How customers really react to web browser security warnings
The University of California, together with Google, recently undertook a study to track real-world clickthrough rates from browser security warnings in two of the most popular web browsers Google Chrome and Mozilla Firefox. The results reveal a much mo…
Protecting Your Social Accounts for Safer Internet Day
Whether it’s National Cyber Security Awareness Month in October or Safer Internet Day in February, it’s always important to remember to be safe online every day. As technology continues to become more integrated into our daily lives, there are settings and security features that can be used to ensure your information and digital identity remain under your control.
It’s a social world
The most dominating force on the Internet today is social. Right now, I have friends pinning their wedding ideas, instagramming lattes, snapchatting outfits, checking into restaurants on Foursquare, vining videos of their cats, sharing newborn baby photos on Facebook, and tweeting in anticipation of The Walking Dead premiere. As these services become more and more popular, they are targeted more frequently by scams, spam, and phishing attempts.
Know your settings
Symantec Security Response advises social users to familiarize themselves with the privacy settings and security services offered by each of these social networks and applications.
- Public or private? By default, many of these services encourage you to share updates publicly. Most offer privacy as a global setting to make your profile public or private, while some offer more options, allowing you to make individual posts public or private. Make sure you review these settings before posting to these services.
- Strong passwords and password reuse. Use a strong password for each service and be sure not to reuse passwords across your social networks.
- If available, set up two-factor authentication. Some services like Facebook and Twitter offer two-factor authentication as an added measure of security for your account. Normally, to login to a service, you input a password, which is something you know. Using two-factor authentication introduces something you have, usually in the form of a randomly generated number or token that can delivered to your phone through SMS or a number generator within the services’ mobile application. This way, if your password is compromised, the thief will need the generated two-factor authentication token before they can login.
Know your enemy
The biggest enemies of most social networking and application users are the spammers and scammers that want to hijack your social accounts to peddle spam, convince you to fill out surveys, or install applications.
- Free stuff is not free. Many scammers will try to entice you with the idea that you can win free gadgets or gift cards if you fill out a survey, install an application, or share a post on your social network. It just isn’t that easy and by doing so, you could give away your personal information.
- Want more followers and likes? There is always a price to pay for trying to get more followers and likes. Whether that’s paying money for fake followers and likes or willingly giving up your account credentials and becoming part of a social botnet. These schemes aren’t worth it.
- Trending topics are ripe for abuse. Whether it’s sporting events or pop stars, the death of celebrities, popular television season or series finales, or the newest gadget announcement, scammers and spammers know what’s popular and will find a way to insert themselves into the conversation to trick users into doing their bidding. Know that this is inevitable and think twice before blindly clicking on links.
- Is this picture or video of you? These scammers want your password and they’ll attempt to convince you to unknowingly give it to them. This is called phishing. If you click on a link and it takes you to a webpage that looks like a login page for a social networking service, don’t just type in your password. Check the address bar to make sure it’s not some long URL that has the word Twitter or Facebook in it. Open up a new browser tab and manually type in twitter.com or facebook.com to see if you’re still logged in. More often than not, you probably are.
Knowledge is power
Understand that as new social networking services and applications become popular in the mainstream, the scammers and spammers will not be far behind. If you take the time to understand the privacy settings and additional security features offered to you on these services, you are taking the first step towards being safer and more secure online. Additionally, if you know who is after your information and the various ways they will try to trick you into giving up that information, you can make better decisions about what links to click, what posts to share, and where it is safe to type in your password.
Want to help your fellow social users? Share this post with your friends and family on your various social networks.
To keep up-to-date with the latest social network scams, follow us on Twitter @threatintel and subscribe to our blog.
avast! bug bounty program update
A year has passed since we launched the Avast Bug Bounty Program. Let’s see some results: Almost one hundred submissions 25 submissions rewarded about $10,000 total One critical bug was rewarded $3,000 As you can see, this is a useful program – it helps AVAST keep our users secure and make our programs as strong […]
Banclip, ShadesRat, and Malware Detections
On January 23, CERT Polska posted a blog describing a piece of minimalist banking malware targeting Polish citizens. The hashes of several samples of the malware were also listed in the blog. Symantec subsequently broke out a new name for this malware, calling it Trojan.Banclip. Using Symantec telemetry it’s possible to understand more about the distribution of this malware, and what else the attackers responsible for the malware may be up to. It is also an opportunity to clear up some misconceptions about malware scanning services.
Related activity
Symantec recorded a variant of Trojan.Banclip being downloaded from a Polish website, zeus[REMOVED].cba.pl, on January 14, 2014. At least six more malware samples were downloaded from this website over time. The graph below shows the number of detections per day of the distributed malware.
Figure. zeus[REMOVED].cba.pl infections per day
In the six samples identified, there were several other variants of Trojan.Banclip, as well as a copy of W32.Shadresrat (aka BlackShades). W32.Shadresrat is a RAT that is ‘for sale’ and offers an attacker complete control over a victim’s computer. The W32.Shadesrat samples downloaded from zeus-[REMOVED].cba.pl also used zeus-[REMOVED].cba.pl as the command-and-control server. This dual use implies that the person responsible for distributing the malware is the same person responsible for using it to attack victims’ computers. It is likely that the other malware, including Trojan.Banclip, are distributed and utilized by the same attacker. This theory is supported because the observed targets for both malware are primarily Polish.
The following samples were identified as being downloaded from the malicious server:
- 0bec288addbe72c20fd442b38dab4867
- 2b0198b52012adce1ad5c5a44ee1c180
- 387fb206eb014525b9a805fbba4b2318
- 3bf9e6fd9c20e06d0769c7a84ae21202
- 6712b0888415fb432270f4d4dbec47a3
- f8987a4dd66edf76f1bbf41578c35a05
- f8dd3554e53160fec476bb8016ea12a9
Detection
When referring to the malware on their blog, CERT Polska indicated that it appeared to be poorly detected. This conclusion was based on the scan results from VirusTotal. Although it’s understandable to use VirusTotal as a test, the results may not be as clear cut as they appear.
In this particular case, the Trojan.Banclip files were actually detected and customers were protected from them. They were detected by Symantec’s Reputation technology, under the detection name of Suspicious.Cloud.2 or Suspicious.Cloud.9, during the time frame shown in the figure above. The Reputation technology uses a number of different variables, including the reputation of the website a file is downloaded from, to detect malware, and because of this it’s not always possible to replicate it with a basic scan of the file.
There are also other detection technologies in Symantec products to detect malware when it runs, or when it makes network connections. These all help to protect a user, but such systems are not reflected in the output of a simple scan. It’s important that customers enable these advanced features to be fully protected.
Paul Walker’s Death Used to Spread Personalized Trojan Horses
It was only a few months ago that Paul Walker that left us in a fiery car accident. These days it is common for spammers and malware writers to use a celebrity’s death to spread malware. In this case, it started with emails with links to a video of Paul Walker’s car on fire, but instead contained a link to a malicious file.
In the latest slew of emails, the sender makes a plea to the victim to find a Dodge Viper GT that was supposedly racing with Paul Walker’s car. The email asks that anyone with information call a number in the email or open the attached file to view a picture of the Viper GT’s driver. In every sample we have dealt with there is always a promise of reimbursement or compensation for helping capture the Viper GT’s driver.
These attacks are unique because of the regular change of subject lines and body text to bypass spam filters. The attacker tries to personalize the email with the recipient’s name in the body, subject, or attached file name.
Each executable file is made specifically for the email address it is sent to and is compiled just before the email is sent. The sender’s email address is always an aol.com email account that has most likely been hacked or otherwise compromised. Whenever a user is compromised, their address book is harvested to continue the chain of personalized emails.
Figure 1. Email about Paul Walker’s death with malicious attachment from January 30, 2014
Figure 2. Email about Paul Walker’s death with malicious attachment from January 31, 2014
Once the malicious file has been executed an error notification is sent indicating that a 32-bit or 64-bit computer is needed to run the file. It may also indicate that the user does not have sufficient permissions to run the file even though the malware continues to run in the background. The Trojan will start to perform DNS queries through a list of domains with similar names until the malware gets a DNS query return and then it will connect to that URL to download a file into the following directory:
“%UserProfile%\Application Data\amhldfbyjmg\kskzjmtypb.exe”
Once the file (kskzjmtypb.exe) is downloaded, it runs and connects to p9p-i.geo.vip.bf1.yahoo.com to download qr1aon1tn.exe. When this runs, it drops the following file:
“%UserProfile%\Application Data\amhldfbyjmg\fdxeuzv.exe”
Symantec detects this malware as Trojan Horse.
Symantec advises users to be on their guard and to adhere to the following security best practices:
- Exercise caution when receiving unsolicited, unexpected, or suspicious emails
- Avoid clicking on links in unsolicited, unexpected, or suspicious emails
- Avoid opening attachments in unsolicited, unexpected, or suspicious emails
- Keep security software up-to-date
- Update antispam signatures regularly
Symantec constantly monitors spam attacks to ensure that users are kept up-to-date with information on the latest threats.
Going to the Olympics? Prepare to be hacked
If you are one of the thousands of visitors headed to Sochi, Russia for Friday’s 2014 Winter Olympics opening ceremony then you will be hacked. Richard Engel, from NBC news, reported that it’s not if you get hacked, it’s when, and he discovered that it starts from the moment you turn on your device. In […]
AVAST expands into the USA (with a little help from our friends!)
AVAST is gearing up to expand further into the US market. With nearly 14 million active avast! Antivirus users in the USA, some would call that a success, but we see it as an opportunity to protect American’s online lives and multiple devices in a bigger way. With the announcement of a new investment in the […]
Back up your data with AVAST!
Did you ever lose your mobile device? Or did you ever accidentally drop it and could not restore your contact details, pictures, text messages? Perhaps you forgot that you have your brand new smartphone in your pocket, when you decided to jump into the pool during your vacation? We hope nothing like this has ever […]
Twitter ?? 100 ????????????????????
先日のスーパーボウルで話題になった Esurance 社のコンテストへの参加者を狙って、詐欺師はさっそく攻撃を仕掛けています。スーパーボウル終了直後に CM を放映した同社は、#EsuranceSave30 というハッシュタグを使って投稿した Twitter ユーザーの中から抽選で 1 名に 150 万ドルを進呈すると発表しました。シマンテックセキュリティレスポンスはその直後から、このコンテストに対する注目度の高さを利用する目的で Esurance 社の偽 Twitter アカウントが大量に作成されていることを確認しました。
偽 Twitter アカウントの多くは、Esurance 社のブランド名のバリエーションとロゴを使って、同社と正規に関連しているように思わせていました。偽アカウントでは、以下のような Twitter 名が使われています。
- EsuranceWinBig
- EsuranceGW
- Essurance
- Esurrance
- Esurnace
- Esuranc
ロゴと画像を使って Esurance 社のアカウントに見せかけようとしているアカウントはほかにもありますが、名前はブランドと無関係です。たとえば @HeIpfulTips というアカウントがあります。この「HeIp」の中の「I」は小文字の「エル」ではなく大文字の「アイ」です。
2012 年 12 月に作成されたこのアカウントは、数千人のフォロワーを集めていますが、コンテスト中に「アカウントピボット」を実行しました。アバター、プロフィール、ヘッダー画像を変更して、Esurance 社のコンテストの一環であるかのように見せかけたのです。このアカウントにはさらに数千人のフォロワーが増え、コンテスト関連のツイートは一晩で 40,000 回以上もリツイートされました。
図 1. Esurance 社のコンテストとの関連性を偽装した Twitter アカウント
同日の午後に入ると、Esurance 社のツイートから十分なフォロワーを獲得したからか、このアカウントは再びアカウントピボットを実行して、Life Hacks という名前に戻りました。
図 2. Esurance 社に偽装したアカウントは、数千人のフォロワーを獲得後、元の名前に戻った
これと同類のアカウントの多くは、リツイートやフォロワーを獲得することを特に目指しましていますが、シマンテックはそれ以上の悪用があることを確認しています。たとえば、Esurance 社を騙る偽アカウントの中には、コンテストの勝率を上げるためと称してフォロワーに寄付金を募るものもありました。
図 3. コンテストの勝率を上げると称して寄付金を募る Twitter アカウント
この活動はただちに閉鎖されましたが、その時点ですでに 261 ドルの寄付金が集まっていました。
こうしたアカウントは、フォロワーにフィッシングリンクを送りつけ、コンテストの参加者を増やすために Twitter にログインするよう求めるためにも使われている可能性があります。
そもそも、このようなアカウントが作成された目的は何なのでしょうか。コンテストの人気やそのハッシュタグに便乗することで、一部のアカウントは 1,000 人から 100,000 人ものフォロワーを集めました。その後、これらのアカウントの所有者は、本当の Twitter フォロワーを集めているアカウントを探し求めている個人に、偽のアカウントを売ることができます。そして、アフィリエイトスパムに利用されるのかもれしません。
マーケティングの目的で Twitter を利用するブランドが増えていますが、「認証済み」あるいはブランドに公式に関連付けられている Twitter アカウントからのコンテストルールを探して、その更新情報をフォローするようにしてください。今回の場合、Esurance 社は Web サイトに公式ルールと FAQ を公開しています。
Twitter 上でユーザーの誤解を誘おうとしている疑いがあるアカウントは、Twitter 社に報告してください。
ソーシャルメディア詐欺について詳しくは、シマンテックセキュリティレスポンスチームの Twitter アカウント（@threatintel）をフォローし、Twitter 詐欺に関するこれまでのブログもお読みください。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。