Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    July 2012
    S M T W T F S
    « Jun   Aug »
    1234567
    891011121314
    15161718192021
    22232425262728
    293031  
  • Email Subscription

  • About Us
    TrendLabs Security Intelligence Blog(breadcrumbs are unavailable)

    Archive for July 6th, 2012




    The security holes in virtual environments open up enterprises to threats that may result in business disruption, data theft, and financial loss. Cybercriminals leverage web server and web applications’ vulnerabilities to access parts of a company’s servers that they should not be able to. These vulnerabilities can be used to access company assets ranging from customer databases to trade secrets. The stolen information can be sold in underground forums or used to launch a far more damaging attack.

    However, despite the obvious risk to the company’s data and the cost of data breaches, system administrators either prefer or are forced to keep their servers unpatched. System administrators sometimes delay patch deployment since restarts are necessary for updates to take effect. For systems requiring 100% uptime, this could mean significant business loss. Vendors may also take time (ranging from days to weeks, even years) in developing patches for vulnerabilities, so administrators have no choice. Just recently, Microsoft announced about zero-day attacks on the vulnerability in Microsoft XML Core Services. Once exploited, it could control an infected system via web-based browser attack. At the time of announcement, there’s no patch available yet. In 2011 alone, 1822 critical ‘software flaw’ vulnerabilities were reported, which more or less put organizations at risk. As such, administrators make a difficult call that may expose their networks to threats, putting company data at risk.

    The infographic “Looking Beyond the Challenges of Securing Virtual Environments” shows virtualization-specific issues that can introduce threats to the corporate network such as legacy exploits, PoCs (proof-of-concept), and zero-day attacks. Once enterprises slip through security holes, these may potentially damage a brand name/image or worse lead to the loss of company “crown jewels.”

     



    Following the fake versions of Instagram, Angry Birds Space, and Farm Frenzy apps, we recently spotted a website offering different fake Skype mobile apps for Android. But based on our analysis, these apps are actually malware that run on older Symbian versions or Android devices installed with apps that enable execution of Java MIDlet. Once installed, the malware send messages to premium numbers without users’ consent.

    The website http://{BLOCKED}ndroidl.ru offers different versions of Skype app for Android. The said site is hosted on Russian domains, similar to the webpages we’ve seen hosting the fake Instagram and Angry Birds Space apps. During analysis, we attempted to download the said app, but noticed that the said app was being downloaded from another website, http://{BLOCKED}mobile.ne.

    We also tried downloading the other Skype mobile app versions being offered by the site. Doing so, however, only lead us to the same .JAR file (instead of an .APK file, the expected download file for Android apps) downloaded from the same malicious site. This .JAR file (detected by Trend Micro as JAVA_SMSSEND.AB) is a Java MIDlet that poses as an installer of Skype for the Android platform. Once executed, the file displays the following interface:

    Should users press the left soft key of their smartphone, it displays the following:

    However, pressing the right soft key redirects the mobile device’s browser to the URL http://{BLOCKED}1.net/?u=1l4zi3m938o80vl. This malicious app functions to send SMS messages to specific numbers. As a result, affected users incur unnecessary monetary charges for these messages.

    Though these fake Skype apps are marketed specifically to Android users, this malicious .JAR file executes on pre-SIS (Software Installation Script) Symbian phones or certain versions of Android that run Java MIDlet. For Android devices to run Java MIDlet, users must first install an app that enables the device to execute the said file. Typically, these type of apps are available on third-party app stores.

    To have an an overview of the latest threats targeting Android devices, you may refer to our infographic Behind the Android Menace: Malicious Apps.

    Trend Micro protects users from this threat via Smart Protection Network™ , which detects and deletes this malicious .JAR file. Access to related websites is also blocked via web reputation service. As an added precaution, users must refrain from downloading apps from dubious websites. Users should also make it a habit to read mobile apps ratings and reviews, to know which apps are safe to download.

    To know more about how to enjoy your mobille devices safely and securely, you may refer to our comprehensive Digital Life e-guides below:

    With additional analysis from Christopher So.

     
    Posted in Malware, Mobile | Comments Off


     

    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice