ESET's ThreatSense.Net® statistical system, which analyses the global trends of virus infections, reported that while on a global scale Conficker was the most prevalent recent infection, with it being detected on nearly one in ten computers (especially rampant in Russia and Ukraine where it was detected in almost one in three computers), in Ireland it is a Trojan, officially labelled WMA/TrojanDownloader.GetCodec that is doing most of the infecting. Latest figures show that in Ireland it featured in approximately 6.5% of all virus detections (while globally it ranked fifth on ESET's threat list with 1.45% of detections).
]]>
Both attacks used a technique known as “cross site scripting” (XSS). The perpetrators of the worms discovered that you could put Javascript code into the “Bio” section of a Twitter account. Anyone then visiting the home page of that account would activate the Javascript which would, in turn, infect the visitors account. Thus the worm was able to spread from one account to another.
]]>
The new variant, Conficker.E (sometimes known as WORM_DOWNAD.E), now has a stop date or May 3rd encoded into it. However the likelihood is that even if the worm itself stops functioning on May 3rd any backdoor that exists as a result of the worm will be left open.
The worm has also been contacting known Waledac worm domains and downloading files from these. Downloads from these servers frequently result in spamming attacks or rogue spyware and virus alerts. The latter may be the real intention of Conficker as it gives cyber-criminals an avenue to monetize the worm’s deployment.
]]>The first was titled "Important Security Alert" and contained the following text:
Your access to Online Services has been suspended. Due to a miss-match access code between your Security information. To enable you continue accessing your online account it will only take you few minutes to verify your Identity. Follow the reference below and you will be guided to where you can gain an instant verification process.
which was followed by the link (DON'T click the link). The interesting thing about this link is that it's on a legitimate (supposedly) radio station website http://www.lemammouthbleu.com Well the site was up when I tried a couple of days ago; but it now "down for maintenance". Were they hacked?
Phish 2 this week was another "You have 1 New Security Notification!" type with just an instruction to log in and the link. I've had two of these this week with the link pointing to different dummy domains.
Just to reiterate the message: don't act on any emails that purport to come from your (or anybody's) bank.
]]>]]>
The worm has in its body an embedded command to trigger its activity on April 1st. This command has thus been activated, prompting the worm to start communication with a randomly-generated number of domains out of the estimated daily total of 50,000 where the worm checks for instructions.
]]>
Like back then, after infecting its target, the malware installs a rogue DHCP server. The main goal of the DHCP server is to spread a bad DNS server IP address.
]]>
The Revenue Commissioners have today (16/03/09) warned of the existence of a fraudulent email purporting to come from Revenue seeking personal information from taxpayers in connection with a tax refund. The email asks the recipient to submit personal details including date of birth and debit/credit card details. This email did not issue from Revenue.
]]>
]]>