On-going Denial of Service (DDoS) Against US Sites

There's currently a large-scale denial of service underway that appears to be affecting sites like ftc.gov.

More information available from F-Secure:
Lyzapo DDoS attack on US and South Korean websites

Message Labs spam traffic analysis

A pretty quick and informative look at what Message Labs is currently seeing on the spam front.
- 90% of all email was spam
- 83.2% was botnet generated
- 45% of botnet generated spam appears to be from Cutwail
- Although one of it's main distribution channels was shut down earlier this month, this botnet showed great resilience by getting right back up. Very little reprieve was seen in traffic
- Virus infected emails 1:269
- Phishing emails 1:280

That's a lot of badness floating around out there. Article Here

Security Researchers Claim to Have Located Dropbox with High-profile FTP Logins

Representatives for Prevx claim they have accessed a server containing valid FTP logins for some high-profile domains (amazon.com, monster.com, bbc.co.uk, etc). This type of compromise goes hand-in-hand with the recent increase in drive-by-downloads.

Article courtesy of The Register.

Interest attack attempting to use security software update

Sophos has reported this morning that they have received copies of a malicious email that attempts to lure customers into downloading "updates" to their security software. The email looks very authentic, and anyone taken by the scheme ends up with Troj/Spoof-H which in turn allows additional malware to be installed.

The email message is:

“Download latest virus identity (IDE) files

If you are running an older version of Sophos Anti-Virus and do not automatically update your protection, you should download virus identity files (IDEs), which provide detection and disinfection of viruses, worms, Trojans and spyware.

All the IDEs you need are available in a single compressed file. NOTE: Please RUN the application accordingly.”

Additional details in the article

General phishing email reported 6/25

We got reports of several users getting this yesterday-

Origin -
85.25.132.91
NetRange: 85.0.0.0 - 85.255.255.255
CIDR: 85.0.0.0/8
NetName: 85-RIPE
NetHandle: NET-85-0-0-0-1

Received: from uf5.cybercity.dk (uf5.cybercity.dk [212.242.42.163])
by smtp2.cybercity.dk (Postfix) with ESMTP id 04DDC313CC2;
Thu, 25 Jun 2009 19:07:31 +0200 (CEST)
Received: from webmail.telenor.dk (localhost [127.0.0.1])
by uf5.cybercity.dk (Postfix) with ESMTP id 840D4205D31;
Thu, 25 Jun 2009 19:07:29 +0200 (CEST)
Received: from 85.25.132.91
(SquirrelMail authenticated user onlineid2@mail.telenor.dk)
by webmail.telenor.dk with HTTP;
Thu, 25 Jun 2009 19:07:30 +0200


Dear mail subscriber,
We are currently verifying our subscribers email accounts in
order to increase the Efficiency of our web mail features.

We are deleting all unused Web Mail account,

To confirm your account is currently in use and join in the
Recent Upgrade Taking Place,

You must Reply to this email by Providing your email Password
in the blank space below. Failure to do this will immediately
render your email address deactivated from our database.

Confirm Your Web Mail Login information
:::::::::::::
FIRST AND LAST NAME:
USERNAME:
PASSWORD:
:::::::::::::

Attention! Account holder who refuses to update
his account within Seven days after receiving this warning will
lose his account permanently.

Thanks for using Web mail

WebMail Admin System
Warning Code :UCIX782X

Several links and info on Twitter devleoping as target for attackers

I don't pass along every single attack I read about using Twitter, but this one described on Trend Micro's blog certainly caught my attention. Koobface seems to have updated it's components to increase mayhem on a user's Twitter (and other social networking sites).

According to the article
The new component uses a victim’s Twitter account to post tweets using Internet-browsing cookies to log in to the target user’s account. Tweets can more successfully be posted when the victim is currently logged on to his/her Twitter account as the ‘evil’ Koobface binary runs in the background.


The content is allegedly updated from a C&C server and then uses shortened URLs from Tinyurl.com to further obfuscate the threat.

In other big Twitter related attack news this week, Sophos has posted a video showing exactly how Guy Kawasaki's feed was exploited and used to try to propagate malware. It's interesting that they used a Mac to show how this exploit worked.

### Warning, this video shows the researcher going to the exploit site which contains erotic imagery which may be offensive or inappropriate in some environments ###
The link to the video is located HERE

Dangers of auto "redistributing" data and Mac Malware updates

Lot's of buzz about how Guy Kawasaki inadvertently put over 100k PC AND Mac users are risk when one of the users his service was setup to automatically redistribute sent a tweet with a malicious link. Those of us who like to share info can take away a very valid warning from this. We're responsible for the info we relay as well as what we post ourselves.

Full article Here

Great analysis and update on the inner workings of "Nine Ball" Attacks

Atif Mushtaq from FireEye provides some great info and research details on the inner workings of this attack.

We just picked up two samples that appear to be part of this last night.

Well worth the read in the threatfire blog HERE

4 Guilty Pleas in Spam Ring Prosecution

Brian Krebs of the Washington Post has an article (photos courtesy of Spamhaus) covering the guilty pleas of four individuals involved with what is described as "on of the worlds top spam kingpins".

The complete list of those pleading guilty of involvement and associated charges:

• Scott K. Bradley - Up to 87 months in prison and $1,000,000,000 fines


• John Bown - Up to 63 months in prison and $75,000 fine


• William Neil - Up to 37 months incarceration and $30,000 fine


• James Fite - 2 years incarceration and $30,000 fine

Sentencing is scheduled for 29 Oct, 2009

Full article is HERE

Your PC "for rent"

bestsecuritytips.com has an interesting article about a network that Finjan calls the "Golden Cash Network". The complete article is HERE

There are attached whitepapers covering the following

• On the buyer side of the trading platform, batches of 1,000 malware-infected PCs can be purchased for $5 up to $100; depending on territory


• Partners are paid for successfully distributing the bot and collecting FTP-credentials of legitimated websites through the infected PCs


• On the seller side of the trading platform, cybercriminals sell batches of 1,000 malware-infected PCs for $25 up to $500


• Compromised malware infected PCs may be infected with additional malware each time they are purchased by a new "owner"


• For attacks and exploitations, an exploit toolkit with obfuscated code and the Trojan Zalupko attack toolkit are provided

Very interesting and easy to follow article about a fairly standard botnet.

Very simplistic and hard to mitigate DoS for Apache Servers

With the prevalence of Apache webservers out there, this is a fairly disturbing bit of news. Will be interesting to see what types of mitigation folks employ to defend against THIS.

Some recommendations for protecting against this type of attack are HERE and HERE, but there may be some impacts on "normal" usage as well.

Some discussion on new Virut activity from Threatfire research

This article is a bit old, but it caught my eye due to the volume of this we've seen in some of our sample collections. The article located HERE provides some historical reference and great current information on the state of this code. WARNING - The article may link to some LIVE malicious code. Following these links is not recommended unless you are a researcher and are taking appropriate precautions.

Hosting company loses user data due to zero-day exploit

Over 100,000 folks relying on low-cost "virtual hosts" became an unfortunate example of why data backup is often worth it's weight in gold. Attackers took advantage of zero-day exploit to destroy a large amount of data on these servers before administrators could react. Story here

Cybercrime gets more accessible

Another outstanding article by Brian Krebs about how cybercrime is developing itself as big business. The complete article Web Fraud 2.0: Franchising Cyber Crime goes into pretty sordid detail as to how even beginning deviants can get into the action and profit from the propagation of malicious code.

Two new malware attacks against Mac users

Earlier this week, we saw an interesting article on theage.com.au that discusses two new malware variants (named OSX/Tored-A and OSX/Jahlav-C).

Also noteworthy aside from the fact that these target the Mac user base (which is normally considered to be a less valuable target to attackers due to the smaller user base) is the fact that the authors are using adult content websites for propagation. There has been a declining trend of this on the spam scene over the past couple years.

Nice articles from Cloudmark on Deliverability Issues

Cloudmark has a two-part blog on some history and causes for deliverability issues. I think it's a great primer for users to understand what often causes legitimate senders to be blocked.

Part I Some Background
Part II Basic Steps and Information to get if you are blocked

If these steps don't work, contacting the Abuse Desk or deliverability manager for the "blocking party" should get the issues resolved.