Malware

Stolen Digital Certificates Becoming Standard Malware Components

In the 15 years or so of serious malware production before 2010, there had been perhaps a handful of examples of malicious programs using digitally signed binaries to bypass antimalware systems. The emergence of Stuxnet earlier this year brought this tactic into the center of the spotlight, and now researchers say that the new mobile Zeus variant that is targeting Symbian and BlackBerry devices is following suit, using a stolen digital certificate to help cloak itself from security systems.

Gaps In International Cyber Law Could Hamper Mariposa Case

ED: Gaps in international cyber law could hamper Mariposa case DEK: The take down of the Mariposa botnet is a cyber law enforcement success story – but gaps in international cyber law could make it difficult to prosecute those behind the botnet. A researcher involved in the analysis and dismantling of the Mariposa botnet said that gaps in cyber law in the countries from which the botnet was operated may make it difficult to prosecute those accused of operating the scheme. Pedro Bustamante, a senior researcher at Panda Security in Spain said that the 20-something crew behind the Mariposa botnet, which netted more than E20,000 a month at its height, may never see jail time because of lax cyber laws in Spain and Slovenia that, among other things, don’t consider it a crime to operate a botnet. In a presentation at the Virus Bulletin Conference in Vancouver, British Columbia, Bustamanted said the take down of the Mariposa botnet, which controlled up to 12 million computers at one point, was an example of the benefits of close cooperation between IT security and anti malware firms and law enforcement. Panda was a member of the Mariposa Working Group – a law enforcement industry partnership that also included the US FBI, Spain’s Guardia Civil (GC), as well as researchers at Georgia Tech, Intel and Neustar. Bustamante said that the botnet, one of the largest ever detected, was particularly effective at leveraging MSN instant messaging accounts to spread from computer to computer – monitoring active chat threads, then inserting messages with links to a malicious drive by download Web site into those active conversations. The Working Group, set up shortly after the botnet was identified in May, 2009, proved instrumental in shutting down the command and control infrastructure that Mariposa used in December, 2009. Law enforcement officials in Spain arrested three Spanish citizens accused of being part of the DDR crew, which leased and operated Mariposa from its Slovenian creators. They also seized systems used by the crew to operate the botnet, recovering data on millions and millions of stolen account credentials, Bustamante said. However, Spanish laws may make it difficult to hold the botnet operators and could make prosecution of them difficult, Bustamante said. Despite evidence gathered by law enforcement that the group stole “millions and millions” of credentials from Mariposa-infected systems, it isn’t clear whether that evidence will be admissiable in the case, nor whether operating a botnet explicitly counts as a crime in Spain, Bustmanate said.  Similar challenges may face prosecutors in Solvenia in their attempts to win jail time for Matjaz Skorjanc, a.k.a Iserdo and Nusa Coh,the 20 somethings alleged to have created and sold the Mariposa botnet client and command and control technology. Data seized in the Mariposa case could be used to identify the entire botnet supply chain, including affiliated criminal groups renting botnets and distributing Trojan horse programs, third parties selling hacking tools like crypters and packers, and money mules who are cashing out illicit proceeds. HOwever, Bustamante said its unclear how far law enforcmeent will go in chasing down the many leads that the Mariposa case generated. “The communiation with law enforcement is one way and difficult,” he said. While clearly proof of the benefit to be had from cooperation between law enforcement and private sector companies, Mariposa may also be an example of the limits of such cooperation in the absence of universal adoption of the Convention on Cyber Crime, which harmonizes national laws on computer crime. To date, forty three nations have signed that treaty, including the United States. However, many European nations, including Spain, have not ratified the treaty. (http://conventions.coe.int/Treaty/Commun/ChercheSig.asp?NT=185&CM=1&DF=9/2/2006&CL=ENG)VANCOUVER–The take down of the Mariposa botnet is a cyber law enforcement success story – but gaps in international cyber law could make it difficult to prosecute those behind the botnet.

LinkedIn Members Targeted by Botnet Malware

Members of LinkedIn who clicked on fake connection requests sent users to a Website that displayed “PLEASE
WAITING…4 SECONDS” before redirecting them to Google. During those 4
seconds, the Website downloaded Zeus data-theft malware onto their PCs. Read the full article. [eWEEK]

All Eyes On Stuxnet At Annual Virus Researcher Summit

by Paul Roberts
2

The world will know more about the mysterious Stuxnet virus by week’s end, after top virus researchers  reveal the findings of their post mortem on Stuxnet at the annual Virus Bulletin Conference. HED: All eyes on Stuxnet at annual virus researcher summitDEK: Researchers will reveal new details about the Stuxnet Virus at the Annual Virus Bulletin Conference in Vancouver this week.

Researcher Finds Infiltration Flaw in Zeus Botnet

by Donald Sears

A security researcher has discovered a potentially crippling
vulnerability in one of the most widely used botnet toolkits, a finding
that makes it easy for blackhats and whitehats alike to take control of
huge networks of infected PCs. Read the full article. [The Register]

Zeus Variant Targets Mobile Online Banking Apps

by Dennis Fisher

Researchers have discovered a variant of the Zeus bot malware that specifically targets users who perform online-banking operations from the mobile phones, playing on the increasingly common use of SMS-based one-time passwords in order to dupe users into loading the malware.

Spamhaus Debuts New Whitelist Service

by Dennis Fisher
1

The Spamhaus Project has debuted a new whitelisting service that is designed to be the inverse of the way that most approved-sender lists work. The Spamhaus Whitelist will exclude by default any IP address or domain that sends marketing or soliciting mail at all and will require domain owners to have an inviation in order to join the whitelist.

Cybersecurity for your growing business
Cybersecurity for your growing business

Topics

Show all

Authors

Threatpost

InfoSec Insider

Infosec Insider Post

Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.

Sponsored

Sponsored Content

Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.