Malware

A new ransomware variant encrypts files on a computer but uses a novel twist on monetizing the extortion threat.

Instead of demanding money directly for decryption keys, as has been the case in other instances, it presumes that the owner of an infected computer will search for information to help unlock the files. The search typically leads to a fraudulent company offering a fix but requiring a payment to obtain it. Read the full story [SC Magazine]

The Shadowserver Foundation reported that it has discovered 7 million unique IP addresses infected by Conficker and its variants. Tracking of the attack was accomplished by cracking the algorithm that the worm uses to find instructions on the Internet.

Amid all the malware on Facebook, Twitter, Bit.ly and other social networks and microblogs, there are some new tips and strategies on how to avoid being hijacked. The article describes a number of methods including the hijacking of Twitter trending topics and hijacking legitimate Twitter accounts for total control and then spreading malware links. Advice points to being skeptical of links, even from friends, and eing careful with shortened urls (a great place to hide malicious links). Even though Twitter and Bit.ly are using Google’s Safe Browsing API, some malware continues to work. Read the full article. [ReadWriteWeb]

There are reports of phony FDIC notification e-mails tricking computers users into installing the ZBot identity-theft Trojan. The e-mails
tell the recipients that their banks have filed for bankruptcy and that
the banks’ asserts are now under the control of the FDIC. The links
offered in the message lead to a page that offers users a chance to see
their “personal FDIC insurance file(s),” but which actually installs
the Zeus or ZBot Trojan on their PCs.  See the FDIC warning [fdic.gov]

Microsoft today released its biannual Security Intelligence Report
which demonstrates some surprising conclusions about how the threat
landscape is impacting enterprise networks. For example, the number of
rogue security software infections, which experienced a high-profile
scourge earlier this year, was down, as was the number of Trojan and
downloader infections. Computer worm infections, on the other hand,
surged upward. Read the full story [SearchSecurity.com].

Dennis Fisher and Ryan Naraine discuss the increasing volume
and sophistication of attacks on social networks, the continued rise of malware
campaigns such as Gumblar and the recent news around cyberwar and cyberterror.

Gumblar, the nasty bit of malware that was part of a mass SQL injection on legitimate Web sites this spring, is continuing to spread and its creators have been busy lately, compromising hundreds of new sites, leading to a massive new wave of infections of end-user PCs.