The Computer Security Landscape Overview as of July 2012

Olympic-related threats were maliciously rampant – even before the Summer Olympic Games began on 27 July 2012, online scammers had already taken the opportunity to target users.

Threats such as twitter bots which were designed to spread URLs leading up infestation of malwares. These twitter ‘accounts’ are generally created the day the Tweets are sent, rarely have any followers, and rapidly post a few Tweets each minute using a wide variety of hash tags linked to trending topics. Twitter has been quick to identify these accounts and suspend them, generally within a few hours of their creation.

There were also fake spam emails which attempt to propagate URLs which mimic interfaces of YouTube.com. Once loaded, it will request user to install newer version of Flash Player which if installed is actually a malware. 

Android.Opfake which was reported in May 2012 also capitalises on Olympic 2012, not without a fight.

Android.Opfake is a malware written for Android devices that masquerades as various apps and content, including even as an installer for the Opera Web browser and a pornographic movie, which requires the user to pay for them. It demands payment for the app or content through Short Message Service (SMS) messages.

This time, attackers bundle their threat with a copy of a legitimate Olympics gaming application.

Phishing attacks related to Olympic 2012 were also common. One example is the MasterCard™ promotion which is hosted in Brazil, included several fake offers such as “Win Free Trips to the 2012 Summer Olympics in London!”, “Participate and win laptops, cameras and many great prizes.”, and “MasterCard and you in the Olympic Games!”. Customers were prompted to participate in the offers by clicking a button labeled “Participate now.” 

Upon clicking the button, customers would be redirected to the next phishing page that asks for the user’s confidential information.

Another example is the fake gift cards from Visa™, reportedly worth USD $1,000. The intention of this phishing attack is to collect email addresses. 

Web Attack Toolkits

Web Attack toolkits primarily The toolkits primarily focus on exploiting third-party browser plugins (which are out-of-date), such as Adobe Reader, Adobe Flash Player, and Java.

Web attack toolkits such as Blackhole accounts for almost two-thirds of all threat activity on malicious websites in 2011.Based on data gathered in July 2012, there are currently three times as many Web attacks occurring now, as there where on average during the last half of 2011.

There are a variety of attack toolkits currently active; Blackhole, Phoenix, Nuclear Pack, Bleeding Life, and Eleonore are some of the more popular ones. 

Attackers generally lure unsuspecting users to the Web attack toolkits by using a variety of social engineering tricks, such as spam emails or social networking attacks. Often these contain a link to legitimate Web sites that have been compromised and onto which the attacker has installed a Web attack toolkit. For instance, the widely popular Blackhole attack toolkit has been behind some rather clever spam campaigns as of late. The attackers have sent spam emails purporting to be rejected wire transfers, New York City traffic tickets, or claim that the recipient has been tagged in a photo on a popular social networking site. The goal in these cases is to entice the user into clicking on the malicious link, from which the attacks can be launched.

The use of Web attack toolkits has grown significantly in the first half of 2012. The reason for their popularity likely has to do with the versatility it offers attackers for compromising computers. No manual hacking is involved as the attack toolkit automates the exploit process.

These toolkits are adopting cloud-computing model providing SaaS as well as new features by plug-in framework, making them more powerful and up to date as time grows.

Also reported was that two prominent remote access trojan (RAT) toolkit projects have either been shut down or saw significant contributors leave. In the first case, the FBI carried out a sting operation that resulted in the arrests of 24 people associated with the Blackshades RAT (a.k.a. W32.Shadesrat).

Junk-printing threats

There have been not one, but two threats recently that seemingly print garbage to networked printers. These threats don’t compromise printers in-and-of themselves, but rather copy themselves as print spooler .spl files to the %System%SpoolPRINTERS folder on a compromised computer. In some cases, Windows interprets these threats as print jobs, and attempts to print the binaries — resulting in what looks like garbage being printed.

Both threats contain rather unique behavior in terms of propagation as well. Trojan.Milicenso13 spreads by using .htaccess redirection on a compromised Apache Web server. Meanwhile, W32.Printlove14 attempts to spread by exploiting a known vulnerability in the Windows XP print spooler, patched in 2010. However, it’s only when the compromised system is patched that it will print garbage print jobs.

Android.Fakeapp

This trojan (once installed) requests permission to perform a variety of other actions, including permission to access the devices’ location, such as GPS information and the ability to read and write the user’s browsing history and bookmarks. It also downloads additional configuration files used to display advertisements to the user, encouraging them to download further apps. Furthermore, it also collects personal information, such as the device IMEI and phone number, and sends it to a Web site hosted on the Internet.

Distribution of this threat are disguised in copies of legitimate, popular games. 

Data breach at Maplesoft

On July 2012, Maplesoft realised that some of its customers started receiving emails from what appeared to be a “Maplesoft Security Update Team,” suggesting they should download a patch. The Web site link contained in the email led to an exploit kit and ultimately attempted to install Trojan.Zbot (aka Zeus) on the compromised computer.

According to Maplesoft, the database that was breached was not the company’s customer database; rather it was a partial email subscription list. The data taken included older subscription data, which meant a significant portion of the list was outdated and many of the email addresses were no longer valid.

Global threats analysis report

Summary:

• Spam – 67.6 percent (an increase of 0.8 percentage points since June)
• Phishing – One in 475.3 emails identified as phishing (a decrease of 0.003 percentage points since June)
• Malware – One in 340.9 emails contained malware (a decrease of 0.023 percentage points since June)
• Malicious Web sites – 2,189 Web sites blocked per day (an increase of 4.0 percent since June)
• Olympic related scams and threats to keep an eye on
• Web attack toolkit activity in the first six months of 2012

Spam analysis

In July, the global ratio of spam in email traffic rose by 0.8 percentage point since June, to 67.6 percent (1 in 1.48 emails). It is perhaps still too early to tell what significant impact the disruption of the Grum botnet has had on the global spam rate, which has been in decline since the end of 2011. 

Saudi Arabia remained the most spammed geography in July, with a spam rate of 79.0 percent.

The most common category of spam in July is related to the Newsletters category, with 62.20 percent. This is a significant shift from June, when it made up only 0.08 percent of all spam, and likely the result of a campaign by the Festi27 botnet that used the social engineering tactic of spoofing newsletters quite heavily in July.

The proportion of spam that contained a malicious attachment or link increased toward the end of the previous month. This is a resilent pattern. However, July highlights the decrease in spam emails resulting in NDRs (spam related non-delivery reports).

Phishing analysis

In July, the global phishing rate decreased by 0.003 percentage points, taking the global average rate to one in 475.3 emails (0.21 percent) that comprised some form of phishing attack. 

The Netherlands remained the country most targeted in July, with one in 94.4 emails identified as phishing attacks. South Africa was the second-most targeted country, with one in 171.2 emails identified as phishing attacks.

Phishing web sites are most often created by automated toolkits which consists of 63.8-percent. Other tactics include unique domains (27.4-percent), IP Address Domains (4.3-percent), Free Web Hosting Sites (3.6-percent) and Typosquatting (0.9-percent).

Malware Analysis

The global ratio of email-borne viruses in email traffic was one in 340.9 emails (0.293 percent) in July, a decrease of 0.023 percentage points since June.

In July, 26.5 percent of email-borne malware contained links to malicious Web sites, 1.5 percentage points higher than June.

The Netherlands remained the geography with the highest ratio of malicious email activity in July, with one in 82.2 emails identified as malicious.

Malware attacks consist of a few core types:

1.) Malicious email-borne attacks

Malicious email-borne attacks destined for small to medium-sized businesses (1-250) accounted for one in 404.4 emails, compared with one in 214.4 for large enterprises (2500+).

2.) Web-based malware threats

This is referring to Web sites which carry malware propogation either deliberately or not.

3.) Endpoint security threats

This is referring to propagation of attacks via USB storage devices and insecure network connections.

Symantec sensors

Symantec has established some of the most comprehensive sources of Internet threat data in the world through the Symantec Global Intelligence Network, which is made up of more than 64.6 million attack sensors and records thousands of events per second.This network monitors attack activity in more than 200 countries and territories through a combination of Symantec products and services such as Symantec DeepSight Threat Management System, Symantec Managed Security Services and Norton consumer products, and other third-party data sources.

In addition, Symantec maintains one of the world’s most comprehensive vulnerability databases, currently consisting of more than 47,662 recorded vulnerabilities (spanning more than two decades) from over 15,967 vendors representing over 40,006 products.

Spam, phishing and malware data is captured through a variety of sources, including the Symantec Probe Network, a system of more than 5 million decoy accounts; Symantec.cloud and a number of other Symantec security technologies. Skeptic, the Symantec.cloud proprietary heuristic technology is able to detect new and sophisticated targeted threats before reaching customers’ networks. Over 8 billion email messages and more than 1.4 billion Web requests are processed each day across 15 data centres. Symantec also gathers phishing information through an extensive antifraud community of enterprises, security vendors, and more than 50 million consumers.

These resources give Symantec’s analysts unparalleled sources of data with which to identify, analyse, and provide informed commentary on emerging trends in attacks, malicious code activity, phishing, and spam. The result is the annual Symantec Internet Security Threat Report.