Mozilla: Many Popular Websites With Symantec Certificates

There are still many popular websites with Symantec certificates that will soon no longer be trusted by Firefox and will cause an error message, as Mozilla has warned. It is about 1 percent of the Top 1 million most popular websites on the internet, which amounts to about 10,000 sites.

These websites use a tls certificate issued by Symantec to encrypt traffic to and from their visitors. Due to various incidents with tls certificates issued by Symantec, browser developers have decided to cancel the trust in Symantec certificates. This will take place in phases, with all Symantec certificates issued before 1 July 2016 no longer being trusted.

Google will implement this measure next month with the launch of Chrome 66. Mozilla will follow Firefox 9 on May 9. With the launch of Firefox 63 in October this year, trust in all Symantec certificates will be canceled regardless of issue date. Users who receive a certificate warning when visiting a website can ignore them and still reach the website, Mozilla explains, but security experts advise internet users never to ignore such warnings and not to visit the website in question.

Conficker Worm Still Active On 150,000 Computers After 9 Years

The Conficker worm that infected nine million computers at its peak has been operating on 150,000 computers since its first appearance on 21 November 2008, anti-virus company Trend Micro said. Conficker is distributed in a variety of ways, including a vulnerability in the Windows Server service, shared network folders, and the Autorun feature of Windows.

The vulnerability in the Windows Server service was patched by Microsoft on October 23, 2008. In January 2009, Conficker also started distributing itself through the Autorun feature of Windows, something for which Microsoft released an update in February 2011. According to Trend Micro, Conficker is mainly active in China, Brazil and India. These three countries together account for more than half of all infections. Most infections were found in government systems, followed by production companies and health care.

After an infection, Conficker tries to connect every day with all kinds of domains to see if there are new instructions from the makers. ICANN, the organization that is responsible for the distribution of ip numbers and domains, has, however, taken measures so that these domains can not be registered. Thus, the infected computers can not be used for criminal purposes.

According to Trend Micro, Conficker can also be labeled as "background malware" that is mainly active on legacy systems. "Although it is not as interesting to the general public as more modern malware such as WannaCry and Petya, it remains a persistent threat and will remain so as long as unsupported, unpatched legacy systems are still part of corporate networks," says researcher the virus fighter .

Test: Ten Tested Virus Scanners For MacOS

German test lab AV-Test has a new test virus put online, this time for anti-virus software for MacOS looked. The amount of new malware for MacOS is not commensurate with those for Windows. However, last year there was an increase in visible , of 819 new units in 2015 to 3033 in 2016.

Most infections MacOS is still doing for social engineering, in which users are tricked into installing malware, although some cases are known where attackers managed to add malware to legitimate programs. That there is little malware for MacOS in circulation is evident from the number of copies that malware-AV-Test used for the test. The lab works on Windows with tens of thousands of malware specimens. 184 specimens were used for the test with Mac malware.

Four products (Bitdefender, Intego, Symantec and Kaspersky Lab) were able to detect all malware instances. MacKeeper ends with a score of 85.9 percent down. Besides the detection was also the tax system looked when copying files. Then put Canimaan Software and MacKeeper down the best performance, followed by Kaspersky Lab and Symantec with one second difference. Intego slows the most systems. Finally, we looked at the false positives. In this case considers a virus if infected legitimate, clean files. During this test item was no virus in error.

Google Punishes Symantec Because Tampering With SSL Certificates

Google has punished Symantec because the company has tampered with SSL certificates, which are just as important for the trust on the Internet. In September, Google discovered that Symantec wrongly an Extended Validation (EV) pre-certificate for google.com and www.google.com had spent.

This was done without Google had asked whether there had consented to do so. Besides security, Symantec also provides SSL certificates provided for identifying web sites and encrypting traffic between websites and visitors. To do this it has several brands, such as VeriSign, GeoTrust, Thawte and RapidSSL. For several years, Symantec is the largest player in the market for SSL certificates. Because of the improper issuance of the certificates, Symantec chose to several workers dismiss.

Also asked Google for a research report. The report (pdf) revealed that 23 test certificates from five organizations without their knowledge were issued, including for domains from Google and Opera. Google has discovered even more dubious certificates Symantec and asked for clarification. Symantec again carried out a research and found that there were a further 164 certificates issued for 76 domains, as well as 2458 certificates for domains that are never registered.

Actions

According to Google, it is worrying that a certification authority has so many problems and the magnitude could not even determine during the first investigation. Therefore, Google will stricter demands on the Symantec certificate. As of June 1, 2016 must support all of the security certificates Certificate Transparency. This is a proprietary technology that Google must address several structural flaws in the SSL certificate system. Certificates issued after this date and do not meet here can cause problems within Google products.

Furthermore, Google will ask the public research report on the incident will be expanded with an analysis of why the 164 additional certificates were not found in the first place and what was the cause of any failure. Furthermore, Google also wants a detailed report on the measures that Symantec will take to correct the errors found and to prevent future. Finally, the security company should also have a comprehensive audit carried out by a third party.

MySQL Servers Used For DDoS Attacks

A group of criminals infects MySQL servers with malware and then let them carry out DDoS attacks. It reports the American security company Symantec in a blog posting.

To hijack the servers, the attackers use a "user-defined function" (UDF). It is in this case to code that can be invoked from within MySQL to provide features which can not offer the database management system. Its use to access MySQL servers is not new and was already discussed in 2005. In this case, the attackers use a UDF to install Chikdos malware on the server. This malware, in late 2013 already in the news.

At the latest campaign attackers Symantec may use an automated scanner or a worm to compromise the MySQL servers and install a UDF. However, the exact method of infection has not been identified. Once the servers are infected, they download a DDoS tool for executing DDoS attacks on websites.

To get around this kind of attack, administrators advised not to run with administrative rights to the SQL server. The SQL server must be patched regularly, and must be safe programming SQL Injection can be prevented. Furthermore, administrators can check for the presence of new user accounts and ensure that remote management is configured securely.

Downloader.Chikdos hashes

4c3750006f7b2c19dcddc79914ef61e0
4e4b5502bd47cf6a107793712f14a78f
bb875b959263cd5b271c78a83c718b04

Trojan.Chikdos.A hashes

d0ffdc99d282d81afa828ad418f4301e
1d0c7d3484cf98b68ad6a233e3529ebe

Makers Benign Router-Malware Publish Source Code

The creators of the benign malware routers, IP cameras and other Internet devices infects, and then secures the source code of their creation have been released and explained their motives. The malware came last week in the news and was released by security company Symantec Wifatch mentioned.

Last year, another researcher had already discovered the malware, which gave it the name ifwatch. The malware spreads via Telnet and uses weak passwords. Once active Wifatch disable the Telnet daemon, so that other attackers can not access anymore. The malware also leave a message for the owner behind to change the password, disable Telnet and update the firmware. Wifatch also has a module to remove other malware on the device.

After Symantec made ​​a blog posting on the malware creators published on Gitlab the source code, including their motivation. They also decided to Symantec approach. She says she developed the malware to learn from it and the project has no malicious intent. The authors regret that she unsolicited infect the machines of others, but argue that the benefits outweigh the disadvantages.

This relates to the amount saved bandwidth for other malware, the routers can use to scan ports or devices, power conservation because malware installed bitcoin miners are removed, any failures and reboots that are prevented by the routers and devices do not overheat and all passwords and money that criminals do not have to steal.

With regard to the source code is now published which partially complete. The part that creates is in fact removed before the infection, as well as the code for creating the malware. This should prevent others can use it, even though the makers warn that sensitive devices can be accessed via Telnet with a default password can be acquired by anyone. Even if they do not have the Wifatch malware.

AV-Test Lab: Linux User Without Virus

The amount of malware for Linux is still very limited, especially compared to Windows. Nevertheless, even Linux systems with malware become infected. In addition, Linux systems are often used in Windows environments and thus come into contact with Windows Malware. Astute Linux users, however, need to install a virus scanner, according to the German test lab AV-Test.

AV-Test decided 16 different security packages for Linux with both Linux and Windows Malware to test an Ubuntu system.The results are disconcerting for some products, because they are by letting 85% of the Windows Malware and up to 75% of the Malware Linux. Eight of the sixteen security suites able to detect between 99.7% and 99.9% of the 12,000 common Windows Malware. Only Symantec scores 100%. McAfee and Comodo scoring with 85.1% and 83% respectively lower.Much worse are the results from Dr. Web (67.8%), F-Prot (22.1%) and ClamAV (15.3%).

Tested for the second part of the test was 900 malware instances for Linux. Kaspersky'm here solely to detect all malware, followed by ESET with 99.7%. AVG scores 99%, followed by the server versions of Kaspersky and Avast that detect more than 98% of malware. Symantec, which identified all Windows Malware recognizes 97.2% of Linux Malware. The other products scored less well, with ClamAV, McAfee, F-Prot Comodo and finish at the bottom. The detection rates lie between 66.1% and 23%.

Linux And Malware

The question remains to what extent it is necessary for Linux users to install a virus. According to AV-Test, the number of Trojans for Linux has increased recently, but they are of poor quality. This is according to the test lab because attackers are aware of good security practices that Linux offers. There is then also especially the ignorance of users use, for example, which become infected by operational errors.

The most common way to become infected by Malware Linux is by installing software updates or via third parties, according to AV-Test. The software will ask during the installation to temporary root privileges. If the user allows this software to the system will be manipulated and attackers can install a backdoor on the system and is it part of a botnet.

According to AV-Test, most Linux users believe that they are one of the safest systems available use. "This statement is true if you only look at the system and leave the rest aside." Insecure third-party software and user errors can ultimately ensure that a Linux system, like Windows and Mac with malware gets infected.

Research by anti-virus companies shows that many infected Linux servers that are part of a botnet. Linux-based botnets often remain even longer operational because the servers do not use security software, unlike Windows Servers where this is the case. And if there is already software installed are often the wrong products. "In many Linux Forums free Comodo products, ClamAV and F-Prot be recommended to home users. This is not good advice", says AV-Test.

The test shows that home better for the free versions of Sophos or Bitdefender can choose. For server systems, there is the free scanner from AVG. ESET is as a whole out on top, followed by Symantec and Kaspersky. For servers are Kaspersky, AVG and Avast recommended.

Virus Scanner Necessary?

Or Linux Users must install a virus is ultimately to their own behavior. AV-Test says that security suites are only a second line of defense. The main security is in fact the user. Anyone who loves his system up-to-date, no unnecessary ports opens, only install software from trusted sources, prevents the browser to run active content and not open just e-mail attachments will do when it comes to Linux Malware no worries make, according to the testing lab.

Helpful Malware Infected And Secure Routers

Researchers have developed a kind of "helpful" discovered malware that infects Internet routers and IoT devices, and then secure the devices and to remove any existing malware. The malware by security firm Symantec Wifatch called and last year was already discovered by another researcher, who gave the name ifwatch gave.

The malware spreads probably via Telnet and uses weak passwords. Once active, the routers and other devices part of a peer-to-peer network to exchange threat information. Furthermore Wifatch disable the Telnet daemon, so that other attackers can not gain access. The malware also leave a message for the owner behind to change the password, disable Telnet and update the firmware. Wifatch also has a module to remove malware infections on the unit.

Despite the actions that Symantec designates Wifatch executes the program so as malware, partly because it contains a number of general backdoors that the creator can access. The backdoors do require a digital signature, so others can not use.Symantec may be tens of thousands of devices with malware infected, most of them in China and Brazil. Owners of an infected router to remove Wifatch can easily do this by resetting the device.

Kaspersky: Angry Ex-Employees Behind Bogus

Yesterday Reuters with a story that Russian anti-virus firm Kaspersky Lab competitors like AVG, Avast and Microsoft did years sabotaged, but according to founder Eugene Kaspersky and the anti-virus company is a nonsense story from angry ex-employees.

The story would have provided the anti-virus company legitimate files from malicious code. These files are then uploaded to the VirusTotal website and shared with other anti-virus companies. VirusTotal is a website where Internet files can be scanned dozens of virus scanners. Uploaded files are shared with participating anti-virus companies. By uploading the files sabotaged legitimate files the virus of anti-virus companies would therefore be regarded as malware.

Kaspersky Lab that the statements are unfounded and untrue and made ​​by angry ex-employees. The anti-virus company shares data correctly with other parties. "Although the security market is very competitive, is the exchange of threat data is an important component of the security of the entire IT ecosystem and we work hard to ensure that this exchange does not jeopardize or sabotaged."

Experiment

Well carried out the anti-virus company in 2009 and 2010, two experiments in which clean files to VirusTotal were sent and Kaspersky Lab files considered intentional malware. A few months later found several other scanners on VirusTotal that the files were infected, even though that was not the case. Kaspersky Lab made ​​the investigation public . In their own words to indicate that the problems with the testing of malware.

Ex-employees

On his own blog is Eugene Kaspersky also on the story and denounces in particular the use of anonymous sources. "Angry ex-employees often say nasty things about their former employer, but in this case the lies are simply ridiculous." According to Kaspersky, the resources possible to convince the journalist of Reuters know, but the story is ultimately published without any evidence. "I therefore ask myself what these ex-workers' media tell us about the next time and who believe their bullshit then."

In the blog posting Kaspersky also discusses the problem with false positives. In 2012 and 2013 had anti-virus companies many problems with false positives. An attacker provided legitimate software from malicious code and spread it. Both Kaspersky Lab and other antivirus companies were targeted. There was then a meeting behind closed doors, where there is information about the attacks was exchanged. This also was the suggestion suggested that another anti-virus company possible was behind the attacks. Symantec confirms the story and says that Kaspersky Lab, in any case, none of the suspects.

Cyber ​​Spies Added Linux Support To Allow Malware

A group of cyber spies who is held responsible for attacks on the Belgian government , the White House and a variety of other businesses , government agencies and institutions in Europe and the United States has developed new malware that also features Linux support.

The group is "Duke" and has been active for several years. Recently, a new instance of malware from the group discovered called "Seaduke". It is a Trojan designed to steal information and will be used against a small number of valuable objectives.According to both Symantec and Palo Alto Networks involves highly sophisticated malware.

Linux

Finland's F-Secure analyzed the malware and also saw that the Trojan is written in Python and supports both Windows and Linux. According to the virus fighter Seaduke is the first "cross-platform" malware of the Duke group. The first thing is to use the popular scripting language Python. Earlier malware cyber spies were written in the programming languages ​​C and C ++. In addition, the Python code for both Windows and Linux proves to be developed. "We therefore suspect that the Duke group same Python code Seaduke used to attack Linux users," says researcher Artturi Lehtiö.

Lehtiö leaves in front Security.NL know that there are no attacks against Linux users in the "wild" are found. "But it is safe to assume that they have added Linux support to the use," he notes. The question remains how Linux users would be attacked.The Duke group, for example, used a funny movie monkeys to attack Windows users, which in reality was an exe file. There are PDF documents containing exploits for vulnerabilities in Adobe Reader used to infect computers with malware.

Adding Linux support to malware is not new. Earlier this year it was discovered another group of cyber spies who had done this. The group decided to use social engineering to infect Linux users. Attacked users received a rogue HTML5 plugin offered which turned out to be in reality spyware.

Google And Anti-Virus Companies Warn Of uTorrent

Both Google and several anti-virus companies warn users that the popular program uTorrent is harmful.Through the software, users can exchange all types of files. UTorrent is free to use and generates revenue through advertising and bundled software.

Globally, it would be used by more than 100 million people. Several anti-virus companies but now warn of the software because the Open Candy-adware is bundled with uTorrent. Altogether now give seven different virus scanners, including ESET, Symantec and G Data, a warning, let VirusTotal see. According to TorrentFreak , it is unprecedented that so many different anti-virus companies stumble uTorrent.

Google

Google also shows users have come to warn the torrent software. Who uTorrent via download Google Chrome gets a message that the software is potentially harmful and therefore blocked. Users must then indicate themselves that they want to maintain the software to complete the download.

In addition, Chrome also allows for different websites uTorrent see a warning that the website "malicious programs".Recently, Google had already announced that it tougher against unwanted software will occur and that Chrome users will be more likely to see warnings. The warning for uTorrent is part of this, let a spokesperson.

Hacking Team Had Zero Day Vulnerabilities For Windows And Flash

The Italian developer of government spyware Hacking Team had zero day vulnerabilities for Windows and Adobe Flash Player, according to the files that were stolen from the company. Yesterday published attackers a file of about 400GB with all sorts of information that was captured by Hacking Team.

The files have now discovered two vulnerabilities for which no security update available yet, says security researcher The Grugq . It is a vulnerability in Windows that allows an attacker can increase his rights on the system. In this case, the attacker must already have access to the computer in order to use the leak. The second vulnerability is in Adobe Flash Player. Through this vulnerability, an attacker computers or completely take over, for example, when users visit a hacked or malicious website.

The embedded Flash Player in Google Chrome is vulnerable. According to security researcher Kevin Beaumont makes the leak is possible to escape from the sandbox of Chrome. Researcher Rik van Duijn of security Dear Bytes however, leaves know that a sandbox escape "through the published code is not possible and therefore a second exploit is required. Hacking Team, which develops spyware for government agencies, has in statement confirming that it has been hacked. "We think there are documents of the company have been stolen. We have launched an investigation to determine the extent of the attack and to determine what exactly is captured," said a spokesman. The company's website has been offline since yesterday.

Update

The National Cyber ​​Security Center (NCSC) government has a warning issued for the flaw in Flash Player. Through the leak, an attacker execute arbitrary code on the computer with the rights of the logged in user. The NCSC states that there is no update available for the leak yet.

Update 13:48

The attack on Hacking Team is claimed by the hacker who last year by spyware developer Gamma International managed to break in and there gigabytes of data was captured, says Vice Magazine . The hacker says soon come up with the details of how he managed to break into Hacking Team.

Update 15:09

Anti-virus company Symantec confirms that this is a zero-day vulnerability in the latest version of Flash Player. The virus firefighter expects that attackers will probably make use of the vulnerability.

Update 15:19

The CERT Coordination Center (CERT / CC) at Carnegie Mellon University warns also the vulnerability and says that users can protect themselves by installing Microsoft EMET unreliable or not Flash content to perform.

Registry Malware Infecting Nearly 200,000 Computers

Malware that only in the Windows Registry is hiding in order to avoid detection and removal has in recent months nearly 200,000 infected computers. It is the Poweliks malware that infected computers used for click fraud and even a zero-day vulnerability in Windows applied to take over a computer completely.Once active Poweliks will first check whether Windows PowerShell is present.

This is a scripting language that allows system administrators to automate many tasks. It is present by default in Windows 7 and can also be installed on other versions of Windows. In case PowerShell is not present is downloaded and installed. Power Shell will later be used to conduct an encoded script file.

This script file contains malware, and makes it possible to download and install additional malware. Then, a key in the Windows Registry created so that the malware is also loaded at the next reboot of the system. By not using a file, like most malware does, but who are completely in the Windows Registry to hide would be more difficult to detect and remove Poweliks.

Ransomware

The malware aims to commit click fraud, where there are visited all kinds of pages that contain advertisements via a hidden browser window. The criminals are paid for every ad displayed. One problem for victims of Poweliks is that the ads displayed itself may be malicious. Poweliks infected with a computer can therefore become infected with a variety of other threats, including ransomware.

According to anti-virus company Symantec , a report ( pdf ) published on the malware, there are many cases in which there was downloaded ransomware through the ads displayed. Remarkably, the malware is active mainly in the United States. Of the 198,500 infected computers showed that 99.5% were in the US. However, that does not mean that users in other countries are not at risk. The virus fighter says that Poweliks shows what future threats may do, with cyber criminals are even more determined to make money from their creations.

Porn Site Spreads Malicious iOS App Beyond App Store

Owners of both jailbroken and non-jailbroken iPhones are the target of a malicious app distributed on a porn site. The app would be needed for supposedly watching a porn video. After installation, the user is, however, a message that he became a member of the porn site and now have to pay 700 euro or 2100 euro after three days.

To install the app do the scammers may use the Apple Developer Enterprise Program. Through this way it is possible to apps outside the Apple App Store to install. This program costs $ 299 per year and is primarily intended for companies that want to install self-developed applications on the phones of employees. Now it seems that scammers use this way of spreading their fraudulent app.

Before the installation begins, however, the user gets a message that it is an app from an untrusted developer. If the user then chooses the developer still trust the app is installed. Next, the app shows a membership page of the porn site and, after some time that the user has subscribed and to pay now.

For now, the scam would only be directed against Japanese users and there is also an Android variant in circulation.Symantec warns users not to pay the money and remove the app. In addition, Apple has been informed that the developer certificate that the app is signed can be revoked.

Ransomware Maker Decrypts As Promised Infected PCs

The creator of the Locker-ransomware has promised as encrypted files on all computers he infected without charge and automatically decrypted. The ransomware had for some time on computers running before it on May 25 suddenly proceeded to encrypt files.

At various forums complained large numbers of users that their files were encrypted suddenly. Unlike other ransomware variants, which require hundreds of dollars, Locker asked a sum of 22 euros for decrypting the files. Rich is the author therefore did not become. According to Symantec, he would total 152 euros received 22 victims.

Last week the ransomware maker on Pastebin posted a message in which he regret expressed. It was at its say never been his intention to spread the ransomware. He compiled a file with all the encryption keys available and stated that on June 2, all remaining infected computers would be automatically decrypted. And the author has fulfilled that promise, reports Bleeping Computer . For users that their computer had been disinfected, there is a unlocker tool made ​​available. How to distribute the ransomware is managed is still unknown.

Infected Version Of PuTTY Steals Passwords

Cyber criminals are spreading on the Internet an infectious variant of the popular SSH client PuTTY, which is designed to steal passwords. PuTTY is a free open source terminal emulator application as a client for SSH, Telnet, rlogin, and raw TCP protocols can serve.

The now discovered version is not on the official PuTTY download site spreads, but via a hacked another page. The infected version would have been the end of 2013 and then already been distributed over the Internet. Recently, anti-virus company Symantec observed more infections. The infection starts with a user searching through a search engine to PuTTY.

Instead of choosing the official website, the user selects a hacked website. The hacked website sends the user several times and let him finally downloading an infected version. When the user logs in via the infected version on a system, the login information can be sent to the attacker. Users also are advised to check that they only download software from the official website of the supplier or developer.

Malware Knew Hard Drive As Copy Protection

In early May there was some fuss about a new malware specimen called Rombertik that analysis, the Master Boot Record (MBR) erased from the hard disk and partition with null bytes' wrote about so that all available data was lost. Initially it was thought that it was a measure to thwart security researchers, but according to Symantec, it is a copy.

Rombertik is a new variant of the Carbon FormGrabber, also known as Carbon Grabber. It is a malware kit that is offered on the black market and is intended for cyber criminals who are unable to write their own malware. To combat illegal use of the malware creators have added a copy protection, so that their creation has not been without a valid license to use. Each version of Rombertik's made for a specific user and licensed. The malware connects to a predefined Command & Control server.

An illegal user could change the address of the server, so the malware makes to another address and link it sends the stolen data to. To prevent this, after the change of address copy protection are active. In addition, the malware also shows a message to the software pirate that the squat attempt failed. Symantec concludes therefore that it is not a measure to thwart investigators, but to punish freeloaders who think they can use the malware free.

Free Virus Scanners Convince On Mac OS X

Mac OS X has to do with much less malware than Windows, most recently in a report revealed by the Finnish anti-virus firm F-Secure. Yet there are also threats to Apple's operating system, which mainly via pirated software and downloading software from the wrong source managed to spread. The reason for the German testing body AV-Test to test ten paid and free virus for OS X.

"Criminals are always looking for groups that are worthy to steal. The now become big group of Mac users is a good target," said Maik Morgenstern of AV-Test. For the test, we looked at various components such as malware detection, false positives, tax system and features. The detection test worked with an "on-demand" scan and an "on-access" scanning. For these two tests were used in a total of 244 malware instances.

Average know the scanners to detect 91% of malware. This percentage is mainly due ClamXav brought down, which scored 36.6% and 54.7% respectively. The other virus scanners are above 88%, with Avira and Symantec both tests score even 100%. However, Avira is a free product. The free virus scanner Avast convinces with a score of 100% and 98.8%.

When it comes to system load Symantec puts the best score down. Copying files to 26,6GB took no scanner 66.1 seconds.The virus took an average of 75.4 seconds. Symantec sitting there with 66.2 seconds, well below while Intego with 97.9 seconds is the greatest strain on the system. Regarding "false positives," the unjustified considering clean files as malware, no single scanner was in the wrong. On ClamXav after all were virus by AV-Test certification. Below the results of the on-demand scan.

Beebone Malware: FBI Praises Cooperation With Dutch Cyber Cops

The FBI is proud to work with the High Tech Crime Team (THTC) of the Dutch police that this week along a botnet pulled off the air. It was a joint operation of the THTC, the FBI, Europol and various security companies was against the malware, which in the press releases of the various investigative services Beebone or AAEH was mentioned.

However, the malware also known as Vobfus and Changeup, Symantec, so let know . It is a worm that first appeared in 2009 and spread through the Autorun feature of Windows. A year later, the worm used the LNK vulnerability allowing the Stuxnet worm spread knew. There were also social engineering used by Changeup.

Working of Beebone Malware

On infected USB drives and network folders worm placed a copy of itself with the names Porn.exe, Sexy.exe, Passwords.exe and Secret.exe and created the executable files with the names of all existing files. These files have a folder icon, so it seemed like it was a folder. Since Windows file extensions by default does not show users could thereby unintentionally activate the malware.

Additional malware

Changeup active once installed all sorts of malware, including malware that tried Internet banking data and passwords to steal, as well as fake virus scanners and ransomware, according to the FBI. The US investigation service went to court with a request to take up 100 domain names that use the botnet to communicate with infected computers. Something the judge gave permission. Then the investigative services were these domains to the servers of Internet providers and Computer Emergency Response Teams (CERTs) of views on the world.

"Botnets as Beebone have made ​​all over the world victims, which shows why a joint approach to global investigative services with the private sector is so important. The FBI is proud to cooperate in the fight against botnets with our partners in the European Cybercrime Centre of Europol, the Joint Action Cybercrime Task Force (J-CAT) and the Dutch High Tech Crime Team, " said FBI Assistant Director Joseph Demarest.

Spammer Uses 750,000 Twitter Accounts For Slimming

One of the spammers have created over a period of one year 750,000 Twitter accounts and used for an extensive spam operation involving slimming based on green coffee beans were offered. To convince potential customers that the pills were legitimately used the spammer kinds Twitter accounts resembling the accounts of famous brands and celebrities, such as CNN, TMZ and MTV.

Spammers also used the Twitter accounts to real Twitterers to send these fake accounts, as reported anti-virus company Symantec. The virus fighter managed to unmask the spammer because that left some traces of his identity. For spam operation used the spammer three types of accounts. Namely new accounts that had no followers, no tweets sent out and used the standard "egg" icon. Symantec calls these accounts "eggs".

There were also accounts stolen content and tweeted photos of real women used. These accounts were followed by both the "eggs" as real users. Finally there were the "mockingbirds" accounts that occurred as the accounts of famous brands and celebrities and slimming advertised. Through the mockingbirds and parrots the spammer trying to spread the tweets about the diet pills among many people. For anyone who purchased the diet pills eventually the spammer got a fee ranging from 36 to 60 dollars.

The spammer could eventually become obsolete because he made some mistakes. So he left traces in the domains he registered and he used one of his "parrot Accounts" as a personal Twitter account. He also used some parrot accounts to retweet personal tweets.

Paying Attention

Symantec warns Twitterers to check that accounts they follow are real, identifiable by the blue tick. In addition, users of the micro blogging service wary of new followers and wants the number of followers on Twitter that someone does not say anything. "Numbers can lie," said the virus fighter. Finally follows the advice that no miracle pills exist to lose weight.