Custom Search

vBulletin Conditional Malware – myFTP.biz Malicious iFrames

We have to be honest here, there’s no fun in cleaning up infected .htaccess files. It’s boring, but it happens a lot! But it’s not the case here. I will also caveat that while in this specific instance we’ll be talking to one specific platform, we are seeing this same tactic spread across a number …

Extracting Digital Signatures from Signed Malware, (Sat, May 11th)

Sometimes attackers digitally sign their malicious software. Examining properties of the signature helps malware analysts understand the context of the incident. Moreover, analysts could use the signature as an indicator of compromise. Here are some tips and tools for determining whether a suspicious Windows executable has been signed and for extracting the embedded signature in …

Microsoft admits it was also hit by hackers, malware infects their Mac business unit

Late on Friday, Microsoft published a statement on its security blog revealing that it was joining the growing list of well-known companies who had suffered at the hands of hackers.

Microsoft says that a “small number of computers”, including some in the company’s Mac business unit, were infected by malware.

As reported by Facebook and Apple, …

Malware evolving to defeat anti-DDoS services like CloudFlare?

Could distributed denial of service (DDoS) malware be evolving to defeat anti-DDoS security measures like CloudFlare? We do not usually see a lot of innovative denial-of-service malware in our day-to-day work. What we do see usually boils down to the basic flooding techniques: TCP Syn, UDP and ping floods, and sometimes HTTP-oriented floods.

Of course, …

Fake Cleaning Apps in Google Play: an AutoRun Attack and More

Almost exactly one year ago, Google announced the addition of a “new layer to Android security,” a service codenamed Bouncer that was intended to provide automated scanning of the Android Market for potentially malicious software. However, as my colleague Jimmy Shah wrote in a previous blog post, Bouncer has not been enough to keep all …

UPS Phishing page with malware

For some time now, attackers have been faking popular websites like YouTube to entice users into downloading and installing malicious software disguised as plugin updates or video codecs. I rcently found a page that is using the same technique to distribute a malicious executable through a fake UPS page.

The page is located at hxxp://www.retinamac.ru/UPS/. …

Ransomware: How to Earn $33,000 Daily

Ransomware is a type of malicious software that disables the functionality of a computer in some way and demands a ransom in order to restore the computer to its original state. Recent variants use law enforcement imagery to add legitimacy to the warning messages. The malware uses geo-location services to determine the location of the …

Free Android USSD vulnerability protection from ESET now on Google Play

If you use an Android phone you may have heard of something called the USSD vulnerability. This allows a nasty piece of malicious software to reset your Android to its factory default settings and permanently delete your data. We will describe the USSD problem in more detail in a moment but first we want to …

Dancing Penguins – A Case of Organized Android Pay Per Install

For years, cyber criminals have organized their operations and traded resources through discussion forums and auction sites. One popular item to trade is access to virus infected PCs for cash. These trading schemes are often called pay-per install (PPI) programs. We have recently started an investigation on a new type of pay-per install program, this …

Trojan.Rodricter spreads by exploiting critical Java vulnerability

On August 26, FireEye reported the discovery of a critical vulnerability in Java Runtime Environment versions 1.7x, which was designated as CVE-2012-4681. Oracle released a security patch only on August 30, and, therefore, the vulnerability remained unclosed for at least four days-an opportunity criminals were quick to take advantage of. Doctor Web determined that a …

August 2012 virus activity review: growing botnets, a Java vulnerability, and new threats to Android

The last summer month of the year saw a noticeable increase in activity on the part of virus makers and Internet fraudsters-pretty much in line with our expectations. Fraudsters crafting paid archive hoaxes came to incorporate malicious software such as Trojan.Mayachok.1 into their “products”. Compared with July, the number of new threats discovered by Doctor …

July 2012 virus activity review: the summer lull and a new threat to Mac OS

July 2012 saw an increased number of system infections by blocker Trojans; at the same time, because one of the largest BackDoor.Blackenergy botnets was brought down, spam traffic declined significantly. At the end of the month, Doctor Web discovered a cross-platform Trojan, dubbed BackDoor.DaVinci.1, targeting both Microsoft Windows and Mac OS X. It should be …

Fan of Twilight? Be Very Careful If You’re Looking Online For It

If you like the Twilight series, be careful if you plan to do any “research” on it, or if you plan to visit the site of the series author (Stephenie Meyer). Her site is currently hacked, blacklisted, and redirecting users to the Blackhole Exploit Kit.

You can see the results on the sitecheck:http://sitecheck.sucuri.net/results/www.stepheniemeyer.com/

This is what …

Scareware on the Piggy-Back of ACAD/Medre.A

There are always people who want to piggy-back on the achievements of others. After ESET warned the public against ACAD/Medre.A in two blogs here and here and issued a free standalone cleaner for remediation, there was always the possibility that drawing attention to the issue would result in the topic being misused for other purposes. While  …

Malware That Pretends To Be Google

Malware authors (AKA the criminals or the bad guys), use many advanced techniques to hide their activities. From encoding, to encrypting, to auto-generated random domains, conditional redirections and many other interesting methods.

In the middle of all their advanced options, they also use simple techniques to confuse the end user to think that a malicious domain …

 
  Older Entries »