Tag Archives: Endpoint Protection (AntiVirus)
Blackshades Rat Usage on the Rise Despite Author’s Alleged Arrest
Back in 2012, a key player involved with the prominent Remote Administration Tool (RAT) known as Blackshades RAT was reportedly arrested. Despite his alleged arrest, and with its code leaked in 2010, the tool is still being sold and used in cybercrimin…
Tomcat ??????????
シマンテックは、Apache Tomcat を実行しているサーバーを標的にする、新しいバックドア型のワームを確認しました。この脅威は、毎日のように発見される通常のワームとは若干毛色が異なります。
バックドア型のワームやトロイの木馬を使うと、攻撃者は侵入先のコンピュータ上でさまざまなコマンドを実行でき、実質的にコンピュータをリモートで制御できるようになります。つまり、ユーザーから重要な情報を盗み出すことも、そのコンピュータを利用して他のユーザーを攻撃することも可能だということです。
このタイプの攻撃は、デスクトップやラップトップなどの PC だけを標的にしていると思われがちですが、残念ながらそうではなく、サーバーも攻撃対象になります。サーバーは高性能なコンピュータであり、24 時間 365 日稼働しているため、むしろ標的としてはかなり貴重です。PHP.Backdoor.Trojan のように、PHP で記述されているバックドア型のトロイの木馬が一般的ですが、今回シマンテックが検出したバックドア型のワームは、Java サーブレットのように動作します。シマンテックは、これを Java.Tomdep と命名しました。
図 1. Java.Tomdep の拡散方法
この Java サーブレットは Apache Tomcat 上で実行されますが、Web ページは作成しません。代わりに IRC ボットのように機能し、IRC サーバーに接続して、攻撃者から送信されてきたコマンドを実行します。感染した Tomcat サーバーから Web ページにアクセスしたエンドユーザーは、この脅威の影響を受けません。感染したコンピュータは、ダウンロードやアップロード、新規プロセスの作成、SOCKS プロキシ、UDP フラッド、自身の更新といった標準的なコマンドだけでなく、他の Tomcat サーバーをスキャンして検索し、そこにマルウェアを送信することもできます。このことから、攻撃者の目的は、侵入先のサーバーから DDoS 攻撃を行うことにあるのかもしれません。
Java.Tomdep は、他の Tomcat サーバーを見つけると、以下のように弱いユーザー名とパスワードの組み合わせを使ってログインを試みます。
図 2. Java.Tomdep がログインを試みるときに使うユーザー名とパスワード
次に、見つかった Tomcat サーバーに自身を配備します。
図 3. 見つかった Tomcat サーバーに Java.Tomdep が自身を配備
攻撃者のコマンド & コントロール(C&C)サーバーは、台湾とルクセンブルクに置かれていることが判明しています。シマンテック製品をお使いのお客様からの感染報告は、限られた国や地域からのみ寄せられています。
図 4. 感染報告のあった国や地域
これまでのところ、この脅威の被害を受けているコンピュータの数は多くありません。しかし、サーバーには PC と同じようなウイルス製品がインストールされていない場合もあるため、それが低い検出率の原因ではないことを祈るばかりです。
この脅威に感染しないように、サーバーとウイルス対策製品にはすべてのパッチを適用して、最新の状態に保つようにしてください。また、強力なパスワードを使うこと、そして管理ポートを一般アクセス用に開放しないことをお勧めします。
シマンテック製品は、今回の脅威を Java.Tomdep および Java.Tomdep!gen1 として検出します。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
Fake AV Software Updates Are Distributing Malware
Contributor: Joseph Graziano
A new clever way of social engineering spam is going around today that is attempts to trick users into running malware on their computers. The methods malware authors are using include pretending to be from various antivir…
All Your Tomcat Are Belong to Bad Guys?
Symantec has discovered a new back door worm-type threat which targets servers running Apache Tomcat. This threat is a little different from the ones we usually encounter every day.
Back door type Trojan horses and worms let attackers execute various c…
Cryptolocker ??????: ???????????????????
英国の国家犯罪対策庁(NCA)は先週、大量スパム攻撃によってきわめて多くのユーザーが Cryptolocker マルウェアの標的になっていると警告しました。
この警告によると、英国内で数百万人ものユーザーが悪質な電子メールを受け取っており、その主な標的は中小規模の企業のようです。
Trojan.Cryptolocker については最近のブログでも取り上げており、ランサムウェアに類する脅威の活発な進化の状況を報告しました。Cryptolocker は、侵入先のコンピュータ上のファイルを暗号化し、復号鍵を取引材料として身代金を要求する手口で増加しています。シマンテックは、『インターネットセキュリティ脅威レポート』の最新号で、このようなランサムウェアの急増を予測していました。
図 1. Cryptolocker に誘導されるスパムメールの例
このスパム攻撃では、被害者を狙うさまざまなワナが使われています。たとえば、覚えのない番号から発信された音声メッセージや、未払いの請求書などに偽装した電子メールが確認されています。
図 2. Cryptolocker に誘導されるスパムメッセージの別の例
悪質な添付ファイル自体はダウンローダであり、それを使って Trojan.Zbot など他の脅威が取得されます。それが最終的に Cryptolocker の感染を引き起こして身代金を要求します。
図 3. 復号鍵に必要な支払いの要求画面
NCA の警告によると、2 枚の Bitcoin(2013 年 11 月 18 日時点で 653 ポンドに相当)を要求する Cryptolocker のサンプルが確認されています。シマンテックが解析したサンプルの中には、Bitcoin を 1 枚だけ要求するものもありました。
シマンテックの Email Security.cloud をお使いのお客様は、組み込みの Skeptic™ テクノロジにより、このスパム攻撃から保護されています。また、シマンテックはこれらのサンプルに対して以下のセキュリティシグネチャを用意しています。
検出名 | 検出定義のタイプ |
Downloader | ウイルス対策シグネチャ |
Trojan.Zbot | ウイルス対策シグネチャ |
Trojan.Cryptolocker | ウイルス対策シグネチャ |
Trojan.Cryptolocker!g2 | ヒューリスティック検出 |
Trojan.Cryptolocker!g3 | ヒューリスティック検出 |
System Infected: Trojan.Cryptolocker | 侵入防止シグネチャ |
シマンテックでは、今後も Cryptolocker マルウェアの最新版に対して保護対策の提供を続けていきますが、お客様の側でも、万一 Cryptolocker に感染した場合に予想される損害を最小限に抑えるための対策として、ファイルを定期的にバックアップすることを強くお勧めします。組み込みツールを使ってファイルを復元する方法については、「Recovering Ransomlocked Files Using Built-In Windows Tools(ランサムウェアでロックされたファイルを Windows の組み込みツールで復元する)」(英語)と題したサポート記事を参照してください。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
A Personal Farewell to Peter Szor
It was with quite some skepticism that I accepted Peter Szor’s invitation to go surfing with him five years ago. I had tried surfing several times before but had been disappointed by the lack of adrenalin. I came from a snowboarding background and everyone had told me to try surfing because it was so similar. I had tried it, several times, and I was not impressed. It was mostly about sitting around waiting for something to happen. Where is the adrenalin? Where is the rush?
Peter Szor holding his book The Art of Computer Virus Research and Defense, I was looking for a picture of him out surfing but I realized that sadly I don’t have any pictures with him at all.
At first Peter wanted to take me (a true novice) to his secret spot* in Malibu, a point break with a rocky bottom that would cut you to pieces if you fell the wrong way. In fact, I remember Peter arriving to work one morning and asking me to have a look at a three inch gash on his head wanting to know if I thought it needed stiches! Not only did he want to take me to this treacherous razor-wire-for-a-sea-bed secret spot (treacherous in my mind anyway) but he also wanted to pick me up at 4:45 AM so we could get out to this spot, about a 45 minute drive from the office, and be ready for the swell he knew was coming. I didn’t want to rock his enthusiasm so I accepted. I think some other people advised him on the “hidden” danger of his strategy and, luckily, he thought better of the first outing and took me close to Santa Monica pier instead at a much more reasonable 6:30 AM.
I don’t know if Peter had read the stress lines appearing on my face or if he was just explaining his own philosophy to me that day. I was new in town and I suppose the stress was starting to show—the stress of being in a new city, a new country and a new role, the stress of taking over and building a new team, setting up the office, as well as dealing with all the normal craziness and hustle and bustle that an incident response role incurs on a daily basis. Whether he was an astute observer or not, I can still clearly remember that early morning surfing session and the conversation we had. In a year of new experiences, arriving in Los Angeles that morning still stands crystal clear in my memory.
We had paddled out together, a little past the break, and we were sitting on our boards waiting… and waiting… I was in the ready position my board facing towards the beach and the city, just waiting for the right wave to come. Peter was sitting upright on his board facing out instead to the ocean. He said “this is what I love about surfing” and at first I thought I misheard him. “There are no waves” I thought. “I’m not catching anything, it’s early, my arms are tired, and I’m just stuck here waiting”. I told myself, “this guy is losing it”.
“I love to come out here in the morning,” he continued, “turn my back on the city, look out on the ocean and just let all the stress go, have the sun on your face, the blue sky above you, nature all around you, feel the calm of the ocean and just relax. If I catch a wave that’s great, that’s a bonus, but I can just sit here and pretend the stress of the city doesn’t even exist and revel in nature”. And here I was scratching at this ocean and trying to bend it to my liking, trying my hardest to get something out of waking up early, trying so hard to be productive. So, like Peter, I stopped, turned my board around, and for the first time enjoyed surfing.
One minute later Peter was up and away on a nice wave he had spotted while his back was turned away from the city. He sailed by me smiling, giving a thumbs up as he passed. It took me quite a few more sessions before I could enjoy a wave in that way but I have never looked at surfing the same since.
That wasn’t the only thumbs up he sent my way. On a professional level he also gave me some much needed thumbs up during my first years in the Los Angeles office. I appreciated his kind words since, even though he sat just one cubicle away, he did not work on my team or benefit from my work in any way. Affirmation of your work has added gravitas coming from someone with more than 20 years of experience, 40 patents, a book, and numerous papers to their name. Actually the breadth of his patents is still a constant annoyance to me as I try to patent ideas and find out “oh, that’s covered by Peter’s XX patent from 10 years ago”. But that I can handle.
The last time I saw Peter was about two months ago. We went out paddling in Huntington Beach which is where he had relocated to when he started working with McAfee. Huntington is at least an hour drive away so meeting up was not as easy as before and on the occasions when he did come up my direction, to Santa Monica, he was visiting family so surfing was the last thing on his mind. I needed to have a work related conversation with him that week. I wanted his input on a situation many security companies were dealing with at the time. He was familiar with many companies, having worked at F-Secure and McAfee, as well as Symantec. So we agreed to meet up to discuss work and to catch some waves at the same time.
We headed out to Bolsa Chica state beach and were in the water for about an hour. The waves were bad but the day was good. With not much surfing to be done Peter was just enjoying the water, chatting with other surfers, asking them about their boards, showing off his, and just generally talking to everyone. We had lunch together and talked for a few hours. He showed me his new house, raved about his new wife—who was away that day so I didn’t get to meet her—and we caught up on his new role at McAfee.
I didn’t see him again after that. I was planning (and attending) my wedding in Hong Kong. When I returned two weeks ago and contemplated getting in the water again, I thought of Peter. I wanted to call him to go out paddling again. In the end I was still jetlagged so I put off the surfing and the call to Peter for one more week, one week too long.
I’m sad that I won’t get a chance to paddle out with Peter again, and to turn our backs to the city, and forget all the stress of life, to be one with nature and enjoy a piece of serenity with my friend for one more short moment.
May you look out on the ocean with your troubles far behind you forever Peter and may you Rest In Peace.
Liam.
*Secret spot: it’s not really a secret spot but someone had told Peter not to mention it to anyone so he felt terribly guilty mentioning it to me at all.
Note: We don’t have comments enabled here but feel free to tweet @liam_omurchu if you have your own stories with Peter.
Cryptolocker Alert: Millions in the UK Targeted in Mass Spam Campaign
Last week, the United Kingdom’s National Crime Agency (NCA) warned that tens of millions of customers were being targeted by the Cryptolocker malware through a mass spam campaign.
According to the alert, millions of UK customers received maliciou…