April 5th, 2013
(via Malware spread on Skype taps victim PCs to mint bitcoins | Ars Technica) As the value of bitcoins skyrockets, security researchers have discovered yet another piece of malware that harnesses the processing power of compromised PCs to mint the digital currency. BTCs, as individual bitcoin units are known, have recently traded as high as $130, about four times their value from February. In Bitcoin vernacular, BTCs are “mined” by computers that solve cryptographic proof-of-work problems. For each correct block of data submitted, contributors are collectively rewarded with 50 25 bitcoins. Legitimate participants, who typically receive a percentage of the reward based on the number of blocks processed, often use powerful systems with multiple graphics processors to streamline the process. But scammers spreading malware on Skype are taking a decidedly more nefarious approach. Their malicious code hijacks a computer’s resources to mine BTC, according to a blog post published Thursday by a researcher from Kaspersky Lab. While the bitcoin-miner.exe malware harnesses only the CPU resources, which are much slower than GPUs in BTC mining, the attackers have the benefit of infecting many computers and then chaining them together to mint the digital currency. Unlike legitimate miners, the criminals don’t have to pay the purchase price of the hardware or pay for the electricity to run them. Bitcoin-mining malware has been circulating for almost two years now. Some versions actually tap infected computers’ GPUs and can even run on OS X Macs. The malware spotted by Kaspersky is most likely just a copycat phenomenon, but there’s reason to think it hasn’t been a waste of time for the people who created it. The bit.ly URL that had been hosting the malware was receiving more than 2,000 clicks per hour just prior to the Kaspersky blog post going live. That’s a fair amount of distributed computing power. “As I said, the campaign is quite active,” Kaspersky Lab Expert Dmitry Bestuzhev wrote. “If you see your machine is working hard, using all available CPU resources, you may be infected.”

(via Malware spread on Skype taps victim PCs to mint bitcoins | Ars Technica)

As the value of bitcoins skyrockets, security researchers have discovered yet another piece of malware that harnesses the processing power of compromised PCs to mint the digital currency.

BTCs, as individual bitcoin units are known, have recently traded as high as $130, about four times their value from February. In Bitcoin vernacular, BTCs are “mined” by computers that solve cryptographic proof-of-work problems. For each correct block of data submitted, contributors are collectively rewarded with 50 25 bitcoins. Legitimate participants, who typically receive a percentage of the reward based on the number of blocks processed, often use powerful systems with multiple graphics processors to streamline the process.

But scammers spreading malware on Skype are taking a decidedly more nefarious approach. Their malicious code hijacks a computer’s resources to mine BTC, according to a blog post published Thursday by a researcher from Kaspersky Lab. While the bitcoin-miner.exe malware harnesses only the CPU resources, which are much slower than GPUs in BTC mining, the attackers have the benefit of infecting many computers and then chaining them together to mint the digital currency. Unlike legitimate miners, the criminals don’t have to pay the purchase price of the hardware or pay for the electricity to run them.

Bitcoin-mining malware has been circulating for almost two years now. Some versions actually tap infected computers’ GPUs and can even run on OS X Macs.

The malware spotted by Kaspersky is most likely just a copycat phenomenon, but there’s reason to think it hasn’t been a waste of time for the people who created it. The bit.ly URL that had been hosting the malware was receiving more than 2,000 clicks per hour just prior to the Kaspersky blog post going live. That’s a fair amount of distributed computing power.

“As I said, the campaign is quite active,” Kaspersky Lab Expert Dmitry Bestuzhev wrote. “If you see your machine is working hard, using all available CPU resources, you may be infected.”

14 notes Source: Ars Technica #Malware#Skype#PCs#mint bitcoins#hijack#tech#security#Kaspersky
April 2nd, 2013
(via Exclusive: Ongoing malware attack targeting Apache hijacks 20,000 sites | Ars Technica) Tens of thousands of websites, some operated by The Los Angeles Times, Seagate, and other reputable companies, have recently come under the spell of “Darkleech,” a mysterious exploitation toolkit that exposes visitors to potent malware attacks. The ongoing attacks, estimated to have infected 20,000 websites in the past few weeks alone, are significant because of their success in targeting Apache, by far the Internet’s most popular Web server software. Once it takes hold, Darkleech injects invisible code into webpages, which in turn surreptitiously opens a connection that exposes visitors to malicious third-party websites, researchers said. Although the attacks have been active since at least August, no one has been able to positively identify the weakness attackers are using to commandeer the Apache-based machines. Vulnerabilities in Plesk, Cpanel, or other software used to administer websites is one possibility, but researchers aren’t ruling out the possibility of password cracking, social engineering, or attacks that exploit unknown bugs in frequently used applications and OSes. Researchers also don’t know precisely how many sites have been infected by Darkleech. The server malware employs a sophisticated array of conditions to determine when to inject malicious links into the webpages shown to end users. Visitors using IP addresses belonging to security and hosting firms are passed over, as are people who have recently been attacked or who don’t access the pages from specific search queries. The ability of Darkleech to inject unique links on the fly is also hindering research into the elusive infection toolkit. “Given that these are dynamically generated, there would be no viable means to do a search to ferret them out on Google, etc.,” Mary Landesman a senior security researcher for Cisco Systems’ TRAC team, told Ars. “Unfortunately, the nature of the compromise coupled with the sophisticated conditional criteria presents several challenges.” The injected HTML iframe tag is usually constructed as IP address/hex/q.php. Sites that deliver such iframes that aren’t visible within the HTML source are likely compromised by Darkleech. Special “regular expression” searches such as this one helped Landesman ferret out reported iframes used in these attacks. Note that while the iframe reference is formed as IP/hex/q.php, the malware delivery is formed as IP/hex/hex/q.php…

(via Exclusive: Ongoing malware attack targeting Apache hijacks 20,000 sites | Ars Technica)

Tens of thousands of websites, some operated by The Los Angeles Times, Seagate, and other reputable companies, have recently come under the spell of “Darkleech,” a mysterious exploitation toolkit that exposes visitors to potent malware attacks.

The ongoing attacks, estimated to have infected 20,000 websites in the past few weeks alone, are significant because of their success in targeting Apache, by far the Internet’s most popular Web server software. Once it takes hold, Darkleech injects invisible code into webpages, which in turn surreptitiously opens a connection that exposes visitors to malicious third-party websites, researchers said. Although the attacks have been active since at least August, no one has been able to positively identify the weakness attackers are using to commandeer the Apache-based machines. Vulnerabilities in Plesk, Cpanel, or other software used to administer websites is one possibility, but researchers aren’t ruling out the possibility of password cracking, social engineering, or attacks that exploit unknown bugs in frequently used applications and OSes.

Researchers also don’t know precisely how many sites have been infected by Darkleech. The server malware employs a sophisticated array of conditions to determine when to inject malicious links into the webpages shown to end users. Visitors using IP addresses belonging to security and hosting firms are passed over, as are people who have recently been attacked or who don’t access the pages from specific search queries. The ability of Darkleech to inject unique links on the fly is also hindering research into the elusive infection toolkit.

“Given that these are dynamically generated, there would be no viable means to do a search to ferret them out on Google, etc.,” Mary Landesman a senior security researcher for Cisco Systems’ TRAC team, told Ars. “Unfortunately, the nature of the compromise coupled with the sophisticated conditional criteria presents several challenges.”

The injected HTML iframe tag is usually constructed as IP address/hex/q.php. Sites that deliver such iframes that aren’t visible within the HTML source are likely compromised by Darkleech. Special “regular expression” searches such as this one helped Landesman ferret out reported iframes used in these attacks. Note that while the iframe reference is formed as IP/hex/q.php, the malware delivery is formed as IP/hex/hex/q.php…

7 notes Source: Ars Technica #Ongoing#malware#attack#targeting#Apache#hijack#tech#security#20#000 sites
March 26th, 2013
First targeted attack to use Android malware discovered | Ars Technica

Malware used to spy on Tibetan activists and other ethnic groups in China is nothing new. But a new Trojan discovered by researchers at Kaspersky Labs has widened the scope of this digital espionage and intimidation. The malware uses a combination of e-mail hacking, “spear phishing,” and a Trojan built specifically for Android smartphones. Kaspersky claims this is the first discovery of a targeted attack that uses mobile phone malware.

On March 25, the e-mail account of a Tibetan activist was hacked and then used to distribute Android malware to the activist’s contact list. The e-mail’s lure was a statement on the recent conference organized by the World Uyghur Congress that brought together Chinese democracy activists and Tibet, Southern Mongolia, and East Turkestan human rights activists. The e-mail claimed to have an attachment that was a joint letter from WUC, the Unrepresented Nations and Peoples Organization, and the Society for Threatened Peoples. If the targets opened the attachment, however, they received malware packaged in an Android APK file.

When opened, the Trojan installs an app called “Conference” on the Android devices’ desktops. If the app is launched, it displays a fake message from the chairman of the WUC—while sending back a message to a command and control server to report its successful installation. The malware provides a backdoor to the device via SMS messages sent by the server. On command, it returns the phone’s contact lists, call logs, data about the smartphone, its geo-location data, and any SMS messages stored on it to a server via a Web POST upload.

The server itself is running on a Chinese-language configured Windows Server 2003 machine sitting in a data center in Los Angeles. In addition to providing an upload point for the data stolen from Android devices, it also hosts more Android malware in its home page and provides a public Web interface (in Chinese) that allows direct control over phones that have been infected with the malware. While the server itself is at an IP address registered to a company called Emagine Concept, a domain pointed at the machine is registered to Shanghai Meicheng Technology Information Development Co., Ltd., a Chinese company with a contact in Beijing.
8 notes #targeted#attack#Android#malware#tech#security
February 7th, 2013
Adobe issues emergency Flash update for attacks on Windows, Mac users | Ars Technica

Adobe Systems has released a patch for two Flash player vulnerabilities that are being actively exploited online to surreptitiously install malware, one in attacks that target users of Apple’s Macintosh platform.

While Flash versions for OS X and Windows are the only ones reported to be under attack, Thursday’s unscheduled release is available for Linux and Android devices as well. Users of all affected operating systems should install the update as soon as possible.

The Mac exploits target users of the Safari browser included in Apple’s OS X, as well as those using Mozilla’s Firefox. That vulnerability, cataloged as CVE-2013-0634, is also being used in exploits that trick Windows users into opening booby-trapped Microsoft Word documents that contain malicious Flash content, Adobe said in an advisory. Adobe credited members of the Shadowserver Foundation, Lockheed Martin’s Computer Incident Response Team, and MITRE with discovery of the critical bug.

The other bug under attack, CVE-2013-0633, also works by tricking Windows users into opening a Word document containing malicious Flash content. It was discovered by researchers from antivirus provider Kaspersky Lab…
25 notes #Adobe#emergency#Flash#update#attacks#malware#tech#security#Windows#Mac
October 1st, 2012
(via DSL modem hack used to infect millions with banking fraud malware | Ars Technica) Millions of Internet users in Brazil have fallen victim to a sustained attack that exploited vulnerabilities in DSL modems, forcing people visiting sites such as Google or Facebook to reach imposter sites that installed malicious software and stole online banking credentials, a security researcher said. The attack, described late last week during a presentation at the Virus Bulletin conference in Dallas, infected more than 4.5 million DSL modems, said Kaspersky Lab Expert Fabio Assolini, citing statistics provided by Brazil’s Computer Emergency Response Team. The CSRF (cross-site request forgery) vulnerability allowed attackers to use a simple script to steal passwords required to remotely log in to and control the devices. The attackers then configured the modems to use malicious domain name system servers that caused users trying to visit popular websites to instead connect to booby-trapped imposter sites. “This is the description of an attack happening in Brazil since 2011 using 1 firmware vulnerability, 2 malicious scripts and 40 malicious DNS servers, which affected 6 hardware manufacturers, resulting in millions of Brazilian internet users falling victim to a sustained and silent mass attack on DSL modems,” Assolini wrote in a blog post published on Monday morning. “This enabled the attack to reach network devices belonging to millions of individual and business users, spreading malware and engineering malicious redirects over the course of several months…”

(via DSL modem hack used to infect millions with banking fraud malware | Ars Technica)

Millions of Internet users in Brazil have fallen victim to a sustained attack that exploited vulnerabilities in DSL modems, forcing people visiting sites such as Google or Facebook to reach imposter sites that installed malicious software and stole online banking credentials, a security researcher said.

The attack, described late last week during a presentation at the Virus Bulletin conference in Dallas, infected more than 4.5 million DSL modems, said Kaspersky Lab Expert Fabio Assolini, citing statistics provided by Brazil’s Computer Emergency Response Team. The CSRF (cross-site request forgery) vulnerability allowed attackers to use a simple script to steal passwords required to remotely log in to and control the devices. The attackers then configured the modems to use malicious domain name system servers that caused users trying to visit popular websites to instead connect to booby-trapped imposter sites.

“This is the description of an attack happening in Brazil since 2011 using 1 firmware vulnerability, 2 malicious scripts and 40 malicious DNS servers, which affected 6 hardware manufacturers, resulting in millions of Brazilian internet users falling victim to a sustained and silent mass attack on DSL modems,” Assolini wrote in a blog post published on Monday morning. “This enabled the attack to reach network devices belonging to millions of individual and business users, spreading malware and engineering malicious redirects over the course of several months…”

9 notes Source: Ars Technica #DSL#modem#hack#banking fraud#malware#security#tech#news#Ars Technica
June 4th, 2012
(via Flame malware hijacks Windows Update to spread from PC to PC | Ars Technica) The certification path of the certificate used to sign WuSetupV.exe, which masquerades as a legitimate Windows Update from Microsoft. The Flame espionage malware targeting Iranian computers contains code that can completely hijack the Windows update mechanism that Microsoft uses to distribute security patches to hundreds of millions of its users, security researchers said Monday. Flame components known as “Gadget” and “Munch” allow Flame operators to mount a man-in-the-middle attack against computers connected to a local network that hosts at least one machine already infected by the malware, Kaspersky Lab expert Alexander Gostev wrote in a blog post published Monday. By exploiting weaknesses in Microsoft’s Terminal Server product—and poor key-management decisions made by Microsoft engineers—the Flame architects were able produce cryptographic seals falsely certifying that their malicious wares had been produced by Microsoft. Microsoft issued an emergency update on Sunday that added three certificate authorities to its list of untrusted certificates, but it’s unclear how useful such measures will be at repairing the damage. Company officials have yet to acknowledge the susceptibility of the update process or to provide guidance for customers whose networks may already be compromised. A representative with Microsoft’s outside PR firm told Ars that Microsoft “doesn’t have anything further to share at this time,” and referred reporters to a series of blog posts that didn’t address these unanswered questions. According to Kaspersky’s Gostev, Flame attackers have been using the same fraudulent Microsoft certificates to spoof the company’s widely used Windows update mechanism. Other researchers quickly weighed in on the enormity of the attack. “Having a Microsoft code signing certificate is the Holy Grail of malware writers,” Mikko Hypponen, chief research officer of antivirus provider F-Secure, blogged on Monday. “This has now happened.” A separate blog post published Monday by Symantec researchers further catalogs the enormous data collection capabilities of Flame. The sheer breadth of functionality and size sets it apart,” Symantec researchers wrote. “Even describing it as an industrial vacuum cleaner does not do it justice.” The flame modules are able to bypass the legitimate Windows update by setting up a fake server named MSHOME-F3BE293C on networks that host an infected machine. When machines attached to the network run software that advertises itself as an official Microsoft update, the fake server delivers the Flame malware instead, causing those machines to also become infected. Right now, Microsoft is using its emergency update process to push a patch that mitigates a Windows threat that can hijack the emergency update process. No doubt, end users should install the patch as soon as possible. But it’s naive to think this out-of-band fix will repair the damage done to networks already hit by Flame, at least until Microsoft representatives provide additional guidance.

(via Flame malware hijacks Windows Update to spread from PC to PC | Ars Technica)

The certification path of the certificate used to sign WuSetupV.exe, which masquerades as a legitimate Windows Update from Microsoft.

The Flame espionage malware targeting Iranian computers contains code that can completely hijack the Windows update mechanism that Microsoft uses to distribute security patches to hundreds of millions of its users, security researchers said Monday.

Flame components known as “Gadget” and “Munch” allow Flame operators to mount a man-in-the-middle attack against computers connected to a local network that hosts at least one machine already infected by the malware, Kaspersky Lab expert Alexander Gostev wrote in a blog post published Monday. By exploiting weaknesses in Microsoft’s Terminal Server product—and poor key-management decisions made by Microsoft engineers—the Flame architects were able produce cryptographic seals falsely certifying that their malicious wares had been produced by Microsoft.

Microsoft issued an emergency update on Sunday that added three certificate authorities to its list of untrusted certificates, but it’s unclear how useful such measures will be at repairing the damage. Company officials have yet to acknowledge the susceptibility of the update process or to provide guidance for customers whose networks may already be compromised. A representative with Microsoft’s outside PR firm told Ars that Microsoft “doesn’t have anything further to share at this time,” and referred reporters to a series of blog posts that didn’t address these unanswered questions.

According to Kaspersky’s Gostev, Flame attackers have been using the same fraudulent Microsoft certificates to spoof the company’s widely used Windows update mechanism. Other researchers quickly weighed in on the enormity of the attack.

“Having a Microsoft code signing certificate is the Holy Grail of malware writers,” Mikko Hypponen, chief research officer of antivirus provider F-Secure, blogged on Monday. “This has now happened.”

A separate blog post published Monday by Symantec researchers further catalogs the enormous data collection capabilities of Flame. The sheer breadth of functionality and size sets it apart,” Symantec researchers wrote. “Even describing it as an industrial vacuum cleaner does not do it justice.”

The flame modules are able to bypass the legitimate Windows update by setting up a fake server named MSHOME-F3BE293C on networks that host an infected machine. When machines attached to the network run software that advertises itself as an official Microsoft update, the fake server delivers the Flame malware instead, causing those machines to also become infected.

Right now, Microsoft is using its emergency update process to push a patch that mitigates a Windows threat that can hijack the emergency update process. No doubt, end users should install the patch as soon as possible. But it’s naive to think this out-of-band fix will repair the damage done to networks already hit by Flame, at least until Microsoft representatives provide additional guidance.

9 notes Source: Ars Technica #Flame#malware#hijack#Windows Update#security#tech#news
June 4th, 2012
(via Iran-targeting Flame malware used huge network to steal blueprints | Ars Technica) Attackers behind the Flame espionage malware that targeted computers in Iran used more than 80 different domain names to siphon computer-generated designs, PDF files, and e-mail from its victims, according to a new analysis from researchers who helped discover the threat. The unknown authors of Flame shut down the sprawling command-and-control (C&C) infrastructure immediately after last Monday’s disclosure that the highly sophisticated malware had remained undetected for at least two years on computers belonging to government-run organizations, private companies, and others. The 80 separate domain names were registered using a huge roster of fake identities, and some of the addresses were secured more than four years ago. “The Flame C&C domains were registered with an impressive list of fake identities and with a variety of registrars, going back as far as 2008,” Kaspersky Lab expert Alexander Gostev wrote in a blog post published Monday. “In general, each fake identity registered only 2-3 domains, but there are some rare cases when a fake identity registered up to 4 domains…”

(via Iran-targeting Flame malware used huge network to steal blueprints | Ars Technica)

Attackers behind the Flame espionage malware that targeted computers in Iran used more than 80 different domain names to siphon computer-generated designs, PDF files, and e-mail from its victims, according to a new analysis from researchers who helped discover the threat.

The unknown authors of Flame shut down the sprawling command-and-control (C&C) infrastructure immediately after last Monday’s disclosure that the highly sophisticated malware had remained undetected for at least two years on computers belonging to government-run organizations, private companies, and others. The 80 separate domain names were registered using a huge roster of fake identities, and some of the addresses were secured more than four years ago.

“The Flame C&C domains were registered with an impressive list of fake identities and with a variety of registrars, going back as far as 2008,” Kaspersky Lab expert Alexander Gostev wrote in a blog post published Monday. “In general, each fake identity registered only 2-3 domains, but there are some rare cases when a fake identity registered up to 4 domains…”

4 notes Source: Ars Technica #Iran#target#Flame#malware#network#blueprints#security#hacking#hacktivism#news#tech
June 4th, 2012
(via “Flame” malware was signed by rogue Microsoft certificate | Ars Technica) Microsoft released an emergency Windows update on Sunday after revealing that one of its trusted digital signatures was being abused to certify the validity of the Flame malware that has infected computers in Iran and other Middle Eastern Countries. The compromise exploited weaknesses in Terminal Server, a service many enterprises use to provide remote access to end-user computers. By targeting an undisclosed encryption algorithm Microsoft used to issue licenses for the service, attackers were able to create rogue intermediate certificate authorities that contained the imprimatur of Microsoft’s own root authority certificate—an extremely sensitive cryptographic seal. Rogue intermediate certificate authorities that contained the stamp were then able to trick administrators and end users into trusting various Flame components by falsely certifying they were produced by Microsoft…

(via “Flame” malware was signed by rogue Microsoft certificate | Ars Technica)

Microsoft released an emergency Windows update on Sunday after revealing that one of its trusted digital signatures was being abused to certify the validity of the Flame malware that has infected computers in Iran and other Middle Eastern Countries.

The compromise exploited weaknesses in Terminal Server, a service many enterprises use to provide remote access to end-user computers. By targeting an undisclosed encryption algorithm Microsoft used to issue licenses for the service, attackers were able to create rogue intermediate certificate authorities that contained the imprimatur of Microsoft’s own root authority certificate—an extremely sensitive cryptographic seal. Rogue intermediate certificate authorities that contained the stamp were then able to trick administrators and end users into trusting various Flame components by falsely certifying they were produced by Microsoft…

12 notes Source: Ars Technica #Flame#malware#rogue#Microsoft certificate#security#Ars Technica#emergency Windows update#tech#news
April 6th, 2012
(via Half-million Mac infection estimate backed by new analysis | Ars Technica) This map shows that Macs in the US are the hardest hit by the Flashback malware, followed by Canada, the UK, Australia, France, and Italy. A second security firm took a shot at estimating how many Macs are infected by the Flashback malware and it arrived at the same conclusion as the first—more than half a million machines. That figure, documented in a Kaspersky Lab blog post published on Friday, would mean Flashback has infected slightly more than 1 percent of the 45 million Macs in existence… Ars has a detailed tutorial here showing how to detect and remove the malware….

(via Half-million Mac infection estimate backed by new analysis | Ars Technica)

This map shows that Macs in the US are the hardest hit by the Flashback malware, followed by Canada, the UK, Australia, France, and Italy.

A second security firm took a shot at estimating how many Macs are infected by the Flashback malware and it arrived at the same conclusion as the first—more than half a million machines. That figure, documented in a Kaspersky Lab blog post published on Friday, would mean Flashback has infected slightly more than 1 percent of the 45 million Macs in existence…

Ars has a detailed tutorial here showing how to detect and remove the malware….

7 notes Source: Ars Technica #Half-million#Mac#infection#analysis#security#apple#Ars Technica#flashback#malware#Kaspersky
January 7th, 2012
wow - this looks dangerous…if you check details - and look at the email address sent from “z7j4hk7t7k7fy6b@marketplace.amazon.com” “marketplace.amazon.com” is not a valid domain - I’m guessing that opening the attached pdf is not a good idea at all… PS - and yes I have already given amazon all the info and forwarded the email…just a reminder to BE CAREFUL…

wow - this looks dangerous…if you check details - and look at the email address sent from

“z7j4hk7t7k7fy6b@marketplace.amazon.com”

“marketplace.amazon.com” is not a valid domain - I’m guessing that opening the attached pdf is not a good idea at all…

PS - and yes I have already given amazon all the info and forwarded the email…just a reminder to BE CAREFUL…

18 notes #fraud#phishing#security#scam#pdf#malware