The Internet Threat Landscape

PayPal Fraud with CAPTCHA

A CAPTCHA or Captcha is a type of challenge-response test used in computing to ensure that the response is not generated by a computer. Very often it is used against bots to protect the website itself. And because of this, users tend to put their guard down against fraudulent websites if they see a Captcha challenge. A recent Paypal phish makes use of this social engineering technique to harvest user’s personal information.

Rea more: http://blog.trendmicro.com/paypal-fraud-with-captcha/

Related Articles

• Koobface Tries CAPTCHA Breaking

AutoCAD Malware Found in the Wild

We have always seen malware that exploits vulnerabilities in browsers and OS. A recent report detected ACM_UNEXPLODE.C which spreads and infects AutoCAD files rendering corrupted. On top of that, it also adds on several entries to the windows registry.

The said malware is already detected by the Smart Protection Network. In addition, AutoDesk has released a workaround at their official blog.

Read more: http://blog.trendmicro.com/autocad-malware-found-in-the-wild/

Brazil: Spam Changing A HOSTS File?

Sending electronic greeting cards used to be a craze in the cyber community 5-8 years ago. However, in the recent years, social networking sites and applications such as Facebook and Twitter have taken the center stage where people exchange greetings and well wishes over the internet. A recent attack in Brazil makes another attempt by spreading spam mail sending e-card. A file is downloaded if the victim clicks on the “read” button and the HOSTS file of Internet Explorer is changed, and set to redirect certain Brazilian baking Web sites to a malicious web site. All information posted in any of the said pages will then be grabbed by the attacker.

Read more: http://blog.trendmicro.com/brazil-spam-changing-a-hosts-file/

Mac OS X DNS-Changing Trojan in the Wild

Malware targeted at MACs strikes again. The Trojan is supposedly a QuickTime Player update disguised as MacCinema Installer with the file name QuickTimeUpdate.dmg. As with its earlier variants, users are prompted to download the malware when trying to view certain online videos from .com domains with the IP address, 91.214.45.73. If infected, a victim’s Web traffic can then be diverted to the website of the attacker’s choosing. Users are advised to update their software only from legitimate websites and not through prompts from websites while surfing. Mac users are protected by the Smart Protection Network through Trend Micro Security for Mac and Smart Surfing for Mac.

Read more: http://blog.trendmicro.com/mac-os-x-dns-changing-trojan-in-the-wild/

Malware threats have gone through many stages of evolution over the years and have increased in complexity, number, danger and ability to infect. In the first six months of 2008, the Trend Micro World Virus Tracking Center (WTC) recorded that 253.4 million systems were infected with malware. The comparable volume for 2009 is almost double at 491.2 million.

Figure 1: Total AV-Test Unique Samples

With such a high volume of threats, a new approach is needed to reduce the heavy burden computers bear to store and deliver protection information. The next-generation cloud-client content security infrastructure is designed to protect customers from Web threats including data-stealing malware. Cloud-client file reputation technology, a component of the Trend Micro™ Smart Protection Network, offloads the storage of traditional signatures from computers and into the Internet cloud.

Read more: http://blog.trendmicro.com/1h-2009-malware-threat-grows-ever-larger/

Signed Malware Coming To A Phone Near You?

As more mobile devices are capable of internet access, PDA and mobile phones also become vulnerable to malware attacks. Even newer versions of the Symbian OS requiring a signed 3rd party are not spared. A recently discovered application called “Sexy Space” steals the user’s subscriber, phone, and network information, and connects to a website in order to send the harvested information and is also capable of sending spam sms. This particular threat is already detected by the Smart Protection Network.

Read: http://blog.trendmicro.com/signed-malware-coming-to-a-phone-near-you/

Looking Back: Six Years Since MSBLAST

Recently, TrendLab experts from Trend Micro published what – in their opinion – are the top most dangerous malware. Top of the list is DOWNAD which exploits MS08-067 vulnerability, followed by KOOBFACE that infect user profiles on social networking applications such as Facebook and Twitter. Read on to find out the most dangerous malware and cyber attacks during their time and within their respective fields.

Read more: http://blog.trendmicro.com/looking-back-six-years-since-msblast/

Political Controversy Spam in Italy

The controversial sex scandal involving Italian Prime Minister Silvio Berlusconi has recently become target for spammers. The spam mail is crafted in Italian and targeted at the Italians who were concerned over the issue. The spam mail comes with a “Youtube” link which actually came from youtorube.com, and not from the real youtube.com. To view the said video, user must download and install a video codec first. Upon clicking the link, it will download a malicious file named wmpcodec.exe. The spam mail is already detected in TMASE Full Pattern 6726, and all URLs are now blocked by Trend Micro.

Figure 1. Notice the extra letters in the sender domain

Read more: http://blog.trendmicro.com/italy-political-controversy-spam/

Sly Spam Run Targets Hotmail Users

Hotmail users are advised to pay attention to this particular spam targeted at them. Noteworthy is the fact that the links were slyly crafted to look very similar to file attachments. There are subtle differences between such spam email and a legitimate email message, which users must watch out for should they receive a suspicious email message. The malicious URLs which are now blocked by Trend Micro Smart Protection Network, leads to the download of the malicious file fotos.com which is now detected as TROJ_DLOADR.AQJ. The said file, in turn, downloads a wide variety of information-stealing malware.

Read more: http://blog.trendmicro.com/sly-spam-run-targets-hotmail-users/

Malicious Twitter Posts Get More Personal

Twitter users be warned again as a recent report shows that malicious twitter posts are getting more personal and dangerous due to the difficulty to be identified.  For starters, spambots have created twitter accounts that look more like legitimate accounts. These accounts then post tweets which seem harmless and share interesting websites or music to listen to. Additionally, the spambot uses the URL shortener Doiop.com to mask the original URL in the posts. Unsuspecting victims will get redirected to malware download or FAKEAV purchases.

Read more: http://blog.trendmicro.com/malicious-twitter-posts-get-more-personal/

You may also be interested in

• Twitter Admin + Obama + Britney Hacked
• Tvviter Typosquatting Phishing Site