DHL Express spam campaign leads to fake AV

A new spam campaign impersonating the popular mail service DHL Express is currently underway, warn Bkis researchers.

The email in question looks like this:



Once the user downloads and opens the attachment, the worm contained in it downloads a fake AV solution from a server located in Russia.

The fake AV ("XP Home Security") immediately starts its work and tries to trick the user into buying a full version that will supposedly remove all the infections it found.

Users are warned to be careful when reviewing emails purportedly coming from DHL express or any of the other well-known express mail services - more often than not, they are fake emails containing malicious attachments.

[net-security]

Hundreds of thousands of hacked websites spreading scareware

Using an automated SQL injection attack, criminals have embedded links to domains carrying scareware in hundreds of thousands of websites. In some cases, visitors to an infected website see an additional page that pretends to be anti-virus software and claims to have discovered an infection on the user's system.

What is not clear is how often the criminals succeeded in embedding the links so that they actually work.

The scattergun approach taken by the SQL injection attack on the content databases of content management systems has meant that in many cases the links were placed in fields such as the title tag which are not interpreted when the page is displayed and are therefore never called. According to Websense, the URLs were also found in some URLs for iTunes podcasts, possibly via modifications to RSS feeds from the vendors in question. Here too the attack carries no threat, as the browser does not interpret the injected links.

The URLs include an address in the domain lizamoon.com and many security experts have therefore designated it the lizamoon attack. The domains used are no longer accessible. Security specialist Dancho Danchev has published an analysis of the domains used by this particular scareware campaign; he reports that they all ultimately lead back to a single IP address. The domains were registered just a few days ago using automatically registered Google Mail accounts.

Anyone running a web server should check their websites for injected JavaScript tags containing links such as <script src=http://lizamoon.com/ur.php></script>. If found, these should be removed. They will also need to find the SQL injection vulnerability used to inject the nefarious content. Installing the latest version of the web application used may be sufficient, but in some cases it may be advisable to seek professional assistance from a code auditor or pen tester.

[H-Online]

Scammers Pushing Fake AV Via Skype

Rogue anti virus software companies have decided to "reach out and touch someone," according to a new report from Krebsonsecurity.com.

Groups responsible for pushing the bogus anti malware programs are using Internet-based phone calls over the Skype network to trick unsuspecting users into downloading their fraudulent wares, the site reports.

Skype users are reporting they’re getting automatic calls from vendors pushing rogue anti-virus, according to a post on Krebsonsecurity.com. The scam is not unlike an unwanted telemarketer call, with users asked to follow instructions given by the mechanized call. Those who fall for the ruse find themselves hit with a ubiquitous scareware page, warning them that their computer is infected and advising them to erase the threats from their computer. After clicking through the warning, users are sent to a “shopping cart” which convinces them to purchase their “professional online repair service.”

Previously spammers have used Skype to peddle their malware via online notifications, while larger projects, like spam campaigns and worms, have become more commonplace with the software.

[Krebs on Security] via [ThreatPost]

Security Fake Security Software Websites – Still popular in 2011

Fake security software is a form of computer malware that misleads users into installing and potentially paying for fake security software. The sites convince users to download the malicious software by displaying fake security warnings such as “Your computer is infected” etc. End users are clearly not educated about such attacks, as the campaigns remain highly successful. Below is a short blog analyzing a recent infection on a friend’s machine to illustrate the problem.

We continue to see numerous infected sites, which are redirecting users to fake security software campaigns. The pages display animated fake security warnings to users in order to scare them and convince them to download and install a binary, which is generally packaged as fake antivirus software. The victim will be infected with a downloader Trojan that will then download additional malware. Below are a few screenshots of animations typically used in the attacks:

After this initial load animation, the user will be prompted with another security warning:

Once a user clicks on the OK button, additional animated fake security warnings will be displayed.

At this point, the user is prompted to download the fake antivirus software.

This same campaign has been used over and over again and can be found hosted at thousands of domains.

All of the above animations are from the same malicious website. The content is randomly changed for each new visit to the site. Once installed the victim is forced to activate or buy a license key to remove these fake threats from the system. Here are some tips for users who still wants to stay away from those attacks.

1) No real Antivirus vendor displays such security warnings, animations and popups.

2) No website will scan a system when visited and display immediate warnings about threats on the system.

3) No real Antivirus vendor will force you to download an executable.

4) When you need AV software, go directly to the site of a reputable vendor yourself.

5) Keep an eye on address bar for the URL name and redirected URL names.

6) Keep any eye on the status bar of the browser, which is present at the bottom to spot redirection taking place.

7) If you want to download executable but are unsure that it is legitimate, it can be scaned against various antivirus vendiors by submitting it to a service such as VirusTotal If popular vendors triggers or declare the file as malicious, immedeatly delete it from the system.

Install a common antivirus solution and keep it updated with latest virus definitions.

9) Last but not least, never pay for such fake security software.

The VirusTotal results for the fake security software from the above example show that it was detected by only 21/42 popular AV vendors. Even now, we are still seeing a large number of fake security software websites promoting their fake products.

Stay safe

[zscaler] via [ComputerSecurityArticles]

Japan earthquake search results already poisoned

It didn't take long for malware pushers to take advantage of Internet users' hunger for news and videos from Japan after it was hit today by the most powerful earthquake in the last 100 years:



According to Trend Micro, a search for the “most recent earthquake in Japan” will yield many search results that take users to pages where they are offered fake AV solutions.

As always, users are advised to search reputable news sites for up-to-date news. If you feel you must use Google, at least go to http://news.google.com/ to search, since those results are taken from legitimate sources.

As a side note, Google has taken advantage of its search engine popularity to post a Tsunami Alert on the engine's home page for a number of countries that are expected to be hit by waves caused by the tectonic shift.

The company has also launched a version of its Person Finder service for people that search for loved ones and friends in the wake of the earthquake.

[Net-Security]