Over the past 24 hours, our sensor networks picked up an interesting website infection affecting a popular Bulgarian website for branded watches, which ultimately redirects and downloads premium rate SMS Android malware on the visiting user devices. The affected Bulgarian website is only the tip of the iceberg, based on the diversified portfolio of malicious domains known to have been launched by the same party that launched the original campaign.
More details:
Just as we anticipated on two occasions in 2012, managed email hacking for hire services continue popping-up at publicly accessible cybercrime-friendly communities, a trend that’s largely driven by the demand for such services by unethical competition, “friends”, or current/ex-spouses.
Often pitched as “forgotten password recovery” services, they rely on social engineering, brute-forcing, and spear phishing campaigns, often leading to a successful compromise of a targeted account. Based on the number of positive vouches, the services continue receiving a steady stream off satisfied and verified customers.
In this post, I’ll profile one of the most recently advertised email hacking for hire services, specializing in hacking GMail and Yahoo! accounts, as well as email accounts using popular free Russian email service providers. How much does it cost to hack a Gmail or Yahoo! account? What about corporate email?
Let’s find out.
How easy is it to create an undetected piece of malware these days? Too easy to be true!
With more DIY malware botnets and DIY malware generating tools continuing to leak at public cybercrime-friendly forums, today’s novice cybercriminals have access to sophisticated point’n’click malware generating tools that were once only available in the arsenal of the experienced cybercriminal.
In this post, I’ll profile a recently leaked DIY malware generating tool, discuss its core features, and emphasize on its relevance in the context of the big picture when it comes to ongoing waves of malicious activity we’ve been monitoring over the years.
More details:
Over the past 24 hours, cybercriminals resumed spamvertising fake Vodafone MMS themed emails, in an attempt to trick the company’s customers into executing the malicious attachment found in these emails.
More details:
Cybercriminals are currently mass mailing tens of thousands of emails, impersonating the EFTPS (Electronic Federal Tax Payment System), in an attempt to trick its users into clicking on exploits and malware serving malicious links found in the emails.
More details:
For years, thanks to the currently mature human-driven ecosystem offering CAPTCHA-solving as a service, cybercriminals have been persistently and automatically abusing major Web properties by undermining the “chain of trust” that these properties rely on so extensively.
Still living in a world supposedly dominated by malware-infected bots, this myopia has resulted in the rise of these managed services, rendering any recent CAPTCHA “innovations” useless since they continue relying on humans – the very species that CAPTCHA is supposed to be recognizable by in the first place.
Just how easy is it to automatically register tens of thousands of bogus accounts at, let’s say, YouTube? In this post I’ll profile a recently released tool that’s relying on API keys offered by a CAPTCHA-solving services, automating the account registration process in combination with the use of malware-infected hosts as proxies.
More details:
Over the past week, cybercriminals have resumed spamvertising fake “ADP Immediate Notifications” in an attempt to trick users into clicking on the malicious links found in the emails. The links point to the latest version of the Black Hole Exploit Kit, and consequently, exploit CVE-2013-0422, affecting the latest version of Java.
With no fix for this vulnerability currently available, users are advised to disable Java immediately.
More details:
Despite the fact that on the majority of occasions cybercriminals tend to rely on efficient and automated exploitation techniques like the ones utilized by the market leading Black Hole Exploit Kit, they are no strangers to good old fashioned ‘visual social engineering’ tricks. Throughout 2012, we emphasized on the emerging trend of using malicious DIY Java applet distribution tools for use in targeted attacks, or widespread campaigns.
Is this still an emerging trend? Let’s find out. In this post, I’ll profile one of the most recently released DIY Java applet distribution platforms, both version 1.0 and version 2.0.
More details:
In 2012, fake flight reservation confirmations and bogus E-ticket verifications were a popular social engineering theme for cybercriminals. On numerous occasions, we intercepted related campaigns attempting to trick customers into clicking on malicious links, which ultimately exposed them to the client-side exploits served by the latest version of the Black Hole Exploit Kit.
Apparently, the click-through rates for these campaigns were good enough for cybercriminals to resume spamvertising related campaigns. In this post, I’ll profile the most recently spamvertised campaign impersonating U.S Airways.
More details:
Certified Public Accountants (CPAs) are a common target for cybercriminals. Throughout 2012, we intercepted several campaigns directly targeting CPAs in an attempt to trick them into clicking on the malicious links found in the emails. Once they click on any of the links, they’re automatically exposed to the client-side exploits served by the latest version of the Black Hole Exploit Kit.
In this post, I’ll analyze one of the most recently spamvertised campaigns impersonating the American Institute of Certified Public Accountants, also known as AICPA.
More details:
Historical cybercrime performance activity of multiple gangs and individuals has shown us that, in order for them to secure multiple revenue streams, they have the tendency to multi-task on multiple fronts while operating and serving the needs of customers within different cybercrime-friendly market segments.
A logical question emerges in the context of the fact that 99% of all the spamvertised campaigns we’re currently intercepting rely on the latest version of the Black Hole Exploit Kit – is Paunch, the author of the kit, multi-tasking as well? What’s the overall impact of his ‘vertical market integration‘ practices across the Web beyond maintaining the largest market share of malicious activity in regard to Web malware exploitation kits?
Let’s find out by discussing two of his well known revenue sources and sample a campaign that’s relying on the managed iFrame/Javascript crypting/obfuscating service that he’s also operating.
More details:
There are a number of similarities between biological viruses and those which infect our PC’s. For one, both types of infections rely on mutations to evade detection and survive. The faster the mutations, the more difficult an infection is to combat. This is because those who spend their time and effort fighting such infections are likely to miss a mutation and therefor lack the chance to create a cure. This point is especially true with traditional antivirus technology where discovery and detection techniques have not kept up with the rapid pace of mutations common in today’s threat landscape. The recent NY Times article ‘Outmaneuvered at Their Own Game, Antivirus Makers Struggle to Adapt’ reported that, “On average, it took almost a month for antivirus products to update their detection mechanisms and spot the new viruses.”
Meet the Webroot Intelligence Network (WIN), a novel new approach to malware intelligence, discovery, detection and protection which scales with the pace of the malware industry. How did we do it? By first creating the most powerful threat intelligence engine the world has ever seen. A cloud hosted engine which correlates live data from millions of user endpoints, honeypots, and sensor networks from around the globe, all in real-time. This engine has populated the Webroot Intelligence Network with detailed data on millions of malicious programs, is aware of over 8.7 billion URL’s, 550 million IP addresses and 2 million mobile applications. WIN provides the necessary visibility into a rapidly mutating and evolving threat landscape to provide Webroot products the intelligence needed to keep users secure.
One key element to the success of WIN has been leveraging the power of our users. By turning every customer endpoint into a malware discovery node capable of sending newly discovered file data to WIN, Webroot researchers around the world are able to analyze and classify incoming data in real time. When a new malicious program, URL or IP is discovered, the entire user-base is immediately protected; no definition updates required. There are a number of benefits to this approach; one of the biggest being that malware variants don’t slip through the cracks. If a Webroot user is the first to see a new infection, it is only a matter of minutes before a researcher discovers the infection and creates a rule to detect and protect the entire user-base. Compare this to traditional signature based AV’s which must first collect the sample (if they can find it – in many cases samples are missed due to the intentionally short lifespan of today’s malware variants), analyze it, and finally release a new detection signature which lastly has to be sent to the endpoint. As the NY Times article mentions, “Part of the problem is that antivirus products are inherently reactive. Just as medical researchers have to study a virus before they can create a vaccine, antivirus makers must capture a computer virus, take it apart and identify its “signature” — unique signs in its code — before they can write a program that removes it. That process can take as little as a few hours or as long as several years.” Most often, by the time a new signature is released, the malware variant it is designed to detect is no longer relevant.
The strength of a security solution is directly related to the quality of its intelligence. By enabling our products to participate in the discovery of new infections, WIN ensures our researchers have the visibility needed to keep up with a malware landscape which relies heavily upon flooding the market with newly compiled infections designed specifically to evade traditional AV methodologies. In many ways, the AV industry is responsible for the current day problem. The lack of innovation and adaptation to the problem created an easy out for malware authors. Webroot aims to change this paradigm by including the force of its entire user-base to combat the problem. It has long been said that the AV industry is at a disadvantage because for every security researcher fighting these infections, there were certainly 100 if not 1,000 hackers creating such infections. Webroot has upped the ante by recruiting its millions of users to help in the fight to keep our personal data and online activities secure. Malware has nowhere to hide when up against the Webroot Intelligence Network.