McAfee: Two Botnets Behind 97 Percent Of All Spam In Q4

Two botnets accounted for 97 percent of all spam sent in the fourth quarter of last year, according to McAfee in a new report. These are the Necurs and Gamut botnets, which are rented by spammers for sending spam, phishing emails and malware.

Necurs was the most used with a share of 60 percent, followed by Gamut with 37 percent ( pdf ). According to McAfee, Necurs is currently the largest spambot network in the world. The contaminated machines that are part of the botnet are controlled via a peer-to-peer model. In the fourth quarter of last year, the Locky ransomware and Dridex bank malware were sent via Necurs, among other things. Gamut focused more on e-mails during this period to recruit money mules and phishing e-mails.

Test: Virus Still Gives Many False Alarms

It is still common for virus scanners and security software wrongly clean consider software as malware, sometimes causing millions of users can get duped and even important files can lose. According to a test of the Austrian test lab AV-Comparatives.


According to the test lab, it is important to not only to measure the detection of malware in the testing of anti-virus software, but also the reliability. A part of the trustworthiness is dealing with clean files, and it does not give false alarms, the so-called 'false positives'. "False positives are an important yardstick for the quality of anti-virus software. A false positive notification from a customer can provide a lot of work and support to remedy the problem. Sometimes it can even lead to data loss and system inaccessible," said the test lab.

During the test from AV-Comparatives gave ESET, Microsoft Security Essentials and Panda Security no false alarms.Kaspersky Lab, Lavasoft, Tencent, Bitdefender, Emsisoft, Trend Micro, BullGuard, eScan, Avira, AVG, McAfee and Sophos was fewer than nine times the error. Fortinet, Quick Heal, F-Secure and Threat Track saw 12 to 18 clean files for malware. Avast and Baidu exciting with respectively 35 and 139 false alarms crown.

The impact varies by product. Fortinet regarded as Adobe Acrobat as malware, and Threat Track this occurs when the Symantec software. Avast see the Trend Micro software again for malware and multiple virus scanners to choke on a game.

AV-Test Lab: Linux User Without Virus

The amount of malware for Linux is still very limited, especially compared to Windows. Nevertheless, even Linux systems with malware become infected. In addition, Linux systems are often used in Windows environments and thus come into contact with Windows Malware. Astute Linux users, however, need to install a virus scanner, according to the German test lab AV-Test.

AV-Test decided 16 different security packages for Linux with both Linux and Windows Malware to test an Ubuntu system.The results are disconcerting for some products, because they are by letting 85% of the Windows Malware and up to 75% of the Malware Linux. Eight of the sixteen security suites able to detect between 99.7% and 99.9% of the 12,000 common Windows Malware. Only Symantec scores 100%. McAfee and Comodo scoring with 85.1% and 83% respectively lower.Much worse are the results from Dr. Web (67.8%), F-Prot (22.1%) and ClamAV (15.3%).

Tested for the second part of the test was 900 malware instances for Linux. Kaspersky'm here solely to detect all malware, followed by ESET with 99.7%. AVG scores 99%, followed by the server versions of Kaspersky and Avast that detect more than 98% of malware. Symantec, which identified all Windows Malware recognizes 97.2% of Linux Malware. The other products scored less well, with ClamAV, McAfee, F-Prot Comodo and finish at the bottom. The detection rates lie between 66.1% and 23%.

Linux And Malware

The question remains to what extent it is necessary for Linux users to install a virus. According to AV-Test, the number of Trojans for Linux has increased recently, but they are of poor quality. This is according to the test lab because attackers are aware of good security practices that Linux offers. There is then also especially the ignorance of users use, for example, which become infected by operational errors.

The most common way to become infected by Malware Linux is by installing software updates or via third parties, according to AV-Test. The software will ask during the installation to temporary root privileges. If the user allows this software to the system will be manipulated and attackers can install a backdoor on the system and is it part of a botnet.

According to AV-Test, most Linux users believe that they are one of the safest systems available use. "This statement is true if you only look at the system and leave the rest aside." Insecure third-party software and user errors can ultimately ensure that a Linux system, like Windows and Mac with malware gets infected.

Research by anti-virus companies shows that many infected Linux servers that are part of a botnet. Linux-based botnets often remain even longer operational because the servers do not use security software, unlike Windows Servers where this is the case. And if there is already software installed are often the wrong products. "In many Linux Forums free Comodo products, ClamAV and F-Prot be recommended to home users. This is not good advice", says AV-Test.

The test shows that home better for the free versions of Sophos or Bitdefender can choose. For server systems, there is the free scanner from AVG. ESET is as a whole out on top, followed by Symantec and Kaspersky. For servers are Kaspersky, AVG and Avast recommended.

Virus Scanner Necessary?

Or Linux Users must install a virus is ultimately to their own behavior. AV-Test says that security suites are only a second line of defense. The main security is in fact the user. Anyone who loves his system up-to-date, no unnecessary ports opens, only install software from trusted sources, prevents the browser to run active content and not open just e-mail attachments will do when it comes to Linux Malware no worries make, according to the testing lab.

McAfee Receives Award For Research Into Botnet

Anti-virus company McAfee has at the Virus Bulletin conference in Prague received an award for research into a botnet which was in collaboration with the Dutch police shut. The botnet, which Beebone, VObfus or AAEH was called, was a polymorphic botnet.


The malware that caused computers part of the botnet had been active since 2009 and spread via infected USB sticks and social engineering. In early April of this year, the botnet was the High Tech Crime Team (THTC) of the Dutch police, the FBI, Europol and security Intel Security, Kaspersky Lab and Shadow Server taken off the air.

To disable the botnet domains were all registered and seized that used the malware to communicate with infected computers. Then the investigating authorities showed these areas to the servers of Internet providers and computer emergency response teams (CERTs) by pointing all over the world, a process also known as "sink holes" is mentioned.Research showed that the malware had infected 12 000 computers.

According to McAfee cooperation between law enforcement agencies and security companies was essential to make the botnet from the air. The anti-virus company wrote a technical report (pdf) on the malware and operation of the botnet.Previously received McAfee last week at the Virus Bulletin conference Peter Szor Award. An annual prize for the best security research named after the anti-virus pioneer deceased in 2013.

Szor began twenty years ago with the analysis of malware and in 2005 wrote the book "The Art of Computer Virus Research and Defense. He worked for Symantec and F-Secure, before he went to work in 2011 at McAfee. In 2013 died he unexpectedly. "This kind of research makes everyone safer, as did the survey conducted late Peter Szor," said Martijn Grooten of Virus Bulletin.

Office Documents Favorite Target Attackers

Microsoft Office documents are the favorite target of attackers at companies and organizations know how to break or there for work, according to research (pdf) Intel Security among more than 500 IT professionals to at least one large data intrusion were given to make.

The intrusions are both performed by external attackers as their own staff. 57% of the attack was the work of external attackers. The remaining 43% came in the name of their own staff. In half of these cases, there was set-up, while in the other half of the internal incidents was unintentional. At both internal and external attackers Office documents are the favorite target, followed by .txt and .csv files.

In most cases, the stolen files contain information about customers and employees. A quarter of the data was stolen by "tunneling 'protocols such as FTP and SCP, while 40% of data thefts occurred stolen via physical media. In the latter case, thus organizations are advised to encrypt data.

Ransomware Focused Specifically On Pedophiles

The Tox-ransomware deployed published in May was initially specifically against pedophiles, know as the designer. Recently announced the author, who claims to be a student teenager, he decided to stop the development of Tox platform and offered for sale to.

Tox is a free kit to experience ransomware. Like other ransomware encrypts files and then demands ransom Tox to decrypt it.The website which is offered Tox is on the Tor network, and generating the ransomware is free. However, the automaker received 30% of the ransom was earned through the ransomware, with the remaining 70% went to the party that spread the ransomware.

The first users of Tox had to cater to pedophiles, because the simple victims. "Pedophiles were the prime target in the beginning, because it is easy to make a file that claims" hot pics "contain," the ransomwaremaker opposite Vocativ . In the first week after Tox went live, he had more than 1,000 users and infections. The maker decided to own saying stop because the business model of ransomware is contrary to his values.

McAfee: Lock Gate And Scan Zip Files Against Ransomware

Companies and organizations that want to protect themselves against ransomware are wise to block Tor and some files and staff to continuously train. This enables anti-virus company McAfee in a new quarterly report ( pdf ). In the first three months of this year the number of new ransomware variants with 165% and also for the future expected the virus fighter many new ones.

To protect themselves against ransomware can companies do take various measures. Besides making backup is recommended to block Tor. "Blocking Gate frequent the ransomware can get the RSA public key of the control server, which will block the encryption process of ransomware," the researchers said.

Furthermore, companies are advised to use a spam filter to block certain file types. Most ransomware generally starts with an e-mail containing a link or attachment. When it comes to unusual formats like .scr is it is easy to block those. In case companies do not block zip files is recommended to scan at least on two levels.

Users

Finally it is advisable to keep users continuously train. "Most ransomware attacks start with phishing emails, awareness of users is essential and necessary. For every ten emails sent to attackers statistics show that at least one will be successful," said the researchers. Which therefore advise not to open any e-mail or attachments from unknown or unverified senders.

Tox-Maker Ransomware Quits And Is Looking For Buyer

The author of the recently published Tox-ransomware, in his own words a teenager who studies, it has decided to stop offering its platform now for sale. According to the developer, he had not counted on all the attention that was his creation. Tox is a free kit to experience ransomware.

Like other ransomware encrypts files and then demands ransom Tox to decrypt it. The website which is offered Tox is on the Tor network, and generating the ransomware is free. A few days after the site went live, which was noticed by McAfee and followed a blog posting , making the fame grew. This resulted in more users and more infections with the Tox-ransomware.

According to the developer, however, it was enough and he's not a criminal. In addition, the situation would get out of hand, which he has now decided to quit. In addition, he provides the database encryption keys for sale. If no one buys the database which he will release in a month and the files of victims will be decrypted automatically. Recently decided the creator of the Locker-ransomware them to stop and automatically decrypted while all infected computers.

Lenovo Provides Free Recovery Media Without Superfish

Owners of a Lenovo laptop can now apply for recovery media to install Windows and additional software without even the Super Fish-adware is installed together, so has let the computer manufacturer on the private forum know. Super Fish is a program that intercepted SSL connections to inject ads. The adware used for this purpose its own root certificate. Researchers managed to crack the password using the private key of the Superfish certificate.

This makes it possible in certain cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed. In total Superfish appeared on more than 40 different types of laptops to be installed. Because of the Superfish debacle Lenovo announced several measures. For example, published a removal tool and put the manufacturer's promise that it will provide cleaner machines with less pre-installed software in the future. Also followed a free subscription of six months on the McAfee virus scanner.

Current owners of a laptop sit with the problem on their recovery media, such as a special recovery partition, Superfish is still present. If the computer is reinstalled using the recovery media is also Superfish replaced. Last month, Lenovo's own forum know that they worked to restore clean media without Superfish which can be requested via the support department. An employee of Lenovo claims that the recovery media will not be sent in bulk. "But if you need due to specific circumstances recovery media, please contact the service desk." Whether the media via CD or USB stick will be offered the employee does not know. We have asked for clarification about Lenovo.

Small Percentage Of Botnet Servers Hosted In Netherlands

Two years ago there was still controversy when McAfee reported that the Netherlands in the Top 3 countries stood with most botnet servers, but now the situation has changed, according to anti-virus firm Trend Micro. The virus fighter analyzed more than 3,000 servers for botnets in 2014 infected computers were aiming. It turned out that was hosted 2.6% of botnet servers in the Netherlands.

This puts the Netherlands in ninth place in the list of countries. Leader is the USA (21%), followed by the UK (9.5%) and India (6.1%). If there specifically looked at botnet servers used in targeted attacks coming Netherlands not even appear in the list.Trend Micro noted that the location of a botnet server says nothing about the country or the criminals behind the infection.

"Most botnet servers are not located in countries that are thought to shelters for his cybercrime panels. Instead, it is a reflection of the wider internet landscape where countries with an extensive infrastructure all kinds of servers hosting that are popular with cybercriminals," said the researchers

Lenovo Provides Customers With Superfish-Adware 6 Months McAfee

Customers of computer manufacturer Lenovo laptop with the Superfish-adware can receive from next week try a virus McAfee for a period of six months without charge, as the company has let know .Because of the Superfish debacle Lenovo announced several measures. Was published as a removal tool and put the manufacturer's promise that it will provide cleaner machines with less pre-installed software in the future.

In addition, the customers a free subscription offer of a half years at McAfee Live Safe. The security software can be used on multiple devices and to protect systems against malware and other online threats. Duped consumers can already download the trial version of the software, to activate it, then next week on 16 March. In case users the security itself already bought their existing subscription will be extended by six months.

In total, more than 40 different types of laptops that Superfish standard was installed qualify for the program. Super Fish is a program that intercepted SSL connections to inject ads. The adware used for this purpose its own root certificate.Researchers managed to crack the password using the private key of the Superfish certificate. This makes it possible in some cases to Man-in-the-middle attacks against systems that perform Superfish and the certificate installed.

Lenovo Will Reduce Bloatware On Computers

Lenovo is the amount of preinstalled software on computers, also called " bloatware called "reduce significantly. That leaves the company said in a response to the Superfish debacle. "The events of last week, reinforce the principle that the customer experience, security and privacy should be our top priorities. With this in mind, we will pre-installed applications will be greatly reduced."

In a press release here said Lenovo will start right away. Will be at the launch of computers running Windows 10 "standard image" for computers only contain the operating system and related software as well as software needed to make the hardware work, security and Lenovo applications. "This would be what our industry" adware "and" bloatware "calls must eliminate." In some countries will install Lenovo programs that users expect in these areas.

Furthermore, the manufacturer information about all software preinstalled and explain what each application does. In addition, it will also collect feedback from users and experts going to make sure the right applications have been installed. In addition to changing the "preloadbeleid" will provide users with a Lenovo PC also receive a free six-month subscription to McAfee Safe Live service. About this action will soon appear more details.

McAfee: POS malware can be ordered online threats jumped 197% issued report

Sellers offer BlackPOS (“Dump, CC Memory Grabber”) for purchase online.

Online marketplaces for stolen credit card numbers are thriving.

McAfee report released 2013 Q4 mobile platform malware threats jumped 197%

2013 fourth quarter, Target and other well-known retailers, consumer credit card information was leaked events, and McAfee's 2013 Q4 report that the malware used by attackers, is derived from 'cyber crime as a Service' ( Cybercrime-as-a-Service) communities.

In addition, McAfee also updated the malware data mobile platform - the company's called "Malware Zoo". Compared to last year, the situation did not diminish - soared 197%.

As ever (probably) the largest credit card information leak case together, despite its place in the point of sale POS system, but the company for the conclusion of the event, but it paints a depressing picture.

Vincent Weafer (McAfee Labs), senior vice president of McAfee Labs wrote: "What is more worrying is that the malicious software industry is how their customer service."

After buying a ready-made version of the POS network malware (Target's case, this stock is called BlackPOS), hackers also specifically modified it for their own use.

The McAfee After working with different organizations to extract and identify different data (domain name and user accounts, etc.), and returns the data to the hacker's code (as shown below).

The Target malware included hardcoded scripts to steal domain names, user accounts, and other data

Vincent Weafer added: "They even had a ready-made, highly efficient black market to sell stolen credit card information, and even includes an anonymous virtual currency payment system based POS raw materials, manufacturing, marketing, trading support - nothing is there. "

McAfee expects these stolen credit card data (reported 40 million), in Lampeduza Republic and other black market price, between one million to four million U.S. dollars.

McAfee's report, there are many noteworthy:

For example, malicious binary signature rise. McAfee said the distribution of content on the network, the "ambiguous" (dubious) more and more. CA certificate malware abuse cases are also quite common.

2013 fourth quarter, the company found that the more than 2.3 million malicious binaries signed, an increase of 52% over the third quarter. The amount of 2013 year was 5.7 million, which is already three times in 2012 and more.

McAfee wrote: "This threat is not only the proliferation of faster, are becoming increasingly complex."

As for the mobile platform, the number of malicious software also continues to climb. Total 2013 collected has reached 2.47 million, of which there are 744000 in the fourth quarter - an increase of 197 percent from a year ago.

McAfee did not pick out a platform, but given Android is already the world's most popular smartphone platform, these words are clearly not self evident.

McAfee noted that malware mobile platform, its mode of transmission and computer platforms roughly the same - be infected through the application, or web browsing. 2013, when the company tracked 200 new malware samples per minute.

Distribution, North America still "tops the list." Although the "hacker hotbed" "is on the rise in other countries and regions," but suspicious content and spam links to the United States is still "excellent."

Overall, the browser is still the most common malicious hacker attacks approaches.

This script sent credit card data to the Target attackers.

MtGox2014 Zip Contains One Malware: TibanneBackOffice.exe
MD5:c4e99fdcd40bee6eb6ce85167969348d
Virus Total Link
Detail from McAfee Report is available: Here