Nexus

#GameOverZeus P2P #Malware

Read

Systems Affected

Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8
Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012

Overview

GameOver Zeus (GOZ), a peer-to-peer (P2P) variant of the Zeus family of bank credential-stealing malware identified in September 2011, [1] uses a decentralized network infrastructure of compromised personal computers and web servers to execute command-and-control. The United States Department of Homeland Security (DHS), in collaboration with the Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ), is releasing this Technical Alert to provide further information about the GameOver Zeus botnet.

Description

GOZ, which is often propagated through spam and phishing messages, is primarily used by cybercriminals to harvest banking information, such as login credentials, from a victim’s computer. [2] Infected systems can also be used to engage in other malicious activities, such as sending spam or participating in distributed denial-of-service (DDoS) attacks.
Prior variants of the Zeus malware utilized a centralized command and control (C2) botnet infrastructure to execute commands. Centralized C2 servers are routinely tracked and blocked by the security community. [1] GOZ, however, utilizes a P2P network of infected hosts to communicate and distribute data, and employs encryption to evade detection. These peers act as a massive proxy network that is used to propagate binary updates, distribute configuration files, and to send stolen data. [3] Without a single point of failure, the resiliency of GOZ’s P2P infrastructure makes takedown efforts more difficult. [1]

Impact

A system infected with GOZ may be employed to send spam, participate in DDoS attacks, and harvest users' credentials for online services, including banking services.

Solution

Users are recommended to take the following actions to remediate GOZ infections:

Use and maintain anti-virus software - Anti-virus software recognizes and protects your computer against most known viruses. It is important to keep your anti-virus software up-to-date (see Understanding Anti-Virus Software for more information).
Change your passwords - Your original passwords may have been compromised during the infection, so you should change them (see Choosing and Protecting Passwords for more information).
Keep your operating system and application software up-to-date - Install software patches so that attackers can't take advantage of known problems or vulnerabilities. Many operating systems offer automatic updates. If this option is available, you should enable it (see Understanding Patches for more information).
Use anti-malware tools - Using a legitimate program that identifies and removes malware can help eliminate an infection. Users can consider employing a remediation tool (examples below) that will help with the removal of GOZ from your system.

F-Secure

http://www.f-secure.com/en/web/home_global/online-scanner (Windows Vista, 7 and 8)

http://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142 (Windows XP)

Heimdal

http://goz.heimdalsecurity.com/ (Microsoft Windows XP, Vista, 7, 8 and 8.1)

Microsoft

http://www.microsoft.com/security/scanner/en-us/default.aspx (Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows XP)

Sophos

http://www.sophos.com/VirusRemoval (Windows XP (SP2) and above)

Symantec

http://www.symantec.com/connect/blogs/international-takedown-wounds-gameover-zeus-cybercrime-network (Windows XP, Windows Vista and Windows 7)

Trend Micro

http://www.trendmicro.com/threatdetector (Windows XP, Windows Vista, Windows 7, Windows 8/8.1, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2)

The above are examples only and do not constitute an exhaustive list. The U.S. Government does not endorse or support any particular product or vendor.

GOZ has been associated with the CryptoLocker malware. For more information on this malware, please visit the CryptoLocker Ransomware Infections page.

References

Revisions

Initial Publication - June 2, 2014

Read More Add comment

Cara Install Windows 7 Dan 8 Themes Kali Linux

By 0x000216

Read

0 Comments

Read More Add comment

Security #Researchers #Discover New #SSL Flaw

By 0x000216

Read

0 Comments

Codenomicon, which found the Heartbleed flaw, discovered another SSL flaw, this time in the open-source GnuTLS library. GnuTLS is part of many Linux distros.

Security firm Codenomicon has found a new Secure Sockets Layer (SSL) flaw in the GnuTLS open-source cryptographic library. Codenomicon rose to notoriety in April as the security firm that found and branded the Heartbleed flaw in the open-source OpenSSL cryptographic library.

GnuTLS is not as widely deployed as OpenSSL, but it is part of many leading Linux distributions, including Red Hat.

"A flaw was found in the way GnuTLS parsed session IDs from Server Hello packets of the TLS/SSL [Transport Layer Security/Secure Sockets Layer} handshake," Red Hat warns in a security advisory. "A malicious server could use this flaw to send an excessively long session ID value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code."

The main GnuTLS project has issued updates for versions 3.1.25, 3.2.15 and 3.3.3 to correct the vulnerability. Joonas Kuorilehto of Codenomicon is credited by the GnuTLS project for reporting the flaw, technically identified as CVE-2014-3466.

The vulnerability is not directly comparable in scope to the Heartbleed flaw that Codenomicon helped discover back in April. The Heartbleed flaw was first made public April 7 and could have enabled an attacker to read information from a server that was protected with OpenSSL. OpenSSL is also significantly more deployed than GnuTLS, leaving hundreds of thousands of users still at risk a full month after it was first disclosed.

The complete impact of Heartbleed is still being measured, as new attacks against the vulnerability continue to be disclosed.

In a presentation May 28 in Lisbon, Portugal, security researcher Luis Grangeia disclosed new wireless attack vectors for Heartbleed. Grangeia's attack, titled "Cupid," leverages the Extensible Authentication Protocol (EAP), which complements SSL in order to exploit vulnerable users.

While GnuTLS is used primarily only on servers, OpenSSL is also widely used for VPNs as well as mobile devices, including those running on Google's Android operating system. According to a report in April from security firm FireEye, as many as 150 million Android app downloads were at risk from the OpenSSL Heartbleed flaw.

source

Read More Add comment

#Russian Evgeniy Bogachev sought over #cybercrime #botnet

By 0x000216

Read

0 Comments

The US has charged a Russian man with being behind a major cybercrime operation that affected individuals and businesses worldwide.

Evgeniy Bogachev, said to be known as "lucky12345" and "slavik", is accused of being involved in attacks on more than a million computers.

The charges came as authorities seized control of a botnet used to steal personal and financial data.

Computer users were urged to run checks to protect themselves from the threat.

In a press conference held on Monday, the US Department of Justice said it believed Mr Bogachev was last known to be residing in Anapa, Russia.

Cooperation with Russian authorities had been "productive", a spokesman added.

In a entry added to the FBI's Cyber Most Wanted list, it stated: "He is known to enjoy boating and may travel to locations along the Black Sea in his boat."

His charges, filed in a court in Pittsburgh, included conspiracy, wire, bank and computer fraud, and money laundering.

The UK's National Crime Agency (NCA) said people probably had "two weeks" before the criminals would get the botnet functioning again, and posted advice on how to best protect computers.

Internet service providers (ISPs) will be contacting customers known to have been affected by either letter or email. The first notices were sent out on Monday, the BBC understands.

Advice from Get Safe Online

Install internet security software from companies listed on Get Safe Online's Facebook and Google+ profiles to download a free tool to scan for Gameover Zeus and CryptoLocker, and remove them from your computer
Do not open attachments in emails unless you are 100% certain that they are authentic
Make sure your internet security software is up-to-date and switched on at all times
Make sure your Windows operating system has the latest Microsoft updates applied
Make sure your software programs have the latest manufacturers' updates applied
Make sure all of your files including documents, photos, music and bookmarks are backed up and readily available in case you are no longer able to access them on your computer
Never store passwords on your computer in case they are accessed by Gameover Zeus or another aggressive malware program

The action related to a strain of malware - meaning malicious software - known as Gameover Zeus.

Malware is typically downloaded by unsuspecting users via what is known as a phishing attack, usually in the form of an email that looks like it comes from somewhere legitimate - such as a bank - when it fact it is designed to trick a person into downloading malicious software.

Once installed on a victim's machine, Gameover Zeus will search specifically for files containing financial information.

If it cannot find anything it deems of worth, some strains of Gameover Zeus will then install Cryptolocker - a ransomware program that locks a person's machine until a fee is paid.

The FBI said Gameover Zeus could be responsible for "financial losses in the hundreds of millions of dollars".

Global action

In what has been described as the biggest ever operation of its kind, servers all over the world were raided simultaneously by the authorities.

"The scale of this operation is unprecedented," said Steve Rawlinson from Tagadab, a web hosting company involved in the take-down effort.

"This is the first time we've seen a co-ordinated, international approach of this magnitude, demonstrating how seriously the FBI takes this current threat."

Jump media player

Media player help

Out of media player. Press enter to return or tab to continue.

Rory Cellan-Jones reports on a "powerful computer attack", which people have two weeks to protect themselves from

The action meant the authorities could direct what are known as Command and Control (C&C) servers - the machines that control the operation of the botnet.

With the C&C servers under police control, criminals should temporarily be unable to manage the computers they hijacked - but only until they are able to set-up new C&C servers elsewhere.

All computer users are being urged to make sure that the malware has not infected their machines.

"This warning is not intended to cause you panic but we cannot over-stress the importance of taking these steps immediately," said UK-based Get Safe Online, a government-backed organisation that has published a list of software it recommends for the task.

Hi-tech crime terms

Bot - one of the individual computers in a botnet; bots are also called drones or zombies
Botnet - a network of hijacked home computers, typically controlled by a criminal gang
Malware - an abbreviation for malicious software ie a virus, Trojan or worm that infects a PC
Ransomware - like malware, but once in control it demands a fee to unlock a PC

"This is because the UK's NCA has taken temporary control of the communications used to connect with infected computers, but expects only a very limited window of opportunity to ensure you are protected."

Technical problems caused some users to become unable to access the Get Safe Online website on Monday afternoon.

A spokesman said: "We have been overwhelmed by the interest of those trying to take action to protect themselves by visiting our page.

"We are sorry about this and are working very hard to make the page available as quickly as possible. In the meantime, the advice can be accessed via our Facebook and Google+ pages."

More detailed information on the threat was published by the US Computer Emergency Readiness Team (Cert).

'Quarantined computers'

Following a slew of high-profile hack attacks in recent weeks - including eBay, Spotify and shoe retailer Office - security expert Rik Ferguson raised concerns that computer users might be suffering from "notification fatigue".

However, he stressed that this operation was more targeted, and should not be ignored.

"I think one of the things that is really critical with this operation is that if people are infected, it's going to be completely invisible to them," the Trend Micro security researcher said.

The FBI said cooperation with Russian authorities had been "productive"

"One of the strengths of this operation is not only that it involved organisations around the world, but that it involved the ISPs as well.

"The ISPs will go out and proactively notify any of their customers who are infected."

He suggested that machines known to be infected by serious malware should be placed in a quarantined environment until the threat was removed.

"Making it uncomfortable, if not impossible, to use the internet is one of the most effective ways to do that," he said.

source

Read More Add comment

tutorial - Check you Disk speed

By 0x000216

Read

0 Comments

Read More Add comment

11.- OSSIM Reenviando logs de Vmware Esxi. Agentless

By 0x000216

Read

0 Comments

Read More Add comment

Cheap and Instant Game Keys

By 0x000216

Read

0 Comments

Read More Add comment

Tuesday Quiz

By 0x000216

Read

0 Comments

Read More Add comment

US Supreme Court "Definitely" At It Again

By 0x000216

Read

0 Comments

Yesterday was a patent double bill from the US Supreme Court. As our dear blogmeister Jeremy has just posted, it was confirmed that for there to be inducement of infringement, there has to be a direct infringement of the patent by a single entity.

The Supreme Court also issued its decision in Nautilus, Inc. v. Biosig Instruments, Inc., Docket No. 13-369 (2014). This Kat will write about it very briefly, mainly because the pertinent point can be expressed quite concisely.

Another indefinite cat

The case concerned the interpretation of 35 U. S. C. §112, ¶2 that requires that a patent specification “conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as [the] invention.” (Merpel points out that the case refers to the law pre-AIA, but her US friends assure her that the reasoning will apply to the new law as well). A claim that does not meet this requirement is considered "indefinite".

In a patent belonging to Biosig (U. S. Patent No. 5,337,753) and asserted against Nautilus, relating to a heart-rate monitor used with exercise equipment, an issue arose concerning the term describing two electrodes being "in spaced relationship with each other". The District Court held the term indefinite in contravention of §112, ¶2. A majority decision of the Federal Circuit reversed this decision, holding that the test to apply in deciding whether a claim term is indefinite is that the claim is indefinite “only when it is‘not amenable to construction’ or ‘insolubly ambiguous.’”

Justice Ginsberg giving the unanimous decision of the Supreme Court held that this test was wrong, and that the correct test is whether claims, read in light of the specification and the prosecution history, fail to inform with reasonable certainty those skilled in the art about the scope of the invention.

The Supreme Court did not indicate how this test applies to the case before it. The case is now remanded to the Federal Circuit to apply the test indicated by the Supreme Court. It will be interesting to see whether under the mandated test the outcome is different in respect of the claim at issue.

Merpel has seen many comments on this case already, and understands that the new test is considered more strict than that proposed by the Federal Circuit, resulting in a bigger challenge for patentees and applicants.

Read More Add comment

Systems Affected

Overview

Description

Impact

Solution

F-Secure

Heimdal

Microsoft

Sophos

Symantec

Trend Micro

References

Revisions

Recent Posts

Facebook