Threat Lab

Girl Scouts and OpenText empower future leaders of tomorrow with cyber resilience

The transition to a digital-first world enables us to connect, work and live in a realm where information is available at our fingertips. The children of today will be working in an environment of tomorrow that is shaped by hyperconnectivity. Operating in this...

World Backup Day reminds us all just how precious our data is

Think of all the important files sitting on your computer right now. If your computer crashed tomorrow, would you be able to retrieve your important files? Would your business suffer as a result? As more and more of our daily activities incorporate digital and online...

3 Reasons We Forget Small & Midsized Businesses are Major Targets for Ransomware

The ransomware attacks that make headlines and steer conversations among cybersecurity professionals usually involve major ransoms, huge corporations and notorious hacking groups. Kia Motors, Accenture, Acer, JBS…these companies were some of the largest to be...

How Ransomware Sneaks In

Ransomware has officially made the mainstream. Dramatic headlines announce the latest attacks and news outlets highlight the staggeringly high ransoms businesses pay to retrieve their stolen data. And it’s no wonder why – ransomware attacks are on the rise and the...

An MSP and SMB guide to disaster preparation, recovery and remediation

Introduction It’s important for a business to be prepared with an exercised business continuity and disaster recovery (BC/DR) plan plan before its hit with ransomware so that it can resume operations as quickly as possible. Key steps and solutions should be followed...

Podcast: Cyber resilience in a remote work world

The global pandemic that began to send us packing from our offices in March of last year upended our established way of working overnight. We’re still feeling the effects. Many office workers have yet to return to the office in the volumes they worked in pre-pandemic....

5 Tips to get Better Efficacy out of Your IT Security Stack

If you’re an admin, service provider, security executive, or are otherwise affiliated with the world of IT solutions, then you know that one of the biggest challenges to overcome is efficacy. Especially in terms of cybersecurity, efficacy is something of an amorphous...

How Cryptocurrency and Cybercrime Trends Influence One Another

Typically, when cryptocurrency values change, one would expect to see changes in crypto-related cybercrime. In particular, trends in Bitcoin values tend to be the bellwether you can use to predict how other currencies’ values will shift, and there are usually...

A peek inside the Ann Malware Loader

Feb 25, 2012 | Industry Intel, Threat Lab

The ever-adapting cybercrime ecosystem is constantly producing new underground releases in the form of malware loaders, remote access trojans (RATs), malware cryptors, Web, IRC and P2P based command and control interfaces, all with the clear objective to undermine current security solutions.

Continuing the “A peek inside…” series, in this post I will profile a malware loader recently advertised within the cybercrime ecosystem , namely, the Ann Malware Loader.

Researchers intercept malvertising campaign using Yahoo’s ad network

Feb 25, 2012 | Industry Intel, Threat Lab

Security researchers from StopMalvertising.com have intercepted a malvertising campaign using Yahoo’s ad network, that ultimately leads to a malicious payload in the form of fake security software known as scareware.

More details:

Why relying on antivirus signatures is simply not enough anymore

Feb 23, 2012 | Industry Intel, Threat Lab

How is it possible that in an industry dominated by advanced performance metrics and benchmarking tests, cybercriminals still manage to release unique malware that remains undetected for weeks by major antivirus vendors?

It’s pretty simple. Cybercrime is innovating much faster than the security industry is.

It used to be that cybercriminals hacked from the fringe, often acting alone and for personal fame. Now, cybercrime is a profitable career. It’s among the top national defense issues; it’s leveraged as a form of political protest; and it’s a relatively easy field to break into.

You might be surprised to how easy it is for anyone to access black markets online, pay a small fee (or nothing at all), and gain access to malicious processes that wreak havoc on company websites, steal financial information, and much more. And their labors are producing countless malware samples each day.

Here’s an up-close look at some of the nasty tactics today’s hackers are using—and why security vendors can’t stop them with yesterday’s approach.

4 Ways Hackers are Winning

Do-it-yourself (DIY) malware cryptors – Malware cryptors, as we cyber nerds call them, are designed to mask malware from being discovered by computer security programs. Cybercriminals can build malware cryptors on their own with relative ease. The idea is: once malware authors release their cryptors into the wild, they have the ability to keep changing it until their malware becomes unrecognizable to antivirus scans. That’s a big “one up” over traditional security.
Managed malware crypting services – Think of malware as a key that is trying to find a door (someone’s device) to unlock. Instead of trying to make your own custom key, you could go to someone who already knows a specific key is going to work. That’s the idea behind malware crypting as a managed service. This process allows cybercriminals to obtain only the malicious executables (the things that make your computer go “boom”) that have the best chance of being effective—without having to build anything on their own.
Server-side polymorphism (SSP) – Server-side polymorphism (say that two times fast!) is malware that is difficult to identify by a computer scan, no matter how many times you clean your system. What’s particularly important to highlight is how it renders traditional server antivirus software totally useless.
Quality assurance processes within the cybercrime ecosystem – Cybercriminals aren’t sloppy about their work. Before a malware campaign is launched, cybercriminals will usually pre-scan their malicious executable against all popular antivirus engines in order to ensure that it will successfully bypass the signature-based malware scanning used by them. The process is highly automated and is often offered as a service at selected cybercrime-friendly online communities.

So what is the security industry’s big mistake?

Habit. Security companies have been relying solely on an outdated system, signature-based threat detection, for catching malware and other threats—a system that slows down people’s computers and doesn’t address today’s threat environment.

Signature-based threat detection works like this:

A new virus or malware variant is discovered
An antivirus vendor creates a new signature to protect against that specific piece of malware.
The antivirus or malware signature is tested, and then pushed out to the vendor’s customers in the form of a signature update.

Year after year, the goal for antivirus companies has been to collect the most antivirus and malware signatures. This not only slows down your computer because it requires a large amount of space on your hard drive, but it also relies heavily on YOU to update your own antivirus program, which increases the risk for infection.

This means that even on the day you purchase most security suites, they are outdated and ill-equipped to protect you against the newest malware. By the time updates are addressed, it’s often too late. In other words, we’ve been trying to bob for apples in a barrel when we should be dumping the barrel upside down.

Dumping the barrel upside down

The future of online security can and should be based on behavior-based blocking techniques, which analyzes files by looking at how they’re acting and what they’re attempting to do, rather than comparing them to a list of known threats. It’s our best option to get a leg up on hackers.

Not only does signature-based threat detection slow your computer down, it also opens a rather large window for new malware to reach your Internet-connected devices while you wait for critical updates. It’s time for the security industry to wake and smell the malware. We did. And that’s why we created Webroot® SecureAnywhere™—an award-winning new approach to behavior-based Internet security.

As a consumer of computer security products, it’s important to know why cybercriminals currently have the upper hand on a fair amount of cyber security companies. We created this article to help you stay informed. If you’d like to learn more about signature-based threat detection on antivirus technology, Wikipedia does a pretty nice job of explaining the subject (click here to go to the article).

You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on Twitter.

An Evolution of Android Malware “My How You’ve Grown PJAPPS!” (Part 1)

Feb 17, 2012 | Threat Lab

We’ve all seen software grow. We watch as our favorite software adds on new features and becomes better at what it does. Malware writers are no different, they want their software to have more features as well as steal even more information. PJApps is a good example of this. PJApps is a Trojan that’s been around for a while causing havoc by being bundled in legitimate applications found in alternative Android markets, it is capable of opening a backdoor, stealing data and blocking sms behind the scenes. In one variant of PJApps it requests the following permissions to steal information:

INTERNET
RECEIVE_SMS
SEND_SMS
READ_HISTORY_BOOKMARKS
WRITE_HISTORY_BOOKMARKS
INSTALL_PACKAGES
WRITE_EXTERNAL_STORAGE
READ_PHONE_STATE

Here’s some of things the older variants of PJApps stole:

-SIM Card Number
-Telephone Number
-IMSI Number

Report: 3,325% increase in malware targeting the Android OS

Feb 17, 2012 | Industry Intel, Threat Lab

Which is the most targeted mobile operating system?

According to the recently released 2011 Mobile Threats Report from our partners at Juniper Networks, that’s the Android OS.

Key summary points from the report:

Spamvertised “Hallmark ecard” campaign leads to malware

Feb 17, 2012 | Industry Intel, Threat Lab

Cybercriminals are currently spamvertising a “You just received a e-card form somebody” themed malware campaign, impersonating Hallmark.

More details:

Twitter adds HTTPS support by default

Feb 15, 2012 | Industry Intel, Threat Lab

On Monday, Twitter announced that it’s introducing support for secure HTTPS connections to all users by default.

More details:

Report: Internet Explorer 9 leads in socially-engineered malware protection

Feb 14, 2012 | Industry Intel, Threat Lab

According to a newly released report from NSS Labs, Microsoft’s Internet Explorer 9 outperforms competing browsers in protecting against socially engineered malware.

More details:

The United Nations hacked, Team Poison claims responsibility

Feb 10, 2012 | Industry Intel, Threat Lab

A well known group of hackers has penetrated the networks of the United Nations, according to a note posted on Pastebin.com.

The group claiming responsibility is Team Poison, a hacking group closely associated with the Anonymous hactivist movement. Team Poison members include TriCk, iN^SaNe, MLT,Phantom~, C0RPS3, f0rsaken, aXioM and ap0calypse.

More details:

Pharmaceutical scammers launch their own Web contest

Feb 10, 2012 | Industry Intel, Threat Lab

What are pharmaceutical scammers up to? From active participation in black hat search engine optimization campaigns, to spamvertising of bogus links — including QR Codes — and compromising of web sites with high page rank in order to redirect to pharmaceutical scams, scammers are keeping themselves pretty busy in order to monetize as much web traffic as possible.

Recently, one of the most popular affiliate network for selling counterfeit pharmaceutical items launched its own Web contest.

Let’s take a look.

Researchers intercept two client-side exploits serving malware campaigns

Feb 8, 2012 | Industry Intel, Threat Lab

Security researchers from Webroot have intercepted two currently live client-side exploits serving malware campaigns that have already managed to infect over 20,000 PCs across the globe, primarily in the United States. Based upon detailed analysis, it can be concluded that both campaigns are launched by the same cybercriminal.

More details:

Researchers spot Citadel, a ZeuS crimeware variant

Feb 8, 2012 | Industry Intel, Threat Lab

Security researchers from “Tracking Cyber Crime” have spotted a new ZeuS crimeware variant, that’s based on the leaked ZeuS source code from last year.

Dubbed Citadel, the crimeware is positioned as a universal spyware system, whose modular nature allows cybercriminals to offer flexibly priced value-added services such as managed malware crypting, and managed web injects as a service.

Some of Citadel’s core features include: