Industry Intel

By Michael Sweeting

After a relatively long lag period without seeing any particular new and exciting Mac malware, last week we saw the surfacing of a new and interesting method of compromising the OSX system. Malware authors have taken a new approach by altering file extensions of malicious .app packages in order to trick users into thinking they are opening relatively harmless .pdf or .doc files. Changing file extensions in Mac OSX can be tricky due to a built in security feature of the OS that detects attempts to change the extension and automatically annexes the extension of its correct file or package type. So what’s the trick you may ask? Well, in order for malware authors to get around this built in OSX security feature, they are implementing what is called “right-to-left encoding” using the built in Mac OSX Character Viewer. OSX Character Viewer allows the user to very easily insert a vast array of characters and text input methods, which in this case, gives the malware author the ability to insert a fake file extension using the “right-to-left” encoding character. read more…

Recently we’ve seen a new fake security product running around that has made improvements to the standard rogue. Typical rogues are annoying, but relatively easy to take care of. Previously, all you had to do was boot into safe mode with networking and remove the files and registry entries (or install an antivirus product). Support forums everywhere use safe mode with networking as the “go to” mode for virus removal as non-core components are not loaded at start up and it’s easier to isolate problems. In the vast majority of the rogues we see, they are not loaded in the few modules which start up in safe mode. Antivirus System does, however, and it also applies some new and improved social engineering tactics to fool you into thinking it’s a real program trying to help you.

Once loaded onto your system, any executable you try and launch will be stopped and flagged as malicious – pretty standard. Eventually the interface will come up and will start scanning. What’s unique about this variant is it does actually scan your system. I do not mean it removes malware or does anything beneficial, but the infections it reports are real files on your computer. This variant flagged Dell drivers that are exclusive to my laptop model and one of my chrome extensions. This indexing of real files is a big improvement over the transparently fake “scan” buttons on previous rogues that just lead to an animation of a loading bar along with a generic list system files. Antivirus System also has many “features” which appear on most legitimate security applications. It has Internet Security which is similar in description to Webroot’s Web Threat Shield. Their Personal Security attempts to spoof features like Webroot’s Identity Shield, and Proactive Defense fakes features similar to Webroot’s Real Time Protection. This rogue even has configuration settings like “Concede resources to other applications” alluding that it can lower how much of a resource hog it can be – if you pay for it. Of course none of these “features” do anything, and if you try and switch them on you’ll just be presented with their purchase screen.

Removal without Webroot installed

Most experienced users would immediately go into safe mode with networking after seeing this. This won’t work, as the rogue is attached to the explorer shell, which is a module loaded in safe mode, and it will lock you down after you launch any executable (regedit, task manager, standalone virus removal tools, ect.). This is probably the point where most people have run out of options and consider taking their PC to a 3rd party technician where you’ll likely pay double the ransom cost of the Rogue. There is no need to do this as there are plenty more tricks to get around these rogues.

• Boot into Safe mode with Command Prompt (doesn’t launch explorer shell)
• The first screen that comes up is cmd.exe, type: “control nusrmgr.cpl” to launch the user account screen
• On the user account screen click on “Manage another account”
• On the Manage Account screen click on “Create new account”
• Call this account whatever you want and then create the account (just make sure it has administrator privileges)
• Reboot the computer and then log into that new account (safe mode or normal mode)
• This new account won’t have those policies the virus created and you should be able to use this account freely You can install Webroot to scan and remove the virus, or you can just delete the files and registry entries associated:
• DELETE:
  C:UsersAll Userspavsdata
  C:UsersAll Userspavsdata21.4.exe
  C:UsersAll Userspavsdataapp.ico
  C:UsersAll Userspavsdatacache.bin
  C:UsersAll Userspavsdatasupport.ico
  C:UsersAll Userspavsdatauninst.ico
  C:UsersAll Userspavsdatavl.bin
  C:ProgramDatapavsdata
  C:ProgramDatapavsdata21.4.exe
  C:ProgramDatapavsdataapp.ico
  C:ProgramDatapavsdatacache.bin
  C:ProgramDatapavsdatasupport.ico
  C:ProgramDatapavsdatauninst.ico
  C:ProgramDatapavsdatavl.bin
  HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “avsdsvc” = “%CommonAppData%pavsdata21.4.exe /min”
• MODIFY:
  [HKEY_CLASSES_ROOT.exeshellopencommand]
  Default=”C:\ProgramData\pavsdata\21.4.exe” /ex “%1″ %*
  to
  [HKEY_CLASSES_ROOT.exeshellopencommand]
  Default=”%1” %*

Removal with Webroot installed

If you already have Webroot installed, then you shouldn’t even have to scan as we should block this in real time.  If you happen to come across a new zero-day signature that doesn’t yet have a determination, then you should know about Webroot’s ability to remediate infections without a database determination. All you have to do is open your client, click the “System Tools” tab, and then click “Start” under Control Active Processes. You’ll then be presented with the screen below, which shows all the active processes that are running:

Anything running under the “monitor” column should be scrutinized. If you find anything randomly named under AppData or ProgramData, then you would set it to “block” and run a scan. Upon finishing the scan, Webroot will remove the file and roll back any changes made by the malware.

Webroot support is always more than happy to help with removal and any questions regarding infections.

Thanks to the fact that users not only continue to use weak passwords, but also, re-use them across multiple Web properties, brute-forcing continues to be an effective tactic in the arsenal of every cybercriminal. With more malicious underground market releases continuing to utilize this technique in an attempt to empower potential cybercriminals with the necessary tools to achieve their objectives, several questions worth discussing emerge in the broader context of trends and fads within the cybercrime ecosystem.

What’s the current state of the brute-forcing attack concept? Is it still a relevant attack technique, or have cybercriminals already found more efficient, evasive and effective tactics to compromise as many Web sites/servers as possible? Let’s discuss the relevance of the attack concept in 2013, by profiling a recently released WordPress/Joomla brute-forcing and account verification tool.

More details:

read more…

We’ve intercepted two, currently circulating, malicious spam campaigns enticing users into executing the malicious attachments found in the fake emails. This time the campaigns are impersonating Vodafone U.K or pretending to be a legitimate email generated by Sage 50’s Payroll software.

More details:

read more…

By Nathan Collier

Last Friday we blogged about the radical Android OS bug 8219321, better known as the “Master Key” bug, which was reported by Bluebox Security. Check out last weeks blog if you haven’t already: “The implications are huge!” – The Master Key Bug. We mentioned how we have been diligently working on protecting those not yet covered by patches or updates, and finding a solution for older devices as well. We are happy to report we have the solution! The newest version of Webroot SecureAnywhere Mobile with a patch for the “Master Key” bug can be found on the Google Play store now: Webroot SecureAnywhere Mobile.

Malware is always evolving, and so are we. No matter what new exploits are thrown our way, we have you covered. From all of us at the Webroot Mobile Team, stay safe.

By Dancho Danchev

Looking for legitimate online gambling services? You may want to skip the rogue online casinos that I’ll highlight in this post. Over the past few days, we intercepted multiple spam campaigns launched by the same party, enticing users into downloading fake online casinos most commonly known as the Win32/PrimeCasino/Win32/Casonline PUA (Potentially Unwanted Application).

More details:

read more…

By Nathan Collier and Cameron Palan

Last week, Bluebox Security reported they’d found a new flaw with the Android OS, saying “The implications are huge!”. The bug, also known as the “Master Key” bug or “bug 8219321”, can be exploited as a way to modify Android application files, specifically the code within them, without breaking the cryptographic signature. We call these signatures the “digital certificate”, and they are used to verify the app’s integrity. Since the bug is able to modify an application and still have the certificate appear valid, it is a big deal. read more…

In a clear demonstration of low QA (Quality Assurance) applied to an ongoing malicious spam campaign, the cybercriminals behind the recently profiled ‘Cybercriminals spamvertise tens of thousands of fake ‘Your Booking Reservation at Westminster Hotel’ themed emails, serve malware‘ campaign, have launched yet another spam campaign.

Despite the newly introduced themed attempting to trick users into thinking that they’ve received a ‘iGO4 Private Car Insurance Policy Amendment Certificate‘, the cybercriminals behind it didn’t change the malicious binary from the previous campaign.

More details:

read more…

For many years now, cybercriminals have been efficiency abusing both legitimate compromised and automatically registered FTP accounts (using CAPTCHA outsourcing) in an attempt to monetize the process by uploading cybercrime-friendly ‘doorways’ or plain simple malicious scripts to be used later on in their campaigns.

This practice led to the emergence of DIY (do-it-yourself) tools and managed service platforms that allow virtually anyone to start monetizing these fraudulently or automatically registered accounting data, signaling a trend towards an efficiency-driven cybercrime ecosystem – a concept that’s been materializing on a daily basis for a couple of years.

In this post, I’ll profile a desktop-based tool that allows cybercriminals to automatically syndicate lists of free/paid proxies — think malware-infected hosts — adding an additional layer of anonymity in the process of uploading their doorways/malicious scripts on any given FTP server whose accounting data they’ve managed to compromise or automatically register.

More details:

read more…

By Dancho Danchev

Cybercriminals are currently mass mailing tens of thousands of fake emails impersonating the Westminster Hotel, in an attempt to trick users into thinking that they’ve received a legitimate booking confirmation. In reality through, once the socially engineered users execute the malicious attachments, their PCs automatically join the botnet operated by the cybercriminals behind the campaign.

More details:

read more…

By Dancho Danchev

We’ve just intercepted a currently circulating malicious spam campaign consisting of tens of thousands of fake ‘Export License/Invoice Copy’ themed emails, enticing users into executing the malicious attachment. Once the socially engineered users do so, their PCs automatically become part of the botnet operated by the cybercriminals behind the campaign.

More details:

read more…

By Dancho Danchev

From managed ransomware as a service ‘solutions‘ to DIY ransomware generating tools, this malicious market segment is as hot as ever with cybercriminals continuing to push new variants, and sometimes, literally introducing novel approaches to monetize locked PCs.

In this case, by forcing their users to complete a survey before they receive the unlock code.

More details:

read more…