Security Response

Security Response has discovered a threat that is being talked about among some members of certain discussion groups in Japan. The threat, named Infostealer.Kenzero, teaches yet another lesson to those using file-sharing networks not to download illegal games. Infostealer.Kenzero primarily arrives in the guise of setup.exe, which in this case is a fake installation file for Japanese pornographic games that are circulating around the file-sharing network “Share.” Several pornographic games have been reported to include this malicious setup.exe file.

Once the setup.exe file is executed it attempts to download image files (.bmp) from a predetermined website. Using these images, the threat brings up a form that asks the user to enter personal information, including his or her full name, password for the game, email address, postal...

Is your wish to spend the upcoming holidays in Hawaii or the Bahamas? With the recent increase in the volume of airline ticket spam, spammers have made it seem easy to grab cheap (or even free) airline tickets to your favorite destinations. During the holiday season many people travel to visit family and friends. In the current economic environment, cheap deals on airfare will attract users’ attention and spammers take full advantage of this fact.

Symantec researchers are observing an increase in spam that is offering cheap airline tickets or gift vouchers to use towards a purchase of airline tickets. Spam messages are originating with spoofed email addresses, such as “AirlineTickets@spam-domain” and “Free.Airline.Tickets@spam-domain.” The link provided in the message redirects the user to an online form where the user’s personal information and credit card details are requested.

The top 20 headlines used in airline ticket spam are...

Once again Zeus is up to its old tricks with a new twist.  The latest spam run informs users that their latest Social Security statement is available but it may contain errors.  The subject of the mail will be something like “Review annual Social Security statement“ and the body warns of a potential identity theft risk and asks you to review your annual statement at the link they provide.

Figure 1. An example of the Spam

If you follow this link you will arrive at the following page:
 

...

A new exploit targeting Internet Explorer was published to the BugTraq mailing list yesterday. Symantec has conducted further tests and confirmed that it affects Internet Explorer versions 6 and 7 as well. The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future.  When this happens, attackers will have the ability to insert the exploit into Web sites, infecting potential visitors.  For an attacker to launch a successful attack, they must lure victims to their malicious Web page or a Web site they have compromised. In both cases, the attack requires JavaScript to exploit Internet Explorer.

The exploit targets a vulnerability in the way Internet Explorer uses cascading style sheet (CSS) information. CSS is used in many Web pages to define...