Avast: Attackers CCleaner Also Wanted To Install keylogger

The attackers who hacked software company Piriform last year and added a backdoor to the popular CCleaner tool were also likely to install a keylogger on infected systems, according to anti-virus company Avast , which is the owner of CCleaner.

Last September, Avast announced that attackers had hacked CCleaner developer Piriform and added malware to the official version. This infected version was downloaded by 2.27 million users. The malware was added to the Piriform development platform between 11 March and 4 July 2017. The software company was acquired by Avast two weeks later on 18 July.

The first phase of the malware was to gather information about CCleaner users, such as the name of the computer, installed software and active processes. The second phase consisted of downloading additional malware. However, this was done with a select number of machines. Eventually, 40 computers received this additional malware. These included systems from major tech companies such as Intel, Samsung, Sony, Asus, NEC and the South Korean telecom provider Chunghwa Telecom.

There is no evidence that a third step has been carried out, but Avast has now found information indicating that it may have been planned. During the investigation into the hacked Piriform infrastructure, early versions of the first and second phase of the malware were discovered, as well as a tool called ShadowPad. ShadowPad is used by cyber criminals to control computers remotely. The tool was installed on four Piriform computers on April 12, while the second phase of the malware was already installed on March 12.

The older version of the second phase malware connected to a command & control server. The servers were no longer active at the time Avast analyzed the computers, so it is unknown what was downloaded, but given the time window it was probably ShadowPad. The Avast researchers also discovered ShadowPad log files with keystrokes from a keylogger installed on the computers. The keylogger had been active since 12 April and had stored keystrokes of all kinds of programs. The encountered version of ShadowPad appeared to have been specially made. Avast thinks that the attackers who had adapted especially for Piriform.

In addition to the keylogger, the attackers also installed a password builder and tools to install other software. According to Avast, there are no indications that ShadowPad is installed on the computers of CCleaner users. The virus fighter does state that it was the third phase of the attack. It is not known whether the attackers wanted to install the keylogger on all 40 attacked computers in the second phase, or just a few or not at all, this is still in under investigation.

Google Play Protect Stops Less Malware Than Anti-Virus Apps

The security software that protects Google Android devices against malware performs worse than anti-virus apps, according to a test of the German test lab AV-Test. In July , Google launched " Play Protect", security software that checks apps that users want to download and install scans malware and periodically checks the device on malware. Play Protect is present on all Android devices with Google Play.

AV-Test has been comparing several mobile virus scanners for a long time, but also included Play Protect in the September test. For the test, 20 different Android virus scanners and Play Protect were tested with nearly 6000 infected apps. It involved detection of 3000 contaminated apps in real time and detection of 2900 infected Android apps found in the last four weeks of the test.

On average, the tested programs detect 95.7 percent and 98.4 percent of the infected apps. Antiy, Bitdefender, Cheetah Mobile, Sophos, Symantec and Trend Micro score 100 percent in both detection tests. Google Play Protect ends at the bottom. During the real-time detection of apps, Play Protect detected 65.8 percent of malicious apps. Of the malicious apps found in the four weeks before the test, Play Protect detected 79.2 percent.

In total, the virus scanners could collect 13 points. Six points were achieved for detecting malicious apps. The same number of points were divided for usability, such as battery usage, system load, high data traffic, and the unreasonable alert of Google Play clean apps and other official marketplaces. Finally, there was one point to earn for additional security measures, such as anti-theft, encryption and backup.

To achieve six points in detecting Android malware, it was not necessary to score 100 percent. Therefore, ultimately, AhnLab, Antiy, Bitdefender, Cheetah Mobile, G Data, Kaspersky Lab, McAfee Symantec, Tencent and Trend Micro can reach the maximum 13 points. Google Play Protect was evaluated only on malware detection. Due to the low detection score, the software receives zero points. Of the anti-virus applications tested on all components, NSHC and F-Secure end with 9 and 9.5 points, respectively, below.

Kickstarter For Wi-Fi Router With VPN And Anti-Virus

On Kickstarter is a crowdfunding campaign started for the Veil Tower, a Wi-Fi router with VPN and anti-virus. The developers hope in this way to win a sum of $ 250,000. The Veil Tower was developed by the American Veil Systems in Detroit.

The device uses open source software, proprietary software and software developed by others. According to the developers, it was impossible and unwise to independently develop all features. For devices that connect to the Veil Tower will automatically use a VPN connection. Furthermore, the device has a network-based anti-virus solution and the router can be managed via an app.

Of the proposed $ 250,000 is still a month to go a little over $ 4,000 raised. The money raised will be used for the production. If everything goes according to plan the Veil Tower will be delivered in the second quarter of 2016. The Wi-Fi router will cost $ 199, as much as the OnHub router Google.

Durka Malicious App: Apps On Google Play Store Infect Millions With Adware

Researchers have found several apps on Google Play that occur as games, but found to contain a million times and downloaded in reality adware. Some of the apps, including the card game Durka, activate the existing adware only after 30 days.

The adware ensures that when users unlock their device, they get a warning that their device is infected or outdated or full porn state. Then you will be asked to take action. If users are being redirected to come dubious apps and app stores herein secretly send text messages or collect all sorts of personal information. In some cases, users refer to security apps on Google Play.

Anti-virus company Avast thinks the adware distributors get paid for generating traffic to the apps and app stores. "Most people will not find out the cause of the problem and will have to deal with every time ads as they unlock their device," says analyst Filip Chytry. He thinks that most people end up trusting the solution offered, which can lead to more unwanted apps or costs. Besides Durka also involves an IQ test app and an app on the history of Russia. The apps are downloaded together between 5 million and 10 million times.

Hashes:

BDFBF9DE49E71331FFDFD04839B2B0810802F8C8BB9BE93B5A7E370958762836 

9502DFC2D14C962CF1A1A9CDF01BD56416E60DAFC088BC54C177096D033410ED 

FCF88C8268A7AC97BF10C323EB2828E2025FEEA13CDC6554770E7591CDED462D

SONY - Malware Analysis

The malware was used recently against Sony is the same " destructive "malware that the FBI this week warned. Reported that the Japanese anti-virus company Trend Micro that a copy of the malware got hold. The main part of the malware is a collection of user names and passwords to be logged on shared network drives.

Once active users remove the malware files and files connected network drives and stops the Microsoft Exchange Information Store service. Then the malware two hour idle and then restart the system. Another part of the malware puts a .bmp file on the computer that contains the message "Hacked by #GOP". This is the same image that would have appeared on the computers from Sony. Trend Micro therefore proposes that the malware that was used against Sony.

Here is Deep Analysis of Destructive Malware By Some Security Research Companies:

Trend Mirco
Kaspersky
Symantec
BlueCoat

VirusTotal Link:
https://www.virustotal.com/en/file/4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9/analysis/1417763962/

The Ins and Outs of ransomware

Malware researcher Bart Blaze has published an extensive article about ransomware on his blog. In the article he interviews a number of anti-malware experts who give their opinion on the current trends and the evolution of ransomware.

The following experts shared their insights:

• Malware researcher Malekal
• Adam Kujawa - Malwarebytes Head of Malware Intelligence
• Fabio Assolini - Kaspersky Senior Security Researcher
• Fabian Wosar - Emsisoft GmbH Administration / Development
• Hendrik Adrian - MalwareMustDie Security Research Group

Experts

The experts will discuss, among other things: their first acquaintance with ransomware, the psychological aspect of ransomware, how ransomware spreads, how effective it is in practice, and last but not least, how can one protect against this specific type of malware.

The experts agree on one thing: the first versions of ransomware were quite primitive but very effective. Over the years it has evolved greatly ransomware and cybercriminals are earning millions of dollars with it. The reason that this type of malware is so fast becoming popular is the fact that ransomware savings than "rogueware" (fake antivirus software), and in particular the variants encrypt files, such as Crypto Locker more money.

"Ransomware as Crypto Locker is currently more efficient than the FBI called Ransomware because almost everyone knows this form now. When the FBI was everyone thought it was legitimate, variant first spotted" explains Adam Kujawa out. "I can not give you exact percentages because I do not have it, but the golden rule is that when a particular attack vector of attack strategy is reused, meaning that the tactic is effective and therefore works. We now identify malware like Prison Locker (or Power Locker ) due to the success of Crypto Locker, just as we saw hundreds of variants and families of the FBI Ransomware in 2012. "

Recommendations

The article also contains several recommendations for both end users and companies. How can one protect against ransomware and what can one do when a computer is infected.

End users

For end users, it comes down to the following: keep all your software up to date, install an antivirus program, remove unused software (eg Java), install security add-ons such as NoScript in the browser (and update it also ), no download applications via spam or suspicious or unknown websites and make backups (and disconnect the external drive after taking the backup).

Companies

For companies, the recommendations are as follows: Use strong passwords for servers, RDP switch off if possible, use a spam filter, using group policies, limit the rights of users, instruct your users and also applies here: make backups.

Never pay

Victims of ransomware should certainly never proceed to payment. There is no guarantee that the cyber criminals the files or accessing the computer will recover. Maybe you even more vulnerable to a new attack, the cyber criminals will know after all that you will pay. By following the recommendations, however, you reduce the chance of becoming a victim already drastically.

Do you want more information, detailed advice and tips, then read the article at Blaze's Security Blog.