Trend Micro: Simple Keylogger Costs Companies Millions

A simple commercial keylogger that is distributed has small and medium businesses worldwide millions of euros cost via e-mail attachments, claims the Japanese anti-virus company Trend Micro. It is the HawkEye keylogger offered on the Internet for a few bucks.

Once active, the keylogger is used to steal passwords from the browser and email client. This data is via e-mail, FTP and web panel sent to the attackers. With the stolen passwords to the email accounts of corporate executives, including the CEO and CFO acquired. Then there via the hijacked email accounts, a payment order sent to the accounting. This scam is also known as "Business Email Compromise" and would have caused worldwide last year to a loss of 216 million dollars.According to the FBI and Secret Service more and more American companies are affected by the fraud. The reason for the investigation services to a warning to deliver.

For the dissemination of the keylogger to send .exe and .zip files that are supposedly an invoice, purchase order or quote. In some cases, the criminals make first contact with the companies. Only after several e-mail exchanges, the keylogger will be sent. According to Trend Micro, the majority of victims of HawkEye in India, followed by Egypt and Iran. These are companies in different sectors, but mainly goods, transportation and manufacturing. It also appears that most companies are accessed via info @ email address.

Trend Micro made ​​a report ( pdf ) on HawkEye which also analyzed two Nigerian cyber criminals using the malware. According to the researchers HawkEye seem a simple keylogger, but is motivated cyber criminals more than sufficient to carry out malware attacks. Also by other security HawkEye was recently investigated as iSight Partners . The research shows that this security be used for the dissemination of keylogger files invoice.exe, payment and purchase slip.exe order.exe. ISight also argues that most victims are in India, but also see a lot of infections in Italy, the United States and Turkey. Furthermore, there are also infections observed in the Netherlands.

Flash And Unpatched IE Vulnerabilities Used On Forbes.com

Visitors to the popular business magazine Forbes late November attacked via vulnerabilities in Adobe Flash Player and Internet Explorer, which at the time of the attack still no updates were available.According to security iSight Partners and Invincea involved a highly targeted attack.

The attack would be directed cons American defense companies and financial institutions, whose staff Forbes.com visit regularly. The website is according to Alexa on the 68th spot of most visited websites in the US Possible are also other parties and organizations affected by the attack, but it is not yet clear. The same is true for the attack period. Which would have taken place on 28 November to 1 December, but a longer period is not excluded. Besides Forbes would have used several obscure websites for the attack.

The attack took place through the "Thought of the Day" (totd) Adobe Flash widget that appears when someone visits a page or Forbes article. Then, use was made of a zero-day vulnerability in Adobe Flash Player, which eventually on December 9 by Adobe was patched. The attack was combined with a vulnerability in Internet Explorer to bypass the ASLR protection measure in the browser. Bypassing the security measure yesterday evening remedied by Microsoft. How many computers are infected by the attack have both security companies do not know.