CONTENTS in THIS ISSUE Fighting Malware and Spam

NOVEMBER 2011 Fighting malware and spam CONTENTS IN THIS ISSUE 2 COMMENT LIKE A JEWEL IN THE SUN Within the margin of error Helen Martin reports on a week 3 NEWS in sunny Spain at the 21st Virus Spammers link to yet-to-be-registered Bulletin International domains Conference. Chemical industry targeted page 4 3 VIRUS PREVALENCE TABLE SPYEYE GOES MOBILE 4 CONFERENCE REPORT Despite the Windows versions of Zeus and SpyEye now sharing source code, Zitmo and Spitmo – the Viva Barcelona! mobile components of each – have nothing in common at the code level. Spitmo was created from MALWARE ANALYSES scratch solely for the purpose of stealing mTANs. 9 Spitmo – SpyEye component for Symbian Mikko Suominen has all the details. page 9 13 Flibi: reloaded FEATURES SNATCH AND GRAB 16 Investigating the abuse of search engines to Botnets such as Zeus, SpyEye and others use promote illicit online pharmacies the effective technique of form grabbing to steal 19 The art of stealing banking information – form sensitive information from victims’ machines. grabbing on fi re Adtiya Sood and his colleagues take a detailed look at the form-grabbing technique. 24 END NOTES & NEWS page 19 ISSN 1749-7027 COMMENT ‘Only 3% of the publication (eagle-eyed readers will already have observed this by adding the two numbers above). webmasters This year’s Virus Bulletin conference featured a similarly responded... Tanase interesting presentation by Stefan Tanase. He described had rediscovered the the process of contacting the webmasters of infected Romanian websites. The result was interesting: only 3% Bontchev constant.’ of the webmasters responded. As was pointed out by a Gabor Szappanos member of the audience, Tanase had rediscovered the Bontchev constant. VirusBuster Now, if my evil twin were writing this comment, he WITHIN THE MARGIN OF would conclude that all the efforts invested in user education and security consciousness over the last ten ERROR years have resulted in a 0.15% decline in awareness. And According to some popular theories, history follows a this is in an even more security-oriented audience – since circular path, always returning to a previous state albeit webmasters ought to be more security-aware than the at a higher level of social development. Recently, I average user falling victim to a macro virus. But since came to the conclusion that anti-virus research follows my twin is not only evil but also fair, he would mention a similar path: not only did an experiment fl ash back that the difference is within the margin of error resulting from the past, but the result turned out to be virtually from fi nite sample size – so he would say that, in fact, identical. the situation is best described as exactly the same as it was ten years ago. During the course of the 2001 Virus Bulletin conference Fortunately, it is not my evil twin writing, but me at Dr Vesselin Bontchev summarized FRISK’s experiences my most optimistic moment. I feel I must transmit of the W97M/Groov.A macro virus. This otherwise optimism, otherwise the readers of this magazine would unremarkable macro virus had an interesting payload: give up all their efforts and retreat to physics or games it uploaded IPCONFIG output data to the complex.is software development. What gives us hope are Tanase’s (FRISK) FTP site. Using the server logs it was possible further fi ndings – namely that although only 3% of the for the researchers to trace back the infected users, webmasters responded, actually 5% of the web pages advise them of the infection, and ask them whether they were cleaned. And I would even take into account the wished to receive further notifi cations. Only 3.15% of additional 1% that were shut down, assuming the best. them responded positively. Therefore, according to my optimistic calculation, All of the above details were quickly forgotten, but security consciousness has grown from 3.15% to 6% in what was remembered by many (and entered into AV ten years. If we continue with the same effort, we will industry folklore) was Bontchev’s famous summary: reach the clear majority in the year 2165, when half of ‘97.3% of the human population are [not security the user population will care about security. I can hardly conscious people]’ – though he used a slightly different wait to see that – though I won’t hold my breath. and much shorter epithet. In fact, the details were But all sarcasm aside, we must continue relentlessly so poorly remembered by the majority that in later with our efforts in user education. First, we need better citations a different number subsisted than in the original PR. If we are not accepted as educators, our message will not be received. For me, the most worrying part of Editor: Helen Martin both experiments was the deafening silence: the majority Technical Editor: Morton Swimmer of users did not even respond to the assistance being Test Team Director: John Hawes offered by the anti-virus experts. I interpret this as an Anti-Spam Test Director: Martijn Grooten indication that the general population does not accept Security Test Engineer: Simon Bates us as an authority when it comes to computer security Sales Executive: Allison Sketchley issues. Web Developer: Paul Hettler The anti-virus industry could not overstep the ancient Consulting Editors: Nick FitzGerald, Independent consultant, NZ accusation that we write the viruses ourselves, but now it Ian Whalley, IBM Research, USA is essential for us to convince the public that we are the Richard Ford, Florida Institute of Technology, USA good guys. Without their support we can only lose the battle over cybercrime. 2 NOVEMBER 2011 VIRUS BULLETIN www.virusbtn.com NEWS SPAMMERS LINK TO YET-TO-BE REGISTERED DOMAINS Prevalence Table – September 2011[1] Commtouch has reported an increase in spamvertized URLs using domains that are yet to be registered at the time the Malware Type % spam is sent – making it less likely for such messages to be Autorun Worm 8.33% blocked by spam fi lters. Encrypted/Obfuscated Misc 6.25% The use of domain blacklists and reputation services is Heuristic/generic Virus/worm 5.16% common among spam fi lters and spammers try to avoid using domains with a bad reputations in their emails – they LNK Exploit 4.49% may use URL shortening services, for instance, or use links Sality Virus 4.48% to compromised pages on a legitimate domain. Adware-misc Adware 4.17% A less common trick is to use domains that are not yet Confi cker/Downadup Worm 3.73% registered – spam fi lters usually do not compute reputation Zbot Trojan 3.49% for non-existent domains. Agent Trojan 3.19% In such cases the domain is registered some time after the Iframe Exploit 2.98% emails have been sent. Because most spam fi lters do their work at the moment the email is received, they will have Heuristic/generic Misc 2.95% made their decision by then. However, many users do not Kryptik Trojan 2.50% read their email until much later and by that time the links Heuristic/generic Trojan 2.48% are expected to be active. Downloader-misc Trojan 2.38% While this trick is not new, spammers have been using it Virut Virus 2.19% extensively in recent weeks – another example of spammers VB Worm 2.19% recycling tricks from the past. AutoIt Trojan 1.97% Injector Trojan 1.94% CHEMICAL INDUSTRY TARGETED FakeAlert/Renos Rogue 1.89% A report from Symantec has detailed a recent targeted attack Crack/Keygen PU 1.86% on a number of large companies, many of which are active in the chemical industry. Cycbot Trojan 1.71% OnlineGames Trojan 1.68% Of the 48 companies known to have been targeted in the attack, 29 are active in the chemical industry. Virtumonde/Vundo Trojan 1.59% The attack began in May and was initially targeted at human Dorkbot Worm 1.57% rights-related NGOs and the motor industry. In the attack, a Hupigon Trojan 1.26% small number of employees of the targeted company receive Dropper-misc Trojan 1.17% an email which appears to be a meeting invitation from an Alureon Trojan 1.17% existing business contact. However, the email contains as its attachment a variant of the PoisonIvy trojan backdoor Slugin Virus 1.10% whose primary targets are domain administrator passwords; Crypt Trojan 1.05% using these passwords the attackers can penetrate the Ircbot Worm 1.04% network further and gain access to sensitive materials. Bifrose/Pakes Trojan 1.02% The researchers have managed to trace the attack to a Delf Trojan 0.97% US-based VPN server owned by a Chinese man. While it is unlikely that he uses this server for instant messaging as Others [2] 16.05% he claims, it is not known whether he is the sole attacker or Total 100.00% acting on behalf of a larger group. These attacks are the latest in what has become a worrying [1] Figures compiled from desktop-level detections. trend for governments and corporations alike. On the eve of [2] Readers are reminded that a complete listing is posted at the London Conference on Cyberspace, the UK government http://www.virusbtn.com/Prevalence/. said it has seen an ‘exponential rise’ in cyber attacks. NOVEMBER 2011 3 VIRUS BULLETIN www.virusbtn.com CONFERENCE REPORT VIVA BARCELONA! uninterrupted views of presenters and projector screens, the layout presented a challenge for the microphone runners Helen Martin who had to negotiate a long fl ight of steps to get from the back of the room to the front. Thankfully there were no The colourful and casualties, but the thought of rolling down the stairs head fl amboyant city of Barcelona over heels and landing in a heap at the foot of the stage has been world famous for haunted VB team members all week.

Load more