Ryan Naraine on KGO AM 810 Newstalk Radio – April 10, 2009
Ed and Jen from San Francisco’s KGO talk radio talk again with Threatpost editor Ryan Naraine. It looks like Conficker is stirring to life (after doing absolutely nothing on April 1) and Ryan says it’s linked to “scareware programs” that pop up warning windows telling users that their computer is infected and that they need to drop some cash on a (fraudulent) anti-virus program to wipe it out.
Internet fraudsters are increasingly taking advantage of the deepening recession to dupe unsuspecting email recipients. The e-mail often includes a request for personal details on the pretense of receiving some financial reward, which later leads to fraud.
Common themes include prize wins, inheritance claims, money mule schemes and, increasingly, recession-beating scams. Read the full story [websense.com]
The Conficker botnet has started to use its peer-to-peer communication system to update itself and download scareware (fake anti-virus programs) to millions of infected Windows machines, according to malware hunters tracking the threat.
The latest Conficker mutant comes a week after a heavily-hyped April 1st activation date and provides the first sign of the motivation behind this malware threat — financially motivated cybercrime.
From ZDNet (Dancho Danchev)
The official web site of Paul McCartney (paulmccartney.com) has been compromised, and is serving live exploits to its visitors [zdnet.com].
According to Mary Landesman [scansafe.com], the compromise might have occurred through stolen FTP accounting data, taking into consideration the fact that the campaign is also present at several different flat HTML only web sites. Read the full story [zdnet.com]
By Andrew Storms
The looming mobile malware threat of the past decade has yet to materialize. The reason for its lack of fruition, according to scientists, is due to geography and the lack of a dominant market shareholder. However well done the math, the scientific study is flawed nonetheless. “Understanding the Spreading Patterns of Mobile Phone Viruses” a new paper by 4 scientists fails take into account modern malware trends and operational knowledge of security vendors like those of antivirus companies.
Trojan downloaders and malware that masquerades as security software are the two fastest growing threats on the Web right now, according an analysis by Microsoft’s Malware Protection Center. In its latest Software Intelligence Report, released on Wednesday, the MMPC found that a Trojan downloader named Renos that installs rogue security software was the most prevalent threat in the second half of 2008, increasing by 66 percent.
The experts at SRI International, who have been tracking the Conficker worm as closely as anyone, have released the source code to the scanner they wrote to detect the active P2P scanning that Conficker-infected machines perform.
From Washington Post (Brian Krebs)
Web site host and domain name registrar Register.com has been the target of a sustained attack this week [washingtonpost.com], disrupting service for thousands of customers. The attacks began on Wednesday, causing a three-hour outage for many Web sites that rely on the company for hosting and/or use the company’s domain name system (DNS) servers, said Roni Jacobson, executive vice president at Register.com.
Read the full story [washingtonpost.com]
From Computerworld (Gregg Keizer)
An old, but little-known worm has copied some of the infection strategies of Conficker [computerworld.com], the worm that raised a ruckus last week, Microsoft security researchers said late Friday.
Neeris, which harks to May 2005, is now exploiting the same Windows bug that Conficker put to good use, and is spreading through flash drives, another Conficker characteristic, said Ziv Mador and Aaron Putnam, researchers with the Microsoft Malware Protection Center. Read the full story [computerworld.com]
From the Internet Storm Center
The mere existence of the Conficker Working Group (also known as the Conficker Cabal) is something of a minor miracle. Security vendors do not have a long history of cooperating with each other, aside from the perhaps the antivirus companies sharing samples. But, as an unidentified member of the Conficker Working Group writes in this diary entry [sans.org], the joint effort to stop the spread of Conficker could be used as a blueprint for future cooperative eforts.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
