Archive for category: Malware

You are here: / Malware

New adware Trojan circulating that targets Mac OS X systems

An article from Cnet about New adware Trojan circulating that targets Mac OS X systems:

A new Mac OS X Trojan is making the rounds, installing an adware plug-in that renders ads on Web pages to generate revenue for its author.

Dubbed Trojan.Yontoo.1, it is the most prominent of an increasing number of adware Trojans making the rounds, according to Russian antivirus company Dr. Web, the same company that discovered the Flashback virus last year.

to read more click here:

A DHL delivery which is nothing but malware – Windows users warned of email attack

An article from Dark reading: Just earlier this week, I warned about a malware attack that had been widely spammed out posing as a message from DHL Express International.

The trick, which is an old one, goes like this.

Cybercriminals spam out an email, with forged header information, tricking you into believing that it is from a shipping company like DHL or FedEx.

To read more click here:

Exposed Devices Used as Botnet to Scan Internet

An article from threat post about botnet: A controversial Internet scanning project has come under fire for illegally accessing and running code on remote machines. The Internet Census 2012 project, revealed Sunday in a post to Seclists.org, discovered 420,000 embedded devices accessible using default credentials. The unnamed researcher behind the project then used the devices as a botnet to scan most of the IPv4 address space.

Although the researcher said in a paper that no changes were made to any of the devices and all were returned to their original state after a reboot, the project is drawing the ire of the security community.

To read more click here:

Researchers highlight potential security risk to iOS users

An article from Cnet about Apple OS malware: Though Apple’s mobile OS is often thought of as impervious to malware, hackers could potentially control a device using a malicious iOS profile, says Skycure Security.

Android usually gets smacked around for playing host to mobile malware, but iOS isn’t totally immune, according to researchers at Skycure Security.

To read more click here:

Android App Licenses Sold in Malware Black Market

Malware article from TechNews:   Verified Android developer licenses are being sold in an Internet black market for $100 each, giving buyers unfettered access to the official Google Play app store.

So far, there’s only been one buyer, but he’s a maker of mobile banking Trojans, security blogger Brian Krebs revealed this week. It’s may just be a matter of time before the buyer uses the verified licenses to sneak corrupted apps into the Google Play store.

To read more click here:

Old School Malware Writers Resurface With ‘MiniDuke’ Cyberattack

an interesting article in Fobes  about malwware:  Have old school malware writers resurfaced? According to Kaspersky Lab CEO Eugene Kaspersky they have, and they are behind the newest cyber attack against governments in Europe through a malware code the Russian internet security firm dubbed “MiniDuke.”

In a statement on their Securelist website, Kaspersky said miniduke is a very unusual cyberattack. I remember this style of malicious programming from the end of the 1990s and the beginning of the 2000s. I wonder if these types of malware writers, who have been in hibernation for more than a decade, have suddenly awoken and joined the sophisticated group of threat actors active in the cyberworld. These elite, ‘old school’ malware writers were extremely effective in the past at creating highly complex viruses, and are now combining these skills with the newly advanced sandbox-evading exploits to target government entities or research institutions in several countries.

To read more click here:

Lastline Report Finds Evasive Threats On The Rise

An Interesting article from Dark reading on Evasive Malware :  SANTA BARBARA, Calif.–(BUSINESS WIRE)–Lastline, Inc., a new provider of active malware defense solutions for businesses, has released a new report, “The Security Threat of Evasive Malware,” that looks at how malware authors are able to exploit the limited visibility of automated malware analysis systems (sandboxes) and ensure that targeted attacks and zero day exploits remain successful. The report concludes that the use of stalling codes is resulting in a growing trend of evasive threats.

“Malware authors have been using evasive techniques for years, and those techniques are becoming more and more complex,” said Chris Kruegel, Chief Scientist at Lastline. “It’s a game of cat and mouse as once a solution to an evasive threat is discovered, the malware authors go back to the drawing board and find another way to avoid detection.”

To read more click here:

NBC website hacked and distributes malware – here’s what happened

An interesting article  form Naked Security about NBC website being hack :The latest high-profile organisation to fall victim to cybercriminals is the National Broadcasting Company (NBC), one of the so-called Big Three television networks in the USA.

NBC’s website was “owned” and used as a go-between in a campaign to infect online visitors automatically.

For more on this topic click here:

Apple’s own Macs bitten by Java-based malware attack

An article form naked Securty about malware  on Mac:   If you still think malware on a Mac is more myth than reality you may want to talk to the security engineers over in Cupertino at a rather prestigious fruit company.

According to Reuters, “Apple Inc. was recently attacked by hackers who infected the Macintosh computers of some employees”.

More specifically Apple engineers had their Mac OS X laptops infected by the same zero-day Java vulnerability that infected Facebook last month.

To  read more on this topic click here:

DNSChanger Malware: Produced by US-CERT

US-CERT encourages users and administrators to ensure their systems are not infected with the DNSChanger malware by utilizing tools and resources available at the DNS Changer Working Group (DCWG) website.

Computers testing positive for infection of DNSChanger malware will need to be cleaned of the malware in order to maintain continued internet connectivity beyond July 9, 2012.

On November 8, 2011, the FBI, NASA-OIG, and Estonian police arrested several cyber criminals in “Operation Ghost Click.” The criminals operated under the company name “Rove Digital,” and distributed DNS changing viruses, variously known as TDSS, Alureon, TidServ, and TDL4 viruses.

Additional information about Operation Ghost Click and the DNSChanger malware is available at the FBI website.

Relevant Url(s):

<http://www.dcwg.org/>

<http://www.fbi.gov/news/stories/2011/november/malware_110911>

 

 

This document can also be found at

http://www.us-cert.gov/current/#dnschanger_malware