Microsoft continues uphill battle against the Alureon rootkit

"According to the Microsoft Malware Prevention Center (MMPC), this month's Malicious Software Removal Tool (MSRT) has scrubbed the Alureon rootkit from over 360,000 Windows PCs since its May 11 release. That represented 18.2% of all MSRT detections for the month, more than double the 8.3% the rootkit accounted for in Apr"


"Almost two-thirds (65%) of the PCs infected with Alureon this month were running Windows XP Service Pack 3 (SP3), with the No. 2 spot taken by Windows XP SP2 (14%). Only 3.5% of the rootkit-infected PCs were running Windows 7, said Microsoft."


Have to give Microsoft credit for not giving up on this.  The longer this problem persists, the longer these machines stay vulnerable.  They are aiming at an unpredictable, moving target though.

Devious New Phishing Tactic Targets Browser Tabs

The essence of phishing is taking advantage of user trust. This attack exemplifies that in every form. Even advanced users may be caught off guard by this scheme. Make sure you check your address bar!

Some good news is that users running NoScript, Safari or Chrome don't seem to be affected by these iterations of the attack.

Example of concept is here

Present Day History of Conficker

This entertaining write-up on the history of Conficker reveals some of the complexity behind the worm. The story also explains the back and forth escalation between the highly proficient authors of the worm and the Conficker Cabal including some interesting details like Confickers implementation of bleeding-edge encryption.

Link: The Atlantic

New Rogueware links identified in many popular entertainment related search queries

MySecurityEngine is a FakeAV (Rougeware) application that seemed to surface towards the end of April. This strain of Rogueware is seeing heavy propagation due to what appears to be a very effective employment of Malicious Search Engine Optimization.

The distributors have been observed achieving very high search rankings for queries on the following topics:

Lost episodes
Friday Night Lights
The Boondocks
The Hills
Family Guy
Iron Man 2
Misc. Popular Musicians
Death of Ronnie James Dio
.. and others

Panda Labs describes the software as:
"MySecurityEngine is an adware program that deceives users warning them of unexisting threats in their computers so that they purchase a certain program that removes them from the computer.

Additionally, it prevents users from accessing certain search engines and from running certain security programs, like antivirus solutions, firewalls, or even fils belonging to fake antivirus programs. It also modifies the searcher that is displayed in the Search option of the Internet Explorer browser.

MySecurityEngine can reach the computer in spam messages containing a link or an attached file, or through malicious websites that have obtained googd positions in the search engines by using BlackHat Seo techniques"

File-sharing can be risky business!

There are many free or inexpensive ways to consume high-quality media online such as Centurylink Video Store, CenturyLink Unlimited Music (and videos), Netflix, iTunes, Hulu and others.

Using reputable services like these can provide great content and save a lot of frustration.

New and improved Zueskit payload from spam messages

Be very careful of this one. It appears that there is limited detection for these variants.

"for instructions and an executable that is meant to be the patch to apply. The executable file named adbp932b.exe (SHA1 0632f562c6c89903b56da235af237dc4b72efeb3) has minimal coverage of about 7%."

Facebook Privacy Check - From the F-Secure Blog

Often, the lines between online privacy and online security merge. Such is the case with many of the changes made on Facebook recently. Many folks don't think about the impacts of data they share online. How is it used, is it shared, and what is the impact to your "friends".

Try this interesting app to see what the privacy and security footprint of your Facebook profile really looks like. It may surprise you!

We'll try to add some discussion about social networking (from both sides of the field) and specifically the recent changes to Facebook in our next webcast.

Phishlabs baits a phisher (and reports some great insight)

Another great article from Brian Krebs. This one shows some really detailed info about what goes on behind the scenes in a "phishing racket".

The fact that this type of activity is now being made available to mainstream opportunists is a double-edged sword. While the prevalence is increasing, it allows allows researchers more opportunities to capitalize on amateurs making mistakes. This was just one such case.

This SC based research organization found this phisher's "back door" and watched it.

AS50896 - (PROXIEZ) Gets Taken Offline

This network was harboring some really bad stuff. While I'm sure these miscreants will find a new home for their garbage, it's always encouraging to see this. If law enforcement keeps up the tempo on arrests and take-downs, it increases the risk and potential loss associated with this type of activity.

Increased risk (and potentially higher operating costs) drastically changes the equation for online fraudsters and provide deterrent that has been lacking in the past.

As a "double whammy" today, I'm including a video of yet another Romanian Law Enforcement agency taking a group of scammers into custody.

"Sexiest Video Ever" on Facebook is a front for Malware

Websense article about this very successful campaign currently running on Facebook.

Adding this to your profile puts you and your friends in jeopardy. Please don't follow these links!

"When clicking on the "video" you are taken to an application installation screen asking you to allow it to access your profile, wall etc. Once approved it claims you have to download an updated FLV Player to view the video and promptly sends an EXE your way...

This is the Hotbar Adware which displays ads in your browser based on your browsing habits etc. In addition, the Facebook application just installed will post messages on your friends wall on your behalf with the same "sexiest video ever" message."

Attack Method Bypasses Anti-Virus

Researchers have revealed a method for bypassing just about any anti-virus software by swapping "safe" code for "malicious" code after it has been scanned, but before it has been executed.

Links:

Article

Research Paper

Updates 5/11/2010 --

Responses from AV Vendors:

F-Secure

Sophos

US Treasury Websites Serving Malware

The Register reports that the US Treasure Department website has been compromised and was serving up malware to visitors as recently as Monday.

Full details at The Register:

http://www.theregister.co.uk/2010/05/03/treasury_websites_attack/