The Internet has dissolved the geographical boundaries and technological limitations that have constrained organized cybercrime in the past. We now live with cybercrime syndicates based in the US, Russia, Asia and all over the globe. When hackers in the US are sleeping, the ones in China are flexing their fingers on their keyboards, and the Read more…
A new threat has surfaced targeting users in Korea and Japan, but this attack, unlike others making the news, is not one motivated by political or ideological dogma. Instead, this one is based purely on old-fashioned greed. Vertu phone owners or those looking for a localized Vertu theme in Korean or Japanese for an Android Read more…
Following the recent discovery of Android/Chuli.A, yet another Android malware has now been found using the same method as Chuli.A: via forged email messages with the Android malware (APK file) as an attachment. However, instead of creating a standalone malicious application that shows a fake invitation about an upcoming congress, this time the attackers compromised Read more…
The number of households in the United States that rely solely on mobile phones continues to increase. As of July 2011, 31% of households had mobile phones and no landlines. Additionally, almost one in six households used mobile phones exclusively or almost exclusively, despite still having a landline. This is the first time that adults Read more…
Last year, we talked about scams and spam circulating on Facebook in our whitepaper. Social networking scammers often reuse common lures to trick users, such as offering free products or additional features that are not available on their network of choice. What these scammers do differently is find new ways to get more eyeballs to view their specific links. Whether it is likejacking or even convincing users to paste code (an external JavaScript file) into the browser address bar, these scammers are relentless.
Just recently, we published a blog about the Facebook Black scam that has been spreading. While that scam continued to spread, we found two old lures being reused, and also two identical Google Chrome extensions being pushed onto the end user.
“Additional feature” lure
Users of social networks have often requested certain features and wondered whether they would ever be implemented on their favorite sites. One of the most commonly requested features across all social networks has been a way to see who has visited one’s profile. This feature has never been available, yet this lure has been used in scams across many of the most popular social networks over the years.
Figure 1. Photo-tagging spam claiming additional feature
In fact, this lure—commonly found on social networks—is identical to the one used in the Facebook Black scam we posted about recently. Users are redirected through an iFrame on a Facebook page and then taken to a website where they are enticed to install a Google Chrome extension.
Figure 2. Browser extension claiming additional feature
Installing the extension does nothing—except present the user with a set of surveys to fill out in order to unlock the additional feature. The feature never gets unlocked. The only thing that happens is the scammers make money off of every survey completed successfully.
Figure 3. Scammer survey
“Get something free” lure
Let’s face it: people like free stuff. But free stuff on social networks is not really free. The newest products are the most valued by users and scammers know this. This is why they continue to reuse this lure.
Figure 4. Web page claiming to get something free
For instance, in February Sony announced their new video game console, PS4. It is not scheduled to arrive in stores until the year-end holiday season. However, that has not stopped scammers from attempting to trick users by offering a free PS4 test unit that they can keep.
Figure 5. Browser extension claiming to get something free
The Web page for this scam claims that users can get a voucher for a free PS4. In reality, there is no voucher. There is just a browser extension created by scammers.
When users install this browser extension, JavaScript files are downloaded onto the user’s computers. These files then perform various actions in the user’s Facebook account, like creating a Facebook page with an iFrame and posting a photo the user’s friends are subsequently tagged in (see previous Figure 1). And this is how the scam spreads.
Protection
Symantec customers are protected against these types of attacks by our Web Attack: Fake Facebook Application 3 IPS signature.
Be cautious when you see offers for free products on social networks, especially products that are highly sought after. Also, if a feature is not currently available on a social network, chances are there is a reason that it is not available. Do not install browser extensions from unverified sources—even if they offer free products or access to an unavailable feature—and be especially suspicious of anything that is promoted aggressively on your social networks.
Google, for their part, removes malicious Chrome extensions as they find them and are improving their automated systems to help them detect items containing malware.
However, in the next post we provide instructions on how to remove these scammer browser extensions yourself, and how to clean up your Facebook timeline from all the spam left by scammers.
In what may be the biggest security-related incident on Google Play this year, multiple Trojans targeting Japanese users were discovered carrying the strain of Android one-click fraud. McAfee Mobile Research has already identified multiple developer accounts that were used to spread the malware and confirmed that more than 80 applications of this type existed on Read more…
In what may be the biggest security-related incident on Google Play this year, multiple Trojans targeting Japanese users were discovered carrying the strain of Android one-click fraud. McAfee Mobile Research has already identified multiple developer accounts that were used to spread the malware and confirmed that more than 80 applications of this type existed on Read more…
Gone are the days when you had to click to “accept” a download or install a software update in order to become infected. Now, just opening a compromised web page could allow dangerous code to install on your device. You just need to visit or “drive by” a web page, without stopping to click or Read more…
マルウェアの多くは、自身を変化させる機能を持っています。侵入先のコンピュータに自身をコピーするときにセキュリティソフトウェアの目を逃れること、あるいは解読したメモリ領域を実行したり解読したメモリ値を読み取ったりしてマルウェアを解析しようとするエンジニアの試みを阻害することが目的です。今回のブログでは、メモリを共有して自身の姿を変えるトロイの木馬の動作について説明します。
マルウェアのプロセスは、図 1 の赤線のように進みます。
図 1. 脅威のプロセスを示すコード
ebx-4 というアドレスは、.data セクションの先頭を示しています。初期状態では、ebx-4 は 0 なので、31h や 32h と比較すると失敗になります。
コードによってアドレス ebx-4 に 31h が書き込まれると、トロイの木馬は自身のファイル名を使って WinExec 関数を実行し、自身を実行します。次に、ExitProcess 関数を使って自身を終了します。実行時には ebx-4 の値が常に 0 なので、プログラムは単に実行と終了を繰り返しているだけのように見えますが、実際には悪質な処理を実行しています。ここが、このマルウェアの巧妙なところです。
このファイルのサンプルには、以下のような構造の .data セクションがあります。
図 2. ファイルサンプルの構造
Characteristics の rw- d0000040 は異例な構成で、以下のように設定されています。
IMAGE_SCN_MEM_SHARED 設定が行われているのでメモリ値が共有されています。
このマルウェアが初めて実行されたときには、アドレス ebx-4 が 0 のため、コードはこのアドレスに 31h を書き込んで自身を再実行します。再実行されたときには、ExitProcess の実行前なので、このアドレスで 31h を保持しているメモリが共有されます。
図 3. 再実行されるとプロセスは異なるルートを進む
新しく実行されたプログラムはこのアドレスに 32h を書き込み、自身を再実行します。新しいプログラムは、このアドレスで 32h を保持しているメモリを共有します。
図 4. プロセスが復号ルーチンに達する
アドレスが 32h なので、プログラムは _decrypt 関数を実行し、暗号化されたコードを復号したうえでアドレス esi にジャンプします。この動作を順に示すと、以下のようになります。
図 5. 実行順で示した動作
攻撃者は、自動の脅威解析システムから悪質な動作を隠そうとしていると考えられます。自動の脅威解析システムを搭載している 8 つの Web サイトにサンプルファイルを送信してみたところ、結果は以下のとおりでした。
自動の脅威解析システムは、図 5 の赤い枠線で示したセクションしか監視していないようです。このタイプの特殊コードが自動の解析システムをすり抜けることは、たびたび確認されています。
シマンテックは、このタイプの悪質なコードと手口を引き続き監視していく予定です。疑わしいプログラムは実行しないようにし、オペレーティングシステムとウイルス対策ソフトウェアは最新の状態に保つことをお勧めします。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
El mundo de las redes sociales ha despegado a un ritmo vertiginoso. Sí, se ha vuelto «viral», y tal vez esto sea solo el comienzo. Ahora que millones de personas se han apresurado a comprar los smartphones más innovadores (no …