November 2006 - Posts

New Malware: Bck/tnegA.A

Posted by Sergio Piñeiro at 30 November 06 10:15 For some time we are getting used to malware that checks if it is being monitored with different tools. As the race between malware creators and Antimalware companies continues, new tools and techniques are being developed to try to gain a small advantage

Security in wireless networks

Posted by Sergio Piñeiro at 29 November 06 04:11 WiFi has been around for several years now, and it is currently an established and accepted technology. Some WiFi spots allow users to access the Internet for free on public places, such as airports, libraries, hotels and pubs, which is great. There are

First MS06-70, then WKSSVC

Posted by Sergio Piñeiro at 28 November 06 08:59 On November 14th, Microsoft released the security bulletin MS06-070 , regarding a critical vulnerability in the Workstation service. This vulnerability can be exploited across the Internet, by sending specially crafted network messages to a vulnerable

Spamta goes on, and on, and on...

Posted by egonzalez at 27 November 06 05:25 We were aching for another wave of Spamtas (Stration/Warezov), and here it is. We have seen "a few" more Spamtas around the clock and we have followed their steps. This is what we have come to from 00:00 to 14:00 (GMT +1): The "wave"

Attachment(s): Evolution_061127.GIFf

Of Pandas and colors

Posted by egonzalez at 24 November 06 02:53 Recent studies reveal that giant pandas can distinguish between colors. Yes, this has nothing to do with malware, security or anything like that, but nobody gets hurt from a bit of general culture. Have a nice weekend...

New worm

Posted by Sergio Piñeiro at 23 November 06 11:06 We have come across a new worm in the lab, "Foamer". For an unknown reason it hates DOS command line screens, so it modifies the Windows Registry to prevent users from using it. If you get infected and try to open one, it displays the message

Attachment(s): Foamer.giff

To whet your appetite

Posted by Sergio Piñeiro at 22 November 06 05:48 In a few days' time, PandaLabs will be publishing its 3rd Quarterly Report. We know we are a little late but... Luis' dog, Robin, ate the draft when we were just finishing it, and then there was a power outage and we hadn't saved the file,

Attachment(s): new_threats_pie.giff

Information Leaking: Malware vs. Garbage Bags

Posted by Sergio Piñeiro at 21 November 06 09:41 In the lab we have lots of examples of malware that steal information. We have banker Trojans, keyloggers, password stealers, etc. We are getting used to hearing about laptop stealing, or information theft. We should also be aware of USB drives, flash

Goodbye Orlando

Posted by egonzalez at 18 November 06 04:13 The meetings are over and the feedback is so positive. The whole community is getting involved (academic, corporate, law enforcement, etc.) and things are improving. However, this is not the end of it. In fact, it is just the beginning of it. The e-Crime

Just to be a little bit irreverent...

Posted by Sergio Piñeiro at 17 November 06 02:23 For those of us who are in the computer security business, it's difficult to forget the date when Microsoft publishes its security bulletins (you know, on the second Tuesday of each month). Don't worry, this post is not aimed at advising you to

e-Gold Phish

Posted by Sergio Piñeiro at 16 November 06 05:54 We have received some emails, with a notification about unusual behaviour on our account, and that we need to verify our identity. Of course you get a convenient link to check your credentials. If we check the real address you can see that REAL LINK:

Attachment(s): eGold_Phish2.JPGf

Greetings from Orlando (II)

Posted by egonzalez at 16 November 06 06:24 Loads of interesting cases, ideas, etc. are going on over here. The APWG meeting is over and tomorrow the e-Crime Researchers Summit will start. We are looking forward to seeing what the academics have to say about phishing and all the malware related

Spam as a financial tool (IV)

Posted by Sergio Piñeiro at 15 November 06 09:47 We keep receiving new samples of yesterday's stock scam. This new wave, informs about a slight drop, but assures that this is going to change and that the price will reach a 300% income today. Unfortunately, today is 15th, and the latest price is

Attachment(s): Stocks.giff

Greetings from Orlando

Posted by egonzalez at 15 November 06 05:41 This week the Anti Phishing Working Group (APWG) is celebrating a general meeting along with the e-Crime Researchers Summit. I have presented a paper giving an overview of the phishing in Spain, which has received a good feedback. Some more papers have

Spam as a financial tool (III)

Posted by Sergio Piñeiro at 14 November 06 06:35 Today we have come across a new wave of stocks-related spam. The goal, as usual, is to convince users to make a purchase of stocks from a company. In this particular case "West Excelsior Enterprise Inc." The attack consists on a huge amount

Attachment(s): SpamStocks.giff

Trojan subscription

Posted by Sergio Piñeiro at 14 November 06 12:49 Yesterday we came across a new variant of an old family, which has been visiting us on a monthly basis since February 2006. The Briz family currently consists of 17 different variants, distributed as follows: - February: A. - March: B, C. - April: D,

A different kind of Spam

Posted by egonzalez at 09 November 06 09:24 We have been aware of a spam message pretending to warn of a wave of attacks against Spanish banks, which would take place today (November 9th). However, the link does not direct you to the site it promises (what a surprise!!). As it can be seen at the

Attachment(s): Political_Spam.JPGf

Spamta/Stration/Warezov strike back

Posted by egonzalez at 07 November 06 11:44 The creator/s of these codes (whichever name suits you best) seem to be rather bored again. At least this is the idea we can get from the last wave of over 20 different samples seen in the last hours. As in previous occasions, they seem to have been spammed,

Phantom file formats

Posted by Sergio Piñeiro at 06 November 06 05:38 One of the many tricks employed by hackers in order to entice users into running malware voluntarily is to change the icon of a malicious executable file, so that it passes itself off as a text file, a JPG picture, or… a Word document. But so far,

November 2006 - Posts

New Malware: Bck/tnegA.A

Security in wireless networks

First MS06-70, then WKSSVC

Spamta goes on, and on, and on...

Of Pandas and colors

New worm

To whet your appetite

Information Leaking: Malware vs. Garbage Bags

Goodbye Orlando

Just to be a little bit irreverent...

e-Gold Phish

Greetings from Orlando (II)

Spam as a financial tool (IV)

Greetings from Orlando

Spam as a financial tool (III)

Trojan subscription

A different kind of Spam

Spamta/Stration/Warezov strike back

Phantom file formats

Categories

Archives

Favourites

Site feed