Beware Changelog spammed-out malware attack

iframe-w-2.jpg

Internet users are receiving emails claiming to contain a changelog – but the files attached are really designed to infect computers. Here’s what a typical email looks like, although the precise wording can vary. Subject: Re: Your Changelog Message body: Good day, as promised chnglog attached (Open with Internet Explorer) The subject lines and attachment names can also be different from email to email – here’s a small

Digital Activists are Building an Uncensorable Network

SciAmMarch2012Mesh01.png

Scientific American’s March issue has an intriguing article which explores the efforts of digital activists to circumvent corporate and governmental control over the Internet. The aim of the moment is to configure and build a decentralized mesh network that cannot be blocked, filtered or turned off. Egypt’s Internet shutdown during last year’s Arab Spring played a significant inspirational role. Image: Scientific American Magazine With a “shadow” network configured, activists

Zeusbot/Spyeye P2P Updated, Fortifying the Botnet

We blogged about a parallel Zeusbot/Spyeye build near the end of last year that introduced some improvements in the botnet, moving the network architecture away from a simple bot-to-C&C system and introducing the beginnings of a peer-to-peer model. This new variant new uses P2P communication exclusively in order to keep the botnet alive and gathering information. Previously, every compromised computer was a peer

PDF Malware Writers Keep Targeting Vulnerability

We keep seeing new waves of PDF file-based attacks that exploit the Adobe Acrobat and Reader CVE-2010-0188 Remote Code Execution Vulnerability (BID 38195) that exists in certain unpatched versions of a popular PDF reading application. All these attacks were stopped by Symantec’s Skeptic™ technology.  A typical example of such an exploited PDF sample contains highly obfuscated JavaScript, as shown in figure 1. Figure 1:

Pramro and Sality – two PEs in a pod

1273_BID079_2D00_001.png

?The second of the families added to the February release of the Microsoft Malicious Software Removal Tool (MSRT) is Win32/Pramro. Win32/Pramro is a family of trojans that can act as a SOCKS proxy on an infected computer. In this case, this proxy may be used to relay spam and HTTP traffic. Detection was first added for Pramro variants in January 2008. There is a strong connection with the polymorphic file

Airline Booking Confirmation Phish

Recently I came across an airline booking confirmation phishing email.  Whilst this is not necessarily a new phishing technique, the email and associated phishing website are quite interesting and at first glance could appear to be legitimate.  In the email, it states confirmation of payment made by credit card, and that the recipient should click an embedded link

‘X’ is named. Alleged computer hacker at the centre of News of the World scandal

notw-170.jpg

For the first time, the identity of a man at the centre of allegations that computers were hacked on behalf of the disgraced News of the World newspaper has been named. The Guardian reports that security consultant Philip Campbell Smith is alleged to have used a Trojan horse to hack into a computer belonging to Ian Hurst, a former British army intelligence officer who handled IRA informers in Northern Ireland. For legal

Incoming search terms for the article:

british army and hackers

Network Security, Circa 1990

AT&T recently released a film from its archive called “Computer Security: You Make The Difference“. While you might chuckle at the 1990′s music and production values – the truth is this – many of basic issues that the video (which is a series of films stitched together) attempts to illustrate are still with us today, 22 years

“Fan Apps” Now Spreading on the Android Market

fan_apps_1.jpg

We’re seeing more and more scams on the Android Market. Last week, we wrote about a developer that uses popular app names to trick users into downloading fake ones. Before that, we saw a fake Temple Run app making the rounds on the Android Market. This time, we saw 37 more apps that share a similar behavior as the previously reported ones. These are “fan

Fake AICPA Mail Serves Blackholes and Rootkits

aicpaexploitmails-300x153.jpg

Be wary of emails claiming to be from AICPA – as per their alert here, these are not real and any mention of “unlawful tax return fraud” is just a bait to convince the end-user to open up a malicious attachment (in this case, a .doc file although there are rogue PDF files in circulation too). Click to Enlarge As with many of the malicious spam campaigns

Incoming search terms for the article:

aicpa junk mail

Ex-girlfriend sex videos, browser plugins and Facebook survey scams

omg-girlfriend.jpg

Scammers are up to their old tricks on Facebook, tricking users into visiting revenue-generating survey scam websites by appearing to offer sex videos. Using a thumbnail which suggests a link to a sex video, messages posted on compromised Facebook users’ walls attempt to lure their unsuspecting Facebook friends into clicking to see more. And if the use of a saucy snapshot of a naked man and woman in an intimate pose wasn’t enough, the

Malware to Mourn Whitney Houston

Thanks to Anand Muralidharan for their assistance with this research. The world is mourning the loss of another legendary pop singer also known as the queen of pop – Whitney Houston. Spammers are paying homage to the icon with a wicked malware. The malicious email shows a video of the last appearance of the star in a Los Angeles night club and also downloads an executable

Incoming search terms for the article:

ireland portuguese japan whitney

Online Threatwatch – Catch up on this week’s latest threats and scams

Ticketweb_hack2.jpg

We bring you a brief summary of the top security stories that have been making news online around the world this week.Fake Scotland Yard RansomwarePolice in the United Kingdom are warning people about a ransomware scam pretending to be a threatening message from Scotland Yard but is instead malware that holds the user’s PC to ransom.The malware infects victims without

Incoming search terms for the article:

police central e crime unit avg, police central e-crime unit avg

Over 90% of Facebook users hate having photos of them posted without approval

pie-chart1.jpg

Facebook users overwhelmingly agree that it’s rude to post photos or videos of them without asking permission first. Some even think it should be illegal. Sophos has polled over 800 Facebook users, asking whether people should seek permission before posting photographs or videos online of others. Although a large majority – 83% – of polled Facebook users think it’s just common courtesy to ask permission before posting a photo or

Bot shopping with my wife

icon_wink.gif

When my wife told me she had received an email with a purchase confirmation she hadn’t done, my first thought was: How can she even remember what she bought? She buys thousands of clothes online, probably she doesn’t remember it, this wouldn’t be the first time After she

Warning: Whitney Houston autopsy video links on Facebook aren’t what they seem

whitney-170.jpg

The death of pop superstar Whitney Houston made headlines around the world this weekend, and it didn’t take long for fraudsters and cybercriminals to cash in on the singer’s death. For instance, messages have been seen shared on Facebook claiming to link to a video of Whitney Houston’s autopsy. According to the messages, the video of Whitney Houston’s autopsy “reveals a shocking secret that

Incoming search terms for the article:

whitney houston autopsy, avast warning about whitney

Avi Rubin: All Your Devices Can Be Hacked

Avi Rubin, a Computer Science professor at Johns Hopkins University, recently gave an informative (and quite fun) presentation at TEDxMidAtlantic. Rubin’s talk summarized the results of efforts to hack various devices. Have you every wondered if you could wirelessly brake a car? TEDxTalks: YouTube

Incoming search terms for the article:

Avi Rubin on Hacking

The where and why of HLUX

664.jpg

This is not the first time the HLUX botnet has been mentioned in this blog, but there are still some unanswered questions that we’ve been receiving from the media: What is the botnet’s sphere of activity? What sort of commands does it receive from malicious users? How does

UK police open new cybercrime departments

cyber-crime.jpg

What’s the story? The UK police have opened three new hubs specifically designed to combat cybercrime. The three centres will be based in in Yorkshire and the Humber, the Northwest and East Midlands. The departments, opened on Wednesday February 8, will each be manned by a detective sergeant and two detective constables. The centres will conduct their own investigations as well as

Incoming search terms for the article:

cyber crime, avg virus national cyber crimes unit, cybercrime, images on cyber crime