Information and Removal »

Earlier today, Trend Micro Technical Account Manager Fioravante Souza in Brazil spotted a (potentially harmful) URL that redirects users from the Best Buy domain site.

Users who visit www.bestbuy.com, as it turns out, are redirected to the URL, hxxp:// pics.bubbled.cn/gallery/hardcore/?23c4f60c1b9f604d6ffb21cba599301f. The compromised page in the domain is found to be the landing page where visitors can choose the language to be used as they browse within the site. Threat Research Manager Ivan Macalintal further identifies that a GEO-IP check happens prior to displaying the said landing page.

“If (the) requesting IP is from the Latin America Region (LAR), users are redirected to the ‘choose English or Spanish’ page—and then bingo!” Macalintal says.

Below is a screenshot of the landing page and its source code:

Figure 1: The “language option” landing page in the Best Buy domain site. This page is found to display only if the requesting IPwww.bestbuy.com is from LAR.

Figure 2: The source code of the landing page. It shows a garbled set of code found at the bottom of the script, a clear sign of code obfuscation. Beneath a 3-layer obfuscation, an iframe redirects the user to a Luckysploit-laden site. The Luckysploit web exploit kit and the obfuscation seen is reminiscent of that found in Gumblar.

Figure 3: WHOIS screenshot of the .CN site stating that it has been created just last June 4, 2009.

Same old criminals

Figure 4: Further investigation shows that the first .CN site is actually located in Germany and is used by attackers in Ukraine. Suffice to say, the Russkranians are the culprits once again.

Best Buy has been informed of the said URL redirections and is resolving the matter as of this writing.

More information to follow.

Hat tip to Advanced Threat Researcher Paul Ferguson for providing more information.

Post from: TrendLabs | Malware Blog - by Trend Micro

Gumblar Invades Best Buy

Information and Removal »

Michael Jackson has been dead for a week already, but there are still a lot of speculations regarding his death. The spam runs are plenty as well — a Michael Jackson-related spam was seen bearing the subject Who killed Michael Jackson?, coming from a sender named x-files.

The spam message suggests that the icon was killed, and that information on who murdered him can be seen on the given URL.

Clicking the said link leads to a website, where the user is asked to execute a file, which supposedly contains secret information, in order to find out who killed Michael Jackson.

But of course, the executable is not at all related to Michael Jackson’s murderer, or to Michael Jackson at all, as the file is really an data-stealer detected by Trend Micro as TROJ_ZBOT.AXY. The Trojan TROJ_ZBOT.AXY connects to a certain URL where it downloads a configuration file containing a list of banking-related websites. Once the user attempts to visit any of the listed sites, a spoofed site is displayed instead of the real one, thus any critical information entered on the spoofed site will be sent to a remote user.

This threat however, doesn’t stand a chance against the Smart Protection Network as of its all components — spam, URL and file — are already either blocked or detected.

Post from: TrendLabs | Malware Blog - by Trend Micro

Spam Speculates Michael Jackson’s Murder

Information and Removal »

Exactly three months ago, the whole IT sector was waiting with bated breath for April 1. The latest DOWNAD/Conficker variant–WORM_DOWNAD.KK–was poised to strike. We know that on that day, it would attempt to access 500 of 50,000 websites and download new malicious files. This led to fears–somewhat misplaced–that new, possibly damaging payloads could cause severe problems, not just for systems already affected by DOWNAD but the Internet as a whole. Many sectors assumed the worst.

April 1 came and went, and… nothing happened. Several days later, another variant appeared, but without the Internet ending (as some of the worst reporting would have led readers believe) most people believed that DOWNAD, as a major threat, was gone.

While it may no longer be as in the news at it was at its height, DOWNAD didn’t suddenly go away. Recent estimates from the Conficker Working Group place the number of unique IP addresses affected by the top 3 DOWNAD variants at well over 5 million. Even considering the group’s disclaimer of putting the number of actually infected systems at only 25-75% of that number, a minimum of 1.25 million infected systems is nothing to laugh at.

The Trend Micro World Virus Tracking Center (WTC) numbers bear this out as well. Almost 790,000 systems were found to be infected with DOWNAD variants in the first three months of the year. In the three succeeding months, that number was almost 1.9 million. Clearly, DOWNAD did not decide to quietly go away.

In addition, out of the public eye, DOWNAD went off and did something with all those infected systems: it went off and formed its own botnet. This was documented in mid-April by Advanced Threat Researchers Paul Ferguson and Ivan Macalintal. The short version, however, is simpler: DOWNAD was used to create a botnet. These can be used for the usual range of threats: spam, Denial of Service attacks, spreading FAKEAV malware, and so on.

Like it or not, malware threats are part of what users have to deal with day in, day out. Like anything people deal with regularly, people become used to malware threats. What was once noteworthy and unusual becomes dull and ordinary. However, this in fact does not make the threat any less dangerous. If anything, it can be argued that it makes the threat more dangerous, as users are more likely to be caught unaware of a threat that may not be something they’re looking out for.

In a very real way, threats like DOWNAD become part of the background noise that is a part of life on the Internet. While it may be unrealistic to expect individual users to keep in mind all threats, but good computing practices will help immensely. The most important one may be: keep your software up to date. This is particularly true for your operating system–a properly patched system would have been proof against most DOWNAD variants. Trend Micro users would have been protected via the Smart Protection Network, of course, but closing the underlying vulnerability would still have been essential.

The price of using your computer freely in today’s Internet may well be constant and unceasing vigilance.

Post from: TrendLabs | Malware Blog - by Trend Micro

Three Months Later: Where’s DOWNAD?

Information and Removal »

PC Confidential is a fake spyware remover, which uses malicious tactics both to spread and to sell. This parasite typically relies on trojans, such as Vundo, or worms, to enter the system. PC Confidential has a range of tactics it uses to trick people into purchasing its full version.
Upon infecting the system, PC Confidential begins its dirty [...]

Information and Removal »

well, it was nice to see something as fundamental the issue of password masking questioned (usability expert jakob nielson’s original article, bruce schneier’s reaction), and then answered (rik ferguson’s response, graham cluley’s response). i wonder if that indicates we’re collectively ready (some of us have been individually ready for a while) to question something equally fundamental like the concept of ‘security experts‘.

i say this because, as was alluded to by rik ferguson, bruce schneier seemed to be pulling ‘blatantly evident factoids’ out of his ass (as ’self-appointed authorities’ tend to do).

empirical evidence of the decline of shoulder surfing, even if it exists, wouldn’t be able to support the implied assertion that it would stay in decline if password masking went away. in fact, the opposite seems much more likely. while it’s true that a determined shoulder surfer would be able to figure out your password from your keystrokes, without the password mask even the most casual shoulder surfer would easily be successful. remove the control that makes something rare and it won’t be rare anymore.

but i digress. this post isn’t about password masking, it’s about ’security experts’ - and i find myself in a bit of a conundrum because, while i would normally be decrying schneier’s posting of material obviously outside his field of expertise, as someone who not only doesn’t lay claim to the title of expert but actively rejects it would i not be practicing hypocrisy?

to answer my own question: yes, yes i would. stop that.

the problem isn’t (or shouldn’t be) that schneier (or anyone else for that matter) posts on topics outside their field of expertise. he should be afforded the freedom to post uninformed opinion just like everybody else. in that regard the problem isn’t really bruce schneier at all (even if he is a FUD spreading self-described media whore), the problem, dear reader, is you - for not recognizing how narrow a scope expertise has, where schneier’s is, and consequently when to hold his statements up to greater/lesser scrutiny (note: if you have figured out that cryptography is his area of expertise and that you should question everything else then i’m not actually talking to you but everyone else).

and yes, i am aware of the implication that you should then question everything i say - that is actually precisely what i want. one of the benefits from not being an expert that i’d like to enjoy is people not blindly accepting everything i say and actually challenging me when something i say doesn’t fit with something they know. i actually like arguing, i find it to have useful properties in the gaining of knowledge, and i think it’s a shame that so many seem to value the finding of consensus over the finding of correctness (nevermind the tendency to use authoritative quotes as a replacement for critical thinking). oh well, at least nick fitzgerald and vesselin bontchev were still willing to expound at length on the topic of malware last i checked (though it has been a while).