Security Response

The two most common questions I hear around this time of year are: what do you think the biggest trend of the year was and what do you think the biggest threat next year will be. After outlining a year in review, let’s spend a little time on what we may expect to see in the next 12 months.

Obviously, the debut of a new operating system brings with it new features for both the research community and malicious code authors to scrutinize. It’s simple to expect that we’ll see new attack attempts on Microsoft Vista. What’s more interesting are trends we’re likely to see that don’t even touch the physical hard drive of a computer. Web 2.0 technologies have already begun to capture attacker interest and motivation. As adoption continues to grow and dependence on these Web applications increases, the impact and frequency of these issues will rise.

Consider the...

…they just move to new mediums. Waaaay back in 1994, a computervirus hoax known as Good Times was passed around the Internet. Whilenot the first computer virus hoax, it is probably one of the bestknown. Since then there have been many similar hoaxes all promisingcertain destruction of your computer if you open an email originatingfrom a certain address or simply by reading certain words that appearon your monitor. Naturally, when many people receive one of thesehoaxes they decide to forward the message to all their friends andfamily to save them from this fate, thus helping the chain letter tospread (if I tell two friends and they tell two friends…).

In recent years, I noticed that these messages were showing up in myinbox less and less frequently. Did people learn not to believe thesemessages? Well, apparently not. They seem to be making a comeback, butrather than being sent via email they’re now sent through the messagingsystems on various social networking sites, as well...

Today, a new Prime Minister took over office in Japan. As usual,malware authors are taking full advantage of this big occasion,launching targeted attacks that play upon the event. Symantec SecurityResponse has received an archive file today with the file namemofa.zip, which contains an executable called mofa.exe. This file isdetected as Backdoor.Darkmoon.E.

According to a local news source(in Japanese), an email pretending to be from the newly elected PrimeMinister, Yasuo Fukuda, is hitting some individuals' email boxes. Theemail contains content in regards to Japanese diplomacy in Asia, alongwith the address and phone number of the Prime minister's office – anattempt to make the email look more authentic. The name “MOFA” inmofa.zip is an acronym for...

Pump-and-dump stock, or penny stock, spam has been around for a longtime. Most memorably it has the distinction of being the maindeliverable of image spam. Regardless of the morphing or variations itis still pump-and-dump stock and while we're not stock advisors wewould advise against it, unless you like parting from your money.

The most recent morphing we've observed over the past few daysincludes highly obfuscated messages with a few distinctive features.For starters, none of the message headers in the attack contain asubject line. This means that when it lands in your inbox there will beno subject line for the message. Spammers may be utilizing this tacticas a means to entice end users to open the message by banking on thecuriosity of an end user to open the mysterious message. There is asubject line in the body of the message. The spammer is most likelydoing this for obfuscation purposes.

Other features of this pump and dump attack are the inclusion ofrandom,...