続きを読む
Brazilian companies receive more than 40,000 spam emails in infostealer campaign
Spam campaign targets Portuguese-speaking firms in Brazil and other regions to deliver malware and steal sensitive data.
続きを読む
続きを読む
Underground black market: Thriving trade in stolen data, malware, and attack services
The underground market is still booming after recent major data breaches. The price of stolen email accounts has dropped substantially, but the value of other illegal goods and services has remained stable.
続きを読む
続きを読む
Hackers use Amazon cloud to scrape mass number of LinkedIn member profiles
Image courtesy of TheTruthAbout.
LinkedIn is suing a gang of hackers who used Amazon's cloud computing service to circumvent security measures and copy data from hundreds of thousands of member profiles each day.
"Since May 2013, unknown persons and/or entities employing various automated software programs (often referred to as 'bots') have registered thousands of fake LinkedIn member accounts and have extracted and copied data from many member profile pages," company attorneys alleged in a complaint filed this week in US District Court in Northern California. "This practice, known as 'scraping,' is explicitly barred by LinkedIn's User Agreement, which prohibits access to LinkedIn 'through scraping, spidering, crawling, or other technology or software used to access data without the express written consent of LinkedIn or its Members.'"
With more than 259 million members—many who are highly paid professionals in technology, finance, and medical industries—LinkedIn holds a wealth of personal data that can prove highly valuable to people conducting phishing attacks, identity theft, and similar scams. The allegations in the lawsuit highlight the unending tug-of-war between hackers who work to obtain that data and the defenders who use technical measures to prevent the data from falling into the wrong hands.
Read 7 remaining paragraphs | Comments
First Widespread Virus Cross-infection
After being in oblivion for a while, the Xpiro family of file infectors is back with a bang—and this time with some notorious capabilities. Not only does the new variant infect 32-bit files, it also has broadened its scope of infection to 64-bit files. The infections are cross-platform (a 32-bit Xpiro variant can infect a 64-bit executable file, and vice versa) and persistent in nature. Additionally, this virus has also enhanced its information stealing capabilities by adding Firefox and Chrome extensions to monitor browser sessions.
Cross-infection and persistence
While we have seen cross-infectors in the past, Xpiro is the first widespread family of infectors which implements this feature. This new variant can infect executable files from the following architectures:
- Intel 386 (32-bit)
- Intel 64 (64-bit)*
- AMD64 (64-bit)
The creators of Xpiro are looking to infect a larger number of computers. They are leaving no stone unturned in their attempts with the introduction of this cross-infecting capability with persistence.
Traditionally file infectors were known to spread by infecting other executables while not caring about persistence. This variant uses an astute technique to achieve both. Firstly, it enumerates all win32 services and attempts to infect the service files. It then follows all the link files (.lnk) on the user’s desktop and start menu folders to infect the target files. It chooses these files because they have the highest probability of being run by the system or the user when the computer first starts, thus remaining persistent on successive reboots. Finally, it infects all executables from drives C to Z if the drive is fixed, removable, or mapped.
*The Intel64 bit files are infected by the new variant but due to a bug in their code, it renders the files corrupted. Symantec detects and repairs such files to their correct state.
Enhanced information stealing
The ultimate goal of the Xpiro has been to steal information from the infected host. The goal remains the same, except it is stealthier now. When an Xpiro infector runs on a computer, it now also adds a Firefox or Chrome extension, in addition to infecting executable files. The Firefox extension is hidden, but the Chrome extension is named “Google Chrome 1.0” so it can pass as a clean extension and mask its presence. The Firefox extension, for instance, can perform the following actions:
- Hide extension presence
- Lower browser security
- Spy on user Internet activity
- Steal logs
- Redirect browser to predefined URLs
After installation, when a new instance of Firefox is opened it is visible that a new add-on has been installed, but the extension cannot be found in the extension list.
Figure 1. Extension list before infection
Figure 2. Extension list after infection
The Xpiro extension hides itself from the extension list, showing same number of extensions before and after infection. It also lowers browser security by modifying the browser configuration.
Figure 3. Reduced browser security
When a user tries to update the browser or browser extensions, the updates won’t take place because Xpiro replaces the update URL with 127.0.0.1, a local IP address. Xpiro does this to avoid any change in configuration that may possibly expose itself as malware.
Figure 4. Xpiro-disabled update
The hidden extension disables many security warnings normally shown in the browser to warn the user. The extension also disables some safe browsing features which would otherwise provide phishing protection to users when enabled.
Xpiro monitors all HTTP activity in the browser and uploads it to a remote server. It then downloads the following lists from predefined servers:
- Target URLs
- Redirection URLs
When a user browses to one of the target URLs on the list, the extension redirects the browser to a corresponding URL from the redirection list. The redirected URL could be an advertising page or a page which downloads more malware.
The Xpiro attackers have upgraded the threat’s functionality to be persistent, stealthier, and most importantly to cross-infect executable files on multiple platforms. Other infector families may be expected to follow suit and add sophisticated functionality to their arsenal in order to be more potent and viable across different platforms. Symantec, however, is committed to protecting your data and information against such advanced threats. Symantec detects this new variant of the Xpiro family as W32.Xpiro.D and W64.Xpiro and also repairs damaged files. Symantec customers are advised to keep their virus definitions up to date.