last week, Adobe released an update for Adobe Acrobat 8 and Adobe Reader 8 and a day later, a working exploit code for the util.printf() vulnerability was released. As expected, malware authors were quick to use the exploit for their own gain.

Trend Micro Research Manager Ivan Macalintal was alerted to the discovery of malicious .PDFs that exploit the Adobe Reader vulnerability, which Trend Micro now detects as TROJ_PIDIEF.CB. Users with unpatched Adobe Reader software may be infected when they unknowingly access a certain remote website or are redirected there from malicious banners and ads.

Upon execution, TROJ_PIDIEF.CB could crash Reader and then allow a malicious user to take control of an affected system. This compromises system security and exposes it to more threats as malicious users could easily dump adware and malicious programs under the VUNDO, VIRTUMON, and in some cases, also VIRUT families into infected PCs.

Trend Micro strongly advises users to patch their Adobe Reader to ensure they are safe from the threats that come with this vulnerability by downloading the updates found in the Adobe Security Bulletin:
- [www.adobe.com]
The Trend Micro Smart Protection Network detects TROJ_PIDIEF.CB at the desktop level and provides solutions for its cleanup and removal. It also blocks the related malicious URLs.
9:31
Malware Watch: Obama ‘Impeachment’ Spam
» ‎ TrendLabs | Malware Blog - by Trend Micro
U.S. President candidate John McCain plans to impeach president elect Barack Obama, at least according to the latest post-election spam spotted today. Here’s a screenshot of the sample email message:

Figure 1. Politically-tinged spam email just keeps coming

Our researchers have seen the following subject lines containing the same text as the above:
- Barack Obama in Danger – McCain will fight for the president post
- McCain Lawmakers Impeach Obama
- The impeachment of new president Obama
- Barack Obama can lost President’s Chair.
- POLITICAL STRIKE TIES
- McCain Lawyers Want to Stop Obama
This is to rouse the curiosity of users into clicking the link that connects to several malicious Web sites. When users access the sites, a bogus US government official website is displayed. It presents a fake video (actually an image) and tricks the user into downloading a fake Adobe Player installer from a URL ending in AdobePlayer9.exe. Trend Micro detects this file as TROJ_PACKED.JFP. It drops and executes TROJ_ROOTKIT.FX. Smart Protection Network also blocks users from accessing the malicious links in the spam, the fake video, and the URL from which the executable is downloaded.

Election-related spam in the last week:
November 10, 2008
9:52
‘US Treasury’ Warns of Phishing, Redirects to Malicious Sites
» ‎ TrendLabs | Malware Blog - by Trend Micro
Spammed email messages supposedly from The United States Federal Reserve Bank warn their recipients of a “large-scale phishing attack” affecting several banks and credit unions. A spammed message may look like this:

Figure 1. Sample spammed message.

The email message gives details on the supposed phishing attack and adds that the US Treasury Department has also monitored a high level of illegal wire transfers. Having told recipients that, the email message then informs them of restrictions imposed on federal wire transfers as part of security measures being taken by concerned government agencies.

The message helpfully gives some links where users can get more detailed information. But instead of being directed to a legitimate website, those who click are led to .org domains with names completely different from the websites of the Federal Reserve Bank, the Treasury Department, or the Federal Deposit Insurance Corporation.

Trend Micro engineers are currently investigating this threat. We will post updates as soon as more information becomes available. Other related attacks that use the names of legitimate government organizations or mask themselves as security measures include the following:
Users are advised to refrain from clicking links in unsolicited email messages. It is best to go directly to the website of the concerned organization for more information.

Updates as of November 11, 2008 6PM PST: Users who unfortunately click on the links in the spam infect their PCs with TROJ_INJECT.DG. This Trojan restarts systems and drops TROJ_INJECT.KQ. TROJ_INJECT.KQ opens a hiddend Internet Explorer window and connects to a certain website to send and receive information.

Updates as of November 13, 2008 2AM PST: TROJ_INJECT.KQ opens a hidden Internet Explorer window to connect to a certain website. It sends to and receives information from this site, compromising system security.