Video Screencast Help
Security Response
Showing posts in English
Symantec Security Response | 25 Aug 2014 18:21:25 GMT

Trojan Backoff 1.png

A recently discovered point-of-sale (PoS) threat known as Trojan.Backoff has affected more than 1,000 US businesses and is capable of stealing credit and debit card information from infected terminals. The threat posed by Backoff has prompted the US Department of Homeland Security to issue an advisory, encouraging all organizations, regardless of size, to check their equipment for PoS malware infections.

The warning follows an earlier bulletin from US-CERT on July 31, which said that seven PoS system providers and vendors had confirmed that they have...

John-Paul Power | 25 Aug 2014 08:41:27 GMT


Spying and violation of privacy are topics that never seem to be out of the headlines these days. Stories about mobile malware being used by governments and law enforcement agencies to spy on people (Finfish), smartphones coming off the production line with spyware preinstalled (Android.Uupay), or stories about cameras and microphones on smartphones being used for spying are all fairly common. Many spyware programs rely on data gathered from a device’s onboard sensors such as the microphone, camera, GPS etc., however, there is one sensor that has perhaps been overlooked and, unlike...

Hon Lau | 22 Aug 2014 18:59:00 GMT

Third Party Mobile 1.jpg

NIST has published draft guidelines (Technical Considerations for Vetting 3rd Party Mobile Applications (Special Publication 800-163)) to help guide organizations on how to check over third party mobile apps before they allow them for use in their environment. The document contains a wealth of information and advice on how organizations can approach the tricky problem of deciding whether certain mobile apps should be allowed or not. This report comes at a time when many organizations are struggling to get to grips with mobile device related security problems posed by the growth of BYOD and the challenge of increasing use of employer provisioned mobile devices. As the boundaries between business and personal use becomes...

Lionel Payet | 22 Aug 2014 10:17:15 GMT


Contributor: Mark Anthony Balanza

As a successful business sector, the automobile industry is an attractive target for cybercrime. The automobile industry is composed of a multitude of businesses ranging from manufacturers and sellers to garages offering maintenance and repair. Earlier this month, we observed a spam campaign that targeted several small to medium sized companies within the automobile industry in Europe with Infostealer.Retgate (also known as Carbon Grabber).

The Carbon Grabber crimeware kit first appeared on underground forums earlier this year. Crimeware kits are not new and since the Zeus (Trojan.Zbot) malware’s notoriety,...

Avdhoot Patil | 19 Aug 2014 23:33:39 GMT

Phishers are known for capitalizing on current events and using them in their phishing campaigns. Celebrity scandals are popular and Symantec recently observed a phishing attack on the Facebook platform that claimed to have the sex tape of well-known Filipino television host and news anchor Paolo Bediones. Paolo Bediones became a hot topic last month when an adult video featuring a person resembling this TV host appeared online.

Symantec discovered a fake Facebook site behind a campaign that offered the "sex scandal" video of Paolo Bediones.


Figure. Phishing site requests user login, then steals credentials

A message on the phishing site requests users to login to watch the full sex video. If users enter their Facebook login credentials, the phishing page...

Symantec Security Response | 15 Aug 2014 19:24:03 GMT


News of the Ebola virus epidemic in West Africa has hit every news outlet around the globe, and cybercriminals are once again using the latest headlines to bait victims. Symantec has observed three malware operations and a phishing campaign using the Ebola virus as a social engineering theme.

Malware and phishing campaigns
The first campaign is fairly simple. Attackers send out an email with a fake report on the Ebola virus to entice victims and what users actually get is an infection of the Trojan.Zbot malware.

In the second campaign, cybercriminals send out an email that impersonates Etisalat, a telecommunications service provider in the United Arab Emirates with footprints in 18 countries across the Middle East,...

Satnam Narang | 14 Aug 2014 21:32:10 GMT

Within 48 hours of the news surrounding the death of actor and comedian Robin Williams, scammers honed in on the public’s interest and grief. There is currently a scam campaign circulating on Facebook claiming to be a goodbye video recorded by the actor just before his death.


Figure 1. Fake BBC news site with fake Robin Williams goodbye video

There is no video. Users that click on the link to the supposed video are taken to a fake BBC News website. As with many social scams, users are required to perform actions before they can view the content. In this case, users are instructed to share the video on Facebook before watching.


Figure 2. Facebook share dialog with fake...

himanshu_mehta | 12 Aug 2014 20:52:31 GMT

Welcome to this month's blog on the Microsoft patch release. This month the vendor is releasing nine bulletins covering a total of 37 vulnerabilities. Twenty-eight of this month's issues are rated Critical.

As always, customers are advised to follow these security best practices:

  • Install vendor patches as soon as they are available.
  • Run all software with the least privileges required while still maintaining functionality.
  • Avoid handling files from unknown or questionable sources.
  • Never visit sites of unknown or questionable integrity.
  • Block external access at the network perimeter to all key systems unless specific access is required.

Microsoft's summary of the August releases can be found here:

The following issues are addressed this month:

  1. ...

Candid Wueest | 12 Aug 2014 15:58:36 GMT


In the security field, virtual machines (VM) have been used for many years and are popular among researchers because malware can be executed and analyzed on them without having to reinstall production systems every time. As we previously discussed, these tests can be done manually or on automated systems, with each method providing different benefits or drawbacks. Every artifact is recorded and a conclusion is made to block or allow the application. For similar reasons, sandbox technology and virtualization technology have become a common component in many network security solutions. The aim is to find previously unknown malware by executing the samples and analyzing their behavior. 

However, there is an even bigger...

Symantec Security Response | 07 Aug 2014 14:01:54 GMT


A cyberespionage campaign involving malware known as Wipbot and Turla has systematically targeted the governments and embassies of a number of former Eastern Bloc countries. Trojan.Wipbot (known by other vendors as Tavdig) is a back door used to facilitate reconnaissance operations before the attackers shift to long term monitoring operations using Trojan.Turla (which is known by other vendors as Uroboros, Snake, and Carbon). It appears that this combination of malware has been used for classic espionage-type operations for at least four years. Because of the targets chosen and the advanced nature of the malware used, Symantec believes that a state-sponsored group was behind these...