Hasta La Gadget!

Microsoft has kicked off a new initiative to try to stop the spread of the Nitol Botnet, and it has the backing of a US District Court in East Virginia in doing so. Microsoft’s Digital Crime Unit was granted permission to go after those distributing the Botnet after it was discovered that cybercriminals were infiltrating the company’s supply chain. Apparently, these unfavorable folks were loading counterfeit software housing the malware onto PCs at some point in the supply chain, leading retailers to unknowingly sell the infected machines.

Microsoft says that a supply chain becomes unsecure when reseller accepts stock from an untrustworthy source. After launching an investigation into these unsecure supply chains, Microsoft determined that it was being hosted at 3322.org, which contained a “staggering 500 different strains of malware hosted on more than 70,000 sub-domains.” The company obtained an ex parte temporary restraining that allows it to take control of 3322.org, thus stopping the spread of Nitol from it and its sub-domains.

In a write-up on the Microsoft Blog, the company says that 20% of the PCs purchased from an unsecure supply chain during its investigation were infected with malware, which obviously isn’t good. Nitol is capable of spreading to other machines and devices through things like USB flash drives, making the problem even more severe. Once you’ve been infected, all kinds of nasty things can happen to your computer, from the malware distributors remotely activating your webcams and microphones to listen in on what you’re doing, to logging all of your keystrokes and netting your personal information without you ever knowing your security has been breached.

While this is a big step in the right direction in the fight against Nitol, Microsoft is urging distributors, retailers, and resellers to make sure that the machines they buy and then sell to consumers are coming from legitimate sources. Microsoft also says that lawmakers need to do their part to help with the issue. As with most efforts against Malware, Microsoft’s battle against the Nitol Botnet is ongoing, so expect to hear more about it soon. Stay tuned.

Microsoft makes major progress in fight against Nitol Botnet is written by Eric Abent & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Warning: don’t search for Emma Watson online unless you want to get infected. According to an McAfee’s annual list of most dangerous online celebrities, if you’re looking for news about Hermione, specifically naked news, you have about a 12 percent chance of picking up malware. More »

What if a virus were a shapeshifter, able to change its appearance each time it infects a machine? What if a virus used your own files against you, able to ransack the programs on your computer for the bits of code it needs? Judging from the progress made on the Frankenstein virus, a venture sponsored by the U.S. Air Force, that may soon be a reality. More »

We’re getting news of a particularly nasty Trojan targeting Windows-based PC today, which anti-virus companies have dubbed “Shamoon.” Like most malware, Shamoon exists to steal data from computers connected to the Internet, but what it does afterward is quite evil. In an effort to cover its tracks, it begins deleting files, including the Master Boot Record. This, naturally, leaves the PC unbootable, and can cause some major headaches. The malware itself is a 900KB file that uses many encrypted resources, as you can see below.

Shamoon doesn’t seem to be widespread, as Seculert reports that it uses a two-stage attack, apparently targeting “several specific companies in a few industries.” Shamoon works its way into a computer that is directly connected to the Internet, and then from there begins to spread to other computers connected to the same network. As stated above, once it’s done stealing what it wants, it begins to cripple the PCs it infected, reminding Kaspersky of the Wiper malware, which attacked PCs in Iran earlier this year and in turn led to the discovery of Flame.

Kaspersky says that it isn’t Wiper, however, pointing out a few key differences. With those differences apparent, Kaspersky says that Shamoon is likely “a copycat, the work of a script kiddies inspired by the story” of Wiper. It’s good to know that Wiper isn’t becoming more widespread, but at the same time its scary that there are those inspired by Wiper’s level of destruction.

Indeed, it’s rare to see malware that actually does damage, as creators typically aren’t interested in anything but stealing information that could lead to some quick cash. With anti-virus companies like Seculert and Kaspersky still looking into Shamoon, this is still a developing story, so keep it tuned to SlashGear for more information – we’ll have additional details if any new ones surface!

[via ComputerWorld]

New Trojan ‘Shamoon’ leaves PCs unbootable is written by Eric Abent & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.

Anyone that uses a smartphone, tablet, or computer knows that there’s a lot of malware out there with the goal of infiltrating your device and stealing information or causing you headaches. According to security company Kaspersky Labs the amount of malware out there specifically targeting Android increased by a significant amount in Q2 of 2012. The company reports that malware levels increased threefold during Q2.

Kaspersky reports that during the three-month quarter 14,900 new malicious programs targeting Android devices were added to its database. The massive increase in malware indicates according to the company that virus writers are increasingly targeting mobile devices with their malicious programs. It also clearly indicates that the growing popularity of Android is making it an ever-increasing target for nefarious programmers.

Kaspersky reports that 49% of the malicious files added to the database during the quarter were multi-functional Trojans that steal data from telephones such as contact names, e-mail addresses, and telephone numbers. These Trojans were also capable of downloading additional modules from servers run by the programmer. The security company reports that a quarter of the Android specific malware detected were SMS Trojans.

A SMS Trojan is a program that steals money from the victim by sending SMS messages to premium rate numbers without the user knowing. These programs are becoming more widespread and have been seen in 47 different countries whereas a few years ago they were limited to countries of the former USSR, Southeast Asia, and China. One of the most alarming statistics is that 18% of the Android threats detected during the quarter were back doors that could give malicious users full control over an infected device. This type of program is used to build botnets consisting of mobile devices. Trojan Spy programs made up 2% of the discovered malware and according to Kaspersky; this is the most threatening the users. This sort of malware transfer data to give the malicious user access to bank accounts.

Android malware level triples in Q2 2012 is written by Shane McGlaun & originally posted on SlashGear.
© 2005 – 2012, SlashGear. All right reserved.