The longest continuous attack recorded by Kaspersky Lab lasted almost two weeks

The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.The longest continuous attack recorded by Kaspersky Lab in the third quarter of 2015 lasted for 320 hours, or almost two weeks. This is one of the findings of the new quarterly DDoS report, based on constant monitoring of botnets and observing new techniques utilised by cybercriminals.

The Q3 report shows that DDoS attacks remain highly localised. 91.6% of victims’ resources are located in only 10 countries around the world, although we have recorded DDoS attacks targeting servers in 79 countries total. What is even more significant is that DDoS attacks are most likely to originate from the same countries.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.

China, the United States of America and South Korea occupied top positions in both ratings of the most frequent attack sources and targets. Although other cybercrime syndicates, focusing on things like credit card theft, may operate far from their country of residence, this is not the case for DDoS.

More than 90% of attacks lasted less than 24 hours but the number of attacks lasting over 150 hours grows significantly. The highest number of attacks on the same victim was 22, on a server located in The Netherlands.

The report also showed that Linux-based botnets are significant, accounting for up to 45.6% of all attacks recorded by Kaspersky Lab. Main reasons include poor protection and higher bandwidth capacity.

“Based on our observations and direct measurements, we cannot pinpoint one exact direction in which the underground business of DDoS attacks is moving," commented Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.

"Instead, the threat appears to be growing everywhere. We have recorded highly complex attacks on banks, demanding a ransom, but have also observed new, low-cost methods designed to put a company’s operations down for a significant amount of time. Attacks are growing in volume with most of them aiming to attack, disrupt and disappear, but the number of lengthy attacks, capable of bankrupting a large, unprotected business is also on the rise. These significant developments make it imperative for companies to take measures to prevent the very real threat and increased risk posed by DDoS attacks.”

The study also found that cybercriminals go on vacation too, just like regular people, with August the quietest month of the quarter for attacks. Meanwhile, banks are frequent targets of complex attacks and ransom demands.

Identities of likely Koobface gang members revealed

It was a well-known fact in security circles that some researchers were involved for quite some time in an investigation aiming at revealing the identities of the individuals behind the Koobface worm and the botnet it created.


In the past week, details about a likely member of the "Ali Baba & 4" group (as they dubbed themselves) were made public by researcher Dancho Danchev on his blog and, as the story begun to unfold, security firm Sophos and the NYT revealed the names of the five individuals thought to be part of the KoobFace gang.

Their names are Anton Korotchenko (a.k.a. “KrotReal”); Stanislav Avdeyko, (“leDed”); Svyatoslav E. Polichuck (“PsViat” or “PsycoMan”); Roman P. Koturbach (“PoMuc”); and Alexander Koltysehv (“Floppy”), and they all apparently live in St. Petersburg, Russia.

The NYT reveals that Facebook, law enforcement officials and security investigators involved in the investigation have known their identities for years, but the fact that they are still free to live their rather comfortable lives and travel to around the world points to an unfortunate reality: it is extremely hard to prove conclusively that these individuals are guilty.

Facebook started its own investigation into the gang shortly after the Koobface worm first began to spread on the social network in 2008, and it took them only weeks to link the attacks to the suspects.

In 2009, independent researcher Jan Drömer mounted his own investigation. Starting with crucial information gleaned from one of the Koobface C&C servers and searching for links to it on the Internet - IP addresses, domain registration information, underground and legitimate forum posts, social network accounts and more - he made a beeline to the aforementioned group of individuals.

According to him, there is a variety of reasons behind the success of the Koobaface gang: they misused powerful online services to spread the worm, didn't overdo on the size of the botnet, haven't aimed at making the worm perfect but invested just enough revenue to earn more than enough money, and have operated in countries whose law enforcement agencies haven't a good record when it comes to cooperating with their US and European counterparts.

Currently, none of the five individuals have been charged of crimes and no law enforcement agency has confirmed they are under investigation or even commented on the situation.

All who are interested in a fascinating blow-by-blow report of how Jan Drömer and SophosLabs' Dirk Kollberg followed the crumbs to the suspected Koobface gang members - go here.

Researchers Uncover Holes In WebOS Smartphones

Linux-based platform prone to Web-injection vulnerabilities and targeted attacks for stealing data.

A pair of researchers has discovered multiple flaws in the WebOS smartphone platform, including one that could let an attacker build a mobile botnet or execute other remote attacks.

Orlando Barrera and Daniel Herrera of SecTheory plan to demonstrate their findings tomorrow at the Austin Hackers Association meeting in Texas. The most dangerous of the vulnerabilities is an injection flaw they found on the WebOS version 1.4.X that allows remote command and control, including access to a phone's files or injecting a remote JavaScript backdoor into the phone's Contacts Application to build a botnet.

Read more here.

ZBot removal tool

ZBot (also known as Zeus, ZeusBot or WSNPoem) is a Trojan engineered to steal sensitive data from compromised computers.

While ZBot focuses mainly on the online banking details that users input on financial organizations’ pages, it also monitors system information and steals additional authentication credentials.

The latest variants can also gather the history of the visited Web sites and other data users provide online, while also capturing screenshots of the their’ desktop.

ZBot is distributed mainly via spam campaigns and Web pages which host its malicious payload, usually under the guise of a popular legitimate application.

Once onto the system, ZBot modifies the files and folders’ structure, adds registry keys, injects code into several processes (such as winlogon.exe or svchost.exe) and adds exceptions to the Microsoft Windows Firewall, providing backdoor and server capabilities. It also sends sensitive information and listens on several ports for possible commands from the remote attackers’ command-and-control center.

This allows cybercriminals to manage the Trojan in order to download and execute additional malicious payloads on or take control over the system, its actions including, without being limited to restarting and shutting down the affected computer.

BitDefender has created a ZBot Removal Tool which checks users’ computers, detects and eliminates most of the ZBot variants spotted in the wild.

Fake ImageShack emails lead to Zbot variant

Emails pretending to be registration notifications from the popular free image hosting website ImageShack are hitting inboxes, and are trying to get the users to follow a link to a malicious website where a Zbot variant awaits to be downloaded.

At first glance, they look pretty legitimate, but a second glance at the offered registration link reveals that the target page does not belong to ImageShack.

Another clue that the email might be fake is the provided username and password. Sunbelt's Chris Boyd received the email in question and remarks that he would never use the give combination of username and password, even if he had registered with the service.

The offered link belongs to an Australian art gallery whose website was probably compromised, and presents to the user the following request:

The file in question is, of course, the Zbot variant I mentioned in the beginning. Luckily for potential victims, the great majority of security solutions has the ability to detect this particular variant, which has been removed in the meantime.

But, Boyd says that users should still be careful about visiting the site, since "there’s still some iframe activity taking place". He also advises users to be careful of such emails in the future, because it is likely that criminals will be sending out the same email - albeit with a different malicious link, pointing to different malware and using a different exploit.

When in doubt whether you have signed up for something, it's better to just delete the email.

1.2 million infected by Eleonore exploits toolkit

AVG’s Web security research team has discovered a network of 1.2 million malware-infected computers controlled by cybercriminals who were using the Eleonore exploit toolkit – a commercial attack software enabling cybercriminals to infect and monitor compromised PCs.

The two-month-long study by AVG Research researched 165 Eleonore toolkits in use by cybercriminals and concluded that those using the Eleonore exploit toolkit were experiencing a 10 percent success rate in infecting the more than 12 million users visiting their compromised web pages.

All 165 domains experienced high volumes of traffic which the cybercriminals managed to compromise. The research was built using AVG LinkScanner product data, identifying URLs that the product blocked when it identified a threat.

“The accessibility and sophistication of easy-to-use cybercriminal toolkits proves that cyber gangs are raising the bar to monetize their criminal activities,” said Yuval Ben-Itzhak, senior vice president, AVG Technologies.

Botnet viruses invade smartphones

New mobile viruses, disguised as "Free World Cup VOD" and other hot topics, were captured last week by NetQin. More than 500 complaint cases were reported and filed on June 23.

Identified as ShadowSrv.A, FC.Downsis.A, BIT.N and MapPlug.A, these viruses were embedded in mini mobile games to lure users to download. Once downloaded, the device will be controlled by the virus originator. The virus propagation model is the same as a computer botnet so the viruses are defined as botnet viruses.

According to NetQin, these viruses will either send messages to all the contacts of the address book directly, or send messages to the random phone numbers by connecting to the server; both of which result in extra charges to the user's phone bill.

Furthermore, the viruses will delete the sent messages from a user's Outbox and SMS log. The messages sent by viruses are themed the hottest topics, including Free World Cup VOD, and the most popular blind date TV show, etc. All messages contain URLs linked to malicious sites that users are unable to see until they've already clicked and fallen into the virus trap.

The targets of these botnets are mobile devices with S60 3rd and 5th OS. An estimated 100,000 mobile phones were impacted, according to NetQin.

Facebook users receiving direct messages from Koobface

Every so often, the Koobface botnet mounts a campaign to increase the number of infected systems, and this latest one employs an already tried tactic.

According to Trend Micro, Facebook users receive a direct message, and the message contains a simple line of text and a link. The text reads: "Someobdy uplaod a vdieo wtih you on utbue. you shuold see", and the link points to a Facebook page whose URL looks like this:

http://www.facebook.com/l/

{random character};{redirected URL}

ANY link poing to such an URL will bring up the Facebook preview page for external links, and if the user ignores the warnings about the potential dangers of following the link to the final destination, he will be faced with a site (hosted on several different IP addresses) apparently displaying the video:

To view the video, the user must download a Flash Player update. As you may already suspect, the offered file is a Koobface variant that proceeds to infect the system and download additional malware.

Email Attack Targets HR Departments

The global recession has brought a shortage of jobs, but job seekers are not the only ones who are targeted by malicious emails and scams.

A targeted attack aimed at human resources departments and hiring managers in the U.S. and Europe was spotted this week -- and sent 250,000 emails during a four-hour period yesterday at the height of the assault.

TrendLabs has recently spotted an email spam campaign that contains just one line of text:

The Resume_document_589.zip file attached to the message is supposed to be the CV in question, but is actually a zipped-up malicious .exe file that drops a Trojan downloader into the victim's system.

The attack had morphed today, with a modified binary, and a different subject line and email message. The theme was the same, though: a prospective application with a CV attached. A CV campaign is still ongoing right now [as of 5:30 UK time], sending to hundreds of thousands of recipients.

Most users and especially HR managers wouldn't be fooled into opening the attachment, but for those who are not familiar with this type of spam, the curiosity might prove too much.

It is good to remember that unsolicited emails should be carefully analyzed - if you're not expecting such an email, and you don't recognize the sender's name or email address, it is best to pass up on opening attachments or following embedded links.

Researchers build 8,000-strong smartphone botnet

Looking to raise awareness about the security implications of third-party apps in smartphones, a pair of security researchers used the lure of an innocuous weather application to commandeer about 8,000 iPhones and Android devices in a mobile botnet.

The research project, first discussed by Dark Reading’s Kelly Jackson Higgins, was unveiled at this year’s RSA conference to show how harmless-looking smartphone apps can harvest sensitive user information, including GPS coordinates and phone numbers.

It was created and submitted it to app clearinghouses that offer apps for Androids and jailbroken iPhones.

It should be made clear that only jailbroken iPhones were caught in the proof-of-concept botnet. The researchers said they avoided Apple’s iPhone app store because of Apple’s strict security process, which includes code signing.

From the Dark Reading article:

Within an hour of the app being set up on the SlideME and ModMyI app sites, the researchers had 126 downloads, and 702 after eight hours. “After 24 hours, we had 1,862,” Tijerina says. And as of yesterday, the count was 7,800 iPhones and Androids running the app. “This was really surprising because if this was malicious code, that’s a lot of bots we would control,” he adds.

To prove the dangers of the mobile botnet, the report said the pair also wrote a malicious version of the weather app that runs bot code and can grab contact information, cookies, and physical addresses, and can send spam runs.

The researchers say they have no plans to release the malicious application.

Details of how the actual malicious application works here.

Mariposa Botnet Malware Found On Vodaphone HTC Magic

Following Energizer's acknowledgment last week that it had been distributing infected software in conjunction with its DUO USB charger comes a report that malware has been found on a Vodafone HTC Magic running Google's Android OS

"Today one of our colleagues received a brand new Vodafone HTC Magic with Google's Android OS," researcher Pedro Bustamante wrote on the Panda Research Blog on Monday.

"The interesting thing is that when she plugged the phone to her PC via USB, her Panda Cloud Antivirus went off, detecting both an autorun.inf and autorun.exe as malicious," he wrote. "A quick look into the phone quickly revealed it was infected and spreading the infection to any and all PCs that the phone would be plugged into."

The malware began "phoning home" for instructions, Bustamante wrote. It's likely the user's credentials would have been stolen, he speculated.

The malware turned out to be related to the Mariposa botnet, but there was other malware on the device too--Conficker and a Lineage password-stealing Trojan, he said.

The botnet is said to have stolen account information and other sensitive data from an estimated 12.7 million compromised IP addresses belonging to individuals, companies, and other organizations across 190 countries.

The botnet spread through P2P networks, USB drives, and MSN links, according to Panda.

A Vodafone spokesperson did not return an e-mail from CNET seeking comment, but The Register published a statement from Vodafone that said it is investigating the matter.

"Following extensive quality assurance testing on HTC Magic handsets in several of our operating companies, early indications are that this was an isolated local incident," the statement said.

Last week, three people were arrested in Spain on charges of operating a massive botnet composed of 12.7 million PCs that stole credit card and bank log-in data and infected computers in half of the Fortune 1,000 companies and more than 40 banks. The botnet was dubbed "Mariposa," which means butterfly in Spanish.

Koobface Botnet - New Christmas Theme

Facebook and other users of web 2.0 social networks should be careful and avoid unusual messages or spammed comments on their sites, and a new variant of the Koobface worm is circulating with a Christmas based theme.

The Koobface botnet, one of the most efficient social engineering driven botnets, is entering the Xmas season with a newly introduced template spoofing a YouTube video page, in between enticing the visitor into installing a bogus Adobe Flash Player Update (New Koobface campaign spoofs Adobe’s Flash updater), which remains one of the most popular social engineering tactics used by the botnet master

Full report here:
http://blogs.zdnet.com/security/?p=5001

New iPhone Worm attempts to build botnet

iPhone users beware.

History repeats itself, as safety trade-offs occur when a product's security layers are altered for ease-of-use or greater functionality. There is very limited exposure for this new threat that F-Secure is currently analyzing. It only impacts devices where Apple's original security safeguards for the iPhone are intentionally altered through a process called "Jailbreaking".

Read the analysis here.

QUOTE: "it only affects Jailbroken iPhones which have SSH installed and have not changed the default password. This one connects to a web-based command & control center running in Lithuania. The worm is not widespread, but it is much more serious than the first iPhone worm as it seems to try to steal information from the devices."

Other useful reads:

How it works
http://www.net-security.org/malware_news.php?id=1144

Ikee - First iPhone Worm impacts "Jailbroken iPhones"
http://www.f-secure.com/weblog/archives/00001814.html

What are "Jailbroken iPhones"?
http://en.wikipedia.org/wiki/Jailbreak_%28iPhone_OS%29

How to change root password in "Jailbroken iPhones"
http://www.f-secure.com/weblog/archives/cydia.htm

Twitter Used As Botnet Command Center

As if being deluged under DDoS attacks isn't bad enough, this week Twitter found itself the target of another sort of threat. The Register recently reported that the wildly popular social networking service is also being used to direct part of a botnet's activities.

According to the report, a security analyst accidentally stumbled across a Twitter account being used by botherders as a cheap and effective way of directing infected computers to websites where they can get further instructions.

This appears to be the first time Twitter has been used as part of a botnet's command and control structure. At time of writing, the malicious account has already been taken offline.

For more details, you can also check the original post from Arbor Sert.

Credits

Finjan Finds Infected PCs Selling For Half A Cent

Most people know that powerful computer criminals don't all have setups similar to those of James Bond villains; a lot of damage can be done with just a little bit of outdated equipment. But a new report from Finjan drives home how very accessible botnets have become.

People who live in certain Asian countries are able to buy batches of 1,000 infected PCs for just $5, according to Finjan. This means just about anyone who can touch a computer, whether it be at a friend's apartment or an Internet cafe, can afford "in."

The highest price Finjan found elsewhere was in Australia, where the same number of infected PCs go for $100. A middle-class eight-year-old might be able to handle that with his Christmas money.

This is all possible due to the existence of the Golden Cash network. A Finjan statement explains, "The trading platform utilizes all necessary components (buyer side, seller side, attack toolkit, and distribution via 'partners')." And if that sounds pretty sophisticated, the statement does continue, "This advanced trading platform marks a new milestone in the cybercrime evolution."

Yuval Ben-Itzhak, CTO of Finjan, also added, "Looking at the list of compromised PCs we found, it is clear that no individual, corporate or governmental PC is safe."

Unfortunately, such trading platforms are probably here to stay. Cybercriminals can make as much as $400 in profit off of each batch of infected PCs, and so will be sure to keep at it for as long as possible.

Finjan just recommends using a Secure Web Gateway to help stop your computers from becoming infected in the first place. The full second issue of Finjan's Cybercrime Intelligence Report is also available for free if you'd like additional information regarding the problem.