|
SpywareGuide's Greynets Blog is a destination where you can hear from the people who are part of the SpywareGuide and FaceTime Security Labs research teams, as well as developers, programmers and the occasional guest blogger. You never know what topics will be covered -- spyware, adware, rootkits, botnets, IM worms, the money side of malware, the underbelly of affiliate marketing, the world of greynets. Greynets are network-enabled applications that are installed on an end user's system without permission from IT and are highly evasive to existing security infrastructure. Greynet applications pose a security risk, but their risk must be managed in concert with the business benefits of the applications.
|
|
|
|
- More Fake Instant Messaging Scams
Here's another fake Instant Messaging application from the creator of the fake Google Talk program currently in circulation. This time round, the victim is MSN Messenger:
Click to Enlarge
Clicking the "Sign In" button opens up a smaller popup - asking you to fill in your .NET Passport details. Of course, filling in your details will result in a fake "Service could not be found message". Once you leave the PC, the attacker happily wanders over, browses to the C Directory and steals your login details.
These programs seem to be flavour of the month at the moment...
- Fake GoogleTalk Application In The Wild
We're still trying to pin down exactly how new this is, but it seems someone has released a fake Google Talk application into the wild.
Compare the fake application on the left with the real thing on the right, and note the differences:
Immediately, we can see that the real thing has a rounded curve at the top - the fake is blocky, and looks like a regular Windows application box. There's an "Inbox" link at the top when you start up the fake application - there isn't a link like that when firing up Google Talk for the first time. The Username / Password box is much lower down on the fake application, and (again) the real "Sign In" button is curved on the real application. Finally, you'll see "Forgot your account / Don't have an account" on the genuine Google Talk program - not so on the fake.
How does this work?
Well, the program doesn't connect to the Internet - for this attack to be successful, the hacker needs physical access to a PC that lots of people use. Could be a workplace PC, could be in a school, library, Net Cafe - anywhere where it's possible to run an executable file then retreat to a safe distance while the potential victim sits down and thinks "Just need to check something on IM..."
Assuming the victim enters their login details into the fake application, they will immediately see a fake error message, and probably think no more of it:
Once they've finished whatever they were doing and left the PC, the attacker only has to sit down and browse to the C Drive where they'll see this:
As you probably guessed, any all login details typed into the fake application will be stored in this text file:
We detect this application as Fake Googletalk.
Research Summary Write-Up: Chris Boyd, Director of Malware Research
Additional Research: Chris Mannon, FSL Senior Threat Researcher
- Random Skype Conversations With A Bulgarian...Sort Of
Here's an extract from an odd chat I had today with someone claiming to be a "hot chick from Bulgaria". There's a fair amount of text, so read on if you fancy hearing about how I spent the afternoon being bombarded with pornography and something that reeked of "infection file"....
Continue reading "Random Skype Conversations With A Bulgarian...Sort Of" »
- Comments Working (Again!)
We did fix it - but something went horribly, horribly wrong somewhere and the comments broke again.
*cough*
Anyway, the fresh deluge of Viagra spam in my mailbox tells me the comments are now 100% up and running once more. I'm now going to sit in the corner and cross my fingers...
Hackers are not only harnessing the power of memes in a big way, they are (in some cases) having their creations dictated to them by whatever the passing fad happens to be at the time. A pretty strange turnaround, but it's all down to the popularity of various warring factions on the web that are increasingly attracting a hacking community. Witness the rise of Anonymous, Project Chanology and a host of others, many of whom "borrow" Memes from sites such as 4Chan, then argue over who created what meme first.
Well, read on to see an example of a DDoS tool riddled with memes just so it'll gain acceptance from the target audience (complete with built in radio and chat functionality, just to keep the "Partyvan" mentality going a little longer) after the jump. By the way, there's no getting around this - many Internet memes are (by their very nature) cruel, vile and offensive. This makes the nature of explaining some of these memes slightly tricky, and (as this is a safe for work blog) kind of makes it difficult to link to source material without making you go blind. As such, anything that might cause you boss to yell at you has been labeled not safe for work. And with that out of the way....
Continue reading "Memehacks" »
I had this waiting for me in my Myspace friend request box today:
...uh. I had pegged this as a standard fake profile, but the addition of the personalised "Why, hello there" message wasn't something I'd seen before with one of these fake profile requests. A look at the profile, and...
Click to Enlarge
.....strange - not the usual fake profile hurling adverts for ringtones, Adware and who-knows-what at me. It's a bit arty, a bit daring - certainly in your face, but for once, it's not adverts and scams in your face, and that's a refreshing change. Could it all go wrong with the "About Me" text though?
Apparently not. There's no mention of the latest Viagra pills or even a webcam. This is weird. It's almost too good to be true.
Almost.
Click anywhere on the page, and (courtesy of an invisible overlay)....
Click to Enlarge
Doh! And we were doing so well for a while there...
- I Just Called, To Say.......Nothing, Actually
There seems to be an odd case of dubious phonecalls taking place in the UK at the moment, but nobody can quite work out if the calls are coming from a legitimate company in need of some customer service training or a scam outfit who simply want to match your details to those on a list before selling it on to the highest bidder.
Alternatively claiming to be a representative of Halifax Bank (or First Assist, an accident insurance company), they cold call their "target" and immediately start quizzing them for personal details, apparently without prompting.
There's three whole pages of puzzled individuals here, and another extremely interesting writeup about it here.
- Beware: New MSN Messenger Password Stealing Program In The Wild
A new hacking program is in circulation that lets hackers create executable files easily and with no fuss. When the victim is tricked into running the infection file, a connection is made to the attacker's PC and they can steal any MSN login details stored on the PC. Here's what the attacker sees in his newly created directory after installing the infection creation tool:
Note the selection of text files that accompany the program. We've seen a growing trend for hackers to leave copyright warnings on their programs, and messages of a similar nature elsewhere. Well, the all-out branding assault continues here:
....Belgium Power? Once they're done impressing you with the technical specs of the programs creation, they continue to hit you around the head with more information:
Once you fire up the Client, you can't help but be impressed by the clean, logical layout (very reminiscent of a spreadsheet, actually):
Click to Enlarge
Even better, the desire for being properly credited for their work runs wild here:
Click to Enlarge
According to that screenshot, they consider their Crew name to be a Trademark, and and program itself seems to be Copyrighted (All Rights Reserved). Creating the infection file is as simple as hitting the "Build It" button - when you see this, you're ready to start pushing your infection file to the masses.
Once the attacker has sent the infection file to the victim and convinced them to execute it on their PC, the attacker will be notified like so:
At that point, the attacker simply opens up the "spreadsheet" page and sees this:
The message says "Ready for action" - so very, very true. At this point, the attacker simply opens the "Passwords" tab, hits the "Get MSN Passwords" button and is presented with all the login details stored on the PC:
We detect this as PassHax.
Research Summary Write-Up: Chris Boyd, Director of Malware Research
Additional Research: Chris Mannon, FSL Senior Threat Researcher
- Pinont.com - No Need To Panic
There have been a few discussions on security lists and forums regarding a wave of spam comments on Facebook that (for the most part) mention a site called Pinont.com. There were some theories that this might be some kind of worm attack - however, one of my researchers told me last night that a relative was apparently phished and (not long after) comments such as these started appearing from the relatives account:
As the title states, no need to panic - it's highly unlikely this is anything other than somebody harvesting accounts the old fashioned way then promoting an endless deluge of pill websites. Yes, Phishing sucks - but for now, it doesn't look like Pinont.com is the Herald of the End of Days or anything equally dramatic..
- The Spectre Of Rogue Facebook Applications, Back Once More
In January, everything went a little crazy because of a Facebook application that (if you believed the hype) force installed Zango, hijacked your PC, set fire to your house, killed your pets.....well, you get the idea. In actual fact, the truth of the matter was a little more convoluted. All I could see was that this application opened up a popup, which (every now and again) would just happen to be an advert for Zango. Hardly Earth shattering, but of course it did switch people on to the fact that they needed to be careful which applications they gave permission to access their data while on Facebook.
Well, a few months on and it looks like the BBC had a coder create an application (in three hours or less) that could swipe a whole pile of data on both you and your friends, before mailing it back home to base. I can't stress enough - when it comes to social networking sites, NEVER post anything you wouldn't feel comfortable posting on an otherwise open and accessible site such as your blog, personal website, whatever. I have pages on Myspace, Facebook, Orkut and a whole bunch of others - and there is NOTHING on them that you couldn't find elsewhere. There is no hidden treasure trove of data to mine, and so I don't care what happens to it because it's all out there in the public domain anyway. This is what I've been telling people for the longest time, and it works.
A few days ago, I talked about the oddly intrusive chat attack I experienced, and how FaceTime products can control / lock down / fire into orbit Facebook applications where necessary. To date, there haven't been any applications out there that have gone in and done all sorts of horrible and malicious things to end-users on Facebook. Personally, I've been more concerned about applications that allow people to post a seemingly endless and imaginative array of body parts in various comical situations. Nobody really wants that all over their desktop in a regular workplace environment, right? However, this seems to me to be a warning shot of sorts - a warning that we not only need to consider locking down applications that cause annoyance and embarrassment, but also to keep an ear to the ground as we await the inevitable arrival of the "I BREAK STUFF" application.
Coming soon to a Web 2.0 site near you...
|
|
© Copyright 2006, FaceTime Communications, Inc. All rights reserved. |
|
