Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    December 2013
    S M T W T F S
    « Nov   Jan »
    1234567
    891011121314
    15161718192021
    22232425262728
    293031  
  • About Us
    TrendLabs Security Intelligence Blog(breadcrumbs are unavailable)

    Archive for December 10th, 2013




    Patch-Tuesday_gray
    The last Patch Tuesday of the year features 11 bulletins, with five rated as Critical and the remaining as Important. This month’s release addresses a notable zero-day vulnerability that was used in attacks. The particular bulletin—MS13-096—was noticeably absent in last month’s Patch Tuesday. As previously reported, attackers took advantage of the vulnerability by embedding .DOC files with malicious .TIFF files to gain account privileges.

    Unfortunately, another zero-day vulnerability remains unpatched. Microsoft earlier that a security fix for the escalation of privilege vulnerability (CVE-2013-5065) was not included in this month’s security releases.  Thus, recommendations and workarounds suggested at that time of its discovery remain in effect. Trend Micro Deep Security has been protecting users from threats exploiting this vulnerability via the rule 1005801 – Microsoft Windows Kernel Elevation Of Privilege Vulnerability (CVE-2013-5065) since its discovery.

    The remaining Critical bulletins addresses vulnerabilities in Microsoft Windows, Internet Explorer, and Microsoft Exchange. These may allow remote code execution if exploited by attackers.

    Users are advised to apply these security updates as soon as possible, as well as visit the Trend Micro Threat Encyclopedia page. Trend Micro Deep Security protects customers from threats via the following rules:

    • 1005805 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5047)
    • 1005806 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5048)
    • 1005807 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5049)
    • 1005808 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5051)
    • 1005809 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5052)
    • 1005764 — Microsoft Graphics Component Remote Code Execution Vulnerability (CVE-2013-3906)
    • 1005812 — Microsoft Scripting Runtime Object Library Use-After-Free Vulnerability (CVE-2013-5056)
    • 1005815 — Microsoft WinVerifyTrust Signature Validation Vulnerability (CVE-2013-3900)
    • 1000552 — Generic Cross Site Scripting(XSS) Prevention
     
    Posted in Vulnerabilities | Comments Off



    Nelson Mandela, one of Africa’s most recognizable figures, passed away last December 5. This unfortunate event did not stop cybercriminals from spewing their usual spam campaigns, this time attempting to leverage the African leader’s demise. What is interesting is that even before Mandela’s death, spammers were already using his name to capture users’ attention. Typically, scammers spur such campaigns after a newsworthy event occurred, but we already saw an activity even before Mandela’s passing. We found this particular sample in November:

    mandelaspam_before_edited

    Figure 1. Sample of spam found before Mandela’s death

    The said email is purportedly from the “Nelson Mandela Foundation”. In the said message, recipients are informed that they are one of the winners of a significant cash prize (more than $5.5 million).  To claim the money, users must provide their full name, address, and other personally-identifiable information (PII) and send these to a specific email address. After Mandela’s death, we found another spam campaign that is essentially a copycat of the previous spam we cited, though with minor modifications.

    mandelaspam_after_edited

    Figure 2. Sample of spam found after the African leader’s death was announced

    Providing these information can be risky for users, as spammers may use these in their other, more menacing schemes. These spam are reminiscent of the classic Nigerian or 419 scams, which are known to offer users a chance to profit from a money transfer in exchange of their bank information. This scam eventually took on other forms, which include fake London Olympics and FIFA World Cup promos.   Though dated, the scam remains a staple in the threat landscape. Just recently, we found  several Ice IX servers that are also engaged in distributing Nigerian scams.

    An effective spam campaign is not just defined by the exploit employed or the sophistication of the malware component. The strength of the social engineering lure can be a deciding factor whether a user would unwittingly fall into cybercriminals’ trap or not. This typically falls on the ability of the campaign to tap into users’ vulnerability such as their emotions and curiosity.

    Mandela’s popularity, the news of his death, and the promise of cash prize may be convincing enough for some users to act against their better judgment, like divulging information to unverified parties. The same can be said to the recent typhoon Haiyan scams found on Facebook and spam campaigns.

    To avoid this ruse, users must always be wary of the email messages they receive. If the message comes from an unknown source or is offering something too good to be true, it is best to delete it from your inbox. Trend Micro protects users from this threat by blocking such messages. For more information on how social engineering works, you may read our paper here.

     
    Posted in Spam | Comments Off


     

    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice