New rootkit uses old trick to hide itself
236872
Over the past month, a new type of malicious software has emerged, using a decades-old technique to hide itself from antivirus software.The malware, called Trojan.Mebroot by Symantec, installs itself on the first part of the computer&#39;s hard drive to be read on startup, then makes changes to the Windows kernel, making it hard for security software to detect it.Criminals have been installing Trojan.Mebroot, known as a master boot record rootkit, since mid-December, and were able to infect nearly 5,000 users in two separate attacks, staged on Dec. 12 and Dec. 19, according to Verisign&#39;s iDefense Intelligence Team. In order to install the software on a victim&#39;s computer, attackers first lure them to a compromised Web site, which then launches a variety of attacks against the victim&#39;s computer in hopes of finding a way to run the rootkit code on the PC.Once installed, the malware gives attackers control over the victim&#39;s machine.The group behind this latest rootkit is the same one responsible for the Torpig Trojan, and it is believed to have already installed more than 250,000 Trojan programs, iDefense said in a report on the rootkit published Monday.The interesting thing about Trojan.Mebroot is that it installs itself on the master boot record (MBR). This is the first sector of the computer&#39;s hard drive and it is the place the computer goes to first whenever it wants to boot up the operating system. &quot;Basically, if you can control the MBR, you can control the operating system and therefore the computer it resides on,&quot; wrote Symantec researcher Elia Florio in a blog posting on Trojan.Mebroot.The criminals are using several different versions of this attack code, some of which are not currently being detected by some antivirus products, iDefense said.&quot;At the moment the AV detection is hit and miss across the board, however in the last day a number of vendors have added detection for it already,&quot; said Andrew Storms, director of security operations with nCircle Network Security. &quot;As for penetration, so far many people are showing it as having a low overall distribution. The concern is that the group which may be preparing to distribute the rootkit is well-prepared.&quot;Malicious software that infected the master boot record was common during the MS-DOS era, but it has not been used much in attacks in recent years.In 2005, however, researchers at eEye Digital Security gave a talk at the Black Hat security conference, showing how a rootkit could hide itself on the MBR. This Trojan.Mebroot software is derived from that code, iDefense said.Getting this kind of malicious software to work reliably is a technical challenge, and there have generally been easier ways for the bad guys to take over PCs in recent years, said Marc Maiffret, an independent security researcher who was chief technology officer at eEye when the code was first developed.Attackers were given a hand last year, however, when researchers at NV Labs published a proof of concept MBR rootkit.Maiffret said that while we may soon see more of these MBR rootkits, &quot;it won&#39;t take long for all the antivirus companies to react.&quot;&quot;It&#39;s not some new attack vector that&#39;s going to be hard to prevent,&quot; he said. &quot;It&#39;s just something that people haven&#39;t really paid attention to.&quot;
10223
Blog: Security researcher points to rootkit found in fingerprint authentication software in Sony's Micro Vault USB drive.
259444
A new computer virus is catching people out by coming back from the dead.
753042
(InfoWorld) - The notorious Mpack hacker toolkit is installing malware that carries out its chores -- including spewing spam -- from within the Windows kernel, making it extremely difficult for security software to detect it, Symantec said Thursday. The Trojan horse that Symantec has dubbed "Srizbi" is being dropped onto some PCs by the multi-exploit Mpack, a ready-to-use attack application that until recently has been selling for around $1,000. Responsibility for a large-scale attack launched from thousands of hijacked Web sites last month was pinned on Mpack, as was a follow-up campaign waged from compromised Internet porn sites. Although Mpack can force-feed any malicious code to a commandeered PC, Symantec researchers said Srizbi stands out. Rather than follow the current practice of hiding only some activities with rootkit-cloaking technologies, Srizbi goes completely undercover. The new Trojan, said Symantec, works without any user-mode payload and does everything from kernel mode, including its main task: sending spam. "When Trojans go to spam, they go out to user land," said Dave Cole, director of Symantec's security response team, referring to malware writers injecting their code into visible Windows processes to carry out spam-sending tasks. "Srizbi, though, is basically using kernel libraries [to send spam]," said Cole. "It's calling the kernel libraries it needs." A blog entry by Kaoru Hayashi, a senior security response engineer at Symantec, spelled out the technical details. "Srizbi seems to move a step forward by working totally in kernel mode without the need to inject anything into user mode," wrote Hayashi. "To manipulate the network connection directly in kernel mode, it attaches NDIS and TCP/IP drivers and gets all the Ndis* and Zw* functions that it needs. This technique also allows the Trojan to bypass firewall and sniffer tools, and to hide all its network activities." Translation: Only advanced security tools will detect Srizbi. It's also the first full-kernel malware spotted in the wild. "It's evolutionary, not revolutionary, but it's indicative of what we see in the threat landscape," Cole said. "And if your security software is relying only on [Windows'] APIs to detect malware, you won't be protected. You need something that uses modern, anti-rootkit techniques." Cole added other information to the Srizbi story, in particular his suspicion that its author is probably the same hacker who created Rustock, a dangerous polymorphic Trojan from 2006 that also relied on rootkit technology to avoid detection. "It appears to be from the same author," said Cole. "He's been quiet for a while, and everyone has been waiting for Rustock 2.0. Some thought he'd maybe went away, but [Srizbi] uses some of the same components as Rustock." Cole expects Srizbi to follow a similar trajectory. "The pattern with Rustock seemed to be to get something out there that might be sloppy at first, but to evolve it over time. It's reasonable to believe that [Srizbi] will do the same." According to Symantec's research, the new Trojan is sloppy. "Users may be able to detect the presence of this malicious code via a registry key that happens to not be hidden by the rootkit component," said an alert to Symantec's DeepSight customers. The registry key to look for, said Symantec, is: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RcpApi\\"MachineNum" = "[six random digits-six random digits-two random digits]" In other Mpack-related news, a third Symantec security researcher said today that he's spotted the toolkit selling for as little as $150, an 85 percent reduction from its previous $1,000 price tag. "Considering the toolkit is written in a script language, it is easy to redistribute and modify," said Eric Chien, a Symantec security response engineer. "The sellers likely didn't even need to buy it themselves, but rather probably found some of the multiple Web sites that did not employ standard Web site protections, allowing them to download the whole kit for free. "Talk about clearance sales." Mpack's wider "distribution" spells trouble not only for the hacker -- suspected to be Russian -- who created the multiple-strike attack kit, but for users, too. "Its usage is likely to grow," said Chien. "In addition, without a single author controlling the distribution of the toolkit, we also expect to see forks of the source code with additional exploits, bug fixes, and other feature enhancements."
146614
F-Secure warns of a rogue software application targeting the Mac that purports to clean a user's system.
521445
Phishing scams, already one of the main nemesis on the Net, have apparently just become even more sneaky -- and ingenious. Now, it appears phishing authors are borrowing some time-tested tactics
719439
Company says affected servers were running old, unpatched versions of Ubuntu as well as a number of insecure Web applications.
498738
A hacker has released attack code that could be used to exploit a critical bug in some versions of the Windows operating system.
611270
A new version of the Santy worm appeared over the weekend and poses a broader threat than its ancestors. A new version of the Santy worm appeared over the weekend, and according to analysis done by some security
86222
In brief Exploit circulating for unpatched vuln
227893
Blog: This security update for Windows users piggybacks patches for Apple users.
214456
Update to SecureCore firewall aims to prevent programs from executing malicious commands.
360514
Sophos experts have discovered that do-it-yourself phishing kits are being made available for download free of charge from the internet.
68684
Image files found on image-hosting sites look harmless, but conceal PHP exploit code.
380030
INTERNET banking users beware, there appears to be a new "phishing" method about.   The technique, which avoids most detection systems, works after you log on to an authentic site.
141736
(Source: Webroot)  Rootkits are the latest IT security threat to make the headlines. Anyone who has heard of rootkits knows their nasty reputation: They cannot be removed, they can live on a computer for years without being discovered, and they can wreak havoc with the operating system. This Podcast Briefing gives computer users a clear explanation of what a rootkit is, separates the facts from the myths, and provides recommendations on how users can defend against rootkit infections, and detect and remove them from their systems.
703214
Online crooks are constantly switching tactics in an attempt to invade your PC. Be on guard for these latest sneaky tricks.