Google And Anti-Virus Companies Warn Of uTorrent

Both Google and several anti-virus companies warn users that the popular program uTorrent is harmful.Through the software, users can exchange all types of files. UTorrent is free to use and generates revenue through advertising and bundled software.

Globally, it would be used by more than 100 million people. Several anti-virus companies but now warn of the software because the Open Candy-adware is bundled with uTorrent. Altogether now give seven different virus scanners, including ESET, Symantec and G Data, a warning, let VirusTotal see. According to TorrentFreak , it is unprecedented that so many different anti-virus companies stumble uTorrent.

Google

Google also shows users have come to warn the torrent software. Who uTorrent via download Google Chrome gets a message that the software is potentially harmful and therefore blocked. Users must then indicate themselves that they want to maintain the software to complete the download.

In addition, Chrome also allows for different websites uTorrent see a warning that the website "malicious programs".Recently, Google had already announced that it tougher against unwanted software will occur and that Chrome users will be more likely to see warnings. The warning for uTorrent is part of this, let a spokesperson.

G Data: Windows User Must Install Optional UAC Patch

Windows users would be wise to install an optional update for Windows, other malware can use a trick to get unnoticed administrator rights on the computer, so advises the German anti-virus company G Data.Following the spread of the Dridex malware.

This is a Trojan horse that recently in Belgium for major damage caused by the banking system to attack the Belgian companies use. The malware spreads via e-mail and MHTML document. This document contains a macro that attempts to download a "downloader". The downloader will place the final malware on the system. If the user macros enable the downloader is downloaded in Microsoft Office. To get administrative rights on the computer downloader tries to bypass the UAC window.

Windows User Account Control (UAC) is a security measure designed to protect computers from Microsoft as "hackers and malicious software." As software or a user wants to change some Windows settings or try to perform actions that require administrative privileges displays a UAC warning. The downloader adjusts according to G Data to a popular trick to hide the UAC warning. It uses a customized file SDB . In this case, Windows will not show because UAC window.

Microsoft has released a patch developed that allows the UAC warning is also shown in this case, but this is an optional update. "The malware creators abuse a weakness in Microsoft's operating system to be without displaying the UAC notification system. Therefore, we strongly recommend to install the Microsoft patch, Microsoft even designates it as a required patch," the German anti-virus company. In addition, users advised to not open email attachments from unknown senders and no macros enable foreign documents.

G Data: Attack Bundestag With Financial Malware

During the attack on the network of the German Bundestag last week, performed financial malware is used. This was reported by the German anti-virus company G Data that has studied the attack. At present it is not clear whether it is a new attack, or a continuation of the attacks in late May 2015 came to light.

According to the researchers there discovered the last attack of the Swatbanker banking Trojan used. This is a Trojan horse that is specifically designed to steal money from online bank accounts, although it can get other information. Research into the configuration files in the malware has made it clear that the administrators of the botnet Swatbanker between 8 and 10 June new filter functions have applied for the domain "bundestag.btg". This is the URL of the intranet of the Bundestag.

Once active malware can all data entered into forms, such as user names and passwords, as well as data from the browser to send the attackers. Swatbanker spreads through e-mails that appear to come from German banks and telecom providers."Looking at the first analyzes, it seems to be an attack with criminal intent. But we can not exclude other motives and the attackers have copied the behavior of criminals to disguise their true intentions," says Ralf Benzmüller , head of G Data Security Labs.

Connection Link Between Turla, Uroburos & Agent.BTZ

Experts from G-Data and BAE Systems recently released information about a persistent cyber espionage operation codenamed Turla (also referred to as Snake or Uroburos). Further to this, Kaspersky Lab's research and analysis team have now found an unexpected connection between Turla and an existing piece of malware known as Agent.BTZ.

The company "Kaspersky Lab" program analysed the relationship Turla, which is also known as Snake or Uroburos, with other known kibershpionami. After the release of reports on this threat a number of companies working in the field of IT security, many experts in the field were made ​​with the conclusion of the relationship Turla and other acclaimed at the time of malicious software - so-called Agent.BTZ.

In 2008 worm infected Agent.BTZ LANs Central Command of U.S. forces in the Middle East and was named the worst event in the history of U.S. military computer. According to some sources, the Pentagon has spent nearly 14 months to eliminate the effects of infection networks sun, and as a result of this incident provided the impetus for the creation of the U.S. Cyber ​​Command, U.S. Army internal divisions.

A malicious program supposedly created in 2007, contains the functionality to search and send valuable information from the infected computer to a remote control center. "Kaspersky Lab" first encountered the aforementioned malicious programs for Turla in March 2013 during an investigation of another incident involving the use of highly complex rootkit.

Map of infections caused by different modifications of “Agent.btz” in 2011-2013

Then in the course of the investigation specialists "Kaspersky Lab" found interesting facts indicating that apparently served as a model Agent.BTZ worm creators most technically advanced cyber weapons - Red October, Turla, as well as Flame and Gauss. Careful analysis showed that the creators of Red October, obviously knew about the functionality of the worm Agent.BTZ. Written by them in 2010-2011 module USB Stealer inter alia seeking and copies with USB-media archives with information accumulated worm and its log files. Turla, in turn, uses the same as Agent.BTZ, file names for logging their own actions, and the exact same key for encryption.

Finally, the program adheres Flame worm similar to file extensions and also stores the stolen information on USB-devices. Taking this into account, it can be argued that the creators of the aforementioned cyber-espionage campaigns thoroughly studied worm Agent.BTZ work and adopted the experience to develop their own malicious programs with similar goals. However, this makes it impossible to talk about a direct connection between the two groups of intruders.

 "Based on the data that we have, it is impossible to make such a statement. All information used by the developers of these malicious programs, was opened to the public for at least the time of creation and Flame Red October . were also not a secret and the names of files in which information accumulated worm from infected systems. Finally, the encryption key, which is identical in cases and Turla Agent.BTZ, was launched back in 2008. unknown, since when it has been applied in Turla. On the one hand, we found it in samples that were created in this and last year, on the other hand, there is information that Turla creation began in 2006, before the sample was found Agent.BTZ. Consequently, the question of communication development of cyber weapons is still open, "- concluded Aleks, the main anti-virus expert" Kaspersky Lab ".

Detail from Kaspersky Report is available: Here

G Data found Russian cyber weapon - rootkit Uroburos

Because of its complexity, Uroburos impossible to detect or destroy conventional methods 

Ouroboros - a classic antique symbol of the serpent devouring its own continuously tail. Like taking off her example, «Uroburos» - a new kind of malware which tends to absorb the network - in this case, perhaps as part of a spyware plan.

According to experts, the rootkit that steals confidential information used by hackers since 2011.

The specialists of the German company G Data found a new malicious program designed to steal confidential information. According to the data of professionals engaged in the development of malware Russian special services. Rootkit Uroburos got its name from a mythical dragon, as well as the sequence of characters within the code of the malware: Ur0bUr () sGotyOu #.

Uroburos steals files from infected computers and intercepts network traffic. A malicious program designed to work in P2P mode to establish communication between the infected systems. This feature allows you to remotely access the same computer with an Internet connection in order to control other PCs on a LAN.

It is interesting that in order to hide their activities rootkit uses two virtual file system - NTFS and FAT, which locally are on the infected machine. These file systems could allow attackers to be stored on the victim's PC party tools, tools for post-operation, temporary files, and binary output. Access to virtual file system can be accessed through the device: Device \ RawDisk1 and Device \ RawDisk2, as well as CDs \ \. \ Hd1 and \ \. \ Hd2.

G Data experts say: "The creation of such structures as Uroburos requires huge investments. The development team of this malware, obviously consists of highly qualified IT-specialists. Such a conclusion can be drawn by analyzing the structure and modern design of the rootkit. We believe that the developers are also improved versions Uroburos, which will appear in the future. "

Finding certain specifications (file name, encryption keys, behavior, etc.), representatives of the G Data suggested that a group of authors Uroburos intruders, which in 2008 carried out an attack on the computer systems of the U.S. with the help of malware Agent.BTZ.

Experts say that before installing the system on its victims Uroburos checks for the presence of Agent.BTZ. If present, the new rootkit remains inactive. Evidence that the creation of Russian Uroburos can stand is that in the code of the malware is present Cyrillic.

Recall that after the attack on the system Agent.BTZ United States banned the use of American military USB-drives and other removable media. While it was assumed that infection of the Ministry of Defence was through USB-drive.

According to statements made by G Data, the authors aim Uroburos are large enterprises, the state intelligence agencies and other organizations. Presumably, the rootkit has been used for three years, as the most long-standing version of the program were written in 2011.

Technical details SHA256: BF1CFC65B78F5222D35DC3BD2F0A87C9798BCE5A48348649DD271CE395656341 MD5: 320F4E6EE421C1616BD058E73CFEA282 Filesize: 210944

Detail from G Data Report is available: Here