In its recent report,  National Police Agency mentioned that the current estimated total cost of unauthorized transactions suffered by Japanese users reached 1.417 billion yen during the period of January-May 2014. In comparison the estimated total damage cost from these kinds of threats was 1.406 billion yen in 2013.

Data released by Japanese Bankers Association also gives similar alarming statistics: 21 cases of online banking theft occurred in Q1 2014 compared to 14 cases for the whole of 2013. The damage cost in Q1 2014 for these cases is already three times more than the entire damage cost in 2013. Similarly, our Trend Micro Security Roundup for Q1-2014 shows Japan placing second in the countries most affected by online banking malware, following the United States.

Figure 1. Countries Most Affected by Online Banking Malware, January–March 2014

We have seen ZBOT variants like Citadel and Gameover targeting Japanese users in the past, but now we are seeing that a significant increase in the number of online banking Trojans is almost single-handedly due to a single malware family – the VAWTRAK family of online banking malware.

VAWTRAK was first spotted in August 2013 as an attachment to fake shipping notification emails. However, at the time, it was only engaged in the theft of information from FTP and email clients. Recently, however, VAWTRAK has expended to include the theft of banking credentials. As a result of this new behavior, we have seen a significant increase in the number of users affected by VAWTRAK.

We assume that several popular sites in Japan may have been compromised – either directly or via malicious advertisements. From these sites, they are led to malicious sites which contain the Angler Exploit Kit; in several cases the Angler Exploit Kit was identified as leading the users to various Flash and Java exploits. These exploits are then used to install VAWTRAK onto affected systems. Angler is one of the more popular replacements for the Blackhole Exploit Kit, which was shut down in 2013. Feedback from the Smart Protection Network  indicates that the top countries affected by this threat are Japan (79.22%), United States (6.47%), and Germany (6.29%).

Figure 2. Top countries affected by VAWTRAK, May-June 2014

In terms of behavior, VAWTRAK is not particularly innovative. Its behavior is very similar to previous malware families. Its previous behavior of stealing FTP credentials is similar to FAREIT malware, while its banking theft routines is similar to the ZBOT family of banking malware. Both of these families are frequently distributed by spam messages via malicious attachments.

In addition to stealing your money, VAWTRAK also increases the risk of users being affected by other malware. It checks for the presence of a wide variety of security software (including Trend Micro products). If it finds any, it tries to downgrade the privileges of the security software, in an attempt to render these ineffective. Four major banks and five other credit card companies in Japan have been targeted by this malware.

According to senior threat researcher Matsuka Bakuei, the increase in banking malware targeting JP banks can be attributed to information stealing malware such as VAWTRACK and TSPY_AIBATOOK, that have added a functionality allowing it to steal banking credentials.  Furthermore,  traditional banking malware like ZeuS/Citadel is not the only malware which hit JP banks.

In the meantime, we advise that users disable or uninstall browser plug-ins (like Java, Adobe Flash, and Adobe Reader) if they are not needed. If they are needed, we strongly recommend that they be kept up to date, in order to minimize the risk from exploit kits that frequently use exploits for old vulnerabilities.

We block the websites involved in these VAWTRAK attacks, as well as the various VAWTRAK variants (detected as BKDR_VAWTRAK.PHY, BKDR_VAWTRAK.SM, and BKDR_VAWTRAK.SMN.)

With additional analysis from Arabelle Ebora, Rhena Inocencio and Kawabata Kohei

When we said as part of our 2014 predictions that there would be one major data breach per month, we actually hoped we’d be wrong. Unfortunately, so far, we’ve been proven right: the latest victim of a massive data breach is the well-known auction site eBay.

To recap, earlier this week eBay disclosed in a blog post that they had suffered a breach that compromised a database containing “encrypted passwords and other non-financial data”. While they said there was no evidence of unauthorized activity or access to financial information, as a best practice they asked all users to change their passwords.

The scale of the attack is difficult to understate. In a separate FAQ, eBay stated that all 145 million of their users would be affected. By any standard, this represents one of the largest data breaches (by number of affected users) of all time.

The breached information included the following details of users:

• Name
• Encrypted password
• Email address
• Physical address
• Phone number
• Date of birth

There’s really only one thing that end users of eBay can do: change their passwords. If you’re an eBay user and you haven’t changed your password yet – open a new tab and do it right away. If you have difficulty remembering a password, use a password manager. (We’ve previously given out tips on password security.)

System administrators may look at this incident and think: how do I make sure this doesn’t happen to me? After all, if a large, presumably well-funded organization like eBay could be attacked and breached, what more a smaller company with fewer resources?

We have created a special report on data breaches, which looks at the overall data breach threat. Looking at this specific incident, some things stand out that other organizations can learn from. First of all, let’s remember how the attack started: with compromised employee credentials. It is quite likely that these were compromised via some form of spear-phishing. We had earlier discussed the entry points of targeted attacks.

Some technical and non-technical solutions are possible to improve a network’s defenses at this stage. For example, internal usage of two-factor authentication systems can lessen the risks associated with any single password being compromised. Training staff to identify and avoid potential spearphising attacks may also be useful.

As for the data itself, all organizations should consider the increased (and correct) use of encryption. Items that people would consider as sensitive information (like those compromised in this data breach) may or may not be stored in an encrypted format.

Just as importantly, the encryption has to be used correctly. Best practices have to be followed throughout the entire process – from what algorithms are used, to how the encryption is carried out, to how keys are generated, etcetera. In the best of circumstances, cryptography is hard, let alone when it is not done correctly.

There’s no single solution that can remedy all potential security problems. That, however, is the point of a layered security solution: there are various ways that an attack can enter a network, and various ways that it can be detected as well. A properly designed custom defense solution will provide the best opportunity to detect and mitigate these threats.

Over the weekend, Microsoft released Security Advisory 2963983 which describes a new zero-day vulnerability found in Internet Explorer. (It has also been assigned the CVE designation CVE-2014-1776.)

This remote code execution vulnerability allows an attacker to run code on a victim system if the user visits a website under the control of the attacker. While attacks are only known against three IE versions (IE 9-11), the underlying flaw exists in all versions of IE in use today (from IE 6 all the way to IE 11).

Serious as this vulnerability is, it’s not all bad news. First of all, the vulnerability is only able to run code with the same privileges as the logged-in user. Therefore, if the user’s account does not have administrator rights, the malicious code will not run with them either, partially reducing the risk. (Of course, this is only true if the user’s account isn’t set up as an administrator.)

Secondly, some workarounds have been provided by Microsoft as part of their advisory; of these enabling Enhanced Protected Mode (an IE10 and IE11-only feature) is the easiest to do. In addition, the exploit code requires Adobe Flash to work, so disabling or removing the Flash Player from IE also reduces the risk from this vulnerability as well.

We will continue to monitor this threat and provide new information as necessary.

Update as of April 28, 2014, 12:30 P.M. PDT

End of support for any software, OS or not, leaves users and organizations more vulnerable to threats. However, there are some solutions that can help address or mitigate this dilemma. Virtual patching can complement traditional patch management strategies as it can “virtually patch” affected systems before actual patches are made available. Another benefit is that it can “virtually patch” unsupported applications. For example, Trend Micro Deep Security has been supporting Windows 2000 vulnerabilities even beyond its end of support.

It should be noted that the Enhanced Mitigation Experience Toolkit (EMET) can also help mitigate attacks that may exploit this particular vulnerability. This toolkit prevents software vulnerabilities from being exploited through several security mitigation technologies. According to the Microsoft advisory, “EMET helps to mitigate this vulnerability in Internet Explorer on systems where EMET is installed and configured to work with Internet Explorer.”

Trend Micro Deep Security and OfficeScan Intrusion Defense Firewall (IDF) have released a new deep packet inspection (DPI) rule to protect against exploits leveraging this vulnerability:

• 1006030 – Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2014-1776)

They also have a rule that restricts the use of the VML tag. This rule is already available to customers:

• 1001082 – Generic VML File Blocker

Update as of April 28, 2014, 6:10 P.M. PDT

As we mentioned earlier, this vulnerability is now designated as CVE-2014-1776. It is due to the way Internet Explorer accesses an object in memory that has been deleted or has not been properly allocated (a use-after-free condition). Successful exploitation allows an attacker to execute arbitrary code in the context of the current user.

To mitigate this threat, Microsoft suggests to unregister VGX.DLL, which is responsible for rendering of VML (Vector Markup Language) code in webpages.

The vulnerability is exploited when victim opens specially crafted webpages using Internet Explorer. Users can be convinced to open these sites via clickable links in specially crafted emails or instant messages. An Adobe Flash file embedded in these malicious sites is used to bypass Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) protections on the target system.

As we mentioned earlier, we provide two rules that protect users against this threat. Not only will these rules help reduce the threat until a patch is provided by Microsoft, it will also protect unsupported OSes, such as Windows XP.

Additional analysis by Pavithra Hanchagaiah.

Update as of April 30, 2014, 4:25 AM PDT

To further protect users from this threat, we have released the following additional heuristic solutions for this threat:

• For Deep Discovery, NCIP 1.12083.00 and NCCP 1.12053.00 provide additional protection as well.
• Our browser exploit prevention technology (present in Titanium 7) has rules that detect websites that contain exploits related to this vulnerability.

To help administrators investigate if this threat is affecting their networks, products with  ATSE (Advanced Threats Scan Engine), such as Deep Discovery,  have heuristic rules which detect attacks using this vulnerability. These attacks are detected as HEUR_SWFHS.A and HEUR_SWFJIT.B in the ATSE pattern 9.755.1107 since April 22.

Update as of May 1, 2014, 5:33 AM PDT

We have also released the following additional solution for this threat:

• OPR 10.767.00 provides additional heuristic capabilities to help detect malicious scripts that take advantage of this vulnerability.

Update as of May 1, 2014, 7:15 AM PDT

The original version of this post mentioned modifying the ACL for VGX.DLL, based on recommendations from Microsoft. Microsoft has modified their guidance, and the blog post has been modified accordingly.

Update as of May 1, 2014, 11:03 AM PDT

The original version of this post mentioned that Windows XP will not be receiving a patch for this vulnerability. Microsoft has just released a security update (MS14-021) for this vulnerability, including one for Windows XP. This blog post has been modified accordingly.

A new zero-day vulnerability in certain versions of Internet Explorer has been identified and is being used in targeted attacks. Microsoft has not released an official bulletin acknowledging this vulnerability yet, but has spoken to news sites and confirmed that both Internet Explorer 9 and 10 are affected. The newest version, Internet Explorer 11, does not suffer from this vulnerability.

If exploited, this vulnerability allows an attacker to target users with a drive-by download, allowing files to be downloaded and run user systems without any user input needed, beyond visiting a website.

Two versions of Windows are not affected by this threat: Windows 8.1 (because it includes IE11), and Windows XP (because it only supports up to IE8.) All other versions of Windows are at potential risk, depending on the version of Internet Explorer present on the system.

This attack was initially spotted on the website of a non-profit organization in the United States. The files used in this exploit are detected as HTML_EXPLOIT.PB, HTML_IFRAME.PB, and SWF_EXPLOIT.PB. The backdoor that was planted on affected machines using this zero-day is detected as BKDR_ZXSHELL.V. No formal bulletin or workarounds have been issued by Microsoft; we recommend that users of Windows 7 or 8 consider upgrading to Internet Explorer 11 to avoid this problem.

We are currently analyzing both the exploit itself and the payloads used in this attack, and will provide further information as appropriate.

Update as of 5:00 PM PST, February 16, 2014:

We have released new Deep Security rules that provide protection against this vulnerability, namely:

• 1005908 – Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2014-0322)
• 1005909 – Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2014-0322) – 2
• 1005911 – Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2014-0322) – 3

Update as of 11:00 PM PST, February 19, 2014:

Microsoft has released an advisory acknowledging this attack and confirming that it is limited to Internet Explorer 9 and 10. A workaround has also been provided in the form of a Microsoft Fix It solution.

People are seldom an entirely open book. It’s common sense and rational to keep some stuff like financial and medical records away from prying eyes. For others, it can be something trivial and silly (say, an embarrassing taste in music) to the more serious (like a traumatic event in one’s past).

With so many methods of sharing, keeping things private is increasingly becoming more  difficult. Websites and services often ask for personal information and track users’ online habits to provide a more “customized” experience. Despite methods of sharing within a select group, sharing online has practically become synonymous with sharing with the public. No matter the privacy level of an account, anything posted online will sooner or later find its way to the public.

This kind of activity is driving some users to reconsider the amount of information they are willing to share. In 2014, we will see users exert more effort in learning tools that can protect their data and control what they share online. This year will be about making sure that secrets remain secret.

It’s not just individuals who have secrets to keep. So do businesses. These can include their future plans and strategies, to their current procedures, to personnel records of their employees and clients. Exposed to the public – and their competitors – these can cost a business millions, and perhaps in an absolute worst case, drive them out of business completely.

Protecting data should become every organization’s top priority this year, considering that we will see one major data breach incident per month. 2013 was marked by several major data breaches and we will see such incidents continue this year.

As part of our 2014 predictions, we developed this video, with the help of our CTO Raimund Genes, to talk about what users and organizations can do to protect themselves and keep their secrets secret in today’s digital landscape:

So what can you do to protect your secrets? Our advice to users will help here: avoid oversharing on social media. Don’t bank or shop online on sites that you don’t trust. Keep track of you data, wherever it is – whether it’s in the cloud, or on one of your devices. In short, being a good citizen of the Internet will help in keeping your secrets away from cybercriminals and other such bad actors found online.

For more concrete steps that outline what you can do to protect your secrets, you can visit the Secrets website, which is part of our broader 2014 predictions.