WatchGuard Lists Most Risky Web Apps

January 26, 2011 · Filed Under Security Software, Software News · Comment 

According to WatchGuard security researchers, the fastest growing threat to corporate networks is web-based social media applications.  These applications can seriously compromise network security, expose sensitive data, and create productivity drains on employees.

There are many reasons why social media applications can pose risk to any size business. Here are a few:

  • Productivity Loss: Various research organizations have reported that the United States loses billions of dollars a year due to lowered productivity, as a result of time sinks such as social media sites.  Although social media sites can be used for collaboration and rich communications, IT administrators often lack the ability to manage and control business productivity web applications vis-a-vis gaming web applications.
  • Data loss: With most US states enacting mandatory data breach disclosure laws, businesses are increasingly concerned about data leakage, whether accidental or malicious. Unfortunately, the attributes that make social media sites a fantastic communication medium also make them a potential risk for information and privacy leakage.  By having application control capabilities, administrators reduce risks associated with accidental as well as malicious data loss. Read more

Tags: , , , , , , , , , , , , , ,

New Hacker Campaign Targets Holiday Trending Topics on Twitter to Spread Malware

December 3, 2010 · Filed Under Software News · Comment 

Numerous Twitter accounts have been created to spread malicious code through festive messages

PandaLabs announced that cyber-criminals are exploiting Twitter to spread malware using festive-themed messages. Using methods akin to Black Hat SEO techniques, hackers are taking advantage of trending topics to position malware distribution campaigns. As the holiday period has begun, topics such as “Advent calendar,” “Hanukkah” or even “Grinch,” are among the most popular subjects used by hackers to entice users.

Thousands of tweets have been launched using holiday-related phrases, such as “Nobody cares about Hanukkah,” or “Shocking video of the Grinch,” along with short URLs pointing to malicious websites. To see an example of a tweet like this, please visit:  http://www.flickr.com/photos/panda_security/5226147792/

Users who click the link will be taken to a page that infects systems with false codecs. These exploit a security hole in PDF files (CVE-2010-2883) and try to trick users into downloading a codec that is really a downloader Trojan, which in turn downloads more malware onto the compromised computer. You can see this image here: http://www.flickr.com/photos/panda_security/5225551137/

In addition to subjects related to Christmas, cyber-criminals are using other hot topics to spread their creations, including the Sundance festival, the AIDS campaign, the Carling Cup and tweets about the actor Morgan Freeman.

According to Luis Corrons, Technical Director of PandaLabs, “Social networks are becoming increasingly popular among hackers as a vehicle for spreading malware. Facebook and Twitter are commonly exploited with malicious intent, giving their ever-increasing number of users the false sense of security that they’re safe posting content on these sites. This is why the number of clicks, and therefore infections, tends to be very high.” Read more

Tags: , , , , , , ,

Trojans accounted for 70 percent of the new malware detected during the second quarter of 2009, according to PandaLabs

July 7, 2009 · Filed Under Security Software, Software News · Comment 

This type of malware was also responsible for over a third of all infections between April and June; the Downloader.MDW Trojan was the most active strain of malware during this period – The malicious use of Twitter, the advance of BlackHat SEO techniques, and an in-depth study of the Waledac worm, are some of the other issues covered in the PandaLabs Quarterly Report

Panda Security, the Cloud Security Company, announced that PandaLabs, Panda Security’s laboratory for detecting and analyzing malware, announced the findings from its second quarterly report of 2009 and determined that Trojans accounted for 70 percent of all new malware between April and June 2009.

The report can be downloaded from http://www.pandasecurity.com/img/enc/Quarterly_Report_PandaLabs_Q2_2009.pdf.

banner_468x60_en

One of the most notable findings of the report is the 6.25 percent drop in spyware, which now represents just 6.9 percent of all new malware. In contrast, adware rose dramatically over this period, from 7.54 percent in the previous quarter to 16.37 percent. This is largely due to the increase in fake antivirus applications, a type of adware that passes itself off as a legitimate security solution. As for worms, their percentage has also risen slightly, now accounting for 4.4 percent of all malware.

Trojans were also responsible for more infections than any other type of malware over this period. This type of malware was behind 34.37 percent of all infections detected by PandaLabs, an increase of 2.86 percent with respect to the previous quarter. Adware infection levels remained stable, accounting for 19.62 percent of the total.

Worms increased slightly (0.89 percent), staying in the picture due largely to the effectiveness by which they spread. Dialers, at 4.48 percent, stubbornly refused to disappear despite the overriding trend for broadband instead of dial-up connections.

In terms of specific strains of malware, the number one ranked specimen between April and June 2009 was Downloader.MDW, a Trojan designed to download other malware on to computers. The Virtumonde spyware and Rebooter.J Trojan were also among the malicious codes that caused most infections.

01 Trj/Downloader.MDW
02 Spyware/Virtumonde
03 Trj/Rebooter.J
04 Trj/Lineage.BZE
05 W32/Bagle.RP.worm
06 Adware/AccesMembre
07 Adware/SystemSecurity
08 W32/Waledac.AS
09 Adware/Lop
10 W32/AutoRun.DJ.worm

When broken down geographically, Taiwan continues to top the list with 33.63 percent of computers infected with active malware. Turkey and Poland come next, with just under 30 percent. Three Scandinavian countries, Sweden (14.2 percent), Norway (12.48 percent) and Finland (12.17 percent), are the countries with the lowest number of computers infected by active malware during the first half of 2009.

Graphical representations of new malware detected in Q2 2009, as well as how different countries are affected by malware infection can be found here: http://www.flickr.com/photos/panda_security/tags/q2report/.

Malicious use of Twitter

A worm appeared in April which used a cross-site scripting technique to infect Twitter users when they visited the profiles of other infected users. It then infected the new user’s profile to continue propagating. New variants appeared, and finally the creator’s identity was revealed: an individual named Mikey Mooney, who apparently wanted to attract users to a service competing with Twitter.

In early June, Twitter was the focus of other attacks, this time using different techniques, most predominantly, BlackHat SEO. Twitter has a feature called “Trending Topics”, which is a list of the most popular topics that appears in the interface of all Twitter users. When users select a topic through this feature, they see all ‘tweets’ published that are related to this issue.

In this case, malicious users were writing tweets about the topics listed in Twitter Trends with links to malicious Web pages from which malware was downloaded. The first attack focused on just one of the topics, but just a few days later the scope of the attack increased and all popular topics contained malicious links. When the actor David Carradine died, there were hundreds of malicious tweets in just a few hours, and the same thing occurred with other popular issues on Twitter.

The second anniversary of Collective Intelligence, a detailed analysis of the Waledac worm, trends regarding the sending of malware via spam and the evolution of BlackHat SEO techniques are just some of the other issues covered in the PandaLabs Quarterly Report.

Source: Panda Security

Tags: , , , , , , , , , , ,

Cyber-Crooks Use Twitter to Infect Users, According to PandaLabs

June 5, 2009 · Filed Under Security Software, Software News · Comment 

Criminals have created accounts in Twitter and published thousands of comments in them under the topic ‘PhishTube Broadcast’ to push them into the ranking of most popular topics

These comments contain links to a spoof Web page used to propagate the PrivacyCenter fake antivirus

This new attack on one of the most popular Web 2.0 networks is similar to previous ones against similar sites such as Digg.com, YouTube, etc.

PandaLabs, Panda Security’s malware analysis and detection laboratory, today announced that it has discovered a new attack on Twitter users. In this case, cyber-criminals have created hundreds of Twitter accounts and published thousands of comments in them under the topic “PhishTube Broadcast,” in relation to the popular rock band, Phish. By infiltrating Twitter with comments, these cyber-criminals are ensuring its presence in the Trending Topic list, resulting in greater visibility and more user traffic to their comments.

The Trending Topics list appears in the interface of all Twitter users, listing the subjects most talked about by the network’s users. Clicking any of these topics returns a series of results displaying comments related to these issues and the users that have published the comments.

In this case, if Twitter users click on the “PhishTube Broadcast” Trending Topic link, they will see the malicious comments published in the accounts created by the cyber-crooks. These include links pointing to a spoof pornographic Web page and users who click on any of the items on this page will end up infecting their computers with a copy of the PrivacyCenter fake antivirus.

A fake antivirus is a type of adware designed to run a spoof scan of the system, as if it were a legitimate antivirus. It falsely informs users that their computers are infected with malware. The aim is to make users believe their systems are infected, and then offer them the chance to eliminate this supposed malware by buying a ‘Premium’ version of the fake antivirus. The overall objective is to profit from these sales.

banner_468x60_en

“We have recently been warning of an increase in BlackHat SEO attacks (malicious techniques to improve search engine rankings), particularly those aimed at selling fake antivirus products. In this case, instead of a search engine, the Twitter ranking mechanism is the target of the attack, forcing topics to appear in the list of the most popular. Anyone interested in this topic will most likely end up on one of the thousands of malicious comments posted, although we have also seen a few legitimate comments,” explains Luis Corrons, Technical Director of PandaLabs. “With millions of users, this network is extremely attractive to cyber-criminals, and it is likely we will see it targeted more often in the future.”

You can find more information in the PandaLabs blog: http://pandalabs.pandasecurity.com/archive/Rogueware-Campaigns-now-blending-in to-Twitter-Trends.aspx

You can view all the images here: http://www.flickr.com/photos/panda_security/tags/malicioustwitter/

Source: Panda Security

Tags: , , , , , , , , , ,