Worm Spreads via Facebook Private Messages, Instant Messengers

According to the received reports about private messages found on Facebook and distributing a link, which is a shortened URL pointing to an archive file “May09-Picture18.JPG_www.facebook.com.zip”.

Once executed, this malware (detected as WORM_STEKCT.EVL) terminates services and processes related to antivirus (AV) software, effectively disabling AV software from detection or removal of the worm. WORM_STEKCT.EVL also connects to specific websites to send and receive information.

Another noteworthy routine is that this worm downloads and executes another worm, one detected as WORM_EBOOM.AC. Based on our analysis, WORM_EBOOM.AC is capable of monitoring an affected user’s browsing activity such as message posting, deleted posted messages and private messages sent on the websites such as Facebook, Myspace, Twitter, WordPress, and Meebo. It is also capable of spreading through the mentioned sites by posting messages containing a link to a copy of itself.

Facebook and IM applications are tools to share and connect. Cybercriminals’ use of these tools is nothing new, but there are users who fall prey to these schemes. We recommend users to be conscious with their online behavior, in particular on social media sites. To know more on how you can prevent these threats targeting Facebook and other social media sites, you may read our comprehensive e-guide A Guide to Threats on Social Media.

Furthermore, with our recent partnership with Facebook, Trend Micro™ protects users via Smart Protection Network™, which blocks access to the related malicious link. The file reputation technology in Smart Protection Network™ detects and deletes both WORM_STEKCT.EVL and WORM_EBOOM.AC.

Reference:

http://blog.trendmicro.com/worm-spreads-via-facebook-private-messages-instant-messengers/

Read More

India crowned global spam-spewing zombie king AGAIN

India has cemented its position as the world's biggest fire hose of spam email, according to new figures.

Hacked computers in the republic working on behalf of crooks spewed more than one in ten of the globe's spam mails in the last quarter, reported web security firm Sophos.

India is home to 5.3 per cent of the world’s internet users, but it plays an oversized role in the global junk mail epidemic. Apparently, lax security leaves the country's PCs prone to viruses, which press-gang machines into remote-controlled zombie armies to do the bidding of criminals - such as flooding inboxes with dodgy advertising spam.

Asian countries disgorged 49.7 per cent of the world's junk email last quarter, compared with 8.6 per cent of spam fired off from North America, according to the stats from Sophos. The security biz also pegged China in eighth place this time around; it's believed the huge authoritarian state's Great Firewall, and the fact that citizens need a licence to run an email server in the nation, play a part in limiting .cn-sourced spam.

Greater availability of internet access in Asia is continuing to fuel the increase in spam from that continent. Only a year ago the US topped Sophos's Dirty Dozen list of spam-relaying countries, but these figures have been turned on their head: India has topped the list of shame for the past two quarters.

The actual content of spam messages have remained largely unchanged, and the identities of gangs responsible for commanding zombie botnets remain unknown.

Reference

http://www.theregister.co.uk/2012/07/25/spam_relay_villains/

Read More