Video Screencast Help
Symantec Appoints Michael A. Brown CEO. Learn more.
Security Response
Showing posts tagged with Endpoint Protection (AntiVirus)
Showing posts in English
Symantec Security Response | 21 Feb 2014 23:01:00 GMT

Watering hole attacks using zero-day vulnerabilities are becoming more common. Last week we announced an Internet Explorer 10 zero-day being used in a watering hole attack and today, just one week later we have an Adobe Flash zero-day, Adobe Flash Player and AIR CVE-2014-0502 Remote Code Execution Vulnerability (CVE-2014-0502), also being used in a watering hole attack. This new attack has been dubbed “Operation GreedyWonk” in various media and is reported to be targeting the websites of three non-profit institutions. Symantec telemetry shows even more sites being targeted in this watering hole attack using this new zero-day.
 

adobe-zero-day.png

Figure 1....

Symantec Security Response | 14 Feb 2014 23:58:13 GMT

In an earlier blog, Symantec highlighted that we were investigating reports of a zero-day exploit affecting Internet Explorer 10 in the wild. Now we have further details on the attack leveraging this new zero-day, Microsoft Internet Explorer CVE-2014-0322 Use-After-Free Remote Code Execution Vulnerability (CVE-2014-0322).

IE 0 day edit.png

Figure. Watering hole attack using IE 10 0-day

Anatomy of the attack

The target of this watering hole attack was the vfw.org (Veterans of Foreign Wars) website. While this attack was active, visitors to the site would encounter an IFrame which was inserted by the attackers in order to...

Symantec Security Response | 14 Feb 2014 00:30:09 GMT

Symantec is currently investigating reports of a potential zero-day exploit affecting Internet Explorer 10 in the wild. This appears to be a watering hole attack that was hosted on a compromised website in the United States. The watering hole attack website redirected unsuspecting users to another compromised website that hosted the zero-day attack.

We continue to analyze the attack vector and associated samples for this potential zero-day. Our initial analysis reveals that the Adobe Flash malicious SWF file contains shell code that appears to be targeting 32-bit versions of Windows 7 and Internet Explorer 10. We have identified a back door being used in this attack that takes screenshots of the victim’s desktop and allows the attacker to take control of the victim’s computer. We identify and detect this file as Backdoor.Trojan.

Symantec also has the following IPS...

Satnam Narang | 12 Feb 2014 18:59:14 GMT

In the latest Snapchat spam developments, an increasing number of the photo-sharing app’s users have been sending out spam pictures of fruits or fruit-based drinks to their contacts, which directs them to websites called “Frootsnap” and “Snapfroot”.

Snapchat Fruit 1 edit.png

Figure 1. Fruit spam on Snapchat

While Symantec has been tracking Snapchat spam for months, this is the first case in which the spam does not originate from fake accounts, but those belonging to real users. These accounts have been compromised to push diet spam.

Instagram users might recall similar...

Dinesh Theerthagiri | 11 Feb 2014 19:49:38 GMT

Hello, welcome to this month's blog on the Microsoft patch release. This month the vendor is releasing seven bulletins covering a total of thirty-one vulnerabilities. Twenty-five of this month's issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the February releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms14-feb

The following is a breakdown of the issues being...

Stephen Doherty | 10 Feb 2014 18:50:53 GMT

 

The Mask 1.png

Modern cyberespionage campaigns are regularly defined by their level of sophistication and professionalism. “The Mask”, a cyberespionage group unveiled by Kaspersky earlier today, is no exception. Symantec’s research into this group shows that The Mask has been in operation since 2007, using highly-sophisticated tools and techniques to compromise, monitor, and exfiltrate data from infected targets. The group uses high-end exploits and carefully crafted emails to lure unsuspecting victims. The Mask has payloads available for all major operating systems including Windows, Linux, and Macintosh.

An interesting aspect of The Mask is the fact that they are targeting the Spanish-speaking world and their tools have...

Christian Tripputi | 07 Feb 2014 13:13:29 GMT

The biggest bank robbery of all time was identified in Brazil in 2005. In this case, a gang broke into a bank by tunneling through 1.1 meters of steel and reinforced concrete and then removed 3.5 tons of containers holding bank notes. This heist resulted in the loss of about 160 million Brazilian dollars (US$380 million).

Robbers today, however, don’t have to bother with drilling through walls to steal money. They can rob a bank while sitting comfortably at home behind a computer. Thanks to cybercrime, organizations have suffered financial losses in the order of millions. The Symantec State of Financial Trojans 2013 whitepaper shows that banking Trojans are becoming more prevalent. Apart...

Satnam Narang | 06 Feb 2014 15:59:32 GMT

safer_internet_day.png

Whether it’s National Cyber Security Awareness Month in October or Safer Internet Day in February, it’s always important to remember to be safe online every day. As technology continues to become more integrated into our daily lives, there are settings and security features that can be used to ensure your information and digital identity remain under your control.

It’s a social world
The most dominating force on the Internet today is social. Right now, I have friends pinning their wedding ideas, instagramming lattes, snapchatting outfits, checking into restaurants on Foursquare, vining videos of their cats, sharing newborn baby photos on Facebook, and tweeting in anticipation of The Walking Dead premiere. As these services become more and more popular, they are targeted more frequently by scams, spam, and phishing attempts.

...

Gavin O Gorman | 06 Feb 2014 13:27:47 GMT

Figure_2.png

On January 23, CERT Polska posted a blog describing a piece of minimalist banking malware targeting Polish citizens. The hashes of several samples of the malware were also listed in the blog. Symantec subsequently broke out a new name for this malware, calling it Trojan.Banclip. Using Symantec telemetry it’s possible to understand more about the distribution of this malware, and what else the attackers responsible for the malware may be up to. It is also an opportunity to clear up some misconceptions about malware scanning services.

Related activity
Symantec recorded a variant of Trojan.Banclip being downloaded from a Polish website, zeus[REMOVED].cba.pl, on January 14, 2014. At least...

Joseph Graziano | 06 Feb 2014 04:01:19 GMT

It was only a few months ago that Paul Walker that left us in a fiery car accident. These days it is common for spammers and malware writers to use a celebrity’s death to spread malware. In this case, it started with emails with links to a video of Paul Walker’s car on fire, but instead contained a link to a malicious file.

In the latest slew of emails, the sender makes a plea to the victim to find a Dodge Viper GT that was supposedly racing with Paul Walker’s car. The email asks that anyone with information call a number in the email or open the attached file to view a picture of the Viper GT’s driver. In every sample we have dealt with there is always a promise of reimbursement or compensation for helping capture the Viper GT’s driver.

These attacks are unique because of the regular change of subject lines and body text to bypass spam filters. The attacker tries to personalize the email with the recipient’s name in the body, subject, or attached file name.

...