Feed aggregator

Google Set to Change Malware, Phishing Warnings Following Study

Threatpost for B2B - Tue, 07/15/2014 - 12:40
Google will soon change the way it displays malware and phishing warnings in its Chrome browser to give users a better idea of the risk and to help them make a decision.

New Kronos Banking Malware Advertised On Russian Forums

Threatpost for B2B - Tue, 07/15/2014 - 11:30
Researchers have spotted a new banking Trojan advertised for sale on Russian forums. Kronos promises features that help it evade detection and analysis, such as a Ring3 rootkit.

Google Project Zero May Prove a Big Win for Security

Threatpost for B2B - Tue, 07/15/2014 - 10:58
Google is focusing some of the sharpest minds it has on a new security initiative known as Project Zero that will dig into the critical software that the Internet and its users depend upon and find new vulnerabilities.

Five Year Old Phishing Campaign Unveiled

Threatpost for B2B - Mon, 07/14/2014 - 16:04
Active for about five years, a campaign in which attackers have pilfered victims’ credentials from Google, Yahoo, Facebook, Dropbox and Skype, was recently revealed.

Outside Panel Finds Over-Reliance on NSA Advice Led to Dual EC Problems

Threatpost for B2B - Mon, 07/14/2014 - 13:47
A group of outside experts found that the process that led to the inclusion of the weakened Dual EC_DRBG random number generator in a NIST standard was flawed and there were several failures along the way that led to its approval. The committee also recommended that the National Institute of Standards and Technology increase the number of […]

Oracle Clarifies XP Support Ahead of Quarterly Patches

Threatpost for B2B - Mon, 07/14/2014 - 12:45
Oracle is expected to release 113 patches across its product lines as part of its quarterly Critical Patch Updates.

First Version of LibreSSL Debuts

Threatpost for B2B - Mon, 07/14/2014 - 11:23
An early version of LibreSSL, a fork of OpenSSL developed by the OpenBSD Foundation, was released for a number of platforms beyond OpenBSD.

LastPass Fixes a Pair of Security Flaws

Threatpost for B2B - Mon, 07/14/2014 - 09:58
LastPass, the popular password manager for most of the top Web browsers, has fixed a couple of vulnerabilities that could have allowed an attacker to target users and generate his own one-time passwords for the victim’s account. The company said that its security team hasn’t seen any active attacks exploiting these vulnerabilities and doesn’t think that […]

Shylock/Caphaw malware Trojan: the overview

Secure List feed for B2B - Mon, 07/14/2014 - 06:00

Recently Kaspersky Lab has contributed to an alliance of law enforcement and industry organizations, to undertake measures against the internet domains and servers that form the core of an advanced cybercriminal infrastructure that uses the Shylock Trojan to attack online banking systems around the globe.

Shylock is a banking Trojan that was first discovered in 2011. It utilizes man-in-the-browser attacks designed to pilfer banking login credentials from the PCs of clients of a predetermined list of target organizations. Most of these organizations are banks, located in different countries.

Kaspersky Lab products detect the Shylock malware as Backdoor.Win32.Caphaw and Trojan-Spy.Win32.Shylock.

We detected this malware generically from the end of August 2011, as Backdoor.Win32.Bifrose.fly. Specific detection of this separate family was added in February 2012. Since then we have observed a very few detections – approximately 24,000 attempts to infect PCs protected by Kaspersky Lab products worldwide.

These are very modest numbers, especially in comparison with other infamous banking malware such as ZeuS, SpyEye, Carberp which have generated (and, in the case of some of them, such as ZeuS , still generate) tens or hundreds of thousands of detections. Of course, these numbers don't tell us everything about how widespread or effective Shylock is, because Kaspersky Lab "sees" only a part of the total number of PC users - only those who use our products.

Low popularity doesn't make Shylock less dangerous though. The set of malicious techniques it utilizes is no less dangerous than that used by other similar malware. It is able to inject its body in multiple running processes, has tools to avoid detection by anti-malware software, uses several plugins which add additional malicious functions aimed at bypassing anti-malware software, collects passwords for ftp-servers, spreads itself via messengers and servers, provides remote access to the infected machine, video grabbing and of course web injection.

This last function is used to steal online banking credentials by injecting fake data entry fields into the web page loaded in the victim's browser.

During the entire period we've seen two relatively big peaks in detection rate for this malware.

The first one was in November 2012 and the second one was in December 2013.

The geography of the November 2012 peak was as follows:

United Kingdom Italy Poland Russian Federation Mexico Thailand Iran Turkey India Spain

The table above shows the top 10 countries wheremost attacks using the Shylock malware were registered. A little more than a year later, in December 2013, the picture had changed dramatically.

Brazil Russian federation Vietnam Italy Ukraine India United Kingdom Belarus Turkey Taiwan

As these tables show, the criminals behind this malware definitely stopped paying so much attention to the developed e-money markets of the UK, Italy and Poland in favor of the actively developing markets of Brazil, Russia and Vietnam. It's slso interesting that both peaks happened in the late autumn to early winter period, a traditional high retail season in many countries around the world.

According to Europol data, this malware has infected more than 30,000  PCs worldwide. This is a big enough scale to cause huge financial damage, so the disruption of the Shylock backbone infrastructure is very good news.

And even better news is that the recent operation, coordinated by the UK's National Crime Agency (NCA), brought together partners from the law enforcement and the private sector, including – besides Kaspersky Lab – Europol, the FBI, BAE Systems Applied Intelligence, Dell SecureWorks and the UK's GCHQ (Government Communications Headquarters), to jointly combat the threat. We at Kaspersky Lab were glad to add our modest contribution to this operation. Global action brings positive results – an example being the operation targeting the Shylock malware.

Possible New Version of GameOver Zeus Malware Emerges

Threatpost for B2B - Fri, 07/11/2014 - 13:55
It’s only been a little more than a month since the FBI and Europol took down the GameOver Zeus botnet, taking control of its command-and-control infrastructure and effectively cutting off the malware’s head. But researchers say that there are some indications that a new strain of the malware may already be active again. GameOver Zeus […]

Digital First Aid Kit A Guide For Activists, First-Responders

Threatpost for B2B - Fri, 07/11/2014 - 13:32
The Electronic Frontier Foundation and other NGOs have published a guide with advice on secure communication, DDoS and malware mitigation and more for activists, journalists and others targeted for surveillance.

Apple Updates OSX Blacklist Following Flash Vulnerability

Threatpost for B2B - Fri, 07/11/2014 - 13:07
Apple acknowledged on Thursday that it has updated its OSX plugin blacklist to reflect a critical vulnerability in Adobe Flash made public earlier this week.

Lack of Certificate Pinning Exposes Encrypted iOS Gmail App Communication

Threatpost for B2B - Fri, 07/11/2014 - 10:48
Google has failed to implement certificate pinning in its official iOS Gmail application, which could enable Man-in-the-Middle attacks exposing encrypted user communications.
Syndicate content