Tag Archives: windows

JASBUG : Una nueva vulnerabilidad de Windows que requiere atención inmediata de los administradores de sistemas.

Para mitigarla se deben reconfigurar los equipos y aplicar un parche adicionalRead More

Windows ????????????? Sandworm ????????

      No Comments on Windows ????????????? Sandworm ????????

限定的な標的型のサイバースパイ攻撃で、標的のコンピュータにバックドアを送り込むために Windows の新しい深刻なゼロデイ脆弱性が悪用されていると報告されています。

Sandworm Windows zero-day vulnerability being actively exploited in targeted attacks

Critical new Windows zero-day has reportedly been used in a limited number of targeted cyberespionage attacks to deliver a back door on to the victim’s computer.

Vulnerabilidade de dia-zero Sandworm, do Windows, é ativamente explorada em ataques dirigidos

Uma nova vulnerabilidade crítica no sistema operacional Windows está sendo explorada em um número limitado de ataques contra alvos nos EUA e na Europa. A vulnerabilidade Microsoft Windows OLE Package Manager Remote Code Execution Vulnerability (CVE-2014-4114) permite que os atacantes incorporem arquivos Object Linking and Embedding (OLE) a partir de locais externos. A vulnerabilidade pode ser explorada para baixar e instalar malware no computador do alvo e parece ter sido usada por um grupo de ciberespionagem conhecido como Sandworm para entregar o Backdoor.Lancafdo.A (também conhecido como Black Energy) a organizações-alvo.

?? ???? ???? ??? Windows ???? ???

      No Comments on ?? ???? ???? ??? Windows ???? ???

Critical new Windows zero-day has reportedly been used in a limited number of targeted cyberespionage attacks to deliver a back door on to the victim’s computer.

Sophisticated Viknok Malware Proves That Click-fraud Is Still a Moneymaker for Scammers

Symantec has spotted a recent surge of infections of Trojan.Viknok, which can gain elevated operating system privileges in order to add compromised computers to a botnet. Trojan.Viknok, first observed in April 2013, infects dll files with a malicious payload. Since its initial discovery, the malware has evolved into a sophisticated threat, capable of obtaining elevated operating system privileges in order to infect system files on multiple Windows operating systems, such as the 32 and 64-bit versions of Windows XP, Vista and 7. 

Attackers have been observed using Viknok-infected computers to carry out Adclick fraud. While click-fraud activity has been prevalent for years, it still seems to be an effective way for scammers to make money. The scammers behind the current Viknok campaign have gone to a lot of effort to add more victims to their Adclick botnet, helping them make more money in the process.

While the Viknok malware was discovered last year, attackers have been increasingly using the threat in the last six months. In April 2014, Symantec observed a spike in Trojan.Viknok activity along with new reports of Viknok-infected computers playing random audio clips through victims’ speakers. In the first week of May alone, Symantec saw 16,500 unique Viknok infections. The majority of victims are located in the US.

In this blog, we’ll talk about how Viknok manages to alter a system dll to gain elevated privileges. We’ll discuss the techniques the threat uses to infect its targets and how it takes advantage of compromised computers to conduct click-fraud. Finally, we’ll show how many Viknok infections have occurred in recent months and talk about how to protect yourself from this threat.

Viknok’s privilege escalation exploit
Modifying a system dll is no easy task in today’s operating systems. Even if a user is operating from an administrator account, they will not have the permissions to alter core system files, such as rpcss.dll which lets software continue to run each time Windows restarts. So how can Viknok infect these files?

Viknok has an arsenal of techniques at its disposal to let it perform the silent infection of the system file rpcss.dll. These methods consist of: 

The most powerful of these techniques is the exploitation of CVE-2013-3660, which allows the threat to run code in kernel mode.

Figure 1. The exploit’s payload code

The code shown in the previous image shows how the threat is able to assign itself the system process’ primary access token, giving the malware the same privileges as the user with the highest administrative rights. 

How Viknok infects computers
Depending on the privileges used to initially execute Viknok, the threat may try one or more of the previously mentioned techniques. The threat’s purpose is to infect the file rpcss.dll, so that the malicious code is executed every time Windows starts. The infection of this file merely provides a loader for the core of the malware itself, which is usually stored in an encrypted file in the %System% folder.

We tested several scenarios to verify Viknok’s infection capabilities, which have been summarized in the following image.

Figure 2. Some common Viknok infection scenarios

There are several conditions that may affect the outcome of the infection process, such as if the threat is manually downloaded and run, if it is dropped through an exploit or if it is dropped by the browser or a browser plugin. The previous image does not exhaust all possibilities; however it shows configurations that are commonly found in user or corporate environments.

In many cases, the infection process is completely stealthy; the threat does not show any warning to the user. The malware is also difficult to detect since it does not show any suspicious running process, nor does it infect any of the standard load points. In some cases, the threat needs to show the User Account Control (UAC) prompt to the user in order to obtain the elevation of privileges. If the user does not grant the permission, the infection will fail. However, the threat uses system components to try and load its code for privilege elevation. As a result, the UAC prompt will look like it’s a part of normal system activity, as shown in the following image.

Figure 3. Example of UAC prompt

Payload & click-fraud activity    
As mentioned previously, attackers are currently using Viknok-infected computers to perform click-fraud activity. Attackers carry out this activity using malware detected by Symantec as Trojan.Vikadclick. Once Vikadclick is loaded by the Viknok-infected rpcss.dll file, it will periodically download commands from command-and-control (C&C) servers under the attackers’ control. These commands force the compromised computer to perform network activity related to Adclick fraud. 

As a result of Trojan.Viknok infections and the related Adclick fraud, unknowing victims have been experiencing random audio playback through their compromised computers. This is believed to be caused by Trojan.Vikadclick surreptitiously visiting Web pages in the background that contain streaming audio content. Our analysis has shown that Trojan.Vikadclick’s Adclick fraud content includes car insurance for teenagers, tickets to Paris and bulk domain name registration, to name a few. 

Symantec telemetry shows that Viknok activity has increased considerably in the last six months, with Symantec detecting and remediating over 22,000 unique infections in April 2014. 

Figure 4. Growth in Viknok detections in the last 6 months.

From May 1 to May 6, Symantec telemetry shows that we have detected over 16,500 unique Viknok infections. The majority of the infections have been observed in the US. The number of Viknok detections for May 2014 is on track to reach the highest amount of infections of this malware recorded to date.  

Figure 5. Heatmap for Viknok detections in May 2014 to date.

Symantec protects users against Viknok under the following detection names:

Antivirus detections

The non-repairable infections are related to copies of legitimate infected dlls, which can be safely deleted without affecting the computer. 

Intrusion Prevention Signatures 

For the best possible protection, Symantec customers should use the latest Symantec technologies incorporated into our consumer and enterprise solutions. Finally, always keep computers up to date with the latest virus definitions and patches.

While still a relatively newcomer on the malware threat landscape, Trojan.Viknok has shown its ability to evolve and implement sophisticated infection techniques to circumvent operating system access control mechanisms. Its use of Adclick fraud to monetize the botnet shows that this form of fraud is still a popular mean of income for malware authors. The continued spike in Trojan.Viknok activity suggests that this threat looks to become a common player on the threat landscape, so Symantec will continue to monitor it closely. Symantec is continuing to investigate how this threat arrived on victims’ computers.

Android App Contains Windows Worm

      No Comments on Android App Contains Windows Worm

When developers are unaware of security they open the door to threats against their customers and users. We are not just talking about exploitable vulnerabilities in their code, but about something much more obvious than that. Here is the curious case of an Android application on Google Play that contains some traces of malware, but Read more…

Microsoft Office ???? CVE-2013-1331 ??????

脆弱性が発見されてから悪用が出現するまでの時間は、ますます短くなっています。ときには、数時間ということさえあります。そのため、IT マネージャは実働システムへのパッチ適用を急がされ、品質保証に必要な設定管理やベストプラクティスに抵触してしまいます。新しいパッチや更新を常にリリースし続けることに四苦八苦している企業も少なくありません。

今月の第 2 火曜日、2013 年 6 月 11 日に、Microsoft 社は多くの脆弱性を対象とするセキュリティ情報(MS13-051)を公開しました。報告によると、その脆弱性のひとつが標的型攻撃に悪用されています。攻撃者は、スピア型フィッシング攻撃の一環として、特別に細工した添付ファイルを送信してこの脆弱性を悪用できてしまいます。

Microsoft Office の PNG ファイルに存在するバッファオーバーフローの脆弱性(CVE-2013-1331)、すなわち Microsoft Office に存在するリモートスタックベースのバッファオーバーフローの脆弱性によって、リモートでコードが実行されます。これは、Microsoft Office 2011 for Mac と、全 Windows プラットフォーム向けの Microsoft Office 2003 に影響することが確認されています。




  • Web Attack: Microsoft Office CVE-2013-1331 2
  • System Infected: Trojan Backdoor Activity 12

シマンテックは保護対策を強化するために、この脅威を継続的に監視し、対応ができしだい、該当の更新を提供する予定です。ウイルス定義対策を定期的に更新し、以下の Microsoft 製品の最新パッチをインストールすることをお勧めします。


* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。