Video Screencast Help
Security Response
Showing posts in English
Dinesh Theerthagiri | 11 Feb 2014 19:49:38 GMT

Hello, welcome to this month's blog on the Microsoft patch release. This month the vendor is releasing seven bulletins covering a total of thirty-one vulnerabilities. Twenty-five of this month's issues are rated ’Critical’.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the February releases can be found here:
http://technet.microsoft.com/en-us/security/bulletin/ms14-feb

The following is a breakdown of the issues being...

Eric Park | 11 Feb 2014 17:55:34 GMT

One of the most popular methods of spamming is snowshoe spam, also known as hit and run spam. This involves spam that comes from many IP addresses and many domains, in order to minimize the effect of antispam filtering. The spammer typically sends a burst of such spam and moves to new IP addresses with new domains. Previously used domains and IP addresses are rarely used again, if ever.

Some spammers like to use a similar pattern across their spam campaigns. This blog discusses a particular snowshoe spam operation that I have labeled “From-Name snowshoe”. While there are other features in the message that allow the campaigns to be grouped into the same bucket, the messages’ most distinct feature is that all of the email addresses that appear in the “from” line use real names as their usernames. 

  • From: [REMOVED] <Leila.Day@[REMOVED]>
  • From: [REMOVED] <CharlotteTate@[REMOVED]>
  • From: [REMOVED] <Diana.Pope@[REMOVED]>
  • ...
Stephen Doherty | 10 Feb 2014 18:50:53 GMT

 

The Mask 1.png

Modern cyberespionage campaigns are regularly defined by their level of sophistication and professionalism. “The Mask”, a cyberespionage group unveiled by Kaspersky earlier today, is no exception. Symantec’s research into this group shows that The Mask has been in operation since 2007, using highly-sophisticated tools and techniques to compromise, monitor, and exfiltrate data from infected targets. The group uses high-end exploits and carefully crafted emails to lure unsuspecting victims. The Mask has payloads available for all major operating systems including Windows, Linux, and Macintosh.

An interesting aspect of The Mask is the fact that they are targeting the Spanish-speaking world and their tools have...

Christian Tripputi | 07 Feb 2014 13:13:29 GMT

The biggest bank robbery of all time was identified in Brazil in 2005. In this case, a gang broke into a bank by tunneling through 1.1 meters of steel and reinforced concrete and then removed 3.5 tons of containers holding bank notes. This heist resulted in the loss of about 160 million Brazilian dollars (US$380 million).

Robbers today, however, don’t have to bother with drilling through walls to steal money. They can rob a bank while sitting comfortably at home behind a computer. Thanks to cybercrime, organizations have suffered financial losses in the order of millions. The Symantec State of Financial Trojans 2013 whitepaper shows that banking Trojans are becoming more prevalent. Apart...

Satnam Narang | 06 Feb 2014 15:59:32 GMT

safer_internet_day.png

Whether it’s National Cyber Security Awareness Month in October or Safer Internet Day in February, it’s always important to remember to be safe online every day. As technology continues to become more integrated into our daily lives, there are settings and security features that can be used to ensure your information and digital identity remain under your control.

It’s a social world
The most dominating force on the Internet today is social. Right now, I have friends pinning their wedding ideas, instagramming lattes, snapchatting outfits, checking into restaurants on Foursquare, vining videos of their cats, sharing newborn baby photos on Facebook, and tweeting in anticipation of The Walking Dead premiere. As these services become more and more popular, they are targeted more frequently by scams, spam, and phishing attempts.

...

Gavin O Gorman | 06 Feb 2014 13:27:47 GMT

Figure_2.png

On January 23, CERT Polska posted a blog describing a piece of minimalist banking malware targeting Polish citizens. The hashes of several samples of the malware were also listed in the blog. Symantec subsequently broke out a new name for this malware, calling it Trojan.Banclip. Using Symantec telemetry it’s possible to understand more about the distribution of this malware, and what else the attackers responsible for the malware may be up to. It is also an opportunity to clear up some misconceptions about malware scanning services.

Related activity
Symantec recorded a variant of Trojan.Banclip being downloaded from a Polish website, zeus[REMOVED].cba.pl, on January 14, 2014. At least...

Joseph Graziano | 06 Feb 2014 04:01:19 GMT

It was only a few months ago that Paul Walker that left us in a fiery car accident. These days it is common for spammers and malware writers to use a celebrity’s death to spread malware. In this case, it started with emails with links to a video of Paul Walker’s car on fire, but instead contained a link to a malicious file.

In the latest slew of emails, the sender makes a plea to the victim to find a Dodge Viper GT that was supposedly racing with Paul Walker’s car. The email asks that anyone with information call a number in the email or open the attached file to view a picture of the Viper GT’s driver. In every sample we have dealt with there is always a promise of reimbursement or compensation for helping capture the Viper GT’s driver.

These attacks are unique because of the regular change of subject lines and body text to bypass spam filters. The attacker tries to personalize the email with the recipient’s name in the body, subject, or attached file name.

...

Symantec Security Response | 05 Feb 2014 00:15:11 GMT

Adobe has published a Security Bulletin for Adobe Flash Player CVE-2014-0497 Remote Code Execution Vulnerability (CVE-2014-0497). The new Security Bulletin, APSB14-04, identifies an integer underflow vulnerability which affects various versions of Adobe Flash Player across multiple platforms. Exploitation of this critical vulnerability could allow an attacker to remotely execute arbitrary code. Adobe has acknowledged that exploitation of the vulnerability has been reported in the wild.

Per the bulletin, the following versions of Adobe Flash Player are vulnerable:

  • Adobe Flash Player 12.0.0.43 and earlier versions for Windows and Macintosh
  • Adobe Flash Player 11.2.202.335 and earlier versions for Linux

Symantec Security Response is continuing to monitor the situation for additional information related to this...

Satnam Narang | 04 Feb 2014 03:00:30 GMT

Scammers are taking advantage of recent Super Bowl social buzz in a scheme that targets entrants of an Esurance contest. The company premiered a commercial following Super Bowl, where they offered US$1.5 million to one lucky Twitter user who used the hashtag #EsuranceSave30. Following this, Symantec Security Response has observed a number of fake Esurance Twitter accounts being created to leverage the attention generated by this contest.

Many of these Twitter accounts used variations of Esurance’s brand name and logo to convince users they are affiliated with the company. These accounts include the following Twitter handles:

  • EsuranceWinBig
  • EsuranceGW
  • Essurance
  • Esurrance
  • Esurnace
  • Esuranc

There are also other accounts that use logos and imagery making them look like they belong to Esurance, but their names have nothing...

Christopher Mendes | 03 Feb 2014 18:13:40 GMT

Contributor: Sean Butler

As it’s the start of a Football World Cup year it’s only natural that we will see many campaigns in relation to this global event. There will be many marketing and promotional campaigns taking advantage of the hype and excitement surrounding this event. Amongst all of the legitimate marketing and promotion emails, you may also receive emails promising anything from free match tickets, to competitions and lottery prizes stating that you have won a car.

Sound too good to be true? Well, you would be right in thinking that!

Fraudsters will be looking to exploit the enthusiasm that comes with the FIFA World Cup, which will be taking place in Brazil this June. The ramifications of you being scammed could be very serious indeed. Not only could you become a victim of fraud by having your bank account emptied by these fraudsters, you could also end up with malware on your computer. This malware could do anything from stealing your...