Pop-up Advertisements Offering Anti-virus Software Pose Threat to Internet Users

An ongoing threat exists for computer users who, while browsing the Internet, began receiving pop-up security warnings that state their computers are infected with numerous viruses.

These pop-ups known as scareware, fake, or rogue anti-virus software look authentic and may even display what appears to be real-time anti-virus scanning of the user's hard drive. The scareware will show a list of reputable software icons; however, the user cannot click a link to go
to the actual site to review or see recommendations.

The scareware is intimidating to most users and extremely aggressive in its attempt to lure the user into purchasing the rogue software that will allegedly remove the viruses from their computer. It is possible that these threats are received as a result of clicking on advertisements contained on a website. Cyber criminals use botnets to push the software and use advertisements on websites to deliver it. This is known as malicious advertising or malvertising.

Once the pop-up appears it cannot be easily closed by clicking "close" or the "X" button. If the user clicks on the pop-up to purchase the software, a form is provided that collects payment information and the user is charged for the bogus product. In some instances, whether the user clicks on the pop-up or not, the scareware can install malicious code onto the computer. By running your computer with an account that has rights to install software, this issue is more likely to occur.

Downloading the software could result in viruses, Trojans and/or keyloggers being installed on the user's computer. The repercussions of downloading the malicious software could prove further financial loss to the victim due to computer repair, as well as, cost to the user and/or financial institutions due to identity theft.

The assertive tactics of the scareware has caused significant losses to users. The FBI is aware of an estimated loss to victims in excess of $150 million.

Be cautious — cyber criminals use easy to remember names and associate them with known applications. Beware of pop-ups that are offering a variation of recognized security software. It is recommended that the user research the exact name of the software being offered.

Take precautions to ensure operating systems are updated and security software is current.

If a user receives these anti-virus pop-ups, it is recommended to close the browser or shut the system down. It is suggested that the user run a full, anti-virus scan whenever the computer is turned back on.

If you have experienced the anti-virus pop-ups or a similar scam, please notify the IC3 by filing a complaint at www.IC3.gov.

----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Spear Phishing E-mails Target U.S. Law Firms and Public Relations Firms

The FBI assesses with high confidence that hackers are using spear phishing e-mails with malicious payloads to exploit U.S. law firms and public relations firms. During the course of ongoing investigations, the FBI identified noticeable increases in computer exploitation attempts against these entities.

The specific intrusion vector used against the firms is a spear phishing or targeted socially engineered e-mail designed to compromise a network by bypassing technological network defenses and exploiting the person at the keyboard. Hackers exploit the ability of end users to launch the malicious payloads from within the network by attaching a file to the message or including a link to the domain housing the file and enticing users to click the attachment or link.

Network defense against these attacks is difficult as the subject lines are spoofed, or crafted, in such a way to uniquely engage recipients with content appropriate to their specific business interests. In addition to appearing to originate from a trusted source based on the relevance of the subject line, the attachment name and message body are also crafted to associate with the same specific business interests. Opening a message will not directly compromise the system or network because the malicious payload lies in the attachment or linked domain. Infection occurs once someone opens the attachment or clicks the link, which launches a self-executing file and, through a variety of malicious processes, attempts to download another file.

Indicators are unreliable to flag in-bound messages; however, indicators are available to determine an existing compromise. Once executed, the malicious payload will attempt to download and execute the file ‘srhost.exe’ from the domain ‘http://d.ueopen.com’; e.g. http://d.ueopen.com/srhost.exe. Any traffic associated with ‘ueopen.com’ should be considered as an indication of an existing network compromise and addressed appropriately.

The malicious file does not necessarily appear as an ‘exe’ file in each incident. On occasion, the self-executing file has appeared as other file types, e.g., ‘.zip’, ‘.jpeg’, etc.

Please contact your local field office if you experience this network activity and direct incident response notifications to DHS and U.S. CERT.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Fraudulent e-mail claiming to contain an FBI Intelligence Bulletin from the Weapons of Mass Destruction Directorate

A fraudulent e-mail, initially appearing around June 16, 2009, claims to contain a confidential FBI report from the FBI "Weapons of Mass Destruction Directorate." The subject line of the email is "RE: Weapons of Mass Destruction Directorate," and contains an attachment "reports.exe". This message and similar messages may contain a file related to the "W32.Waledac" trojan software, which is designed to steal user authentication credentials or send spam messages.

Do not click on any links associated with this e-mail or similar e-mails, it is a hoax.

The FBI does not send unsolicited e-mails or e-mail official reports. Consumers should not respond to any unsolicited e-mails or click on any embedded links, as they may contain viruses or malicious software.

Below is an example of the fraudulent e-mail message:

CLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
INTELLIGENCE BULLETIN

Weapons of Mass Destruction Directorate

HANDLING NOTICE: Recipients are reminded that FBI Intelligence Bulletins contain sensitive terrorism and counterterrorism information meant for use primarily within the law enforcement and homeland security communities. Such bulletins shall not be released, either in written or oral form, to the media, the general public, or other personnel who do not have a valid need-to-know without prior approval from an authorized FBI official, as such release could jeopardize national security.

Link to malicious software (report.exe)


If you have been a victim of Internet crime, please file a complaint at www.IC3.gov.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

No, Your Social Networking “Friend” Isn’t Really in Trouble Overseas

According to the Internet Crime Complaint Center (IC3), there has been an increase in the number of hijacked social networking accounts reported to www.ic3.gov.

One of the more popular scams involves online criminals planting malicious software and code onto to victim computers. It starts by someone opening a spam e-mail, sometimes from another hijacked friend’s account.

When opened, the spam allows the cyber intruders to steal passwords for any account on the computer, including social networking sites. The thieves then change the user’s passwords and eventually send out distress messages claiming they are in some sort of legal or medical peril and requesting money from their social networking contacts.

So far, nearly 3,200 cases of account hijackings have been reported to the IC3 since 2006.

Cyber thieves are also using spam to promote phishing sites, claiming a violation of the terms of service agreement or creating some other issue which needs to be resolved. Other spam entices users to download an application or view a video. Some of these messages appear to be sent from friends, giving the perception of legitimacy. Once the user responds to a phishing site, downloads an application, or clicks on a video link, the electronic device they’re using becomes infected.

Some applications advertised on social networking sites appear legitimate but install malicious code or rogue anti-virus software. These empty applications can give cyber criminals access to your profile and personal information. These programs will automatically send messages to your contacts, instructing them to download the new application too.

Infected users are often unknowingly spreading malware by having links to infected websites posted on their webpage without the user’s knowledge. Since the e-mail or video link appear to be endorsed by a friend, social networking contacts are more likely to click on these links.

Although social networking sites are generally a safe place to interact with friends and acquaintances, keep in mind these suggestions to protect yourself while navigating the Internet:

* Adjust website privacy settings. Some networking sites have provided useful options to assist in adjusting settings to help protect your identity.
* Be selective when adding friends. Once added, contacts can access any information marked as viewable by all friends.
* Limit access to your profile to only those contacts you trust with your personal information.
* Disable options, such as photo sharing, that you might not regularly use. You can always enable these options later.
* Be careful what you click on. Just because someone posts a link or video to their wall does not mean it is safe.
* Familiarize yourself with the security and privacy settings and learn how to report a compromised account.
* Each social networking site may have different procedures on how to handle a hijacked or infected account; therefore, you may want to reference their help or FAQ page for instructions.

If your account has been hijacked or infected, report it to by visiting www.ic3.gov or www.lookstoogoodtobetrue.com.

The Internet Crime Complaint Center is a partnership between the FBI and National White Collar Crime Center (NW3C).

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Almost 30,000 Videos on YouTube Contain Comments with Links to a Malicious Web Page, Reports PandaLabs

/PRNewswire/ -- PandaLabs, Panda Security's malware analysis and detection laboratory, has approximately 30,000 videos on YouTube with comments containing links that point to a Web page designed to download malware. This is another example of how cyber-criminals are attacking popular Web 2.0 sites to distribute malware. Similar attacks have previously been seen, to a lesser extent, on sites including Digg.com and Facebook.

The comments are normally suggestive, claiming that the link will take users to a legal Web page with pornographic content. You can see an image here: http://www.flickr.com/photos/panda_security/3548358349/.

However, when users click the link, they are taken to a page that spoofs the original and which is really designed to download malware. On this page, users will be prompted to download a file in order to view the video. If they take the bait, users will really be downloading a copy of the PrivacyCenter fake antivirus.

This malware, when run on a computer, pretends to scan the system, supposedly detecting dozens of (non-existent) viruses. It then offers users the chance to buy the paid version of the antivirus to clean their computers. The ultimate aim of cyber-crooks is to profit from the sale of this 'Premium' version of the fake software.

"The technique of using malicious comments on YouTube is not new," explains Luis Corrons, technical director of PandaLabs. "What is alarming however, is the quantity of links we have detected pointing to the same Web page. This suggests that cyber-criminals are using automation tools to publish these comments."

-----
Community News You Can Use
www.fayettefrontpage.com
www.georgiafrontpage.com
www.politicalpotluck.com
Follow on Twitter @GAFrontPage

Cyber-Criminals Create Specialized Search Engines to Lead Users to Malicious Web Sites, According to PandaLabs

/PRNewswire/ -- PandaLabs, Panda Security's malware analysis and detection laboratory, today announced that it has uncovered evidence that cyber-criminals are starting to create their own search engines and use them to lead users to malicious pages, often created for distributing malware.

This new trend underlines how cyber-crime is becoming increasingly professional. Previously, cyber-crooks would use malicious SEO (Search Engine Optimization) or "blackhat SEO" techniques to improve the ranking of their pages among popular search engines. Now, they are beginning to use their own search engines which lead users directly to pages designed to infect or defraud them. One such malicious search engine, detected by PandaLabs, has already received approximately 195,000 visits.

These search engines operate as follows: When users enter a search term, the engine returns just five or six results. Clicking on any of these results will redirect the user to a Web page created specifically to distribute malware. The pages may include content such as pornographic videos, which ask users to download the latest version of "Web media player" in order to watch the clip. However, the file downloaded is really the adware WebMediaPlayer. These pages are also being used to distribute fake antivirus programs. You can see an image here: http://www.flickr.com/photos/panda_security/3504323344/

This technique is known as social engineering, and basically involves infecting users by enticing them to click a link or run a malicious file.

"We started searching for words and issues frequently exploited by cyber-crime, in this case swine flu, or celebrity names such as Britney Spears or Paris Hilton and this took us to pages created to distribute malware. But, we then found that even searching for our own names would reveal results that were in fact malicious pages," explains Luis Corrons, Technical Director of PandaLabs. "Strangely though, there is the occasional normal result among all the malicious ones. Perhaps this is to bolster the illusion that this is a genuine search engine."

To avoid falling victim to these attacks, PandaLabs advises users only to use trusted search engines, and to be wary of Web sites offering sensational videos or unusual stories.

"If on this kind of Web site you are asked to download a codec or any other kind of program to watch videos, there is a strong chance that it is really malicious code," warns Corrons.

-----
Community News You Can Use
Follow on Twitter @GAFrontPage
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Finjan Discovers a Network of 1.9 Million Malware-Infected Computers Controlled by Cybercriminals - Corporate and Government Computers are Included

/PRNewswire/ -- Finjan Inc., a leader in secure web gateway products and the provider of unified web security solutions for the enterprise market, today announced that Finjan's Malicious Code Research Center (MCRC) has discovered a network of 1.9 million malware-infected computers. Corporate, government and consumer computers around the world were infected by the malware.

This discovery is part of a research conducted by MCRC when investigating command and control servers operated by cybercriminals. The cybercrime server has been in use since February 2009, is hosted in the Ukraine and is controlled by a cybergang of 6 people. These cybercriminals established a vast affiliation network across the Web to successfully distribute and operate their malware install-base. They compromised computers in 77 government-owned domains (.gov) from the US, UK and various other countries.

The malware is remotely controlled by the cybercriminals, enabling them to instruct the malware to execute almost any command on the end-user computer as they see fit, such as: reading emails, copying files, recording keystrokes, sending spam, making screenshots, etc.

Since the discovery of its findings, Finjan has provided US and UK law enforcement with information about the server. Finjan has also contacted affected corporate and government agencies to let them know that they were part of the infected computer names.

"As predicted by Finjan at the end of last year, cybercriminals keep on looking for improved methods to distribute their malware and Trojans are winning the race (http://www.finjan.com/Content.aspx?id=827#SecurityTrendsReport). The sophistication of the malware and the staggering amount of infected computers proves that cybergangs are raising the bar," said Yuval Ben-Itzhak, CTO of Finjan. "As big money drives today's cybercrime activities, organizations and corporations need to protect their valuable data to prevent theft by these kind of sophisticated cyberattacks."

The research also revealed that the malware is installed on computers when visiting compromised websites serving malicious code. Information found by MCRC on the command and control server includes the IP addresses of the infected computers as well as the computers' name inside corporate and government networks that are running the malware.

The global spread of infected computers in percentages is as follows:

- US: 45%

- UK: 6%

- Canada: 4%

- Germany: 4%

- France: 3%

- Other: 38%

The malware is infecting computers running the Windows XP operating
system and using the following Web browsers:

- Internet Explorer - 78%

- Firefox - 15%

- Opera - 3%

- Safari - 1%

- Other - 3%



As recommended by leading analysts, a unified Web security solution is the preferred solution for corporate and government agencies against today's cyber attacks. Finjan's Unified Secure Web Gateway (http://www.finjan.com/Content.aspx?id=190) product combines multi-layered Web security, utilizing real-time content inspection technologies, with data leakage prevention (DLP) solutions. Finjan's product also provides Web 2.0, productivity, liability and bandwidth control via URL categorization, content caching and applications control technologies on one dedicated appliance. This enables companies and governmental agencies alike to enjoy optimal multi-layered protection in real-time, with lower Total Cost of Ownership (TCO) and higher Return on Investment (ROI).

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Google Trends Used to Promote Fake Anti-Virus Software

PRNewswire/ -- Internet criminals are using Search Engine Optimization tactics to promote links to free hosted blog sites in an attempt to dupe unsuspecting visitors into infecting themselves with malware and fake anti-virus products, say experts from Marshal's TRACE threat team.

Criminals are using tools such as Google Trends to identify the most popular and current Internet search terms. The same criminals then use new blogs on free hosting sites, such as Windows Live Spaces and AOL Journals, featuring the same search terms. When an Internet user then makes a search using those popular terms they get multiple links to these hosted blog sites in their search results. If the user then clicks on the link, thinking it is relevant to their desired search, they are taken to a blog site with an apparent embedded video player. If the user clicks on the video player, they are prompted to load a 'codec', which surreptitiously loads malware, including fake anti-virus software that promises to clean non existent viruses from the computer in return for their credit card details.

"A recent example of an exploited search term was 'OJ Simpson Verdict'," said Phil Hay, lead threat analyst for Marshal's TRACE Team. "The criminals identify this as a 'hot' search term and then ensure their Windows Live Spaces blog contains 'OJ Simpson Verdict'. This promotes the blog up the order in Google search results and increases the chances that users will hit those web pages."

"Using search engine optimization to promote web pages hosting malware shows increasing levels of sophistication and professionalism on the part of the criminals," said Hay. "The use of fake video players to disguise the installation of fake anti-virus programs is not new. This kind of activity has been going on for many months now, but previously the links have been promoted via spam. This new approach shows a diversification of tactics."

According to Marshal, the malicious executables downloaded by clicking on the fake video player are not reliably detected as malware by established antivirus programs, further adding to the seriousness of the criminal's activity.

"Fake anti-virus programs are especially prevalent right now," said Hay. "Once installed, the program pops up and tells you it has found viruses on your computer and offers to clean these if you are willing to pay via credit card. The viruses the program reports are fake, the program itself is fake and the so called legitimate company you deal with is fake. The whole thing is a con designed to part you from your money. It is fairly sophisticated and convincing."

"Now the criminals are trying new methods of promoting their malicious web pages that aren't dependant on spam. Our advice is to not blindly trust results from Google searches, and be wary of these kinds of links to hosted blog sites. Also, if you are unfortunate enough to be infected by one of these fake anti-virus products, do not provide any credit card information or payment of any kind. Use a legitimate and reputable anti-virus solution from a name brand vendor," said Hay.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page