The Internet attack threat landscape has definitely changed. Long gone are the days when it was easy for bot network owners and script kiddies to run their favorite publicly available exploit for the vulnerability of the week. They could take control of as many computers as they bothered to take the time to attack. Really, the flurry of remotely available network-based vulnerabilities and their corresponding attacks that exploded in the first few years of the twenty-first century were culminations of the type of attack that was exploited by the Morris Worm, back in 1988. Microsoft Windows was the ideal target: coded for commercial purposes, security was still in its infancy and it was ripe for the harvest.

Today, perimeter security technologies, such as firewalls, are a part of the standard vocabulary of your average computer user. Microsoft even packaged one with their operating system and enabled it by default, quickly making opportunistic attacks...

Unlike traditional worms or viruses, spyware usually does not spread itself from system to system. One of the easiest ways to distribute spyware is to go directly to the users and gain their consent to download the application. One of the more common trends in accomplishing this act is through the use of “misleading applications.” On the extreme end, these are applications that can grossly exaggerate and alert critical errors on users’ systems that are not actually present. This deceives some users and scares them into purchasing the program for a substantial fee to fix errors that are nonexistent.

Another method used to distribute spyware is to entice the user by offering up something desirable or useful for free. Not only does the user get the freebie tool, but they also get the bundled adware or spyware program downloaded with it as well.

On the flip side, there are ways of installing and downloading spyware without user consent, such as the...

Recently we have seen an increase in Trojan horse programs that attempt to steal online gaming accounts. Massively multiplayer online role playing games (MMORPG), such as Lineage, Ragnarok Online, World of Warcraft, and Final Fantasy are often targeted by these Trojans. What is the purpose of the attacks? Money. Players can trade their virtual money or items used in their game of choice online, at a special market called RMT (Real Money Trading). RMT is run by third parties and is not usually permitted by the official game vendors; however, RMT has become a big market. A recent report stated that RMT has traded more than two billion USD thus far in 2006. So, if attackers can steal gaming account information from compromised computers, they can easily sell virtual money for real money in the RMT market.

Attackers use a variety of methods to install Trojans on compromised computers. One of these ways is to use a Web site. In the past, attackers used to...

Symantec Security Response is aware of anexploit currently running in the wild on a vulnerability in MicrosoftPowerPoint. The exploit targets Chinese language versions of Office2000 running on Chinese language versions of Windows XP. Thus far, thisattack is not widespread and there is no reason to believe it willbecome more prevalent, based on our experience with similar attacksthis year. This is a continuation of the trend (which we have beentracking throughout this year) toward exploiting vulnerabilities inMicrosoft Office applications in order to install malware—mainlyTrojans.

It is not currently known if other languages or versions areaffected by the underlying vulnerability. Symantec has releasedantivirus definitions that detect this threat as Trojan.PPDropper. Allof the normal advice applies here (i.e., don't open attachments frompeople you don't know or are not expecting them from and keep yourantivirus and security solutions up to date).

...