Symantec has detected a Trojan which targets an already patched Microsoft Office security flaw. This Trojan is delivered via an e-mail which contains a Microsoft Word document and a .dll (Dynamic Link Library) file.

The moment a user opens the email that user’s system would be infected with the Trojan. In an official Symantec blog, Takayoshi Nakayama, a researcher at Symantec, stated that the exploiter has utilised an ActiveX control that has been embedded in the Word document and further stated “When the Word document is opened, the ActiveX control calls fputlsat.dll which has the identical file name as the legitimate .dll file used for the Microsoft Office FrontPage Client Utility Library.”

Symantec has named this Trojan as “Trojan.Activehijack” and has revealed that it exploits the vulnerability which was rated as “important” and patched by the Redmond based software giant in the month of September 2011 with MS11-073 bulletin.

Microsoft Corp said hackers exploited a previously unknown bug in its Windows operating system to infect computers with the Duqu virus, which some security experts say could be the next big cyber threat.

“We are working diligently to address this issue and will release a security update for customers,” Microsoft said on Tuesday in a short statement.

News of Duqu surfaced in October when security software maker Symantec Corp said it had found a mysterious computer virus that contained code similar to Stuxnet, a piece of malicious software believed to have wreaked havoc on Iran‘s nuclear program.

Government and private investigators around the world are racing to unlock the secret of Duqu, with early analysis suggesting that it was developed by sophisticated hackers to help lay the groundwork for attacks on critical infrastructure such as power plants, oil refineries and pipelines.

Details on how Duqu got onto infected machines emerged for the first time on Tuesday as Microsoft disclosed its link to the infection.

Separately, Symantec researchers said they believe hackers sent the virus to targeted victims via emails with tainted Microsoft Word documents attached.

If a recipient opened the Word document and infected the PC, the attacker could take control of the machine and reach into an organization’s network to propagate itself and hunt for data, Symantec researcher Kevin Haley told Reuters.

He said some of the source code used in Duqu was also used in Stuxnet, a cyber weapon believed to have crippled centrifuges that Iran uses to enrich uranium.

That suggests that the attackers behind Stuxnet either gave that code to the developers of Duqu, allowed it to be stolen, or are the same people who built Duqu, Haley said.

“We believe it is the latter,” he said.

(Reporting by Jim Finkle. Editing by Robert MacMillan)

Windows maker Microsoft Corp. went on to patch its antivirus software on Friday that was incorrectly targeting Google’s Chrome Web browser, the company announced.

The antivirus program in question, the company’s own product – Microsoft Security Essentials, accidentally targeted the massively popular browser after an update containing faulty signatures was pushed, and it had already lasted for about three hours before it was finally taken care of. Almost 3000 users were affected due to the same, Microsoft admitted.

“An incorrect detection for PWS:Win32/Zbot was identified and as a result, Google Chrome was inadvertently blocked and in some cases removed from customers’ PCs” (personal computers), Microsoft said on Malware Protection Center.

According to reports, Google Chrome was perceived by the security software as a part of the infamous Zeus malware family.

Microsoft, however, regretted for the inconvenience the affected users had to face, and reassured them that the problem had been since identified, and eventually taken care of with updated signatures.

As mobile phones get more sophisticated, hi-tech criminals are dusting off some old tricks.

Security companies have noticed a rise in trojans known as diallers that used to be popular during the days of dial-up net access.

On a smartphone the diallers are being used to call premium rate lines leaving victims with a big bill.

Experts say the diallers are proving popular as a quick way for criminals to cash in.

Diallers were widely used during the days of dial-up net access when most people connected via modem.

Many diallers lurked on porn sites and, once they snared a victim, disconnected their modem and then placed a long distance call. Many victims were left with huge phone bills.

The economics of international calls meant that some of the cash spent on the call would be shared with the criminals. Some diallers were very sneaky in that they muted the speaker on a modem so victims could not spot when the overseas call was being placed.

Now, the security wing of software firm CA has said it is seeing a rise in diallers for smartphones. This time, instead of calling international numbers, the diallers call premium rate lines and land victims with the bill.

Writing on the CA security blog, Akhil Menon said it was seeing a “an increasing trend of trojan diallers”. Mr Menon profiled one such virus, called Swapi.B, which sends premium SMS messages.

“The messages sent out are in the typical format to invoke premium services and land the mobile user with heavy mobile bills without the user’s knowledge and consent,” wrote Mr Menon.

Many diallers, including Swapi.B, are contracted from porn sites which disguise themselves as software, video clips or helper programs.

Mikko Hypponen, head of research at F-Secure which makes security software for mobiles, said it had seen a “handful” of diallers in recent months.

They were popular, he said, because they get round one of the big problems facing anyone wanting to make money out of Windows viruses.

“PC malware can’t just directly steal money from your machine; it has to jump through hoops like keylogging your credit card number or sending spam,” he said.

“However, mobile malware can just instantly steal from you by making premium-rate calls or messages,” said Mr Hypponen.

Some creators of diallers were also working to ensure that it was hard to shut down the premium rate service they had set up to cash in.

Mr Hypponen said some diallers sent messages or rang many different numbers, including legitimate ones.

“The trojan can place calls to, say, 100 different premium-rate numbers, only one of which is his own number,” said Mr Hypponen.

“How would you fight this? Shut down all the numbers, including the innocent ones?”

A new type of malware infects PCs using file-share sites and publishes the user’s net history on a public website before demanding a fee for its removal.

The Japanese trojan virus installs itself on computers using a popular file-share service called Winny, used by up to 200m people.

It targets those downloading illegal copies of games in the Hentai genre, an explicit form of anime.

Website Yomiuri claims that 5500 people have so far admitted to being infected.

The virus, known as Kenzero, is being monitored by web security firm Trend Micro in Japan.

Masquerading as a game installation screen, it requests the PC owner’s personal details.

It then takes screengrabs of the user’s web history and publishes it online in their name, before sending an e-mail or pop-up screen demanding a credit card payment of 1500 yen (£10) to “settle your violation of copyright law” and remove the webpage.

Held to ransom

The website that the history is published on is owned by a shell company called Romancing Inc. It is registered to a fictitious individual called Shoen Overns.

“We’ve seen the name before in association with the Zeus and Koobface trojans. It is an established criminal gang that is continuously involved in this sort of activity,” said Rik Ferguson, senior security advisor at Trend Micro.

Kenzero is a twist on ransomware, he added, which infects a computer and encrypts the documents, pictures and music stored on it, before demanding a fee for a decryption key.

“Interestingly we’ve seen a separate incident that focuses on European victims,” he said.

A fictitious organization calling itself the ICPP copyright foundation issues threatening pop-ups and letters after a virus searches the computer hard drive for illegal content – regardless of whether it actually finds anything.

It offers a “pretrial settlement” fine of $400 (£258) payable by credit card, and warns of costly court cases and even jail sentences if the victim ignores the notice.

However rather than take the money, the outfit sells on the credit card details, said Mr Ferguson.

“If you find you are getting pop-ups demanding payments to settle copyright infringement lawsuits, ignore them and use a free online anti-malware scanner immediately to check for malware,” was his advice.

“And if there’s online content that you want to get hold of, get it from a reputable website – if that means paying that’s what you have to do.”

Security companies have noticed a rise in trojans known as diallers that used to be popular during the days of dial-up net access.

On a smartphone the diallers are being used to call premium rate lines leaving victims with a big bill.

Experts say the diallers are proving popular as a quick way for criminals to cash in.

Diallers were widely used during the days of dial-up net access when most people connected via modem.

Many diallers lurked on porn sites and, once they snared a victim, disconnected their modem and then placed a long distance call. Many victims were left with huge phone bills.

The economics of international calls meant that some of the cash spent on the call would be shared with the criminals. Some diallers were very sneaky in that they muted the speaker on a modem so victims could not spot when the overseas call was being placed.

Now, the security wing of software firm CA has said it is seeing a rise in diallers for smartphones. This time, instead of calling international numbers, the diallers call premium rate lines and land victims with the bill.

Writing on the CA security blog, Akhil Menon said it was seeing a “an increasing trend of trojan diallers”. Mr Menon profiled one such virus, called Swapi.B, which sends premium SMS messages.

“The messages sent out are in the typical format to invoke premium services and land the mobile user with heavy mobile bills without the user’s knowledge and consent,” wrote Mr Menon.

Many diallers, including Swapi.B, are contracted from porn sites which disguise themselves as software, video clips or helper programs.

Mikko Hypponen, head of research at F-Secure which makes security software for mobiles, said it had seen a “handful” of diallers in recent months.

They were popular, he said, because they get round one of the big problems facing anyone wanting to make money out of Windows viruses.

“PC malware can’t just directly steal money from your machine; it has to jump through hoops like keylogging your credit card number or sending spam,” he said.

“However, mobile malware can just instantly steal from you by making premium-rate calls or messages,” said Mr Hypponen.

Some creators of diallers were also working to ensure that it was hard to shut down the premium rate service they had set up to cash in.

Mr Hypponen said some diallers sent messages or rang many different numbers, including legitimate ones.

“The trojan can place calls to, say, 100 different premium-rate numbers, only one of which is his own number,” said Mr Hypponen.

“How would you fight this? Shut down all the numbers, including the innocent ones?”

This scam has two sets of victims, the companies that are being stolen from and the innocent people being used to do the dirty work. Most are recruited via phony “Work from Home” ads. Scammers prey on the unemployed and underemployed, often flooding sites like Craigslist and Monster with fake job openings and also scanning the site for job seekers who have posted contact info and spamming them. What makes this part of the spear phishing scam so sinister is that the mules aren’t just being scammed, they are money laundering, which is a serious criminal offense.

The FBI advises companies to confine their banking activities to a dedicated, locked down computer that is not used for any other purpose and isn’t allowed access email or everyday web browsing. A strong and constantly updated firewall is also a must.

Source: Sue Walsh November 2009

Zeus lurks on the victim’s hard drive, doing nothing, until the infected computer visits a page related to financial matters, such as a brokerage firm, online banking, Paypal, or a credit card account page. A keylogger is activated when such a page is detected and the login details are stolen. The Trojan can also hijack a browser and redirect the user to a fake version of a bank’s webpage. These so-called “Man in the Browser” attacks are hard to detect.

“This attack illustrates how organized internet crime syndicates are expanding their focus from consumers to enterprises, by targeting employees with credentials to access high value banking, financial, and other web-based applications,” said Mickey Boodaei, CEO of Trusteer. “The level of personalization used in these Phishing messages and the fact that they appear to be coming from the company’s IT department makes this attack very convincing and by extension very dangerous. We are urging enterprises to warn their employees and lock down browser settings to prevent unauthorized code execution inside the browser.”

Experts say that the hackers behind Zeus are targeting corporate users because business accounts tend to have much higher balances than consumer ones. The malicious sites linked to in the spam message are located all over the world in places like Romania, Russia, Columbia, and Hungary, and so far Zeus is not being detected by many anti-virus programs.

Source: Sue Walsh October 2009

Investigating the possibilities will ultimately save you time, money and the hassle of wondering “Is this email or website for real?”

Email your feedback to us via the contact us form.

http://www.hoax-slayer.com

All the Best!

Vangelis Solutions

It is sweeping through thousands of offices in the UK and has affected computers at the Ministry of Defence.

The virus – known variously as Conficker, Kido or Downadup – burrows deep into the operating system and tricks the machine into running the infected program.

Once the worm is running on the computer it automatically starts to download more malicious programs from hackers’ websites, with devastating effects.

The majority of computers infected by the worm, which was first identified in October, are in Russia, China, Brazil and India. But the virus is now taking hold in the UK.

The worm has password cracking capabilities, often successful because company passwords sometimes match a predefined password list that it carries.

Eddy Willems, a security analyst with anti-virus firm Kaspersky Labs, said that a new strain of the worm was now causing additional problems.

Computer users are advised to ensure their anti-virus software, operating system and firewall is up to date, and that they have installed a Microsoft patch designed to combat the problem.

Experts have also warned the virus could spread by copying itself to USB memory sticks shared between computers, and urged users to use caution.

Microsoft Advisory:
http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32%2fConficker

Original Patch released 23 October 08:
http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

More info on latest variant:
http://support.microsoft.com/kb/962007

Source: Sky News January 21st 2009 & P Giles Vangelis Solutions