CONTENTS in THIS ISSUE Fighting Malware and Spam
Total Page:16
File Type:pdf, Size:1020Kb
JUNE 2011 Fighting malware and spam CONTENTS IN THIS ISSUE 2 COMMENT 2128 ADDRESSES Education, education, education ‘Under IPv6, spammers could send out one piece of spam per IPv6 address, discard it and then move on to the next address for the next 10,000 years and 3 NEWS never need to re-use a previous address.’ Terry Zink explains why mail providers are not thrilled about Standalone comparatives using IPv6 to handle email. Apple adds daily defi nition checks page 4 Mobile insecurity CLASSES OF BROWSER MALWARE Aditya Sood and Richard Enbody propose a 3 VIRUS PREVALENCE TABLE taxonomy of browser malware with the aim to provide a better insight into the techniques and tactics used. FEATURES page 8 4 Digging through the problem of IPv6 and email 20 YEARS OF EICAR 8 A browser malware taxonomy Eddy Willems reports 13 New targeted attack via Google Images on some of the topics, debates and research presented 16 CONFERENCE REPORT at the EICAR 2011 conference. EICAR 2011: A 20th anniversary in Austria page 16 18 END NOTES & NEWS ISSN 1749-7027 COMMENT ‘In the fi ght While the perpetual debate about the effi cacy of user education runs on, a clear IT security policy in the against cybercrime workplace, along with guidance on how to adhere to knowledge can be such a policy, is surely one of the most basic steps an a very powerful organization can take to help safeguard its systems. Ensuring that employees understand their responsibilities weapon.’ – and that they are fully aware of the ramifi cations for any breaches of the policy – are also important factors. Helen Martin, Virus Bulletin It is unlikely that many end-users within an organization will have a direct interest in IT security, so an effective EDUCATION, EDUCATION, way to get the message across is to educate in a way that relates to their jobs and which illustrates how their EDUCATION actions can play a role in safeguarding the company’s The end of May marked my tenth anniversary as Editor assets (and ultimately their own job security). of Virus Bulletin. In some ways it seems like only Education at the IT administrator level is also important yesterday that I was cautiously taking my fi rst steps in – in the fi ght against cybercrime knowledge can be a the anti-malware industry, yet in other ways it’s hard to very powerful weapon. Learning events that provide believe that so much has changed in just a decade. There solid, meaningful content from respected industry are a couple of things that have not changed: the warmth researchers can be an excellent resource for IT security and friendliness of the members of this industry and the admins – helping them to keep up to date with emerging age-old debate over user education. issues and the latest defensive procedures. Indeed, The importance of IT security in today’s super-connected providing such an educational forum is one of the key VB world seems to become ever more apparent on almost aims of ’s one-day UK seminars (the second of which a daily basis as we hear reports of the servers of was run at the end of last month). multinational companies being hacked, personal data However, a big question mark remains over the being stolen, fi nancial losses through phishing, targeted education of the general public. One VB Seminar attacks, cyber espionage and so on. delegate asked last month: ‘What efforts are AV vendors making to provide education for the masses?’. Most (if PWC’s 2011 Global State of Information Security not all) AV fi rms make concerted efforts to raise general Survey (which questioned more than 12,000 executives awareness of the threat landscape and the need for responsible for their organization’s IT and security defensive measures. Within the industry we see frenetic investments) reported that 20% of organizations had blogging, tweeting and issuing of white papers in an suffered fi nancial losses as a result of cybercrime, 15% attempt to spread the security message, and we often see of organizations had suffered intellectual property theft, company spokespersons talking to the media when a big and 14% said that their brand or reputation had been cybercrime story breaks. But could vendors put more damaged as a direct result of cybercrime. Meanwhile, effort into providing education for the masses – to reach digital investigations fi rm Guidance Software found those who are not likely to be perusing technology blogs that an astonishing 64% of employees are given no on a regular basis and who are not inclined to follow the instruction about IT security in the workplace. latest IT security Twitter feeds? Could AV fi rms look upon education programmes for Editor: Helen Martin the general public in the same way as free products? A Technical Editor: Morton Swimmer growing number of security fi rms now provide versions Test Team Director: John Hawes of their products that are free for home use – the purpose Anti-Spam Test Director: Martijn Grooten of which is to enhance the security of the community as Security Test Engineer: Simon Bates a whole, while also benefi ting the company in question Sales Executive: Allison Sketchley by building trust in the brand name. If AV fi rms were to Web Developer: Paul Hettler invest more in education at the most basic level, fi nding Consulting Editors: Nick FitzGerald, Independent consultant, NZ ways to capture the imagination of the masses rather than Ian Whalley, IBM Research, USA sticking to their comfort zones of the online technology Richard Ford, Florida Institute of Technology, USA pages, could they both raise their own commercial profi les as well as benefi ting the community? 2 JUNE 2011 VIRUS BULLETIN www.virusbtn.com NEWS STANDALONE COMPARATIVES From this month, VB will be taking a slightly different Prevalence Table – April 2011 [1] approach to the publication of VB100 and VBSpam comparative reviews. The comparatives will henceforth be Malware Type % published as standalone articles with a publication date of Autorun Worm 9.73% the middle of the month. As with the magazine, subscribers will be notifi ed by email when the comparatives are VB Worm 7.10% available to download. This will allow more time for the Heuristic/generic Virus/worm 7.06% preparation of the reviews, the checking of results and so FakeAlert/Renos Rogue AV 6.16% on, without delaying the publication of the magazine. Sality Virus 5.28% Confi cker/Downadup Worm 5.12% APPLE ADDS DAILY DEFINITION CHECKS LNK Exploit 3.71% After a recent increase in malware targeting Mac OS X, Downloader-misc Trojan 3.47% Apple has stepped up its security offerings by adding Adware-misc Adware 2.71% functionality to its XProtect program that will check for new Zbot/Zeus Trojan 2.49% malware defi nitions on a daily basis. Ircbot Worm 2.41% The daily updating feature will be added to XProtect when the most recent security update – which adds detection Slugin Virus 2.15% for the MacDefender trojan – is applied. Until now, Apple ArchSMS/Pameseg PU 2.07% has dealt with security incidents on a case-by-case basis, BHO/Toolbar-misc Adware 1.90% pushing OS changes as and when needed to address specifi c AutoIt Trojan 1.74% issues. The new move towards automatic updates should give Mac users better protection – at least until new Mac StartPage Trojan 1.74% malware starts to appear on a more frequent basis. Heuristic/generic Trojan 1.65% Qakbot Trojan 1.63% MOBILE INSECURITY Virut Virus 1.61% Cycbot Trojan 1.50% A report compiled by McAfee and Carnegie Mellon University has revealed lax security when it comes to the WinWebSec Rogue AV 1.50% use of mobile devices in the workplace. Crypt Trojan 1.46% A survey of more than 1,500 users of mobile devices Agent Trojan 1.40% and senior IT decision-makers found that, while 95% of Iframe Exploit 1.32% organizations have a mobile security policy in place, only FakeAV-Misc Rogue AV 1.28% one in three employees are aware of such policies. Virtumonde/Vundo Trojan 1.28% The survey found that almost half of users store sensitive Dropper-misc Trojan 1.21% information on their mobile devices – whether personal or business-related – and that 40% of organizations have had Crack/Keygen PU 1.17% mobile devices lost or stolen. Almost 60% of the lost or Redirector PU 1.12% stolen devices were said to contain business-critical data. Exploit-misc Exploit 1.11% Meanwhile, four in 10 organizations allow employees to OnlineGames Trojan 1.06% access the Internet and download mobile apps freely using Ramnit Trojan 0.99% their mobile devices – a risky strategy given the potential for third-party apps to harbour malicious code. Others [2] 13.87% Some of the risks associated with the use of mobile devices Total 100.00% will be highlighted at VB2011 in Barcelona in presentations looking at Android malware (specifi cally the dangers [1] Figures compiled from desktop-level detections. associated with the Android Market and third-party apps) as [2] Readers are reminded that a complete listing is posted at well as cell phone money laundering. See http://www.virusbtn.com/Prevalence/. http://www.virusbtn.com/conference/vb2011/ for details. JUNE 2011 3 VIRUS BULLETIN www.virusbtn.com FEATURE 1 DIGGING THROUGH THE The reason there is so much rotation in IP addresses is because modern spam fi lters make use of IP blocklists. PROBLEM OF IPv6 AND EMAIL When a blocklist service detects that an IP is sending spam, Terry Zink it adds it to the blocklist and rejects all mail from it.