Video Screencast Help
Security Response
Showing posts in English
Joji Hamada | 09 Jun 2014 17:07:32 GMT

Just around this time last year, Symantec came across a fake security app called Android Defender (Android.Fakedefender) that held mobile devices hostage until a ransom was paid up. This particular malware locked up the device, making it useless, in order to coerce the user into paying for the app. Now, a year later, a batch of malicious apps that take files stored on mobile devices hostage by encrypting them have been discovered in the wild by security researchers. These variants, which Symantec detects as Android.Simplocker, pretend to be legitimate apps and appear to be hosted on fake Google Play sites aimed at Russian-speaking Android device owners. An example of one of these fake sites can be seen in Figure...

Symantec Security Response | 05 Jun 2014 15:26:17 GMT


Figure. List of the latest patched OpenSSL vulnerabilities

The OpenSSL project recently released patches for several OpenSSL vulnerabilities, two of which are marked as critical. One of the critical vulnerabilities, OpenSSL CVE-2014-0224 Man in the Middle Security Bypass Vulnerability (CVE-2014-0224), could let an attacker carry out a man-in-the-middle attack, allowing them to intercept traffic between a vulnerable client and a vulnerable server. One way that attackers could exploit this flaw is by setting up a rogue Wi-Fi hotspot in a public area. If a user connects to this rogue access point, the attackers controlling...

Satnam Narang | 05 Jun 2014 10:59:51 GMT

Dating back to last year, Symantec has been following a trend involving adult webcam spam on social networks, dating applications, and photo sharing applications. Our research found that no matter which platform it was found on, most adult webcam spam shared a common thread: it led users to a mobile messaging service called Kik.

What is Kik?
Kik is an instant messaging service available for all smartphone platforms. The service has more than 100 million users and is extremely popular with teenagers.

A recent history of adult webcam spam

The first cross advertising for Kik spam made its way to Twitter towards the end of summer 2013. Spam bots would target specific keywords and send a reply when one was found. For instance, tweets with the word “horny” would be met with a response from a spam bot, posing as a female, containing the word “horny.” The message would ask the user to reply back...

Joseph Graziano | 02 Jun 2014 17:31:22 GMT

Everyone hates getting bills, and with each new one it seems like the amount due just keeps getting higher and higher. However, Symantec recently discovered an energy bill currently being emailed to people that will hit more than just your bank account.

A recent spam campaign sending out emails masquerading as an Australian energy company is serving up the Cryptolocker malware…or at least that’s what the spammers want you to think. Once users become infected, they are told they are infected with Cryptolocker (Trojan.Cryptolocker) however, upon further research, Symantec discovered that the malware is not related to the original Cryptolocker virus and is merely a copycat attempting to cash in on the hype and infamy of Cryptolocker.

Energy bill gives users a shock
This particular spam campaign requires a lot of work from the victim to work but once it...

Symantec Security Response | 02 Jun 2014 14:33:16 GMT

The FBI, the UK's National Crime Agency, and a number of international law enforcement agencies have significantly disrupted two of the world’s most dangerous financial fraud operations: the Gameover Zeus botnet and the Cryptolocker ransomware network. Working with a number of private sector partners, including Symantec, the FBI has seized a large amount of infrastructure used by both threats. On the back of this operation, Symantec has released a new tool that victims can use to completely remove Gameover Zeus infections.


Gameover Zeus is responsible for millions of infections worldwide since its inception...

Symantec Security Response | 30 May 2014 15:15:55 GMT


Earlier this year, Symantec blogged about Infostealer.Bankeiya, a Trojan that was specifically targeting  users in Japan through the Microsoft Internet Explorer Use-After-Free Remote Code Execution Vulnerability (CVE-2014-0322). Bankeiya monitors and steals confidential information specific to Japanese online banking sites.

A few months after our first blog, Symantec noticed that Infostealer.Bankeiya had resurfaced and was infecting more online banking customers in Japan. While it is unclear exactly how much money was stolen by Bankeiya, there is no doubt that its previous...

Satnam Narang | 29 May 2014 17:12:10 GMT

Following reports of Apple IDs being compromised and devices being held for ransom in Australia and New Zealand, Apple issued a statement to ZDNet proclaiming that their iCloud infrastructure had not been breached. They went on to warn users to “change their Apple ID password as soon as possible and avoid using the same user name and password for multiple services.” Symantec would like to advise owners of Apple devices to keep an eye out for emails attempting to phish for Apple ID login credentials.

Going phishing for Apple IDs

While there have been no confirmed reports as to how these Apple IDs were compromised, one possible explanation is phishing scams. Due to all the media attention this event has received, Symantec is cautioning...

Joji Hamada | 29 May 2014 13:26:22 GMT

In mid-May, Symantec observed a gradual uptick in attacks exploiting the Adobe Flash Player Buffer Overflow Vulnerability (CVE-2014-0515), and we continued to monitor this trend. Symantec’s research now indicates that the attacks are being performed on a massive scale and that majority of them are focused on Japan.

Back in April, CVE-2014-0515 was originally being exploited in watering-hole attacks against specific organizations or industries. Later in the same month, Adobe released a patch for the vulnerability. However, just a few weeks later Symantec telemetry indicated that instead of the initial targets, the exploit was now being used to target a wider range of Internet users.

Figure 1....

Satnam Narang | 27 May 2014 21:06:05 GMT

Many users in Australia and New Zealand have had their Apple IDs compromised. We are seeing reports on Apple’s support community and social networks that their Apple devices are being remotely locked and held for ransom by someone claiming to be Oleg Pliss, a software engineer at Oracle, who the attackers randomly chose to pin this attack on.

Apple ID 1 edit.png

Figure 1. Locked iPhone ransom message

What happened to my Apple device?

Based on initial feedback, a number of Apple IDs have been compromised and used to lock iPhones, iPads, and Macs. It remains unclear exactly how the Apple IDs were compromised, but possible explanations include phishing attempts, weak passwords, or password reuse. A separate breach involving emails and passwords used to login to Apple and iCloud could have...

Joseph Graziano | 27 May 2014 18:38:53 GMT

At the beginning of April, a vulnerability in the OpenSSL cryptography library, also known as the Heartbleed bug, made headlines around the world. If you haven’t heard of the Heartbleed Bug, Symantec has published a security advisory and a blog detailing how the Heartbleed bug works.

As with any major news, it is only a matter of time before cybercriminals take advantage of the public’s interest in the story. Symantec recently uncovered a spam campaign using Heartbleed as a way to scare users into installing malware onto their computers. The email warns users that while they may have done what they can by changing their passwords on the websites they use, their computer may still be “infected” with the Heartbleed bug. The spam requests that the user run the...