Feed aggregator

Research Shows Increase in Internet Filtering and Usage of FireChat App in Iraq

Threatpost for B2B - Thu, 07/24/2014 - 12:00
Researchers at Citizen Lab have taken a close look at the extent of Internet filtering in Iraq, as well as the security of a popular offline chat app used there, and found an increase in the number of services blocked by the government and identified serious privacy and security problems with the chat app. As tensions […]

Bugcrowd Releases Open Source Vulnerability Disclosure Framework

Threatpost for B2B - Thu, 07/24/2014 - 09:01
The problems that come from doing security research on modern Web applications and other software aren’t just challenging for researchers, but also for the companies on the receiving end of their advisories. Companies unaccustomed to dealing with researchers can find themselves in a difficult position, trying to figure out the clearest path forward. To help […]

A new generation of ransomware

Secure List feed for B2B - Thu, 07/24/2014 - 08:55

Ransomware is now one of the fastest growing classes of malicious software. In the last few years it has evolved from simple screen blockers demanding payments to something far more dangerous.

The Ransomware class is now based on so-called encryptors – Trojans that encrypt every kind of data that may be of value to the user without his or her knowledge. The data can include personal photos, archives, documents, databases (e.g., databases used in 1C:Enterprise software intended for automation of business activities), diagrams, etc. In order to decrypt these files the criminals demand a payment – often a significant sum. CryptoLocker, CryptoDefence (and its successor CryptoWall), ACCDFISA, and GpCode are some of the most notorious examples. There are also lots of lesser-known families that have spread in Russia and the CIS.

At the end of June 2014 Kaspersky Lab detected a new encryptor. Analysis showed that the Trojan had nothing in common with other known families and a number of features that suggested it was a completely new creation. Its name? CTB-Locker.

This new family is detected by Kaspersky Lab as Trojan-Ransom.Win32.Onion.

This encryption malware belongs to a new generation of ransomware. Its developers used both proven techniques 'tested' on its predecessors (such as demanding that ransom be paid in Bitcoin) and solutions that are completely new for this class of malware. Specifically, hiding the command and control servers in Tor anonymity network complicates the search for the cybercriminals, and the use of an unorthodox cryptographic scheme makes file decryption impossible, even if traffic is intercepted between the Trojan and the server. All this makes Trojan-Ransom.Win32.Onion a highly dangerous threat and one of the most technologically advanced encryptors out there.

Description

The high-level algorithm used by the malicious encryptor is quite ordinary and is as follows:

  • after launching, the malware copies its body to (CSIDL_COMMON_APPDATA) and adds the task to launch the file to the Task Scheduler;
  • search all the fixed, removable and network drives for files matching a list of extensions (see Figure 1);


Figure 1. Data fragment with a list of file extensions used by the encryptor

  • encrypt the files found;
  • display a window demanding ransom and containing a list of files that have been encrypted. The cybercriminals demand that the user pay ransom in Bitcoins (Figures 2, 3);
  • set an image named AllFilesAreLocked.bmp as desktop wallpaper. The wallpaper informs the user that data on the computer has been encrypted (Figure 4).


Figure 2. Window informing the victim that files on the computer have been encrypted


Figure 3. The cybercriminals' demands


Figure 4. Image set as desktop wallpaper

So what sets this Trojan apart from dozens of similar malicious programs?

The command server is located within the Tor anonymity network

The sample analyzed has a single static command server address, which belongs to the .onion domain zone.

It is worth noting that this in itself is not 'innovative'. We have seen similar arrangements in other malware types (discussed, for example, here and here).

However, this is a new development for ransomware. Although some of the ransom Trojans from families detected earlier demanded that the victim visit a certain site on the Tor network, the malware discussed here supports full interaction with Tor without the victim's input, setting it apart from the others.

This brings us to another feature, which is unique among known malware.

Unusual technical implementation of access to the Tor network

All the previously detected malware, if it communicated to the Tor network at all, did this in an unsophisticated manner: it launched (sometimes by injecting code into other processes) the legitimate file tor.exe, which is available for download on the network's official website.

Trojan-Ransom.Win32.Onion does not use the existing file tor.exe. Instead, all the code needed to implement interaction with the anonymity network is statically linked to the malicious program's executable file (i.e., is implemented as part of the malicious code) and is launched in a separate thread.


Figure 5. Pseudocode showing how launching the tor proxy thread is implemented

The code contained inside the thread_tor_proxy procedure is nearly all taken from open sources (Tor is an open-source project).

When connection to Tor has been established and a local tor proxy server has been set up at IP 127.0.0.1 (the port number varies from one infected machine to another and depends on the MachineGuid parameter), the global flag can_complete_circuit is set, which is later checked in the thread thread_post_unlock_data.

As soon as this happens, the malware establishes network communication with this local address, as shown in Figure 6.


Figure 6. Pseudocode showing how network communication with the tor proxy is implemented

A request sent by the malware to the server contains protected data required to decrypt the victim's files.


Figure 7. Data sent to the command server

In response, the server returns data about the cost of unblocking the user's files in bitcoins and US dollars, as well as the address of the wallet to which the payment is to be made.


Figure 8. Data returned by the command server

Compressing files before encryption

None of the encryptors known before used compression technologies (with the exception of ACCDFISA, which simply adds files to a password-protected rar-sfx archive; however, in this case encryption and compression is not functionality implemented in a malicious program but simply utilization of a ready-made product – WinRAR).

In this aspect of its operation, Trojan-Ransom.Win32.Onion also shows considerable originality. Here is what it does:

  • moves the victim's file to a temporary file using the MoveFileEx API function;
  • reads temporary file from disk block-by-block;
  • each block is compressed using Zlib, a freely distributed library (procedure deflate());
  • after compression, each block is encrypted and written to disk;
  • service information required for decryption is placed at the beginning of the resulting file;
  • the encrypted file is given the .ctbl extension.
Unusual cryptographic scheme

Cryptomalware most commonly uses a cryptographic scheme based on the AES+RSA combination. In this scheme, the server generates a pair of keys – rsa-public + rsa-private – for RSA, which is an asymmetric encryption algorithm. The private key, rsa-private, remains on the server, while rsa-public is sent to the malware. Next, the malware generates a new key – aes-key – for each of the victim's files, to be used by AES, a symmetric-key block algorithm. Each file is encrypted using AES, then its aes-key is encrypted using RSA (using the rsa-public key) and saved to the file.

Since the scheme uses asymmetric encryption, nobody can decrypt the file without having the rsa-private key, which never left the cybercriminals' server.

However, Trojan-Ransom.Win32.Onion has used an unusual approach yet again!

The sample uses the asymmetric cryptographic protocol known as ECDH – Elliptic curve Diffie–Hellman.

Elliptic curve Diffie-Hellman

The original Diffie-Hellman algorithm (the so-called key exchange method or shared-secret protocol) was developed some time ago and published in 1976 by famed cryptographers Whitfield Diffie and Martin Hellman. A modification of the algorithm which uses elliptic curves was published later in 2000, in a Certicom Research article, Standards for efficient cryptography, SEC 1: Elliptic Curve Cryptography.

A detailed description of the protocol is beyond the scope of this publication, so we are going to drop the details and describe the main principles that will be helpful in understanding how the malware operates.

  • A pair of keys – private and public can be generated.
  • The so-called shared secret can be generated from your private key and the other party's public key.
  • If the two parties have exchanged public keys (the private keys are not exchanged!) and each has independently calculated the shared secret from the other party's public key and its own private key, both parties will get the same value.
  • The resulting shared secret can be used as a key for any symmetric encryption algorithm.

The authors of Trojan-Ransom.Win32.Onion used an existing implementation of this cryptographic algorithm, a description of which is available on the Internet.

The high-level cryptographic scheme used by Trojan-Ransom.Win32.Onion is as follows.

Key generation:

  • the malware generates the pair master-public (public key) + master-private (private key);
  • master-private is sent to the server securely along with other data. It is not saved on the client (fact I);
  • for each file to be encrypted, a new key pair is generated – session-public + session-private;
  • the shared secret is calculated: session-shared = ECDH(master-public, session-private).

Encrypting a file belonging to the victim

  • the file is compressed using the Zlib library;
  • after being compressed with Zlib, each file is encrypted using AES, with the hash SHA256 (session-shared) used as the key;
  • after encryption, the session-public key is saved in the file (fact II), while session-private is not saved (fact III);
  • the shared secret calculated – session-shared – is not saved, either (fact IV).

Decrypting a file belonging to the victim

The Diffie-Hellman protocol is designed in such a way that the following equality is true:

ECDH(master-public, session-private) = session-shared = ECDH(master-private, session-public) (fact V)

The above equality defines the underlying principle on which the operation of Trojan-Ransom.Win32.Onion is based.

Provided that the Trojan has not saved session-private (see. fact III) and session-shared (see. fact IV), only one decryption method remains – calculating ECDH(master-private, session-public). This requires the master-private key (sent to the cybercriminals' server, see fact I) and session-public key (saved in the beginning of the encrypted file, see fact II). There are no other ways to decrypt the file, which means that the file cannot be decrypted without the master-private key.

Securing connection with the command server

The key sent to the server might be intercepted, but unfortunately, this would not be sufficient to decrypt the victim's files. This is because the malware writers have used the same asymmetric protocol, ECDH, to protect their traffic, albeit with a separate, dedicated set of keys.

  • the malicious program's body contains the public key, network-server-public;
  • when establishing a connection, the malware generates a new pair of keys: network-client-public + network-client-private;
  • the malware calculates the shared secret network-shared = ECDH(network-client-private, network-server-public);
  • the malware encrypts the data being sent using AES with SHA256(network-shared) used as the key;
  • the public key network-client-public is sent to the server in an unprotected form (fact VI);
  • the client keys, network-client-public + network-client-private, as well as the shared secret network-shared, are not saved (fact VII).

The cybercriminals have the key network-server-private and receive the key network-client-public from the client (see fact VI). As a result, they can decrypt the data received. To do this, they have to calculate network-shared = ECDH(network-client-public, network-server-private).

Without having network-server-private, this value cannot be calculated (see fact VII). As a result, unfortunately, intercepting traffic will not provide master-private, without which the victim's file cannot be decrypted.

Propagation

The creators of the early versions of Trojan-Ransom.Win32.Onion had English-speaking users in view as their primary targets, so English was the only supported GUI language.

In the more recent versions, however, Russian also came to be supported in the Trojan's GUI along with English. The piece of malware also underwent some visual refurbishments, such as a countdown displayed to intimidate the user. The new Russian GUI and, more specifically, certain strings within the Trojans' body give us ground to assume that its creators are Russian speakers.

The analysis of how Trojan-Ransom.Win32.Onion penetrates victim computers has shown that it is different (once again) in this respect from most other encryptors that are active today. For many known ransomware programs, the main propagation vectors are spam messages with malware in an attachment, or brute forcing weak passwords and launching a file via remote administration tools.

The propagation method

We established that the bot Andromeda (detected as Backdoor.Win32.Androm by Kaspersky Lab products) receives a command to download and run another malicious program from the Email-Worm.Win32.Joleee family to the victim computer. The latter is primarily a malicious tool for sending spam emails, but it can also execute a number of commands from the cybercriminals, including the command to download and launch an executable file. It is actually Joleee that downloads the encryptor to the infected computer.

Trojan-Ransom.Win32.Onion's propagation procedure is presented in the following flowchart.


Figure 9. Trojan-Ransom.Win32.Onion's propagation scheme

Global distribution

Below are the infection statistics as of July 20, 2014. Most attempted infections took place in the CIS, while there were individual cases recorded in Germany, Bulgaria, Israel, the United Arab Emirates and Libya.

Trojan-Ransom.Win32.Onion was detected in the following countries:

Country Number of users attacked Russia 24 Ukraine 19 Kazakhstan 7 Belarus 9 Georgia 1 Germany 1 Bulgaria 1 Turkey 1 United Arab Emirates 1 Libya 1

Please note that the above numbers are provided for the verdict "Trojan-Ransom.Win32.Onion" only. The number of users attacked by the encryptor is in fact greater, as malicious packers with different verdicts are used to spread the malware. Unknown samples of the encryptor are also proactively detected by Kaspersky Lab products as "PDM:Trojan.Win32.Generic". This data is not included into the statistics above.

Recommendations for staying safe Backup copies of important files

The best way to ensure the safety of critical data is a consistent backup schedule. Backup should be performed regularly and, moreover, copies need to be created on a storage device that is accessible only during this process (e.g., a removable storage device that disconnects immediately after backup). Failure to follow these recommendations will result in the backed-up files being attacked and encrypted by the ransomware in the same way as the original file versions.

Backup procedures must be in place for any systems containing files of any appreciable importance. Even if no malware threats arise, remember – no one is completely secured against a commonplace hardware failure.

Security solutions

Your security solution should be turned on at all times and all its components should be active. The solution's databases should also be up to date.

Kaspersky Lab products detect this threat based on its signature with the verdict Trojan-Ransom.Win32.Onion.*. Unknown modifications are detected heuristically with the verdict HEUR:Trojan.Win32.Generic, or proactively with the verdict PDM:Trojan.Win32.Generic.

In addition, Kaspersky Lab products incorporate the Cryptomalware Countermeasures technology which is capable of protecting user data even from unknown encryptors for which there are still no signatures or cloud-based data available. This technology is based on the principle of creating protected backup copies of personal files as soon as a suspicious program attempts to access them. The technology will automatically restore the file even if it is encrypted by malware. For this technology to operate, the System Watcher component must be enabled in the Kaspersky Lab product settings.

WordPress Sites Seeing Increased Malware, Brute Force Attacks This Week

Threatpost for B2B - Wed, 07/23/2014 - 15:11
A glut of Wordpress sites have fallen victim to both malware infections and a series of brute force attacks that have making the rounds over the past several days, researchers claim.

Researchers Demo TAILS Flaw Exploit, Disclose Details to Developers

Threatpost for B2B - Wed, 07/23/2014 - 14:22
The critical vulnerability in the TAILS operating system discovered by researchers at Exodus Intelligence lies in the I2P software that's bundled with the OS and the company has released some details and a video demonstrating an exploit against the bug.

Firefox 31 Patches 11 Security Flaws

Threatpost for B2B - Wed, 07/23/2014 - 09:40
Mozilla has released a new version of Firefox, which includes patches for 11 security vulnerabilities. Three of the bugs fixed in Firefox 31 are critical, including a use-after-free vulnerability and a handful of memory safety issues.

Researchers Plan to Disclose Critical Bugs to TAILS Team Soon

Threatpost for B2B - Tue, 07/22/2014 - 15:52
There are several security issues that aren't patched in the new release of the OS Tails that have been identified by researchers at Exodus Intelligence.

Trio of Flaws Found in OleumTech Wireless Monitoring System

Threatpost for B2B - Tue, 07/22/2014 - 11:11
Researchers have identified several remotely exploitable vulnerabilities in a wireless remote monitoring product from OleumTech that is used in energy, water and other critical infrastructure sectors.

Privacy Badger Extension Blocks Tracking Through Social Icons

Threatpost for B2B - Tue, 07/22/2014 - 10:03
Privacy Badger is one of a new generation of tools designed to help users block much of the silent, pervasive tracking that's done on the Web today, a lot of which is accomplished through social media channels.

Third-Party Software Library Risks To Be Scrutinized at Black Hat

Threatpost for B2B - Tue, 07/22/2014 - 09:00
Third-party software libraries introduce efficiency and risk into enterprise applications. Two researchers will identify some of the most vulnerable libraries during a talk at the upcoming Black Hat conference.

Haunted by APT

Secure List feed for B2B - Tue, 07/22/2014 - 00:15

Over the past decade, APT have intensely targeted organizations and individuals across India. Its developing base of technology, its geographical location and bounds, its inclusive and riotous political energy, and its growing economic weight makes it a special place of interest for badly intentioned cyber attackers. The list of APT groups targeting Indian organizations is unfortunately quite long. A few interesting mentions include Gh0stNet, Shadownet, an Enfal actor, Red October, NetTraveler, the LuckyCat actor, the Turla APT, a Mirage actor, and the Naikon crew. There are many more. And, in unique cases, we have seen unusual new techniques, some for infiltrating mobile devices by the Chuli attackers, the Sabpub attackers' focus on Apple's OS X devices, various effective watering holes, and the generally noisy, targeted activity we would expect from most of these actors.

More recently in March, we saw a pickup in offensive activity on Indian organizations invested in environmental, economic and government policy. This crew has been targeting organizations for a few years now with an unusual offensive WMI technique that continues to be effective. The components have been called WMIGhost or Shadow. These attackers, like others currently active, are generally re-using current headline geopolitical event spearphishing themes to establish a foothold in target organizations. For example, in a March 2014 attack, this actor used an upcoming meeting between national energy labs and the Departments of Energy as their spearphishing lure, filename mis-spellings and all, "India US strategic dialouge press release.doc" (000150415302D7898F56D89C610DE4A9).

From there, the dropper and component chain is the same they have used in the past. Successful exploitation drops  "dw20.exe" (803e8f531989abd5c11b424d8890b407)  -->  "gupdate.exe" (481f8320b016d7f57997c8d9f200fe18) and "~tmpinst.js" (6a279a35141e9a7c73a8b25f23470d80). The script instantiates WMI objects for communications complete with their Comment Crew-like encoded wordpress site instructions that redirect the backdoor to the appropriate command and control server for further instruction.

Along with other groups, WMIGhost attackers are actively hitting Indian targets. In another recent WMIGhost campaign this year, a spoofed unclassified military document was sent simultaneously to several Indian targets with the consistent WMIGhost toolchain, "united states air force unmanned aircraft systems flight plan 2009-2047.doc".

We observe more of these current attacks occurring throughout the country on government and military agencies, NGOs, subcontractors and technology developers, with an expanding scope of targets.

Of these groups to date, NetTraveler was the most prolific, and in many ways the most successful at exfiltrating large volumes of information. The NetTraveler crew spent a disproportionate amount of effort and attention on extracting data from Indian organizations overall. NetTraveler is stealing GB of data from victims all over the globe, including the many victims in India. An example of their past spearphish decoys deployed to India is displayed here. The content encompasses Indian political issues, current at the time of delivery:

Meanwhile, other actors are currently working to exfiltrate more data out of India. Multiple levels of Indian organizations are frightfully pounded with spearphish and webserver attacks with no end in sight.

IBM Fixes Code Execution, Cookie-Stealing Vulnerabilities in Switches

Threatpost for B2B - Mon, 07/21/2014 - 13:46
IBM recently patched a handful of vulnerabilities in some of its KVM switches that if exploited, could have given an attacker free reign over any system attached to it.

Researcher Identifies Hidden Data-Acquisition Services in iOS

Threatpost for B2B - Mon, 07/21/2014 - 12:22
There are a number of undocumented and hidden features and services in Apple iOS that can be used to bypass the backup encryption on iOS devices and remove large amounts of users' personal data.

EFF Releases Open Wireless Router Firmware

Threatpost for B2B - Mon, 07/21/2014 - 10:30
The EFF is working on an open wireless router firmware that’s designed to be a secure and flexible alternative to the existing software that runs on home and small business routers, much of which is notoriously insecure. The Open Wireless Router project, which the organization announced at the HOPE X conference over the weekend, is […]

Point-of-Sale Dealers Need a Security Sit-Down

Threatpost for B2B - Mon, 07/21/2014 - 09:11
Retailers and hospitality vendors are falling victim to point-of-sale hacks, and little is being done to stem the tide. At the upcoming Black Hat conference, a researcher hopes to spur a call to action.

Thousands of Sites Found Tracking Users Through Practically Unblockable ‘Fingerprint’ Mechanism

Threatpost for B2B - Mon, 07/21/2014 - 09:00
The rise of sophisticated new online tracking mechanisms, including one known as ‘canvas fingerprinting’ that’s been infiltrating the Internet, could soon raise the ire of privacy conscious users.

Spam in June 2014

Secure List feed for B2B - Mon, 07/21/2014 - 07:00
Spam in the spotlight

In June, high-profile news events such as the FIFA World Cup and the situation in Ukraine were exploited by fraudsters to extract money and financial information from Internet users.

In the run-up to the Muslim holiday of Ramadan and Father's Day, English-language holiday-related spam offered a variety of themed products and services. The leading spam themes in June were adverts for various online dating services as well as offer for fuel cards and jewelry.

The World Cup

In June, football fans around the world finally saw the World Cup get underway. Popular sporting events like the World Cup attract the attention not only of millions of spectators but also spammers and phishers. This year, the first fraudulent mailings exploiting the World Cup theme were first registered back in November, long before it began. In June, the attackers sent out phishing emails in Portuguese offering the chance to win tickets to the opening ceremony and other World Cup matches. To do this, the user was required to click a link (which was of course fraudulent) and enter his registration data and credit card information. The fake link was directly attached to a graphic file that was displayed when the user opened the message. The phishing pages were located on the free .tk domain – the national top-level domain for the Tokelau Islands (New Zealand). To convince the user that the email was legitimate, the spammers used the domains of the Visa payment system and FIFA in the sender address.

Holiday spam

English-language spam in June was dominated by Father's Day, celebrated on the third Sunday of the month. The spammers sent out adverts for e-gadgets, replicas of designer goods and weapons from various ages trying to attract the recipient's attention with discounts, sales and low prices. In order to bypass spam filters, spammers inserted junk text at the end of the message – a quote from a literary work. They also used a popular short link service to mask the real address and redirect users to a spammer site. The name of the holiday was mentioned in the subject and text field of the email.

More secular holidays are exploited in spam than religious ones, but spammers never forget to provide users with appropriate promotional offers. The name of the Muslim holy Ramadan appears in spam traffic every year. This year was no exception: in June, we came across adverts for restaurants that contained references to Ramadan (as well as an invitation to come and watch broadcasts of World Cup matches). We also registered offers of IT services and services for sending out promotional text messages. Ramadan will continue until the end of July, and we expect the spammers will continue spreading messages exploiting this holiday.

Ukrainian 'Nigerian' spam

The political events in Ukraine were again used by "Nigerian" scams for luring money from credulous users. This time, the author of the email presented himself as a personal assistant to a Ukrainian female politician who was among the first victims of the clashes in Kiev. As is usual with these types of letter, the deceased has left her assistant millions of dollars that have to be urgently transferred from Ukraine to the account of a foreign recipient. The assistant is promised a reward and a certain amount of money to cover any fees that may arise when transferring the money.

The same "Nigerian" scam is used from year to year, only the details change. However, we would like to remind you that all "Nigerian" offers to make you rich quick are ​​merely scams to lure money from users.

Online dating

A significant part of June's spam was adverts for dating services targeting different social and ethnic groups, including Muslims, Christians as well as elderly and married people.

In June, we registered emails and mass mailings spread on behalf of people who wanted to get acquainted, via the Internet, "for serious relationships or marriage". The offers involved not only traditional but also same-sex relations. Some "senders" had attached their photo and provided their email address or a link to their page on a dating service site (which was often a veiled advertisement of such services and the emails were most probably sent on behalf of non-existent members as bait). The senders described their appearance and interests and said they wanted to start correspondence. It was often stated that the recipient's address had been provided by a mutual friend or found on a social networking site or on another dating site, which was not necessarily true.

Spammers also sent out emails promising a partner that met absolutely any criteria (age, skin color, interests and so on) within three minutes of using their "Soulmate database". To use the service, the recipient had to send a text message to a short number. In addition to the money taken from the user's mobile account the spammers got access to his contact information, in particular to his phone number.

For those more interested in meeting people in person the spammers offered lessons in seducing women ("24 laws of attracting women"), and other tips for successful relationships.

One of the mailings contained an advert for a dating spam service. The spammers offered their assistance in creating and promoting (of course, with the help of mass mailings) a new dating site which would include users from many countries. The message included an email address and an ICQ number for communication.

Jewelry

There were a lot of jewelry-themed offers in June. Most of them were promotional and bonus offers from small jewelry stores, jewelry manufacturers and firms engaged in the production and cutting of diamonds. They offered the spam recipients the chance to participate in their business and provided the price list for their products.

Fuel cards

Yet another popular theme in English-language spam was fuel cards for automatic payments at gas stations. This payment method is quite convenient for transportation companies with lots of vehicles routes that find it difficult to control the fueling process. Spam "middlemen" offer the recipients the chance to compare prices, choose the most favorable fueling company and sign a contract for a special fuel card. A specific feature of this sort of spam mass mailing was the fact that the links in the emails led to sites registered on recently created domains. And the sites are intended for calculating quotes only.

Statistics The percentage of spam in email traffic


Percentage of spam in email traffic

The percentage of spam in email traffic averaged 64.8%, which is 5 percentage points less than in May. The highest spam levels were seen during the second week of the month (65.8%), and the lowest levels were seen in the third week (63.5%).

The geographical distribution of spam sources

Previously our statistical data on the sources of spam by country was based on the information received from spam traps in different countries. However, the spam from the traps differs from the spam received by common users. For example, spam targeting specialized companies does not reach the traps. That is why we have changed the data source and now with KSN (Kaspersky Security Network) we draw statistical reports on spam based on the messages that the users of our products receive worldwide. Since the information for the statistical report in June was received from a different source, comparing the results with the statistics for the previous month would be incorrect.


Distribution of spam sources by country

At the end of June 2014, the top three sources of spam around the world included the US (13.2%), Russia (7%) and China (5.6%).

Vietnam was in fourth place (5.3%) followed by Argentina (4.1%), Germany (3.7%), Spain (3.6%), Ukraine (3.2%) and Italy (2.9%).

The Top 10 was rounded off by India, which accounted for 2.8% of the world spam.

Malicious attachments in email

The graph below shows the Top 10 malicious programs spread by email in June.


Top 10 malicious programs spread by email

As is now traditional, the list of malware spread by email is topped by Trojan-Spy.HTML.Fraud.gen. This threat appears as an HTML phishing website and sends email disguised as an important notification from banks, online stores, and other services.

Second in June was Trojan-Downloader.MSWord.Agent.z. This malicious program appears in the form of the *.doc file with the embedded macros written in Visual Basic for Applications (VBA) which is executed on opening the document. The macro itself downloads and runs the malicious program.

In June, representatives of the Bublik family occupied third, fourth, fifth and seventh places. Their main functionality is the unauthorized download and installation of new versions of malware onto victim computers.

Backdoor.Win32.Androm.elwa took sixth place. This malicious program is the modification of Andromeda – Gamarue, a universal modular bot which is a basis for building a botnet with a variety of features. The functionality of the bot is expanded using a system of plugins that are loaded by the criminals in the necessary amount at any time.

The Email-Worm.Win32.Bagle.gt worm, which ranked eighth in June, sends itself to all of the email addresses it can find on the computer. Its main objective is to download and launch files from the Internet without the victims noticing. To spread infected messages, Worm.Win32.Bagle.gt uses its own SMTP library.

Trojan-Banker.Win32.ChePro.ilc. ended the month in ninth position. This downloader appears in the form of a CPL applet (a component of the control panel) and, as is typical for this type of malware, it downloads Trojans developed to steal bank information and passwords. These banking Trojans mainly target online customers of Brazilian and Portuguese banks.

Rounding off the Top 10 was Email-Worm.Win32.Mydoom.l, a network worm with backdoor functionality that is spread as an email attachment via file sharing services and writable network resources. It harvests email addresses from infected computers so they can be used for further mass mailings. The worm also connects directly to the recipient's SMTP server.


Distribution of email antivirus detections by country

In June, Germany saw a big surge in the number of antivirus detections and topped the rating (+8.17 percentage points) having pushed the UK off top spot.

Russian reentered the Top 20 at 13th place with 2.03% of all antivirus detections.

The UAE (+0.96 percentage points) bypassed Australia, Hong Kong and Vietnam in terms of antivirus detections, while Switzerland dropped out of the Top 20.

The percentage of email antivirus detections in other countries did not change much in June.

Special features of malicious spam

The vacation season is gaining momentum: many people are still thinking over their holiday plans while those who have already decided where to go often self-book flight tickets and hotel accommodation. Besides the traditional seasonal increase of holiday spam, we have seen a growth in the number of fraudulent messages sent on behalf of various booking services, including international ones. These fake notifications appear in the form of a booking confirmation and usually contain malicious attachments imitating bills for a hotel reservation. Generally, the email includes the order number, the date of arrival/departure and the cost of the order. One of the most popular malicious programs used in the holiday spam in June was Trojan-Spy.Win32.Ursnif. This Trojan steals confidential data and sends it to a remote server. It can listen for network traffic, download and run other malicious programs, as well as disable some system applications such as the firewall.

In order to send malicious attachments, the fraudsters use not only fake notifications from major booking services, banks or online hypermarkets but also shops with more narrow specialization. For example, last month we came across a malicious mailing spread on behalf of an online pet store. The recipient was asked to download and print out the invoice for purchased goods. Should he have any questions, the email read, he could contact the support service of the pet store by clicking the link on its official website. Instead of the promised PDF file with the information about the purchase, the archive contained Trojan-Banker.Win32.Shiotob.c. This malware steals system information, user names and passwords from FTP and various sites when the user logins on to them.

Phishing

Email search sites (32.1%) again topped the rating of organizations most frequently targeted by phishers in June, with a slight drop of 0.2 percentage points from the previous month. Second came Social networks (27.7%), having increased their contribution by 3.7 percentage points from May. Financial and payment organizations (11.6%) and Online stores (10.6%) declined by 1.2 and 1.5 percentage points respectively. The percentage of attacks targeting Telephone and Internet service providers fell by 0.1 percentage points leaving this category in fifth place in the rating.


Distribution of the Top 100 organizations targeted by phishers, by category

The ranking is based on Kaspersky Lab's anti-phishing component detections that are triggered every time a user attempts to click on a phishing link, regardless of whether the link is in a spam email or on a web page.

In June, the scammers sent out fake notices on behalf of the US corporation Electronic Arts that produces and sells video games. The phishers tried to access users' personal accounts in the online store Origin owned by the company. To deceive their victims, the attackers used an old trick of sending out an email saying the online store was going to enhance protection for their customer accounts and asked the recipients to confirm they were the owner of the account. In order to make the email look legitimate the fraudsters used the Origin logo, links to the official website of the company and the usual warning not to give the password from a personal account to anybody.

Conclusion

The proportion of spam in global email traffic in June dropped 5 percentage points and averaged 64.8%. This may be a seasonal decline as summer business activity decreases and many spam bots are disabled for the vacation season.

In June, high-profile political and sporting events were used by scammers to trick users. In the run-up to the FIFA World Cup, a huge event for football fans, phishers were trying to obtain banking information from users by asking them to participate in the competition to win tickets. "Nigerian" scammers again exploited the situation in Ukraine and asked for help to transfer non-existent millions.

In June, Email search sites (32.1%) again topped the rating of organizations most frequently targeted by phishers. Second came Social networks (27.7%), having increased their contribution by 3.7 percentage points from May. This can be explained by the traditional growth in the activity of schoolchildren and students during the holidays, which is of course used by the fraudsters. Financial and payment organizations (11.6%) rounded off the Top 3 organizations most frequently targeted by phishers.

As is now traditional, the list of malware spread by email is topped by Trojan-Spy.HTML.Fraud.gen imitating notifications from banks and online stores. The holiday season has brought an increase in the number of fake notifications from various booking services containing malicious attachments. Germany (16.4%) was the country with the highest proportion of email antivirus detections.

CryptoLocker Ransomware Alive and Evolving, Says Researcher

Threatpost for B2B - Fri, 07/18/2014 - 15:38
Despite FBI claims that CryptoLocker was neutralized in the GameOver Zeus botnet takedown, a researcher says that the ransomware is alive and evolving new variants.
Syndicate content