There’s a new Mac Trojan dropper that uses a silent installation process and it also has the ability to establish backdoor access to infected machines. Security researchers at Intego found samples of the OSX/Crisis malware on the Virus Total website, but it has not yet been found in the wild.
Botnets are a lot like dandelions; you think they’re dead and then when you’re not looking they pop right back up. It’s happened time and again in the malware ecosystem and the latest member of the undead botnet society is Grum, which was only just taken down last week. Over the weekend several of the command-and-control servers used by the Grum botmasters reappeared in Ukraine.
Dennis Fisher talks with botnet researcher Jose Nazario about whether botnet takedowns are worth the effort, the evolution of attack techniques and whether we can ever get the upper hand on attackers.
A new malware report indicates Android malware samples grew three-fold last quarter and that one in every 140 devices connected to mobile networks was infected at some point.Closer to home, about 14 percent of household networks were hit by malware this spring, with a 50 percent increase in high-level bots, Trojans and backdoors, according to the Q2 2012 Malware Report from Kindsight Security Labs.
Just a couple of days after authorities in the Netherlands pulled the plug on two of the four command-and-control servers behind the Grum spam botnet, the remaining C&C servers have been taken offline as well, thanks to a cooperative effort among researchers. As a result, the number of Grum-infected IP addresses sending spam has fallen from 120,000 down to about 21,000.
Microsoft researchers are warning about a new Trojan horse program for Android mobile devices that sends out premium SMS messages once installed.
When you hear about botnets such as Rustock, Mariposa or Grum being taken down, one of the tactics that’s usually involved is sinkholing. The technique, which involves pointing the infected machines to a server controlled by good guys rather than attackers, often is used as one of the last steps to take the botnet offline. But some recent work done by researchers at Damballa took a slightly different tack and used the sinkhole as a way to study a recently discovered botnet in operation, and what they found in their traffic analysis was pretty interesting.
If you find some random person says they’ve tagged a Facebook photo with you, think twice before you investigate further. SophosLabs has discovered malware infecting machines by getting users to open a malicious link in a fake Facebook e-mail notification.Everything looks legit about the alert with one big exception: the domain name for the sender’s URL is Faceboook.com, not Facebook.com.
In this special edition Threatpost editor-in-chief Dennis Fisher talks with founding editor, Ryan Naraine about Mac security. They discuss why it took longer for the security community to understand the vulnerabilities of the Mac and when these conversations started. You’ll hear how cybercriminals are targeting OS X more than ever before and what you need to know to protect yourself from an attack.
A new variety of spyware has been targeting users in Iran, Israel and the Middle East for the last eight months according to joint research from Israeli security software firm Seculert and Kaspersky Lab. The new malware is using a variety of odd techniques and misdirection to entice users to install it, and researchers say it is targeting a specific group of potentially high-value targets.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
