Video Screencast Help
Security Response
Showing posts tagged with Security
Showing posts in English
Sean Butler | 23 Jun 2014 21:05:36 GMT

On June 19, we came across an interesting e-card spam campaign. E-card spam typically distributes malware; however this campaign simply redirects the user to a “get rich quick” website.

This campaign’s emails are very basic. The messages are sent from a spoofed 123greetings.com email address and contain one sentence and a link.

ecard spam 1.png

Figure 1. E-card spam campaign email

After looking at the header for one of the emails, we saw that the email appears to have been sent from an Amazon IP address. This is most likely an attempt to trick anyone that reads the header into thinking the email is legitimate. However, the IP address actually resolves to a DNS name that is not associated with Amazon.

In the body of the emails, the spammers use URL shorteners to redirect victims to their site...

Shunichi Imano | 19 Jun 2014 10:53:19 GMT

Nico Nico, meaning “smile” in Japanese, is one of the biggest video sharing sites in Japan, with more than 30 million free members and over 2 million paid subscribers.

Rumors surfaced earlier today, claiming that some users who were watching videos on Nico Nico saw a strange pop-up message, asking them to update Flash Player to the latest version.

Niconico_5_LOB.png
Figure 1. The suspicious pop-up message, which says “This page cannot be displayed! Update to the latest version of Flash Player!”

The domain that the pop-up message appears from, downloads.[REMOVED].biz, does not look like it belongs to Adobe or Nico Nico.

If the user clicks “OK” on the pop-up message, they will be redirected a fake Flash Player download site, which mimics the appearance of the legitimate Adobe website.

...

Satnam Narang | 17 Jun 2014 19:36:05 GMT

Over the weekend, a large number of Pinterest accounts were compromised and used to pin links to a miracle diet pill spam called Garcinia Cambogia Extract. Since most of the compromised accounts were linked to Twitter, these spam “pins” on Pinterest were also cross-posted to Twitter.

Pinterest and Tumblr 1 edit.png

Figure 1. Pinterest miracle diet spam cross-posted to Twitter

Back in April, we published a blog on compromised Twitter accounts used to promote the same miracle diet pill spam. During our investigation, we made a connection to the Pinterest hack reported by TechCrunch in late March.

...

Symantec Security Response | 17 Jun 2014 18:10:10 GMT

In March 2014, the Zorenium bot (W32.Zorenium) made headlines after the malware’s author claimed that the information-stealing threat had been updated with some advanced new features. According to the malware author, known as Rex, these features included the ability to run on iOS and Android devices, steal banking credentials, support peer-to-peer (P2P) communications, and spread over Skype and Facebook.

The malware originally appeared in 2013 and Symantec has observed how it has evolved over time. If Rex’ claims were true, then the update could have made Zorenium a major threat. While this update’s full feature set was never proven, Rex stood by the iOS claim and later stated that the iOS code came from a third party. In this...

Candid Wueest | 13 Jun 2014 09:57:42 GMT

ios8_features_concept.png

Last week, Apple introduced the new version of its mobile operating system, iOS 8, at its Worldwide Developers Conference. Apple unveiled many new features for iOS 8 in different categories and some of them were security related. Now that iOS 8’s new features have been revealed, it’s time to take a look at the possible security implications surrounding these enhancements. 

Since iOS 8 has not yet been released, it is unclear how exactly these features will be implemented. Based on the information currently available, there is a handful of security features that should enhance iOS devices’ protection levels.

iOS app extensions – More than just third-party keyboards
One of iOS 8’s most discussed enhancements is its app extensions, which will allow third-party apps to communicate with each other. With app extensions,...

Sammy Chu | 12 Jun 2014 21:23:05 GMT

The Symantec Global Intelligence network has detected a significant increase in hit-and-run spam attacks (sometimes referred to as ‘snowshoe’ spam attacks) from .club domains in the last 24 hours. Earlier this year the Internet Corporation for Assigned Names and Numbers (ICANN) released a number of generic top-level domains (gTLD), with .club among them. Spammers have taken to abusing gTLDs, and specifically, the .club gTLD to perform hit-and-run spam attacks. Hit-and-run spam attacks quickly cycle through domains and IP addresses with unknown reputation to avoid detection. In this case they are using domains with the .club gTLD because of their lack of reputation.

We have observed the following “From:” header lines in these attacks:

  • From: "CarClearanceLot" <CarClearanceLot@[REMOVED].club>
  • From: "CarSavingsEvents" <CarSavingsEvents@[REMOVED].club>
  • From: "PriceNewCar" <PriceNewCar@[REMOVED].club>
  • From: Gift Cards <...
Binny Kuriakose | 12 Jun 2014 08:56:56 GMT

Many countries around the world will celebrate Father’s Day this year on June 15. With only a few days remaining, people are busy planning and purchasing gifts for the greatest hero in their life. Unfortunately, this is also when Father’s Day spam and fraud emails are at their height and many unsuspecting users could get conned by these campaigns. 

We have observed a gradual increase in the amount of spam taking advantage of Father’s Day since the end of May. Most of the spam shares similarities with Mother’s Day spam, as observed last month. The campaigns are not so different from the ones seen in previous years. In fact, this year, we have observed spam with the exact same products and offers as last year.

fathersdayspam_1.png
Figure 1. Product spam related to Father’s...

Lionel Payet | 11 Jun 2014 08:16:05 GMT

Contributor: Roberto Sponchioni

It’s well known that hot political topics make enticing lures for cyberattacks and, as such, Symantec is constantly on the lookout for attacks using this tactic. Recent monitoring of the global political landscape led us to observe a malicious campaign piggybacking on the coup d’état that occurred in Thailand three weeks ago (May 19, 2014) after months of turmoil in the country. We have seen the emergence of a limited and targeted spam campaign against government officials in Southeast Asia

The malicious emails claim to be from a well-known media institution based in Myanmar and come in three variations where only the attached Word document’s name changes:

  • The_Military_situation_in_Thailand.doc
  • Thai_Coup_Leader_Says_He_Has_Received_King.doc
  • ...
himanshu_mehta | 10 Jun 2014 20:03:34 GMT

Hello, welcome to this month's blog on the Microsoft patch release. This month the vendor is releasing seven bulletins covering a total of 66 vulnerabilities. Fifty-five of this month's issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the June releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/...

Satnam Narang | 09 Jun 2014 17:49:51 GMT

With the 2014 FIFA World Cup in Brazil just around the corner, scammers have kicked off efforts to target fans of the international football event. World Cup fans everywhere should watch out for free ticket scams, news service scams, and online streaming scams. Symantec has already identified several email scams and we expect to see attempts to target fans on social networks.

Free tickets to the World Cup

The most common scam around the World Cup involves free tickets. After all, what fan would not want an all-expenses paid trip to Brazil? Scammers know a dream come true is hard to pass up and circulate emails promising everything imaginable. 

Fifa World Cup 1.png

Figure 1. Scam email offers free tickets to 2014 World Cup in Brazil

Emails Symantec has identified in...