Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    August 2014
    S M T W T F S
    « Jul    
  • About Us
    TrendLabs Security Intelligence Blog(breadcrumbs are unavailable)

    Author Archive - Bernadette Irinco (Technical Communications)

    After the out-of-band update for the IE zero-day reported a few weeks ago, this month’s cycle for patches is fairly a light one. Today, Microsoft released seven bulletins addressing several vulnerabilities for October. Out of the security updates only one is tagged as critical.

    Included in this release is MS12-064 that addresses vulnerabilities existing in Microsoft Office. Accordingly, once this vulnerability is exploited via a specially crafted .RTF file, it could result to remote code execution thus compromising the security of the system. Another notable security update is MS12-070 that patches the vulnerability in Microsoft SQL Server in systems with SQL Server Reporting Services (SSRS). Remote attackers can execute commands when this vulnerability is exploited. Moreover, an attacker can just send a specially crafted link to the users to exploit this vulnerability or create a web page hosting an exploit.

    Trend Micro Deep Security and Office Scan with Intrusion Defense Firewall (IDF) plugin users are protected ever since this security advisory is released. For more information on the bulletins and their IDF rules, visit the Threat Encyclopedia page.

    Posted in Bad Sites | Comments Off

    Web applications have become crucial for enterprises to meet customer demands and conduct business on the web. Web apps process data—anything from retail orders to B2B transactions—and store results in a back-end database server where data such as customer information sits.

    However, web apps also introduce security risks like attacks that leverage server and application vulnerabilities. Some of the factors that contribute to the said risks include fast development for apps such that security is overlooked, the existence of legacy and custom-made web apps, and the complex nature of transactions done online.

    Moreover, security often becomes second priority when web developers are commissioned to deliver websites that are fast, scalable, and has good user interface for various users (customers, partners, and employees). There are also cases when IT administrators delay deployment of patches for web-related servers and databases if the patch is unstable or buggy/incomplete.

    Aside from web apps, vulnerabilities in web and database servers can be used by cybercriminals to penetrate enterprise networks, which can result to business disruption, tampered brand image, or the loss of critical data. For instance, the “Apache Killer,” a tool that takes advantage of an Apache HTTP Server vulnerability, enables a denial of service (DoS) attack when exploited. We also spotted a vulnerability in Oracle Database Server’s TNS listener, which can allow access to the database without the need to enter a password or user name.

    In the TrendLabs’ primer Web Applications Vulnerabilities: How’s Your Business on the Web?, we tackled various security risks on web, web application, and database servers and the situations that introduce these risks in the network. It also delves on solutions that can mitigate and protect the network from security loopholes and attacks.

    Posted in Vulnerabilities | Comments Off

    We’re currently investigating a new zero-day exploit that affects Internet Explorer versions 7, 8, and 9. The exploit, which is detected by Trend Micro as HTML_EXPDROP.II, is found to be hosted in {BLOCKED}.{BLOCKED}.104.149. Incidentally, this server also hosted the Java zero-day exploit reported last August 30.

    Based on our initial analysis, when executed, HTML_EXPDROP.II drops a malicious .SWF file (SWF_DROPPR.II). The .SWF file then drops a backdoor detected as BKDR_POISON.BMN. More information the analysis will be posted in this entry.

    Trend Micro Smart Protection Network™ blocks access to the malicious servers and detects the exploit and other malicious files. Watch this space for updates and additional analysis information.

    Update as of September 18, 2012 6:11 AM PDT

    We have identified a second attack that uses this zero-day exploit as well. BKDR_PLUGX.BNM — a variant of the recently discovered PlugX remote access tool (RAT), is the payload of this other attack. It has been demonstrated to have significant information theft and backdoor capabilities, and is used as a component of sophisticated information theft campaigns.

    We detect the malicious files as noted above and URL reputation blocks access to the command-and-control servers. In addition, Deep Security protects users from this threat via IDF rule 1005194 – Microsoft Internet Explorer ‘execCommand’ Use-After-Free Vulnerability.

    Update as of September 18, 2012 6:57 PM PDT

    Microsoft announced that they will be issuing a workaround for this vulnerability within the next few days.

    Update as of September 18, 2012 11:22 PM PDT

    BKDR_PLUGX.BNM has been renamed to TROJ_PLUGX.ME. For more information on PlugX and its capabilities, please check our previous reports:

    Update as of September 19, 2012 10:02 PM PDT

    Microsoft has announced that an out-of-bound patch to resolve this vulnerability will be released on Friday, at 10AM PDT (5PM UTC). In the mean time, a workaround has also been added to the earlier bulletin.

    While this vulnerability may have seen limited exploitation previously, we have seen more and more attacks exploit this security hole. This may have led Microsoft to decide to release a patch outside of the regular Patch Tuesday cycle.

    Until the patch is released, the browser exploit prevention built into Titanium 2013 also protects users against exploits targeting this vulnerability.


    The security holes in virtual environments open up enterprises to threats that may result in business disruption, data theft, and financial loss. Cybercriminals leverage web server and web applications’ vulnerabilities to access parts of a company’s servers that they should not be able to. These vulnerabilities can be used to access company assets ranging from customer databases to trade secrets. The stolen information can be sold in underground forums or used to launch a far more damaging attack.

    However, despite the obvious risk to the company’s data and the cost of data breaches, system administrators either prefer or are forced to keep their servers unpatched. System administrators sometimes delay patch deployment since restarts are necessary for updates to take effect. For systems requiring 100% uptime, this could mean significant business loss. Vendors may also take time (ranging from days to weeks, even years) in developing patches for vulnerabilities, so administrators have no choice. Just recently, Microsoft announced about zero-day attacks on the vulnerability in Microsoft XML Core Services. Once exploited, it could control an infected system via web-based browser attack. At the time of announcement, there’s no patch available yet. In 2011 alone, 1822 critical ‘software flaw’ vulnerabilities were reported, which more or less put organizations at risk. As such, administrators make a difficult call that may expose their networks to threats, putting company data at risk.

    The infographic “Looking Beyond the Challenges of Securing Virtual Environments” shows virtualization-specific issues that can introduce threats to the corporate network such as legacy exploits, PoCs (proof-of-concept), and zero-day attacks. Once enterprises slip through security holes, these may potentially damage a brand name/image or worse lead to the loss of company “crown jewels.”


    During the third quarter of 2011, the threat landscape saw great shifts, replacements, as well as continued cybercriminal efforts. The nature of the attacks seen in the past quarter mostly dealt with software vulnerabilities and different threat infection vectors. This signified possible changes in cybercriminal strategy.

    First off, Google replaced Microsoft as the software vendor with the greatest number of reported vulnerabilities for the quarter—82. This is due to the increasing number of vulnerabilities found in Chrome, which continues to grow in popularity. Oracle came in second place, with 63 vulnerabilities, while Microsoft fell to third place with 58 vulnerabilities.

    Furthermore, the United States, which normally takes the top spot in the list of spam-sending countries dropped out of the top 10 list and was replaced by India and South Korea. South Korea has earlier expressed willingness to take action in order to reduce the spamming activity in their country by blocking port 25 on a nation wide level.

    Trend Micro threat researchers also witnessed a significant shift in terms of cybercriminal attack targets. The attacks have changed from being massive in nature—those aimed at affecting as many users as possible, to targeted, particularly those against large enterprises and government institutions. Research conducted by Trend Micro researchers on these attacks led them to the discovery of one of the most notable groups behind targeted attacks in the third quarter— the LURID downloader.

    Read the rest of this entry »



    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice