AV-Test Lab: Linux User Without Virus

The amount of malware for Linux is still very limited, especially compared to Windows. Nevertheless, even Linux systems with malware become infected. In addition, Linux systems are often used in Windows environments and thus come into contact with Windows Malware. Astute Linux users, however, need to install a virus scanner, according to the German test lab AV-Test.

AV-Test decided 16 different security packages for Linux with both Linux and Windows Malware to test an Ubuntu system.The results are disconcerting for some products, because they are by letting 85% of the Windows Malware and up to 75% of the Malware Linux. Eight of the sixteen security suites able to detect between 99.7% and 99.9% of the 12,000 common Windows Malware. Only Symantec scores 100%. McAfee and Comodo scoring with 85.1% and 83% respectively lower.Much worse are the results from Dr. Web (67.8%), F-Prot (22.1%) and ClamAV (15.3%).

Tested for the second part of the test was 900 malware instances for Linux. Kaspersky'm here solely to detect all malware, followed by ESET with 99.7%. AVG scores 99%, followed by the server versions of Kaspersky and Avast that detect more than 98% of malware. Symantec, which identified all Windows Malware recognizes 97.2% of Linux Malware. The other products scored less well, with ClamAV, McAfee, F-Prot Comodo and finish at the bottom. The detection rates lie between 66.1% and 23%.

Linux And Malware

The question remains to what extent it is necessary for Linux users to install a virus. According to AV-Test, the number of Trojans for Linux has increased recently, but they are of poor quality. This is according to the test lab because attackers are aware of good security practices that Linux offers. There is then also especially the ignorance of users use, for example, which become infected by operational errors.

The most common way to become infected by Malware Linux is by installing software updates or via third parties, according to AV-Test. The software will ask during the installation to temporary root privileges. If the user allows this software to the system will be manipulated and attackers can install a backdoor on the system and is it part of a botnet.

According to AV-Test, most Linux users believe that they are one of the safest systems available use. "This statement is true if you only look at the system and leave the rest aside." Insecure third-party software and user errors can ultimately ensure that a Linux system, like Windows and Mac with malware gets infected.

Research by anti-virus companies shows that many infected Linux servers that are part of a botnet. Linux-based botnets often remain even longer operational because the servers do not use security software, unlike Windows Servers where this is the case. And if there is already software installed are often the wrong products. "In many Linux Forums free Comodo products, ClamAV and F-Prot be recommended to home users. This is not good advice", says AV-Test.

The test shows that home better for the free versions of Sophos or Bitdefender can choose. For server systems, there is the free scanner from AVG. ESET is as a whole out on top, followed by Symantec and Kaspersky. For servers are Kaspersky, AVG and Avast recommended.

Virus Scanner Necessary?

Or Linux Users must install a virus is ultimately to their own behavior. AV-Test says that security suites are only a second line of defense. The main security is in fact the user. Anyone who loves his system up-to-date, no unnecessary ports opens, only install software from trusted sources, prevents the browser to run active content and not open just e-mail attachments will do when it comes to Linux Malware no worries make, according to the testing lab.

Malwarebytes Launches Free Anti-Malware Tool For Mac

Anti-virus firm Malwarebytes has launched a free tool for Mac users to malware, adware and potentially unwanted programs (PUPs) to remove it. In addition, the company also take Adware Medic of The Safe on Mac, as the virus fighter let know .

From examination of OPSWAT showed that 50% of Mac users have not installed virus scanner. According Malwarebytes this is because malware is not seen as a problem for Mac. Compared to Windows, there is much less Mac malware in circulation. These are often malware via pirated software and downloading software from untrusted sources is distributed. It is also adware and toolbars by some parties as the biggest threat are labeled for Mac users.

Something that is also reflected in the number of downloads of Adware Medic, a program to remove adware along. The software is in the first half of this year already downloaded 2.8 million times. Also from research from Google shows that adware on Windows and Mac is a problem. Nevertheless, users can also protect against here. So anti-virus company Avast suggested recently that a lot of adware and toolbars can be prevented if consumers better read and pay attention when installing software.

Thomas Reed Adware Medic, who is now at Malwarebytes will focus on the development of Mac products, says that Mac users need protection against adware, which assumes more and more the form of an epidemic. Malwarebytes Anti-Malware for Mac is available for free download and use. Later this year there are versions for SMEs and large enterprises.

TorLocker-Ransomware By Mistake Decrypt Free

For several months, a new ransomware copy active TorLocker called, but by the fault of the author shows that stocks in more than 70% of cases are free to decrypt. TorLocker , also called "scraper", was the First discovered in late October last year.

Like other forms of crypto TorLocker ransomware encrypts all kinds of files on the computer and connected network drives for ransom. This keeps the ransomware account files that are larger and smaller than 512MB. Is a file larger than 512MB, then only the first 512MB of encrypted file. Also, all system restore points are removed and the ransomware sets a background with instructions how to decrypt the files. For this, the victim, a sum of $ 300 or more payments in bitcoins.

To encrypt TorLocker makes use of AES and RSA encryption. A bug in the implementation is the encryption in more than 70% of the cases to undo without victims must pay for this, says the Russian anti-virus firm Kaspersky Lab. The virus fighter developed a free tool that allows free access to the bulk of their encrypted files can decrypt. Last year also several ransomware variants discovered which were free by a programming error to decrypt.

Kaspersky Denounces "Sensationalist Reporting" About KGB Ties

Eugene Kaspersky, founder of the Russian anti-virus company, has lashed out at a journalist from Bloomberg because of an article about alleged links between the virus fighter and Russian intelligence services. "It's a long time since I read an article from the first line felt so inaccurate," says Kaspersky.

The article by Bloomberg followed an article by Reuters , which stated that Kaspersky Lab kinds of American cyber-espionage operations would have revealed but would be reluctant to do this in Russian cyber operations. According to Kaspersky search journalists to conspiracy theories where the Kremlin is playing a role. However, the article by Bloomberg was full of false information, speculation and unfair conclusions is based on wrong facts.

"In their hunger for sensation journalists have turned things and ignored some obvious facts. Congratulations to the authors, they have scored well in bad journalism." The Russian fighter virus indicates that anti-virus company actually has unveiled espionage operations that have been attributed to Russian cyber spies. Furthermore, says Kaspersky he never worked for the KGB.

"I have studied mathematics at a school that was sponsored by the Department of Atomic Energy, the Ministry of Defence and the KBG. After I graduated, I worked for several years as a software engineer at Defence", let Kaspersky know. He also denies regular sauna visits with Russian intelligence officers. He also mentions the cooperation between Kaspersky Lab and all investigative agencies, such as Interpol and Europol.

According to Kaspersky, it is difficult for a company with Russian roots to become successful in Europe and the United States. "By default, we are trusted by no one. Our only strategy is to be 100% transparent and fair. It took years to explain who we were. Many people tried to find the" dirty laundry "and failed, because there is nothing to hide is. "

Politics

In response to the message sent by Reuters Kaspersky also been a reaction to various media. It let him know to choose a political side. "As governments and their spies treat the Internet as a battlefield, it is increasingly important for IT security to interfere in politics. There is no other way to examine all cyber threats and protect here. If you choose a side transfer your effectiveness at risk. If you ignore certain malware you are partially blind and unable to provide full protection. "

Kaspersky Would Have Hesitation About Revealing Cyber Attacks

The Russian anti-virus firm Kaspersky Lab would have hesitation about revealing two cyber attacks attributed to the Russian regime, as were sources within the company across Reuters have announced.According to founder Eugene Kaspersky, the company never asked by government to refrain from investigating a cyber attack.

The researchers would not be guided by the political interests of a country. Yet, say several current and former employees of the company Kaspersky Lab about publishing at least two alleged cyber attacks has hesitated. Kaspersky Lab as published last year under paying customers a report on a sophisticated espionage campaign that had discovered it.

The report, however, was only five months later publicly disclosed once had a British defense company about the espionage campaign published . According to the British BAE Systems were likely to be a campaign of the Russian government, which mainly computers in the Ukraine were infected. Eugene Kaspersky, however, denied that political motives played a role. "We were late," as he announced. According to the virus fighter is not possible to win everything.

Discussion

In 2013, Kaspersky Lab researchers discovered another espionage campaign called Red October , by Russian-speaking programmers would be created and focused on governmental and diplomatic organizations in Europe, Central Asia and North America. Only after a heated internal debate virus fighter still decided to publish a report on the operation. According to several current and former employees of Kaspersky Lab, who wished to remain anonymous, it was probably an operation of a Russian military intelligence.

Update

Kaspersky Lab said in a statement that the company has never doubted about publishing studies because of political reasons. "We have no political ties," said the virus fighter, who noted further with various countries and international investigative agencies to work together. In case an attack campaign is discovered the anti-virus company follows a special procedure whereby the investigative services are warned in the countries concerned, as well as partners and customers before the investigation appears.

Destover malware signed with Sony certificate

It has been discovered a new variant of the dangerous malware attackers against Sony Pictures Entertainment have deployed and those with a digital certificate of the company is signed, so let researchers know. It is the "Destover" malware, which also last year against South Korean banks and television companies was used. On infected computers malware steals data and then removes all files, making the machines currently unusable.

During the attack on Sony, the attackers have the private keys captured and published that the company used to provide files of a digital certificate. However, they can also be used to sign malware, and then be used in further attacks, let anti-virus firm Kaspersky Lab know. They discovered Destover variant was signed on 5 December. Because Sony certificates are trusted by security makes this attack effectively. The digital certificate has been revoked, let certificate authority DigiCert via Twitter know.

Security Researcher Colin Keigher leave via Twitter that this is a "joke" among security researchers. A researcher who requested anonymity had found the certificate and discovered that it was the password file. Then this investigator signed the Destover malware with the Sony certificate and uploaded it to VirusTotal, which eventually landed at Kaspersky Lab.

SONY - Malware Analysis

The malware was used recently against Sony is the same " destructive "malware that the FBI this week warned. Reported that the Japanese anti-virus company Trend Micro that a copy of the malware got hold. The main part of the malware is a collection of user names and passwords to be logged on shared network drives.

Once active users remove the malware files and files connected network drives and stops the Microsoft Exchange Information Store service. Then the malware two hour idle and then restart the system. Another part of the malware puts a .bmp file on the computer that contains the message "Hacked by #GOP". This is the same image that would have appeared on the computers from Sony. Trend Micro therefore proposes that the malware that was used against Sony.

Here is Deep Analysis of Destructive Malware By Some Security Research Companies:

Trend Mirco
Kaspersky
Symantec
BlueCoat

VirusTotal Link:
https://www.virustotal.com/en/file/4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9/analysis/1417763962/

Kaspersky - Regin Malware Copy 1999

The Russian anti-virus firm Kaspersky Lab has a copy of the advanced Regin-espionage malware found in 1999. This involves the oldest copy that is known up to now. Earlier, a specimen was labeled in 2003 as a senior. The existence of Regin was recently made ​​public by several anti-virus companies.

Regin Platform Diagram

An analyst at Kaspersky Lab named the malware even more sophisticated than Stuxnet . Yet there was also criticism of the anti-virus companies as long as they would have waited to disclose the information. The Russian anti-virus company this refers to a comparison of Sean Sullivan from F-Secure. He likened the search for Regin with the work of paleontologists who found the bones of an unknown dinosaur. Everyone has a bone, but the entire skeleton is missing.

In the case of Regin Kaspersky Lab discovered in 2012 damaged "bone" of a hitherto unknown malware. Figuring out the size of a particular campaign or espionage malware family can sometimes take months or years, the company notes. As it sometimes worked with other parties who may have other parts of the malware possession. "It makes little sense to publish your discovery until you can confirm that the samples really are big and dangerous," said the Russian anti-virus company.

Most Regin copies date from 2007, 43 pieces in total, followed by 35 copies in 2009. Kaspersky also addresses accusations that anti-virus companies, the existence of Regin would have concealed. "We have never been asked by a customer or government agency to whitelist certain malware or to pass through. We would never meet such a request, no matter who it comes from."

The Ins and Outs of ransomware

Malware researcher Bart Blaze has published an extensive article about ransomware on his blog. In the article he interviews a number of anti-malware experts who give their opinion on the current trends and the evolution of ransomware.

The following experts shared their insights:

• Malware researcher Malekal
• Adam Kujawa - Malwarebytes Head of Malware Intelligence
• Fabio Assolini - Kaspersky Senior Security Researcher
• Fabian Wosar - Emsisoft GmbH Administration / Development
• Hendrik Adrian - MalwareMustDie Security Research Group

Experts

The experts will discuss, among other things: their first acquaintance with ransomware, the psychological aspect of ransomware, how ransomware spreads, how effective it is in practice, and last but not least, how can one protect against this specific type of malware.

The experts agree on one thing: the first versions of ransomware were quite primitive but very effective. Over the years it has evolved greatly ransomware and cybercriminals are earning millions of dollars with it. The reason that this type of malware is so fast becoming popular is the fact that ransomware savings than "rogueware" (fake antivirus software), and in particular the variants encrypt files, such as Crypto Locker more money.

"Ransomware as Crypto Locker is currently more efficient than the FBI called Ransomware because almost everyone knows this form now. When the FBI was everyone thought it was legitimate, variant first spotted" explains Adam Kujawa out. "I can not give you exact percentages because I do not have it, but the golden rule is that when a particular attack vector of attack strategy is reused, meaning that the tactic is effective and therefore works. We now identify malware like Prison Locker (or Power Locker ) due to the success of Crypto Locker, just as we saw hundreds of variants and families of the FBI Ransomware in 2012. "

Recommendations

The article also contains several recommendations for both end users and companies. How can one protect against ransomware and what can one do when a computer is infected.

End users

For end users, it comes down to the following: keep all your software up to date, install an antivirus program, remove unused software (eg Java), install security add-ons such as NoScript in the browser (and update it also ), no download applications via spam or suspicious or unknown websites and make backups (and disconnect the external drive after taking the backup).

Companies

For companies, the recommendations are as follows: Use strong passwords for servers, RDP switch off if possible, use a spam filter, using group policies, limit the rights of users, instruct your users and also applies here: make backups.

Never pay

Victims of ransomware should certainly never proceed to payment. There is no guarantee that the cyber criminals the files or accessing the computer will recover. Maybe you even more vulnerable to a new attack, the cyber criminals will know after all that you will pay. By following the recommendations, however, you reduce the chance of becoming a victim already drastically.

Do you want more information, detailed advice and tips, then read the article at Blaze's Security Blog.

Connection Link Between Turla, Uroburos & Agent.BTZ

Experts from G-Data and BAE Systems recently released information about a persistent cyber espionage operation codenamed Turla (also referred to as Snake or Uroburos). Further to this, Kaspersky Lab's research and analysis team have now found an unexpected connection between Turla and an existing piece of malware known as Agent.BTZ.

The company "Kaspersky Lab" program analysed the relationship Turla, which is also known as Snake or Uroburos, with other known kibershpionami. After the release of reports on this threat a number of companies working in the field of IT security, many experts in the field were made ​​with the conclusion of the relationship Turla and other acclaimed at the time of malicious software - so-called Agent.BTZ.

In 2008 worm infected Agent.BTZ LANs Central Command of U.S. forces in the Middle East and was named the worst event in the history of U.S. military computer. According to some sources, the Pentagon has spent nearly 14 months to eliminate the effects of infection networks sun, and as a result of this incident provided the impetus for the creation of the U.S. Cyber ​​Command, U.S. Army internal divisions.

A malicious program supposedly created in 2007, contains the functionality to search and send valuable information from the infected computer to a remote control center. "Kaspersky Lab" first encountered the aforementioned malicious programs for Turla in March 2013 during an investigation of another incident involving the use of highly complex rootkit.

Map of infections caused by different modifications of “Agent.btz” in 2011-2013

Then in the course of the investigation specialists "Kaspersky Lab" found interesting facts indicating that apparently served as a model Agent.BTZ worm creators most technically advanced cyber weapons - Red October, Turla, as well as Flame and Gauss. Careful analysis showed that the creators of Red October, obviously knew about the functionality of the worm Agent.BTZ. Written by them in 2010-2011 module USB Stealer inter alia seeking and copies with USB-media archives with information accumulated worm and its log files. Turla, in turn, uses the same as Agent.BTZ, file names for logging their own actions, and the exact same key for encryption.

Finally, the program adheres Flame worm similar to file extensions and also stores the stolen information on USB-devices. Taking this into account, it can be argued that the creators of the aforementioned cyber-espionage campaigns thoroughly studied worm Agent.BTZ work and adopted the experience to develop their own malicious programs with similar goals. However, this makes it impossible to talk about a direct connection between the two groups of intruders.

 "Based on the data that we have, it is impossible to make such a statement. All information used by the developers of these malicious programs, was opened to the public for at least the time of creation and Flame Red October . were also not a secret and the names of files in which information accumulated worm from infected systems. Finally, the encryption key, which is identical in cases and Turla Agent.BTZ, was launched back in 2008. unknown, since when it has been applied in Turla. On the one hand, we found it in samples that were created in this and last year, on the other hand, there is information that Turla creation began in 2006, before the sample was found Agent.BTZ. Consequently, the question of communication development of cyber weapons is still open, "- concluded Aleks, the main anti-virus expert" Kaspersky Lab ".

Detail from Kaspersky Report is available: Here