Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:


  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    September 2015
    S M T W T F S
    « Aug    
     12345
    6789101112
    13141516171819
    20212223242526
    27282930  
  • Email Subscription

  • About Us


    Author Archive - Abigail Pichel (Technical Communications)




    Patch-Tuesday_gray

    This month’s Patch Tuesday features seven bulletins, with four rated as critical. Updates for Internet Explorer take the spotlight as one bulletin, MS14-010, addresses 24 vulnerabilities in Internet Explorer. These vulnerabilities could result in remote code execution, which could allow an attacker the same user rights as the current user.

    A second bulletin, MS14-007, addresses a separate vulnerability in Direct2D that can trigger remote code execution by opening a malicious website in Internet Explorer or opening an email attachment.

    The remaining critical vulnerability of most importance for most users is MS14-011, which patches a vulnerability in the VBScript scripting engine. If exploited, this could also trigger remote code execution.

    Another critical bulletin, MS14-008, affects Microsoft Forefront for Exchange. While this product is now discontinued, Microsoft has promised security updates until December 2015. Three other bulletins released today were rated as important by Microsoft.

    Other vendors have also been busy patching flaws in their software. Last week, Adobe released a patch to Flash Player to deal with reported in-the-wild vulnerabilities, and this week Shockwave Player received an update as well.

    Users are advised to apply these security updates as soon as possible, as well as visit the Trend Micro Threat Encyclopedia page for further information. Appropriate rules for Trend Micro Deep Security have also been created and are available for use by system administrators.

     
    Posted in Vulnerabilities | Comments Off on Four Critical Bulletins for February 2014 Patch Tuesday



    Patch-Tuesday_gray
    The first Patch Tuesday of the year is relatively light, with Microsoft rolling out only four bulletins for the month. Despite the small figure, users must update their systems immediately to avoid possible  threats leveraging software vulnerabilities.

    Included in this month’s release are updates for three privately reported vulnerabilities found in Microsoft Office. If exploited, these vulnerabilities could allow an attacker to gain the same user rights as the current user. Such access could prove damaging, especially to those with administrative user rights.

    This month’s release also addresses two vulnerabilities that deal with elevation of privilege. The last bulletin addresses an issue affecting Microsoft Dynamics AX that can allow denial of service if the vulnerability is exploited.

    January 2014 marks one of the last months that Windows XP will receive patches.  As previously reported, Microsoft is ending its support of this particular OS on April 2014, a good few months away. Users and enterprises should seriously consider migrating to later versions of Windows to continue receiving patches for vulnerabilities.

    Two other tech companies have also released patches and updates. Oracle has rolled out a Critical Patch Update containing 144 new vulnerability fixes for multiple products. Adobe, meanwhile, released fixes for Adobe Flash Player, Adobe Reader, and Adobe Acrobat.

    Users are advised to apply these security updates as soon as possible, as well as visit the Trend Micro Threat Encyclopedia page.

     
    Posted in Vulnerabilities | Comments Off on January 2014 Patch Tuesday Features 4 Bulletins



    We recently came across a CryptoLocker variant that had one notable feature—it has propagation routines.

    Analysis of the malware, detected as WORM_CRILOCK.A, shows that this malware can spread via removable drives. This update is considered significant because this routine was unheard of in other CRILOCK variants. The addition of propagation routines means that the malware can easily spread, unlike other known CRILOCK variants.

    Aside from its propagation technique, the new malware bears numerous differences from known CryptoLocker variants. Rather than relying on a downloader malware—often UPATRE— to infect systems, this malware pretends to be an activator for various software such as Adobe Photoshop and Microsoft Office in peer-to-peer (P2P) file sharing sites. Uploading the malware in P2P sites allows bad guys to easily infect systems without the need to create (and send) spammed messages.

    Further analysis of WORM_CRILOCK reveals that it has a stark difference compared to previous variants. The malware has foregone domain generation algorithm (DGA). Instead, its command-and-control (C&C) servers are hardcoded into the malware. Hardcoding the URLs makes it easier to detect and block the related malicious URLs. DGA, on the other hand, may allow cybercriminals to evade detection as it uses a large number of potential domains. This could mean that the malware is still in the process of being refined and improved upon. Thus, we can expect latter variants to have the DGA capability.

    The differences between this particular CRILOCK variant and the others have led some researchers to believe that this malware is the product of a copycat. Regardless of its creator, WORM_CRILOCK.A shows that this could become the new favored attack method of cybercriminals.

    Users should avoid using P2P sites to get copies of software. They should always download software from official and/or reputable sites. Given WORM_CRILOCK’s ability to spread via removable drives, users should also exercise caution when using flash drives and the like. Users should never connect their drives into unfamiliar or unknown machines. Our blog entry, Defending Against CryptoLocker, discusses at length additional ways of protecting a computer and a network against CryptoLocker malware.

    Trend Micro uses AEGIS (behavior monitoring) to detect and block all threats related to this malware. For more information on ransomware’s background, you may visit this page. You may also refer to our FAQ page on Cryptolocker for a more comprehensive view about the malware.

    With additional insights from Mark Manahan and Jimelle Monteser 

     
    Posted in Malware | 1 TrackBack »



    We recently noticed that there has been an increase in spammed messages that use airline information as bait. These messages are made to look like notifications from airlines such as Delta Airlines, British Airways, US Airways, and American Airlines. Each message comes with an attachment—often in the form of a fake e-ticket—that recipients are supposed to open. This attachment is actually a BKDR_KULUOZ variant.

    spam_sample_holiday_kuluoz

    Figure 1. Screenshot of sample spam

    KULUOZ variants are known to download and execute other malware, such as SIREFEF/ZACCESS and FAKEAV variants. KULUOZ variants are also evolving: we’ve even seen one variant, detected as BKDR_KULUOZ.MN, that collect system information including the antivirus installed in the affected computer. This is a routine previously unheard of from this malware family.

    While we have seen KULUOZ spam in the past, there have been no significant change in numbers in the past several months. KULUOZ spam now represents nearly half of all malicious spam attachments.

    spam_holidays_1

    Figure 2. Breakdown of spam attachments over a one-week period

    Based on our investigation, this batch of BKDR_KULUOZ is distributed by the Cutwail/Pushdo botnet. Previously, we noted that the said botnet was responsible for sending out Blackhole Exploit kit (BHEK)-like spam that serve UPATRE variants.

    Previous instances of KULUOZ spam used shipping and airline notifications as bait. The exclusive use of airline tickets in this new campaign could be a deliberate move, considering people frequently travel over the holidays. Victims may be more inclined to click attachments if they’re actually expecting airline tickets.

    Users should remain extremely careful when opening messages. Since most messages are specially crafted to look as legitimate as possible, it’s ideal to double-check with the sender to see if an email is legitimate. Trend Micro Smart Protection Network blocks all related threats in this attack.

    With additional insights from Merianne Polintan, Jerwin Solidum, Maydelene Salvador, and Mark Manahan.

     
    Posted in Botnets, Spam | Comments Off on Holiday Season Ushers In Airline Spam, KULUOZ Malware



    Patch-Tuesday_gray
    The last Patch Tuesday of the year features 11 bulletins, with five rated as Critical and the remaining as Important. This month’s release addresses a notable zero-day vulnerability that was used in attacks. The particular bulletin—MS13-096—was noticeably absent in last month’s Patch Tuesday. As previously reported, attackers took advantage of the vulnerability by embedding .DOC files with malicious .TIFF files to gain account privileges.

    Unfortunately, another zero-day vulnerability remains unpatched. Microsoft earlier that a security fix for the escalation of privilege vulnerability (CVE-2013-5065) was not included in this month’s security releases.  Thus, recommendations and workarounds suggested at that time of its discovery remain in effect. Trend Micro Deep Security has been protecting users from threats exploiting this vulnerability via the rule 1005801 – Microsoft Windows Kernel Elevation Of Privilege Vulnerability (CVE-2013-5065) since its discovery.

    The remaining Critical bulletins addresses vulnerabilities in Microsoft Windows, Internet Explorer, and Microsoft Exchange. These may allow remote code execution if exploited by attackers.

    Users are advised to apply these security updates as soon as possible, as well as visit the Trend Micro Threat Encyclopedia page. Trend Micro Deep Security protects customers from threats via the following rules:

    • 1005805 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5047)
    • 1005806 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5048)
    • 1005807 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5049)
    • 1005808 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5051)
    • 1005809 — Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2013-5052)
    • 1005764 — Microsoft Graphics Component Remote Code Execution Vulnerability (CVE-2013-3906)
    • 1005812 — Microsoft Scripting Runtime Object Library Use-After-Free Vulnerability (CVE-2013-5056)
    • 1005815 — Microsoft WinVerifyTrust Signature Validation Vulnerability (CVE-2013-3900)
    • 1000552 — Generic Cross Site Scripting(XSS) Prevention
     
    Posted in Vulnerabilities | Comments Off on December Patch Tuesday Addresses TIFF Vulnerability


     

    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice