Spyware, viruses, & security forum: NEWS - April 13, 2012

Security researchers have discovered a strain of fake anti-virus software that tries to intimidate supposed file-sharers into paying for worthless software. [Screenshot: Torrent Alert Scareware]

SFX Fake AV, first detected by freebie antivirus scanner firm Malwarebytes, blends the features of scareware with those more associated with ransomware Trojans. The malware stops any legitimate anti-virus package from running on compromised PCs, something common to other other scareware packages. But this particular strain of malware goes further than this by stopping Process Explorer (procexp.exe) and preventing browsers from loading - tactics designed to force marks to complete the 'input credit card details' screen and hand over money for the scamware.

The evil app also falsely tells prospective marks that they are going to be sued for breaching SOPA legislation, claiming it has detected torrent links on PCs. It offers to get around this problem by activating an "anonymous data transfer protocol" for torrent links, another inducement aimed at persuading prospective marks into paying for the worthless security app.

This latter feature differentiates the malware from strains of scareware we've seen in the past, which demand money after supposedly detecting "offensive materials" on PCs, sometimes under the guise of a police fine. SFX Fake AV, by contrast, offers a supposed way to evade law enforcement attention. [Screenshot]

Finally, the malware also performs a fake scan that classifies Windows Registry Editor as a porn tool.

Bruce Harrison, VP Research at Malwarebytes, said: "SFX Fake AV is morphing at a relatively fast rate, so it is something that signature-based vendors will have to watch out for as there will be an increasing number of variants in the wild. Also, the use of Dropbox as a delivery mechanism is a something that the industry is going to have to take into account and protect against, as it is an emerging trend."

http://www.theregister.co.uk/2012/04/13/scareware_ransonware_hyrbrid/

From TrendLabs Malware Blog:

We have encountered a ransomware unlike other variants that we have seen previously. A typical ransomware encrypts files or restricts user access to the infected system. However, we found that this particular variant infects the Master Boot Record (MBR), preventing the operating system from loading. Based on our analysis, this malware copies the original MBR and overwrites it with its own malicious code. Right after performing this routine, it automatically restarts the system for the infection take effect. When the system restarts, the ransomware displays the following message: [Screenshot]

This message prompt informs affected users that the PC is now blocked and that they should pay 920 hryvnia (UAH) via QIWI to a purse number (12 digits) - 380682699268. Once paid,they will receive a code that will unlock the system. This code will supposedly resume operating system to load and remove the infection. This particular variant has the "unlock code" in its body. When the unlock code is used, the MBR routine is removed.

Trend Micro detects this ransomware as TROJ_RANSOM.AQB and the infected MBR as BOOT_RANSOM.AQB.

Ransomware Still In The Game

Unfortunately, we may not be seeing the end of ransomware attacks just yet. Last February, certain attackers compromised the website of the French confectionery shop Laduree to spread the malware. Users who visited the said site when it was compromised ended up with systems infected with TROJ_RANSOM.BOV. This variant was found to display a notification that impersonates the French National Gendarmerie and demands payment from affected users. The people behind this attack have also impersonated police notifications from Italy, Germany, Belgium, and Spain.

Continued : http://blog.trendmicro.com/ransomware-takes-mbr-hostage/

Related: Ransomware Prevents Windows From Starting by Replacing the Master Boot Record

Recent ebanking heists — such as a $121,000 online robbery at a New York fuel supplier last month — suggest that cyber thieves increasingly are cashing out by sending victim funds to prepaid debit card accounts. The shift appears to be an effort to route around a major bottleneck for these crimes: Their dependency on unreliable money mules.

Mules traditionally have played a key role in helping thieves cash out hacked accounts and launder money. They are recruited through email-based work-at-home job scams, and are told they will be helping companies process payments. In a typical scheme, the mule provides her banking details to the recruiter, who eventually sends a fraudulent transfer and tells the mule to withdraw the funds in cash, keep a small percentage, and wire the remainder to co-conspirators abroad. [Screenshot]

But mules are hardly the most expedient method of extracting funds. To avoid arousing suspicion (and triggering anti-money laundering reporting requirements by the banks), cyber crooks usually send less than $10,000 to each mule. In other words, for every $100,000 that the thieves want to steal, they need to have at least 10 money mules at the ready.

In reality, though, that number is quite often closer to 15 mules per $100,000. That's because the thieves may send much lower amounts to mules that bank at institutions which have low transfer limit triggers. For instance, they almost always limit transfers to less than $5,000 when dealing with Bank of America mules, because they know transfers for more than that amount to consumer accounts will raise fraud flags at BofA.

Continued : https://krebsonsecurity.com/2012/04/thieves-replacing-money-mules-with-prepaid-cards/

Developer David Poll discovered that a vulnerability in the Facebook SDK for Android grants specially crafted Android apps unauthorised access to the smartphone owner's Facebook account. Apps such as foursquare use the SDK as a convenient way of reading users' Facebook profiles or posting photos to their walls; usually, this requires additional permissions to be requested from the user.

Once those permissions are granted, the app receives an access token from the Facebook server that, until revoked, enables it to perform the requested actions. Poll found that, with the required permissions in place, the Facebook SDK writes a URL that contains the token to a log file on the smartphone - and this log file is accessible by any app that has been given permission to "Read Sensitive Log Data" during installation.

As many Android users automatically confirm permission requests when installing apps, it shouldn't be difficult for attackers to obtain the required access. Using the stolen access token, a specially crafted app could then obtain any permissions that were granted to the token's legitimate app.

Continued : http://www.h-online.com/security/news/item/Facebook-SDK-hole-leaves-accounts-vulnerable-1519859.html

Sometimes the solution can cause as much mischief as the problem it's trying to correct. Kaspersky Lab said Thursday that it has suspended the distribution of its tool for removing the Flashback Trojan (sometimes called "Flashfake") that spread like wildfire in Apple's Mac computers this month. The firm pointed to a bug that's causing the tool to mess with user settings in the machines it's supposed to be fixing.

"Kaspersky Lab has identified an issue with its free Kaspersky Flashfake Removal Tool," the company said in a statement on its site. "In some cases it is possible that the use of the tool could result in erroneous removal of certain user settings including auto-start configurations, user configurations in browsers, and file sharing data."

The antivirus vendor said the Flashfake Removal Tool would be made available again once the bug was fixed. Another Flashback tool form Kaspersky, called Flashback Checker, is still up and running, the company said. Flashback Checker doesn't remove the Flashback Trojan, which attacks Macs by way of a Java vulnerability that's been fixed in an updated version of the software. Instead, the Flashback Checker tool scans a user's Mac to see if it's infected and if not, checks if the system has the latest Java update installed to prevent an attack.

Continued : http://www.pcmag.com/article2/0,2817,2402981,00.asp

Also:
Kaspersky Lab removes Flashfake Removal Tool
Kaspersky Lab suspends Flashback-removal tool

"Security vulnerability in NVIDIA's proprietary Linux drivers fixed"

A new version of NVIDIA's proprietary UNIX graphics drivers for Linux, Solaris and FreeBSD fixes a security vulnerability (CVE-2012-0946) that allowed attackers to read and write arbitrary system memory in order to, for example, obtain root privileges. To take advantage of the vulnerability, an attacker must have access permission for some device files - which, for systems with these drivers, is typically the case for users who can launch a graphical interface as 3D acceleration and some other features cannot be used otherwise.

Version 295.40 of the driver corrects this problem; for older drivers whose version numbers start with 195, 256 to 285, or 290 to 295, NVIDIA has made patches available that change the vulnerable part of the kernel module belonging to the driver. Users who update the driver with this patch and use the CUDA debugger will also need to update the CUDA library before the debugger can work again.

NVIDIA has categorised the security hole as "high risk" and recommends that users update to the new version if they use the drivers with GeForce 8, G80 Quadro graphics cards, or newer models from those lines. The company has not confirmed whether the problem also exists for older graphics card models or legacy drivers (such as the 173 line).

http://www.h-online.com/security/news/item/Security-vulnerability-in-NVIDIA-s-proprietary-Linux-drivers-fixed-1520095.html

See Vulnerabilities / Fixes: NVIDIA Graphics Drivers for Linux GPU Device Node Access

"False Start's sad demise: Google abandons noble attempt to make SSL less painful"

Google is abandoning an SSL tweak that significantly reduces the time it takes websites to establish encrypted connections with end-user browsers because the experimental technique was causing problems with too many HTTPS servers.

Google security researcher Adam Langley, who announced False Start in 2010, said on Wednesday it would be disabled in version 20 of the company's Chrome browser. Although the technique reduced the latency of an SSL handshake by 30 percent and worked with the vast majority of websites, it remained incompatible with an unacceptably large number of them, mostly those that used dedicated hardware known as SSL terminators, which offload SSL processing from the servers. [Screenshot]

"These hardware devices terminate SSL connections and proxy unencrypted data to backend HTTP servers," Langley wrote in a post titled False Start's Failure. "I believe that False Start intolerance is very simple to fix in the code and one vendor suggested that was the case. None the less, of the vendors who did issue an update, most failed to communicate that fact to their customers."

Langley went on to say he has experienced similar problems getting manufacturers of SSL products to make changes that protect against an exploit demonstrated in September known as BEAST, which can silently decrypt SSL-protected data that's passing between a webserver and an end-user browser.

Continued : http://arstechnica.com/business/news/2012/04/google-abandons-noble-experiment-to-make-ssl-less-painful.ars

Also: Google's False Start gets a real stop

Her Facebook profile says she is into men and women and that she has 726 friends. She graduated from a college that was 338 miles from her high school, according to Facebook.

She has never updated her status on the world's biggest social network, perhaps because she was busy tagging photos: On average, she has 136 tags on every four photos she uploads to Facebook.

And she may very well be fake, according to a study released earlier this year by Barracuda Labs, which identified common characteristics of phony, malware-spreading Facebook profiles.

Fake profiles are a big problem for Facebook. The company had to file an amendment to its initial public offering paperwork with the Securities and Exchange Commission to acknowledge that as many as 6% of its more than 850 million user accounts could be phony, despite strict controls and its best efforts to make sure people don't register under pseudonyms.

We've asked Facebook for comment on what it's doing to cut down on the fake profiles, which are often used to spread malware and spam other users. We'll update the post when we hear back from the company.

On the harmless end, some of those Facebook profiles may have been created for a beloved family pet. More seriously, they may have been set up by a cheating spouse. And at their worst, fake Facebook profiles distribute malware. Users click on links sent to them by a new "friend" and end up with an infected computer. The profiles designed solely to entice you to befriend them were those examined by Barracuda in its study.

Continued : http://www.readwriteweb.com/archives/how_to_spot_a_phony_facebook_profile.php