Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    May 2015
    S M T W T F S
    « Apr    
  • Email Subscription

  • About Us

    Author Archive - Abigail Pichel (Technical Communications)

    Ransomware continues to make waves, especially with the rise of file-encrypting ransomware like CryptoLocker. However, we are seeing yet another alarming development for this malware: it is now targeting mobile devices.

    Reveton Makes a Comeback

    In early May, it was reported that this mobile ransomware was the product of the Reveton gang. Reveton was one of the many cybercrime groups that spread police ransomware, which hit Europe and the U.S. and consequently spread to the other parts of the world.

    It now appears that these cybercrime groups have decided to include mobile users in their intended victims. Our earlier efforts  resulted in some of those behind these attacks being arrested, but not all of these cybercriminals are now behind bars – and some have expanded their efforts into mobile malware.

    This is detected as ANDROIDOS_LOCKER.A and can be downloaded through a specific URL. The domain contains words like “video” and “porn,” which can give an idea of how users wound up on the site.

    The malware will monitor the screen activity when a device is active or running. Based on the analysis of its code, it tries to put its UI on top of the screen when the device is unlocked. People will not be able to uninstall the malicious app by traditional uninstall means as one would normally do because the system or even the AV UI is always “covered” by the malware’s UI.

    It also tries to connect to several URLs that are its command-and-control servers. These are currently inaccessible. However, one URL was found to display pornographic content.  The ransomware appears to be capable of sending information to these C&C servers albeit a limited function because it only has few permissions.

    These URLs are hosted in two IP addresses located in the U.S. and in the Netherlands. Further analysis reveals that these IP addresses also host other malicious URLs, though not related to this particular malware.

    The Continued Migration to Mobile and Best Practices

    Over the last couple of years, “desktop” malware have continued to make their way to mobile endpoints. We reported last March that we encountered Bitcoin-mining malware that targets Android devices. To avoid these threats, we strongly suggest that you disable your device’s ability to install apps from sources outside of Google Play and double check the developer of the app you want to download and be very meticulous of the app reviews to verify apps’ legitimacy.

    This setting can be found under Security in the system settings of Android devices. On-device security solutions (like Trend Micro Mobile Security) provide an additional layer of protection that detects even threats which arrive outside of authorized app stores.

    With additional analysis from Yang Yang and Paul Pajares


    Patch-Tuesday_grayThis month’s Patch Tuesday features eight bulletins, the most number of bulletins released for the year so far. Out of the eight bulletins, two are rated as ‘critical’ and the remaining, ‘important.’ While Microsoft may have released an out-of-band update for Windows XP to address a (then) zero-day vulnerability, updates for that OS are noticeably absent for this rollout.

    Aside from the eight bulletins, this Patch Tuesday also includes the out-of-band security patch that was released two weeks ago addressing an Internet Explorer zero-day vulnerability. But that isn’t the only update concerning Internet Explorer. One of the two ‘critical’ updates, MS14-029, addresses two privately reported vulnerabilities in Internet Explorer that could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.

    The second ‘critical’ update (MS14-022) addresses multiple vulnerabilities in Microsoft Office server and productivity software. According to Microsoft, “[t]he most severe of these vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a target SharePoint server.”

    Two updates address vulnerabilities concerning Microsoft Office. MS14-023 resolves vulnerabilities that could allow for remote code execution if a user opens an Office file in the same network directory as a specially crafted library file. MS14-024, meanwhile, resolves a vulnerability that could security feature bypass if a user “views a specially crafted webpage in a web browser capable of instantiating COM components, such as Internet Explorer.” The remaining updates address vulnerabilities that could allow elevation of privilege and denial of service if exploited.

    Users are advised to apply these security updates as soon as possible, as well as visit the Trend Micro Threat Encyclopedia page for further information. Two rules for Trend Micro Deep Security and Trend Micro Intrusion Defense Firewall plugin for OfficeScan have also been created and are available for use by system administrators:

    • 1006034 – Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-0310)
    • 1006056 – Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2014-1815)

    Update as of 7:26 PM, June 12, 2014

    Adobe has also released security updates to address vulnerabilities affecting Adobe Flash Player. Once these vulnerabilities are successfully exploited, remote attackers can potentially control the system. We highly advised users to update their Adobe Flash Player to version

    Trend Micro Deep Security and Office Scan with Intrusion Defense Firewall (IDF) plugin protect user systems from threats that may leverage these vulnerabilities via the following DPI rules:

    • 1006062 – Adobe Acrobat And Reader Use-after-free Vulnerability (CVE-2014-0527)
    • 1006070 – Adobe Flash Player Buffer Overflow Vulnerability (CVE-2014-0515) – 1
    • 1006066 – Adobe Reader Unspecified Security Bypass Vulnerability (CVE-2014-0512)
    Posted in Vulnerabilities | Comments Off on May 2014 Patch Tuesday Rolls Out 8 Bulletins

    Adobe has released a security advisory regarding a zero-day vulnerability (CVE-2014-0515) found in the program Adobe Flash. According to the advisory, the updates pertain to “Adobe Flash Player and earlier versions for Windows, Adobe Flash Player and earlier versions for Macintosh and Adobe Flash Player and earlier versions for Linux.”

    Adobe has also acknowledged that an exploit for this zero-day exists, targeting Flash players on the Windows platform. If exploited, the zero-day could allow a remote attacker to take control of the system.

    Users should install the update as soon as they can. They can check out the version of Flash installed through a page in the Adobe website. Updates for Flash via Internet Explorer and Google Chrome will be done automatically but you may require restarting the browser. For users who rely on browsers other than Internet Explorer, they will need to install the update twice (one for IE and another for the other browser). Microsoft has also released a security advisory related to this vulnerability. For downloading updates, we encourage users to rely on Adobe’s official site as “Adobe updates” are often used by bad guys to deliver malware and other threats to users.

    We will continue to monitor this threat and provide new information as necessary.

    Update as of May 2, 2014, 4:00 AM PDT

    We have obtained samples of this attack in the wild. We detect these malicious files as SWF_EXPLOIT.RWF. We believe that this is being used in targeted attacks, as a specific version of Cisco MeetingPlace Express has to be installed for this attack to work.

    In addition to detecting these malicious files, our browser exploit prevention technology (present in Titanium 7) has rules that proactively detect websites that contain exploits related to this vulnerability. Products with the ATSE (Advanced Threats Scan Engine), such as Deep Discovery,  have heuristic rules which detect attacks using this vulnerability. These attacks are detected as HEUR_SWFJIT.B with ATSE pattern 9.755.1107 since April 22.

    Update as of May 07, 2014, 10:48 P.M. PDT

    Trend Micro Deep Security and OfficeScan Intrusion Defense Firewall (IDF) have released a new deep packet inspection (DPI) rule to protect against exploits leveraging this vulnerability:

    • 1006031 – Adobe Flash Player Buffer Overflow Vulnerability (CVE-2014-0515)
    • 1006044 – Restrict Adobe Flash File With Embedded Pixel Bender Objects

    Patch-Tuesday_grayThis month’s Patch Tuesday is primarily notable for two reasons. It addresses the recent zero-day vulnerability for Microsoft Word and it also marks the last Patch Tuesday for Windows XP and Microsoft Office 2003. All in all, April Patch Tuesday is relatively light, with only two ‘critical’ and two ‘important’ updates.

    One ‘critical’ update is a patch (MS14-017) addressing the recent zero-day affecting Microsoft Word and Office web applications. If exploited, this vulnerability (CVE-2014-1761) could allow a remote attacker to execute commands remotely via specially crafted files and email messages. This vulnerability was first reported by Microsoft in a Security Advisory, which also contained a fixit tool. According to an advance notification from the company, users must disable the tool after the security update has been applied.

    This month’s release also includes a ‘critical’ cumulative security update for Internet Explorer. This will address six vulnerabilities for the application. If exploited, these could allow remote code execution if a user visits a specially crafted webpage. MS14-019 fixes a vulnerability of Microsoft Windows that will allow remote code execution if a user runs a specially crafted .BAT or .CMD file. A vulnerability in Microsoft Office is addressed by MS14-020. The vulnerability may allow remote code execution if a user opens a specially crafted file in an affected version of Microsoft Publisher.

    As mentioned earlier, this is also the last Patch Tuesday for Windows XP. After 13 years of service, Microsoft will not provide updates for the popular OS version. Users who rely on the platform may find their computers at increased risk as any vulnerability will not be patched anymore. Discussions about the Windows XP end-of-support may be found in our blog entries, “Managing Windows XP’s Risks in a Post-Support World” and “Windows XP Support Ending – Now What?” We encourage users to upgrade to later versions of Windows to ensure that computers remain protected.

    Though not as heavily publicized as Windows XP, Microsoft Office 2003 has also reached its end-of-support—or to be more precise, its extended end-of-support. Office 2003 users will no longer receive any extended period for updates and fixes. Like Windows XP users, Office 2003 users are encouraged to updater to later versions to continue to receive updates. However, users may also opt to go for open source applications like LibreOffice (for Windows and Linux) and NeoOffice (for Mac OS X).

    Microsoft has also released a security advisory containing updates for Adobe Flash Player in Internet Explorer. This update addresses vulnerabilities in Adobe Flash Player for Internet Explorer versions 10 and 11.

    We encourage users to apply these updates as soon as possible. Additional information may also be found in the Trend Micro Threat Encyclopedia page. Appropriate rules for Trend Micro Deep Security have also been created and are available for use by system administrators.

    Posted in Vulnerabilities | Comments Off on April 2014 Patch Tuesday Fixes Microsoft Word Zero-Day

    Just six months after mobile malware and high risk apps reached the one million mark, we have learned that that number has now doubled.

    Figure 1. The number of malicious and high risk apps reaches the 2M mark

    This milestone comes at the heels of the “tenth anniversary” of mobile malware. 2004 saw the first mobile malware—a proof-of-concept (PoC) malware named SYMBOS_CABIR—which infected Nokia phones. But it wasn’t until during the start of the smartphone era that mobile malware exploded onto the threat landscape. From relatively harmless pop-up messages, mobile malware has since evolved to include premium service abuse, information theft, backdoors, and even rootkits.

    And the threats continue to evolve. After hitting the 1M mark, we are now seeing mobile malware veer into pioneer territory. These malware could very well be the bellwether for the kinds of malware we’ll be seeing in the following months.

    Anonymity with TORBOT

    The Onion Router (more commonly known as TOR) is known as one way for users to become “anonymous” online. It’s also known for its connection to underground markets. Cybercriminals are now using TOR to hide their malicious mobile routines. ANDROIDOS_TORBOT.A is the first mobile malware to use TOR to connect to a remote server. Once connected, it performs routines like make phone calls, intercept and read text messages, and send text messages to a specific number. The use of the TOR network makes it more difficult to track down the activity and trace the C&C server.

    Proliferation with DENDROID

    We’ve often discussed how the number of mobile malware keeps increasing at a rapid pace. The creation of a particular remote access Trojan (RAT) mobile malware may soon become a significant contributor to that number.

    ANDROIDOS_DENDROID.HBT can take screenshots, photos, and video and audio recordings. It can also record calls. But what makes DENDROID notable is that it is also peddled as a crimeware tool. DENDROID is being sold in underground markets for US$300 with the promise of easily “Trojanizing” legitimate apps. DENDROID provides an APK binder tool, an APK client, and a background control panel for would-be buyers to repack created apps. Perhaps making it more alarming is that DENDROID was actually found in the Google Play Store.; the malware was able to bypass Google Bouncer and avoid detection.

    Mobile Devices Are Now Miners

    Cybercriminals have also branched out to making miners out of mobile devices. ANDROIDOS_KAGECOIN.HBT has the ability to mine cryptocurrencies like Bitcoin, Dogecoin, and Litecoin. The mining only occurs once the mobile device is charging so the excess usage will not be noticeable. However subtle the routine might try to be, the routine takes a definite toll on the mobile device. Mining for digital currencies requires a lot of processing power that most phones do not have so users will end up with phones with sluggish performance.

    The New Frontier for Mobile Threats

    One thing to note is that the malware discussed in this entry involve topics that are pretty popular within the tech landscape. TOR continues to gain popularity and awareness due to concerns over online privacy. Cryptocurrencies, like Bitcoin and Dogecoin, are fast becoming popular with the public as their monetary values continue to rise (and fall). This only shows that cybercriminals are willing to tap into anything remotely feasible in order to gain new victims.

    With mobile threats reaching the 2 million mark , it’s important that users take the time to secure their devices. Scrutinizing apps, avoiding unknown URLs, and deleting suspicious messages and emails can contribute to a device’s security. Paying close attention to reported software vulnerabilities and flaws—such as the ones involving custom permissions and a system crash vulnerability—is also needed as cybercriminals are wont to exploit these. The Trend Micro Mobile Threat Hub provides helpful information about mobile threats and other security tips for smartphones, tablets and other gadgets.

    Posted in Malware, Mobile | Comments Off on Mobile Malware and High Risk Apps Reach 2M Mark, Go for “Firsts”


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice