Malware RSS Feed

"El Machete"

Malware Alerts - Wed, 08/20/2014 - 02:30
Introduction

Some time ago, a Kaspersky Lab customer in Latin America contacted us to say he had visited China and suspected his machine was infected with an unknown, undetected malware. While assisting the customer, we found a very interesting file in the system that is completely unrelated to China and contained no Chinese coding traces. At first look, it pretends to be a Java related application but after a quick analysis, it was obvious this was something more than just a simple Java file.  It was a targeted attack we are calling "Machete".

What is "Machete"?

"Machete" is a targeted attack campaign with Spanish speaking roots. We believe this campaign started in 2010 and was renewed with an improved infrastructure in 2012. The operation may be still "active".

The malware is capable of the following cyber-espionage operations:

  • Logging keystrokes
  • Capturing audio from the computer's microphone
  • Capturing screenshots
  • Capturing geolocation data
  • Taking photos from the computer's web camera
  • Copying files to a remote server
  • Copying files to a special USB device if inserted
  • Hijjacking the clipboard and capturing information from the target machine
Targets of "Machete"

Most of the victims are located in, Venezuela, Ecuador, Colombia, Peru, Russia, Cuba, and Spain, among others. In some cases, such as Russia, the target appears to be an embassy from one of the countries of this list.

Targets include high-level profiles, including intelligence services, military, embassies and government institutions.

How does "Machete" operate?

The malware is distributed via social engineering techniques, which includes spear-phishing emails and infections via Web by a fake Blog website. We have found no evidence of of exploits targeting zero-day vulnerabilities. Both the attackers and the victims appear to be Spanish-speaking.

During this investigation, we also discovered many other the files installing this cyber-espionage tool in what appears to be a dedicated a spear phishing campaign. These files display a PowerPoint presentation that installs the malware on the target system once the file is opened.  These are the names of the PowerPoint attachments:

  • Hermosa XXX.pps.rar
  • Suntzu.rar
  • El arte de la guerra.rar
  • Hot brazilian XXX.rar

These files are in reality Nullsoft Installer self-extracting archives and have compilation dates going back to 2008.

A consequence of the embedded  Python code inside the executables is that these installers include all the necessary Python libraries as well as the PowerPoint file shown to the victim during the installation. The result is extremely large files, over 3MB.

Here are some screnshots of the mentioned files:

A technical relevant fact about this campaign is the use of Python embedded into Windows executables of the malware. This is very unusual and does not have any advantage for the attackers except ease of coding. There is no multi-platform support as the code is heavily Windows-oriented (use of libraries). However, we discovered several clues that the attackers prepared the infrastructure for Mac OS X and Unix victims as well. In addition to Windows components, we also found a mobile (Android) component.

Both attackers and victims speak Spanish natively, as we see it consistently in the source code of the client side and in the Python code.

Indicators of Compromise Web infections

The following code snippets were found into the HTML of websites used to infect victims:

Also the following link to one known infection artifact:

hxxp://name.domain.org/nickname/set/Signed_Update.jar

Domains

The following are domains found during the infection campaign. Any communication with them must be considered extremely suspicious

java.serveblog.net
agaliarept.com
frejabe.com
grannegral.com
plushbr.com
xmailliwx.com
blogwhereyou.com (sinkholed by Kaspersky Lab)
grannegral.com (sinkholed by Kaspersky Lab)

Infection artifacts MD5 Filename 61d33dc5b257a18eb6514e473c1495fe AwgXuBV31pGV.eXe b5ada760476ba9a815ca56f12a11d557 EL ARTE DE LA GUERRA.exe d6c112d951cb48cab37e5d7ebed2420b Hermosa XXX.rar df2889df7ac209e7b696733aa6b52af5 Hermosa XXX.pps.rar e486eddffd13bed33e68d6d8d4052270 Hermosa XXX.pps.rar e9b2499b92279669a09fef798af7f45b Suntzu.rar f7e23b876fc887052ac8e2558f0d6c38 Hot Brazilian XXX.rar b26d1aec219ce45b2e80769368310471 Signed_Update.jar Traces on infected machines

Creates the file Java Update.lnk pointing to appdata/Jre6/java.exe

Malware is installed in appdata/ MicroDes/

Running processes Creates Task Microsoft_up

Human part of "Machete" Language

The first evidence is the language used, both for the victims and attackers, is Spanish.

The victims are all Spanish speaking according to the filenames of the stolen documents.

The language is also Spanish for the operators of the campaign, we can find all the server side code written in this language: reportes, ingresar, peso, etc.

Conclusion

The "Machete" discovery shows there are many regional  players in the world of targeted attacks. Unfortunately, such attacks became a part of the cyber arsenal of many nations located over the world. We can be sure there are other parallel targeted attacks running now in Latin America and other regions.

Kaspersky Lab products detect malicious samples related to this targeted attack as Trojan-Spy.Python.Ragua.

Note: A full analysis of the Machete attacks is available to the Kaspersky Intelligent Services customers. Contact: intelreports@kaspersky.com

ZeroLocker won't come to your rescue

Malware Alerts - Mon, 08/18/2014 - 11:16

In recent times we've been seeing a lot of file-encrypting ransomware activity.

One of the new ones we've seen pop up in the last couple weeks is called ZeroLocker. There's indication the C&C configuration contains some errors which would prevent successful decryption. This is why we urge people not to pay up even more so than normal.

So far we've observed a limited amount of detections through our Kaspersky Security Network. The actors behind ZeroLocker are initially asking $300 worth of BTC for decrypting the files. This goes up to $500 and $1000 as time passes:

ZeroLocker adds a .encrypt extension to all files it encrypts. Unlike most other ransomware ZeroLocker encrypts virtually all files on the system, rather than using a set of pre-defined filetypes to encrypt. It doesn't encrypt files larger than 20MB in size, or files located in directories containing the words "Windows", "WINDOWS", "Program Files", "ZeroLocker" or "Desktop". The malware gets executed at boot from C:\ZeroLocker\ZeroRescue.exe.

Though there's a Bitcoin wallet hardcoded inside the binary the malware tries to fetch a new wallet address from the C&C. This is most likely done to make it more difficult to trace how successful the operation is and where the money goes.

We've gathered several Bitcoin wallet addresses and at the time of writing none had any transactions associated with them. As the C&C server is providing the Bitcoin wallet information it's possible the attackers are able to use a unique wallet for each victim.

The malware generates one random 160-bit AES key to encrypt all the files with. Due to the way the key is generated the key space is somewhat limited, though still large enough to make general brute forcing unfeasible. After encryption the malware runs the cipher.exe utility to remove all unused data from the drive, making file recovery much harder. The encryption key, together with a CRC32 of the computer's MAC address, and the associated Bitcoin wallet is sent to the server.

Interestingly enough, the encryption key along with the other information is sent through a GET request, rather than a POST. This results in a 404 on the server. This could mean that the server is not storing this information. That means victims who pay up may likely not see their files restored.

Several other URLs that the malware tries to get result in 404s as well, which indicates this particular operation may still be in its infancy. When those errors are fixed we may see ZeroLocker deployed on a larger scale. These operations rely on people paying up. Don't do it. Make sure you have backups instead.

We detect current ZeroLocker samples as Trojan-Ransom.MSIL.Agent.uh.

The Syrian Malware House of Cards

Malware Alerts - Mon, 08/18/2014 - 04:00

 Our full Report

Introduction

The geopolitical conflicts in the Middle East have deepened in the last few years. Syria is no exception, with the crisis there taking many forms, and the cyberspace conflict is intensifying as sides try to tilt the struggle in their favor by exploiting cyber intelligence and using distortion.

The Global Research & Analysis Team (GReAT) at Kaspersky Lab has discovered new malware attacks in Syria, using some techniques to hide and operate malware, in addition to proficient social engineering tricks to deliver malware by tricking and tempting victims to open and launch malicious files. The malware files were found on activist sites and social networking forums, some other files were also reported by local organizations like CyberArabs and Technicians for Freedom.

The full report detailing the attacks and related activities can be found here.

A glance at what was discovered

The number of attacks and malicious files being distributed is constantly increasing as the attackers become more organized and proficient. The samples are all based on Remote Administration Trojan Tools (RATs)
The number of malicious files found: 110
The number of domains linked to the attacks: 20
The number of IP addresses linked to the attacks: 47

The National Security Program - what the malware attacks look like

Masquerading as a reportedly "Government leaked program" that has the names of all wanted people in Syria, the National Security Program conceals a full featured RAT client to steal all sorts of information under one of its buttons.

برنامج الأمن الوطني.exe (The national security program)

Using shockingly disturbing videos to distribute malware

A disturbing video showing injured victims of recent bombings was used on YouTube to appeal to people's fear and prompt them to download a malicious application available on a public file sharing website. After initial analysis, the file named "فضائح .exe" (Scandals.exe) proved to be heavily obfuscated with the commercial utility "MaxToCode" for .NET in order to avoid early detection by antivirus solutions.

Did you install your "Ammazon" Security Suite?

If you thought the era of fake antiviruses was over, here comes this newly developed Syrian sample to challenge your beliefs. With the innocent title of "Ammazon Internet Security", this malicious application tries to mimic a security scanner, even including a quite thorough graphical user interface and some interactive functionality.

Your "Ammazon" is now secure, what about the rest of your network?

Total Network Monitor (which is a legitimate application) is inside another sample found, being used with embedded malware for spying purposes. Offering security applications to protect against surveillance is one of the many techniques used by malware writing groups to get users desperate for privacy to execute these dubious programs.

Instant messaging, instant infection

It's also the case with other samples, where social engineering does all the heavy work. Instant messaging applications for desktop operating systems have been used in the past to spread malware and it seems Syrian malware authors have jumped on the bandwagon.

Beware of Chemical Attacks

Another of the attacks using social engineering tricks, the sample named Kimawi.exe (Arabic for Chemicals) with a JPG icon, is a RAT file bound to the image Kimawi.jpg. The picture is a previously leaked paper supposedly from the regime in Syria warning military units to prepare for Chemical Attacks. The file is being sent by email to selected victims.

FAQ What is new?

The threat actors are becoming more organized, the number of attacks is increasing and the samples being used are becoming more sophisticated, while also relying extensively on powerful social engineering tricks that many people fall for.

Where are the victims and the attackers?

The victims infected when accessing the hacked forums and social networking sites tend to be ordinary users or activistshey were, or specific targets if they receive the malware via email, Skype, or messages on social networking sites.

The victims are also located outside Syria. We have seen victims of Syrian-based malware in:

  1. Turkey
  2. Saudi Arabia
  3. Lebanon
  4. Palestine
  5. United Arab Emirates
  6. Israel
  7. Morocco
  8. France
  9. United States

The attackers' command and control centers were tracked to IP addresses in Syria, Russia, Lebanon, the US and Brazil.

How many have fallen victim?

We believe the number of victims exceeds 10,000, with some of the files being downloaded more than 2000 times.

The attackers' malware samples and variations have increased dramatically from only a few in Q1 2013 to around 40 in Q2 2014.

What is the impact on victims?

Remote Administration Trojans tools are used to fully compromise the system on victim devices. RATs are capable of stealing user credentials in addition to activating camera and microphone functionalities...

Are users protected?

Kaspersky detects and blocks all the samples that have been found. They are detected as follows:

  • Trojan.MSIL.Zapchast
  • Backdoor.Win32.Bifrose
  • Backdoor.Win32.Fynloski
  • Backdoor.Win32.Xtreme

More details and analysis of the attacks and malware samples can be found in the full report here.

Use anti-virus software

SANS Tip-of-the-Day - Sat, 08/16/2014 - 23:13

ZeuS GameOver, Brazilian Trojans and Boletos: an explosive combination

Malware Alerts - Wed, 08/13/2014 - 10:00

I'm sure you've read or heard about the malware attacking boletos – the popular Brazilian payment system – and how lots of malicious code is able to modify it, redirecting the amount paid to an account owned by criminals. Despite the fact that some numbers were overestimated by some companies and media outlets, these attacks are of particular interest and the Brazilian bad guys are quickly developing and adopting new techniques. Trust me: everything you read about boleto malware was only the tip of the iceberg; our complete research into this topic will be presented at the next Virus Bulletin conference.

The boleto malware campaigns combine several new tricks to infect and steal from more users. One of the most recent is the use of non-executable and encrypted malware payloads XORed with a 32-bit key and compressed by ZLIB. It's no coincidence that a very similar technique was used by ZeuS GameOver some months ago, but this time the files are using extensions such as .BCK and .JMP, instead of .ENC.

We have evidence of Brazilian criminals cooperating with western European gangs involved with ZeuS and its variants; it's not unusual to find them on underground forums looking for samples, buying new crimeware and ATM/PoS malware. The first results of this cooperation can be seen in the development of new attacks such the one affecting boletos payments in Brazil.

A typical Brazilian boleto: using web-injection to change the numbers in the ID field is enough to redirect the payment

In February, security expert Gary Warner wrote about a new version of ZeuS campaign that downloads some strange and non-executable .ENC files to the infected machine. Our colleagues at CrySys did a very detailed analysis showing how this is an effective technique for passing through your firewall, webfilters, network intrusion detection systems and many other defenses you may have in place, as a tiny Trojan downloads these encrypted (.ENC) files and decrypts them to complete the infection.

Brazilian cybercriminals decided to use the .JMP extension in files encrypted in the same way, and downloaded by several small Trojans used in boletos and Trojan banker campaigns. This is what an encrypted file looks in the beginning:

After removing the encryption we can see it as a normal PE executable:

The criminals tend to encrypt the big payload files using this technique, as well as some removal tools such as Partizan and big Delphi Trojan bankers that include images of Internet banking pages. The aim is always to encrypt the payload and make it undetectable, so that it's not recognized as a normal portable executable.

Other files of interest are those with .BCK extensions – they are packed with an as yet unknown application that appears to be a commercial backup app. Just checking the head of the encrypted file is enough to see what's inside - in this case it is a malicious CPL file used in the boletos campaigns:

"refazboleto" is Portuguese for "rebuild boleto". It points to a CPL file

Our antivirus engines are prepared to unpack and detect .JMP and .BCK files like these. These facts show how Brazilian cybercriminals are adopting new techniques as a result of the collaboration with their European counterparts.

Thanks to my colleague Alexander Liskin for help with the analysis.

Always Check Credentials

SANS Tip-of-the-Day - Tue, 08/12/2014 - 23:43

August Update Tuesday - OneNote's First RCE, IE Memory Corruption

Malware Alerts - Tue, 08/12/2014 - 14:34

The second Tuesday of the month is here along with Microsoft's August security updates, and with it brings interesting updates of OneNote and Internet Explorer. The full list is nine security bulletins long.

OneNote has been a part of Microsoft's drive into mobile and cloud technologies, away from traditional Wintel computing, providing Office-integrated note-taking multi-user collaborative functionality across tablets and mobile devices. I noticed a bunch of Blackhat attendees using this software. While the vulnerability is limited to all versions of Microsoft OneNote 2007,, and there have been a couple of releases since, I believe that this vulnerability is the first RCE enabled by a component exclusively delivered with the OneNote software. In this case, it is the file parser that reads onenote (.ONE) files that enables remote code execution attacks. This software package now is available for Windows, Mac, Windows RT, Windows Phone, iOS, Android and Symbian, but the vulnerable OneNote code appears to be available only for TabletPCs and the Windows platform. cve-2014-2815 was privately reported to Microsoft.

Another big Bulletin pushed today for Internet Explorer addresses 25 critical RCE vulnerabilities(!) across IE 6 - 11 on Windows clients Vista through 8.1, all memory corruption issues. The browsers on related server installs are rated moderate. Some of these vulnerabilities have been actively exploited ItW, so it is an urgent update issue.

And Adobe released their own patch separately from the Microsoft update process to fix an extraordinary sandbox vulnerability abused by APT that we reported a while back. Be sure to check out those details. It effects fairly recent versions of Reader sandboxes.

CVE-2014-0546 used in targeted attacks - Adobe Reader Update

Malware Alerts - Tue, 08/12/2014 - 11:09

Today Adobe released the security bulletin APSB14-19, crediting Kaspersky Lab for reporting CVE-2014-0546.

This out of band patch fixes a rather creative sandbox escape technique that we observed in a very limited number of targeted attacks.

At the moment, we are not providing any details on these attacks as the investigation is still ongoing. Although these attacks are very rare, just to stay on the safe side we recommend everyone to get the update from the Adobe site as soon as possible.

You can grab the Adobe Reader updates here.

Spam and phishing in Q2 2014

Malware Alerts - Tue, 08/12/2014 - 08:00

 PDF Version

Spam: quarterly highlights Spam and legislation

On 1 July, new anti-spam legislation (CASL) came into effect in Canada. The new law covers commercial communications including email, messages on social networks and instant messaging services as well as SMS. Now, before a company starts sending emails, it must get the recipients' consent. Canadian companies appear to have taken the new law seriously: in the second quarter, we saw a lot emails from Canadian companies asking users for permission to send their mailings. As well as asking for permission, these emails also contained offers links to lotteries.

Some companies actually used the law as an excuse to collect subscribers' addresses. We came across requests asking users for permission to send them mass mailings even in the addresses of traps that have never been signed up to any mailing lists. Moreover, many of the users who received these sorts of request marked them as spam.

This flow of requests shows that many Canadian mass mailing distributors have never thought about the wishes of users before, but have just sent out their messages to the addresses on their lists.

There are two general views of the new law. On the one hand, an anti-spam law in yet another country will undoubtedly help the fight against spam. On the other hand, legitimate Canadian businesses that use mass mailing fear they may now be regarded as illegal. Microsoft first decided to stop sending out all its security news, but changed its mind a few days later, which is not all that surprising: despite the severity of the law, CASL includes a number of exceptions, and Microsoft's mass mailings don't fall under its jurisdiction. Among the CASL exceptions are mass mailings with various information about a product or service that the user has purchased from a company; mailings aimed at collecting donations; non-commercial mailings, etc.

Playing the market again!

In Q2 2014, we saw a new wave of spam advertising offers to buy stock in small companies. This is a well-known form of stock fraud called 'pump and dump'. The peak of this type of spam was registered in 2006-2007, although fraudsters continue to use it.

Pump-and-dump spam is a form of stock market fraud where spammers buy shares in small companies, artificially inflate the prices by spreading information they were allegedly going to significantly increase in value in the near future and then sell the shares at a higher price.

Interestingly, in addition to these well-known fraudulent tricks, the scammers also applied some time-tested methods to bypass filtering:

  1. A random set of sentences inserted at the end of each email that use a color close to that of the background (mailings included random sentences from Wikipedia);
  2. Image spam: the main information is contained in a picture; the color, the text size, the font, the background color and angle of the picture vary from email to email in the mailing.

Image spam was also popular in 2006-2007, and then virtually disappeared, as anti-spam vendors developed graphical analyzers and learned to successfully block these sorts of emails. Also, because of excessive 'background noise', this spam is unlikely to attract many users. These 'stock market' mailings appear to spread in huge volumes: spammers send out hundreds of millions of emails hoping for a minimal response.

Spam and the World Cup

In the first quarter of 2014, the Winter Olympics was the most popular sporting theme for spammers while in Q2 they switched their attention to the FIFA World Cup. You can get more information about phishing and malware attacks that used the World Cup theme from our blog. Apart from dangerous emails, there were messages offering hotel bookings and tickets to the matches as well as adverts for World Cup-related souvenirs and messages inviting bets on the results.

As is usual in such cases, the theme of the World Cup was exploited in spam that had no direct connection to the event. For example, one resourceful German used the theme to advertise Viagra.

"Remain the champion in your bedroom after the World Cup is over," states the advert above.

Sent from iPhone: mobile-themed email

To continue the theme of integration between email spam and mobile devices, we should note that in the second quarter of 2014 mass mailings imitating messages sent from iPad and iPhone were particularly popular. The range of emails was quite diverse – from pharmaceutical offers to messages with malicious attachments. All of them contained the same line in the body of the message: 'Sent from iPhone/iPad'.

In the first example, the link, following several redirects, opened a site advertising medication to enhance male potency; the second attachment contained a malicious program detected by Kaspersky Lab as Trojan-PSW.Win32.Tepfer.tmyd.

The mailings were most likely sent by different groups of spammers as the technical headers (such as Data, X-Mailer, Message-ID) were very different. For example, in some emails the headers were written carelessly while in the others the fields were empty. The only thing they had in common with real messages sent from the iOS-based devices was the phrase in the body of the message. In other emails the headers were not just accurate, they were imitations of the headers used by the real Apple mail client:

X-Mailer: iPhone Mail (9B206)
Message-Id: UNQC4G8K-NTOU-2PNZ-JUVC-WHRCD5GXS1QF@*****.**

However, on closer examination, the headers only looked like the real thing (in terms of the number of symbols and the location of hyphens). The fact is that real messages sent from iOS mobile devices use hex code to record Message-ID. The hexadecimal format includes numbers from 0 to 9 and the letters ABCDEF, which means there can be nothing else apart from these numbers and letters in the Message-ID. The fake emails just contained a random set of letters and numbers.

Redirects

To bypass filtering, criminals often try to hide the address of the site the user is prompted to visit. There are many ways to hide spam links. One of the most widespread is when the links in emails lead to compromised sites from which the user is redirected to the target site. This site may contain an advertisement and/or malicious code. Usually, compromised sites are included in the system redirects simply because cybercriminals can hack them, but sometimes the fraudsters intentionally seek them out. For example, we came across a mass mailing which redirected the user to an advertisement for pharmaceuticals via a compromised site. Moreover, the sites that had been compromised were actually pharmaceutical sites (rxpharmacy *****. com). Cybercriminals use such targeting to make the link appear as genuine as possible to the user.

In addition, we have recently come across a lot of hacked sites belonging to religious societies. It is unlikely they were targeted or subjected to social engineering deliberately – they were probably just poorly protected.

Malicious attachments in email


Top 10 malicious programs spread by email in Q2 2014

As is now traditional, the list of malware spread by email is topped by Trojan-Spy.HTML.Fraud.gen. This threat appears as an HTML phishing website where a user has to enter his personal data which is then forwarded to cybercriminals. Noticeably, the percentage of this malicious program decreased by 1.67 percentage points from the previous quarter.

Trojan-Banker.Win32.ChePro.ilc. ended the quarter in second position. This banking Trojan mainly targets online customers of Brazilian and Portuguese banks.

For the first time in a while, exploits made it into the Top 10, with one (Exploit.JS.CVE-2010-0188.f) coming straight in at third place. Exploits in email are especially dangerous as they are created in the form of harmless documents rather than executable files. This particular exploit appears in the form of a PDF file and uses a vulnerability in version 9.3 and lower of Adobe Reader. This vulnerability has been known for a long time and poses no danger to users who update their software regularly. However, if the Adobe version is old, the exploit downloads and runs the executable file detected by Kaspersky Lab as Trojan-Dropper.Win32.Agent.lcqs. The dropper installs and runs a java script (Backdoor.JS.Agent.h) which collects information about the system, sends it to the attackers' server and receives various commands in return from the server. The commands and the results of their execution are transmitted in an encrypted form.

In Q2 2014, representatives of the Bublik family occupied fourth, sixth, seventh and eighth places. Their main functionality is the unauthorized download and installation of new versions of malware onto victim computers. These Trojans appear in the form of the .EXE files, although they imitate Adobe documents with the help of an icon. They often download the notorious ZeuS/Zbot to users' computers.

The Email-Worm.Win32.Bagle.gt ranked fifth in Q2. The main functionality of this type of worm is to harvest the email addresses from compromised computers. The Bagle family worm can also receive remote commands to install other malware on the infected computer.

Yet another exploit – Exploit.Win32.CVE-2012-0158.j – ended the quarter in ninth place. It was designed to look like a Microsoft Word document and exploits a vulnerability in the mscomctl.ocx code in Microsoft Office. Its activity results in the installation and launch of malicious programs on the user computer.

The Top 10 in Q2 was rounded off by Trojan-Spy.Win32.Zbot.sivm from the Zbot family. Zbot is a family of Trojans that can execute different malicious operations (their functionality is updated over time) but most often they are used to steal banking information. Zbot can also install CryptoLocker, a malicious program that demands money to decrypt user data.

With regards to the most popular malware families rather than individual modifications, the distribution in Q2 was slightly different:


Top 10 malware families spread by email in Q2 2014

Bublik (which often downloads other malware, specifically the Zbot family of Trojans), as well as Zbot itself, are far ahead of their competitors in the rating. These two malware families account for over a third of all email antivirus detections. This is because the majority of malware is used to steal money and Zeus/Zbot is one of the most popular and widely available of these programs.

The Androm family is in third place. The Andromeda family of malware consists of backdoors that allow cybercriminals to secretly control a compromised computer. Machines infected by these programs often become parts of botnets.

Targets of malicious mass mailings by country


Distribution of email antivirus detections by country in Q2 2014

The TOP 20 countries with the highest number of antivirus detections saw some change from the first quarter of 2014. The percentage of malicious spam targeting users in the US decreased slightly (-3.5 pp). However, this was enough to see it drop from first to third place, allowing the UK and Germany to take the lead. Among the other significant changes was the 2.5 times increase in the proportion of malicious spam sent to Brazil which moved this country up from 15th to fifth place. This was due to the ChePro family banker: over 80% of instances of this malicious program were sent to Brazilian users.

Special features of malicious spam

Cybercriminals often mask spam with malicious attachments in emails from well-known organizations – delivery services, stores, social networks. However, as a rule, all such mass mailings imitate emails regularly received by users (bills, delivery status notifications, etc.). In Q2, we registered a more creative mass mailing supposedly sent by Starbucks coffee house chain that made use of a social engineering technique.

The message claimed that one of the recipient's friends, who requested anonymity, had allegedly made an order at for him at Starbucks. To view the menu, find out the address and the exact time that the order was available, the recipient had to open the attachment, an executable that the cybercriminals hadn't even bothered to mask.

Statistics The proportion of spam in email traffic


The percentage of spam in email traffic in January-June 2014

The percentage of spam in all email traffic during the second quarter the year came to 68.6%, up 2.2 pp from the previous quarter. A peak was reached in April and since then the share of unwanted messages in email traffic has been falling gradually.

Sources of spam by country

Previously our statistical data on the sources of spam by country was based on information received from spam traps in different countries. However, the spam from the traps differs from the spam received by ordinary users. For example, spam targeting specialized companies does not reach the traps. That is why we have changed the data source, and now with KSN (Kaspersky Security Network) we compile statistical reports on spam based on the messages that the users of our products receive worldwide. Since the information for the statistical report in June was received from a different source, comparing the results with the statistics for the previous quarter would be incorrect.


Sources of spam by country in Q2 2014

The US tops the rating of the most popular spam sources, accounting for 13.4% of junk mail sent worldwide. This is not surprising since the US is the country with the largest number of Internet users. Even with high user awareness about the dangers of the Internet, not everyone can avoid an infection on their computer, which can result in the machine becoming part of a botnet that spreads spam.

The distribution of other spam sources by country is quite uniform. This makes sense in that botnets are distributed throughout the world, meaning there are infected computers in almost every country.

Russia came second having accounted for 6% of world spam. Vietnam is in third place (5%).

According to our statistics, in many countries a significant amount of incoming junk mail is "domestic spam", i.e. it originates and is addressed to users in one country. In Q2, 18% of spam sent to Russian users originated in Russia.  In the US "domestic spam" accounted for 27.2% of the country's junk mail. The same trend can be seen in other large countries from which a significant share of the world spam is sent. In smaller countries, spam mostly comes from abroad.

The size of spam emails


Size of spam emails: Q2 2014

The distribution of spam emails by size was almost identical to that in the previous quarter. Small spam emails weighing in at under 1 KB are by far the most common – they are easier and quicker to send.

In Q2 we registered some decline in the proportion of 2-5 KB emails (-2.7 pp) and a small growth in 5-10 KB emails. This might be due to the increase in the share of image spam: firstly, there were lots of mass mailings of stock market fraud containing pictures (see above) and secondly, Russian-language spam of the "How to lose weight" and "Fake designer goods" categories also included a lot of images.

Phishing

In Q2 2014, Kaspersky Lab's anti-phishing component registered 60,090,173 detections. Phishers attacked users in Brazil most often: at least once during the quarter the Anti-Phishing component of the system was activated on computers the of 23.2% of Brazilian users.


The geography of phishing attacks in Q2 2014*

* The percentage of users on whose computers the Anti-Phishing component was activated, from the total number of all Kaspersky Lab users

Top 10 countries by the percentage of attacked users:

  Country % of attacked users 1 Brazil 23.2% 2 India 19.2% 3 Puerto Rico 18.6% 4 Japan 17.1% 5 France 17.0% 6 Armenia 16.8% 7 Dominican Republic 16.2% 8 Russia 16.1% 9 Australia 16.1% 10 UK 15.8%

Brazil only entered the Top 10 in 2014. The increase in phisher activity targeting Brazilian users may be down to the World Cup being held in the country.

Targets of attacks by organization

The statistics on phishing targets is based on detections of Kaspersky Lab's anti-phishing component. It is activated every time a user enters a phishing page while information about it is not included in Kaspersky Lab databases. It does not matter how the user enters this page – by clicking the link contained in a phishing email or in the message in a social network or, for example, as a result of malware activity. After the activation of the security system, the user sees a banner in the browser warning about a potential threat.

In our previous reports we referred to the TOP 100 organizations when analyzing the most attractive targets for phishing attacks. In Q2, we analyzed the statistics for all attacked organizations.

During attacks on organizations from the Banks, E-pay systems, and Online stores and e-auctions categories the attackers were interested in users' personal information in order to gain access to their e-accounts. As a result, we have merged these three categories into one - Online finances.


Organizations most frequently targeted by phishers, by category – Q2 2014

Below is a similar chart for the previous quarter:


Organizations most frequently targeted by phishers,  by category – Q1 2014

As in Q1 2014, in the second quarter the Global Internet portals category tops the rating of organizations most often attacked by phishers: its share dropping by just 1.7 pp. This category incorporates portals that combine many services including search and email services. The data stolen from such portal allows fraudsters to access all their services. Most often the phishers imitate the authorization pages of email services.


Phishing attacks on global Internet portals *

* The rating does not show the safety level of phisher targets but reflects the popularity and credibility of the services with users, which affects their attractiveness to phishers

Financial phishing accounted for 24.84% of all attacks, a 1.8 pp growth compared with the previous quarter. The percentage of detections on Banks and Online stores increased by 0.93 and 0.85 pp respectively.

Social networks remained in third.


Phishing attacks on social networks *

* The rating does not show the safety level of phisher targets but reflects the popularity and credibility of the services with users, which affects their attractiveness to phishers

In the first quarter, Facebook accounted for 79.5% of the total number of user attempts to click on links leading to fake social networking sites. In Q2, the number of phishing attacks on Facebook users decreased significantly (-23.54 pp) while the percentage of user attempts to visit fake pages on the Russian social networks Odnoklassniki (Classmates) (+18.7 pp) and VKontakte (+10.68 pp) rose sharply.

Top 3 most organizations most frequently targeted by phishers   Organization % phishing links 1 Yahoo! 30.96% 2 Google Inc 8.68% 3 Facebook 8.1%

In Q2 2014, the share of phishing links to the pages of Yahoo! services reached 30.96% of all attacks.

Yahoo! topped the rating of the most popular phisher targets in the first quarter of 2014 with 31.94% of all attacks after a sharp increase in the number of such fraudulent links in early January.


The number of daily detections on phishing sites imitating Yahoo! pages, Q1 2014

In the second quarter there were no peaks in the detection of phishing links to fake Yahoo! pages

In January of this year in its blog, Yahoo! announced the introduction of HTTPS by default for its email service. This security measure, in addition to protecting the transmitted data can help fight phishers: now, in the event of a phishing attack when the domain name in the address bar remains unchanged (for example, the DNS server is substituted), the absence of a secure connection icon in the address bar should alert the user. However, the absence of a secure connection is just one sign of a phishing page, while its presence does not guarantee the site authenticity.


An example of a phishing page imitating the authorization page of the Yahoo! email service

In Q2, Google (8.68%) became the second most popular phishing target outstripping Facebook. Previously, phishers used to imitate the entry page of the Gmail service while now they have switched to the authentication page common to all Google services. This is a highly attractive target for phishers - "One account. All of Google."

In the second quarter of 2014 we came across a very interesting example demonstrating the appetite of phishers who are obviously not satisfied with just targeting Google:

This phishing page imitating the authentication page for all Google accounts provides the owners of AOL, Hotmail and Yahoo email accounts with the option of choosing passwords.

Last year's leader, Facebook, dropped one place and settled in third in the rating of Anti-Phishing component detections (8.02%). The percentage of phishing attacks targeting users of social networks lags far behind that of the visitors to global Internet portals, but the former is still of interest for phishers on the hunt for users' accounts worldwide.

Hot topics in phishing

The main "seasonal" theme for phishers was the FIFA World Cup.


"Chance to win the tickets to the next match of the World Cup"

Fraudsters exploited the football theme until the end of the World Cup. The first football-related mass mailings emerged in early 2014 and then appeared regularly throughout the first half of the year. Typically, the phishers imitated messages from well-known organizations (mainly FIFA) and asked the user to follow a link to a site offering the chance to win a valuable prize. The prize, like the example above, was usually tickets to a World Cup match. The user had to enter his personal information including his credit card details, i.e. information that is especially interesting for the scammers.

Additionally, in Q2 phishers turned their attention to the popular fast-food restaurant McDonald's. In April, the attackers tried to lure card data from Portuguese-speaking users. The fake email informed the recipient of the chance to win 150 euros from McDonald's. To do this, he had to follow the link in the email and participate in the survey. The phishing page which opened once the user clicked the link suggested he answer a few questions and enter his credit card data for the alleged money transfer. This was exactly what the criminals were after – many unsuspecting users send their personal information to third parties without being aware of the fraudsters' plans.

Noticeably, the fraudulent email was written in Portuguese and most likely addressed to residents in Brazil and Portugal while the text of the survey was in English, which is quite typical for this type of "survey".

Conclusion

In the second quarter of 2014 we came across a lot of mailings from various Canadian organizations willing to get users' agreement to receive mass mailings before the new anti-spammer law comes into force there. In a bid to attract new users, the companies sent out the requests to email addresses on lists that included many that were not already among the recipients of their mailings. Nevertheless, the law has begun to yield some favorable results even before it comes into force.

One of the most popular spam themes in Q2 was the stock market spam used in fraudulent "pump and dump" schemes. Interestingly, the distributors of this time-tested theme tried to bypass filtering using some well-known methods – image spam and "white text".

The mobile theme in spam continued with fake notifications sent from iOS-based devices. Most imitations did not take into consideration the details and specifics of this operating system, meaning these mailings were easily detected.

In Q2 2014, Fraud.gen remained the most popular malicious program distributed via mail. This malicious program was designed to steal users' banking data. Second came Brazilian banking Trojan ChePro. Among the most popular malware families were Bublik and Zeus/Zbot. Interestingly, after a long break the TOP 10 welcomed back two exploits, one of which went straight in at third place.

The World Cup theme was actively exploited both for advertising goods and for malicious and phishing spam. The percentage of malicious spam sent to Brazil in Q2 increased 2.5 times compared with the previous quarter (mainly due to the Trojan Banker family ChePro). Brazil also came first in the rating of countries most often attacked by phishers. The Global Internet portals category took the lead among the organizations most frequently targeted in phishing attacks.

According to KSN statistics, the US topped the list of the most popular spam sources by country. Russia was second followed by Vietnam. Interestingly, in many large countries a significant portion of spam received by their users originated from their own territories.

Warkitteh, Mainframes and planes – DefCon22

Malware Alerts - Mon, 08/11/2014 - 05:07

This years DefCon just ended and thousands of hackers, security professionals and other visitors heading back home.  This years schedule was again a good mix of talks, but which to attend is not that easy due to the mass of visitors. That's why the organizers will move again next year to a different location, in order to deal with the growth of participants and events happening.

Five main tracks of talks, skytalks, contests and areas for different interests fills participation schedule for three days easily. Some talks got lots of attention as the experiment by Gene Bransfield, who utilized a cat to map WiFis in the neighborhood, named "Warkitteh". Hacking airplanes let one quick think of horror scenarios, but, as Phil Polstra stated, it's not possible to override the pilot. But also attacks on Mainframes were discussed. Mainframes are special systems, mainly used in enterprise and government segement. Several talks focused on hacking connected devices, reflecting the general IoT (Internet of Things) trend.

This years DefCon-Badge was again an electronic one, open for hacking and modifying. This ranked from basic to advanced LED/Light-extensions to Quadcopter mounting.

 

 

Pages

Subscribe to RIT Information Security aggregator