New ZBOT/Zeus Binary Comes with a Hidden Message

Feb10

New ZBOT/Zeus Binary Comes with a Hidden Message

11:49 pm (UTC-7)   |   by Jonell Baltazar (Advanced Threats Researcher)

Trend Micro advanced threat researchers recently came across a new ZBOT/Zeus binary file detected as TROJ_ZBOT.BTM.
ZBOT/Zeus variants are well-known for stealing banking information from its victims via various social-engineering tactics (e.g., spammed messages, malicious links sent to social-networking site members in the guise of messages, and compromising legitimate sites), as evidenced by the following documented noteworthy occurrences:

• Phishing in the Guise of Enhancing Security
• ZBOT Targets Facebook Again
• Several Compromised Thai Sites Serve Malware

Apart from the usual information-stealing tactics ZBOT/Zeus Trojans are known for, however, this new variant came with a hidden message that thanks and taunts some well-known antivirus companies for the help they provide the cybercriminals behind the malware to constantly improve on their craft. The said message, however, will only be visible after the binary file (version 1.3.3.3) unpacks and copies itself onto affected systems’ memory.
This taunting message shows that cyber criminals have systems that monitor the performance of AV companies in detecting their craft, and they are constantly updating their software to avoid detection.
Trend Micro™ Smart Protection Network™ already protects product users from this threat by blocking user access to the malicious site, http://{BLOCKED}p.com/consc/cons.exe, where the binary file could be downloaded via its Web reputation service and by detecting and preventing the file’s execution on affected systems via its file reputation service.
Non-Trend Micro product users, on the other hand, can also stay protected by using free tools like Web Protection Add-On, which was especially designed to block user access to potentially malicious websites in real-time.

iRemove Amsterdam Now Open!

iRemove Amsterdam NOW OPEN!

Having problems with your computer?


Is your system running slow or doesn't start properly?


Worried about personal online security and want to protect yourself against the newest threats of 2010?

Is your computer filled with Viruses, Spamware and Adware & any other types Malware?


Then visit iRemove Amsterdam. Virus & Malware removal specialists, we can help.



Fast & freindly service, NO FIX NO FEE!


Our Services include:

* Virus & Malware Removal
* Computer Safe & Secure Setup
* Home Network Secure Setup (wired & Wireless)
* Remote Assistance & online help
* Fresh Operating System Installation (including "Windows 7")
* Data Backup & Recovery
* Online Store
* Advanced Tutorials in Online Protection & Security
* Local Password recovery (including MSN, AIM, Windows Login, WEP & WPA)


House calls available : 30.00EU per Hour
No travel cost inside Amsterdam

Contact us for a price list of operating systems. email :infected@iremove.nl


Securing & Protecting Local Amsterdam, Byte by Byte. Online, At Home or Pickup & Delivery.

Ex-army bloke says the US is not ready for cyber war

By Nick Farrell
The Inquirer
9 February 2010

FORMER US ARMY computer insecurity specialist Christopher Tarnovsky showed the Black Hat Technical Security Conference exactly why the US cannot handle a cyber war.

Speaking before the throngs of hackers, he hacked into a computer chip called a "Trusted Platform Module" or TPM. TPM chips are supposed to be the industry's highest standard of security and are present in more than 100 million computers sold to businesses and individuals.

When he managed it he had access to all the highly sensitive documents in government and business and almost everything on the PC.

Tarnovsky unlocked the most secure chip manufactured by Infineon Technologies and he claimed that his technique will work on the entire line of security chips manufactured by the outfit. Infineon is the leading maker of TPM chips.

It is not Goodnight Vienna for the computer world, however. Hackers wanting to try the Spanish Inquisition on the TPM chips have to first get their paws on a smartphone, laptop or X-box. They will also then have to torture the TPM chip in acid baths, rust remover, and finally drive a oaken spike into the heart of the chip.

[...]

Chinese-born engineer gets 15 years in spying for China

By Patrick J. McDonnell
Los Angeles Times
February 9, 2010

A Chinese-born aerospace engineer who had access to sensitive material while working with a pair of major defense contractors in Southern California was sentenced Monday to more than 15 years in prison for acquiring secret space shuttle data and other information for China.

U.S. District Judge Cormac J. Carney in Santa Ana imposed a 188-month prison term on Dongfan "Greg" Chung, 73, a naturalized U.S. citizen who lives in Orange.

Carney declared that he could not "put a price tag" on national security and sought to send a signal to China to "stop sending your spies here,"
according to the U.S. attorney's office.

Chung, who worked at Boeing's Huntington Beach plant, denied being a spy and said he was gathering documents for a book, not for espionage. His attorneys argued that much of the material was already available on the public record.

[...]

More information security experts needed, says CyberSecurity Malaysia

MySinchew
2010-02-09

KUALA LUMPUR, Feb 9 (Bernama) -- Although Internet banking cybercrimes are still at a manageable level, the country still needs to produce more information security experts, according to CyberSecurity Malaysia.

"I do not want to claim we have a lack of experts or our experts are enough to solve problems but we need to collaborate to produce more experts," said its chief executive officer Lt Col (Rtd) Husin Jazri.

He said with the number of Internet users rising and the trend moving into an advanced level such as mobile banking, the country needed to be prepared in all areas, particularly with information security experts.

Currently, Malaysia has about 16 million Internet users, he told reporters after delivering the opening speech at the CyberSecurity RSA Seminar 2010 here today.

On online banking, Husin said it was the users rather than financial institutions that were most affected by the cybercrimes.

"I'm not worried about the banks. They have a lot of money to secure their systems. They can have the world's best consultant to look into their security systems," he said.

"It's the human part that gets affected, not the technological part. The users become the victims. When the users communicate to the banks, they are exposed to the social engineering, scams and other threats."

According to Husin, online users should be aware that banks never do online maintenance as far as Internet banking is concerned for their customers.

"We need to educate users on this fact which can contribute towards curbing the problem when they aware of this aspect," he said.

>From the total of 3,564 cases reported last year, 1,022 were fraud and
forgery cases, which accounted for one-third of the cases, Husin said.

"We should share know-how and identify the necessary strategy to address
threats such as increasing risk of security breaches, identity theft,
phishing and cyberterrorism," he said.

'Rugged Manifesto' promotes secure coding

By Tim Greene
Network World
February 08, 2010

Three respected security professionals have issued a call for developers to learn and practice secure programming in an effort to reduce the number of exploits directed at applications.

Called the Rugged Manifesto, the document encourages developers to adopt characteristics that will lead them to write more secure applications.
The three authors of the manifesto are Josh Corman, an analyst with The
451 Group; David Rice, formerly with the National Security Agency and author of Geekonomics, a book about the real cost of insecure software; and Jeff Williams, the chairman of OWASP, an organization focused on Web application security. The trio announced the project at the SANS Institure AppSec Conferenc in San Francisco Monday.

The problem now, Corman says, is that developers write code assuming the only task is to make it perform a function. But that can lead to programs riddled with vulnerabilities that can in turn lead to economic damages, lost data and lost productivity. "We have to get to the mass of programmers who simply don't realize their code is being attacked and subverted by talented and persistent adversaries," he says.

The three are trying to motivate developers to aspire to rugged ideals and to learn how their code can be more secure. It's a philosophy or value set accompanied by business cases showing why it makes economic sense to write rugged software rather than dealing later with the consequences of vulnerable software.

Hackers Try to Steal $150,000 from United Way

By Brian Krebs
Krebs on Security
February 3rd, 2010

Hackers broke into computer systems at a Massachusetts chapter of the United Way last month and attempted to make off with more than $150,000 from one of the nation.s largest charities.

Patricia Latimore, chief financial officer at the United Way of Massachusetts Bay and Merrimac Valley, said unknown attackers tried to initiate a number of bogus financial transfers out of the organization.s bank account, but that the United Way was able to work with its bank to block or reverse the unauthorized transfers.

"We were able to pretty much capture things as they were happening,"
Latimore said. "Fortunately, we saw it on the day that it occurred."

The intruders attempted to send more than $110,000 in unauthorized payroll transfers to at least a dozen individuals across the United States who had no prior business with the United Way chapter. At least one large wire transfer was attempted, for nearly $40,000, to a 32-year-old man in New York.