-
The Winlock numbers, the Winlock laws
While Eugene’s busy taking bets (wonder how much he’s going to make?), I’ve been having a think about the Winlock case.
Russian law enforcement is estimating that the bad guys could have raked in as much as $1 billion. While it’s difficult to be certain about the exact amounts involved (obviously they spread their money across a lot of different accounts to avoid attracting attention), a little bit of simple math makes me think this figure isn’t as crazy as it might sound.
Our statistical analysis tells us there could be around a million people who’ve been infected. 10 cybercriminals, each...
-
Understanding Current Trends in the Fake Anti-Virus/Scareware Ecosystem
The cyber-criminal groups behind fake anti-virus (scareware/rogueware) infections have run into some significant roadblocks over the last few years, but there is much more to the overall story.
Some groups have been arrested. Some have had their operations and entire call support centers
shut down.
Some groups attracted too much attention, picked off
the low hanging fruit and eventually walked away from their botnets.
In some cases, the groups just weren't very skilled
at developing anti-anti-malware techniques, blackhat SEO,...
-
The Winlock case - I'm taking bets!
Interesting news on Trojan SMS Blockers (Winlock etc). These programs block Windows and demand a ransom in the form of a text message which is sent to short number for a fee. It's a very popular type of racket at the moment, both in Russia and a few other countries.
The whole affair has now reached the General Prosecutor’s office of Russia – the criminals have been identified and detained (or so it seems) and will be prosecuted in Moscow soon.
Altogether the criminals have earned an estimated 790,000 roubles, or $25K. Moreover, they have caused other damages by blocking or...
-
Twitter goes OAuth-only (Yay for security!)
In a long overdue move, Twitter turned off basic authentication for third-party applications, while enforcing OAuth for all apps. This is a move that should be applauded by anyone concerned about the security of their Twitter account.
This latest move covers a potential vulnerability in the process of giving read/write access to third-party applications, which could lead to a Twitter account being compromised. Well, not anymore. You don't need to give your username and password to third-party developers anymore if you want to use their application on your Twitter account.
Being always concerned about security, I salute Twitter's move to...
-
Gumblagra and a piano
Since the beginning of August, our Japan office has seen 900+ mails of a certain kind in their spam traps.
We noticed two common patterns in all of the mail. First, the links in these spammed messages all point to compromised servers. Also, the file names of the redirectors are all dictionary words followed by two digits. The files redirect the users to online pharmacy sites and fake watch stores. Here is a screen capture of a directory hosted on one of these online sites:
You might wonder why this caught our...
-
Who needs my SQL server?
We all know that cybercriminals will target anything and everything they can reach. And at Kaspersky, we also know that a lot of IT admins don’t look after their Internet resources. Sad but true – ask an admin if their servers are protected, and you’ll often get the answer, "Oh, come on, who needs my SQL server?"
A few months ago we set up a new honeypot (http://www.mwcollect.org) in our Japanese research centre in Tokyo. The honeypot is mainly used to collect malicious Windows executables, which it does pretty well by emulating shellcode when it finds network exploits. A...
-
New IM Worm Squirming in Latin America
Whenever we discuss the most active
malware-producing countries, Russia, China and Brazil are always atop
the list. But there’s a new country
that’s starting to appear in the top five: Mexico
In our monthly Latin America malware analysis published on href="http://www.viruslist.com/sp/">Viruslist
and href="http://threatpost.com/es_la?set_region=es_la">Threatpost
(both in Spanish), we already mentioned that Mexico is known
for producing local botnets.
On Aug 21, we (Kaspersky Lab) detected a new instant messenger worm
that spreads through almost all well-known IM programs, including
Skype, GTalk, Yahoo Messenger and Live MSN Messenger. The name of the
threat is " style="font-weight: bold; color: rgb(204, 0, 0);">IM-Worm.Win32.Zeroll.a"
It "speaks" 13 different languages (including
Spanish and Portuguese) according to the local...
-
Whitelisting - how it protects us
Malware writers are inventing new attacks regularly - but the anti-virus industry invents new protection techniques just as regularly. Whitelisting is on of the newer protection technology which are now standard in Internet Security products. It sounds positive, but how does it actually work? Does it overload your computer? How can developers whitelist their programs? Will whitelisting replace other protection technologies?
Join Andrey Nikishin, Director of Cloud and Content Technology Research, Vladimir Zapolyansky, Manager of Whitlelisting and myself as we discuss how whitelisting itself works. We will also discuss how software writers can join our program and what the benefits are...
-
Oops they did it again!
It seems the BBC has been dabbling in the world of malware ... again. They have reported that they have created a smartphone application that is also able to spy on the activities of the person using a compromised handset.
Readers of the blog may remember that the Beeb has something of a history in this area. They raised eyebrows in March 2009 when they 'acquired' a botnet. Shortly after this they also bought personal information, including credit card numbers, from a 'broker' of such data in India.
There's no question...
-
First SMS Trojan for Android
I think the title of this post speaks for itself. Trojan-SMS.AndroidOS.FakePlayer.a passes itself off as a media player application. If the user chooses to install it, this icon with the name "Movie Player" will appear in the list of applications:
The malware sends SMS messages to two premium rate numbers 3353 and 3354, with each message costing approximately $5. It does this stealthily, without requiring any confirmation from the device owner.
