"MiniDuke" the latest Malware, but the Worst

If you live on this planet, you must have definitely have heard of the new malware that is making use of a zero-day vulnerability in Adobe Reader.
This malware is called MiniDuke, and it is slowly but surely becoming the nightmare of any company:

• it is polymorphic – there are thousands of variants in the wild.
• it is using an exploit in a highly popular software product – Adobe Reader.
• it starts its actions once the operating system is rebooted, so it cannot be easily associated with an action which the user did just before the infection.
• the malware copies itself multiple times on the computer, so the cleaning it is rather complex.
• it makes connections to various Comand and Control (C&C) servers around the world, so it can’t be easily stopped just by shutting down of few of these servers.
• it can dynamically find other C&C servers using simple Google searches.
• it uses Twitter to spread links to other C&C servers.
• it obfuscates the downloads of the real payload containing the malware by downloading first GIF files (small icons)

All Avira users are protected and the malicious files are detected as
- EXP/MiniDukeGif.A – exploited GIF samples
- EXP/MiniDuke.A – exploited PDF samples
- TR/MiniDuke.A – the payload binaries
We were able to detect components used in MiniDuke in other malware dating from 2010.  Due to the high complexity, the analysis of the samples continues and an update will be posted here.
Because of the huge number of exploit samples currently we’re working on a generic exploit detection for the PDF and GIF files.
Update:
An engine update was released adding the generic detection of the payload as “TR/Crypt.XPack.gen” and “TR/Dropper.gen”.

Read more »

Zero-Day Java 7 Exploit still Exist

A zero day exploit is a malicious computer attack that takes advantage of a security hole before the vulnerability is known. This means the security issue is made known the same day as the computer attack is released. In other words, the software developer has zero days to prepare for the security breach and must work as quickly as possible to develop a patch or update that fixes the problem

Zero day exploits may involve viruses, trojan horses, worms or other malicious code that can be run within a software program. While most programs do not allow unauthorized code to be executed, hackers can sometimes create files that will cause a program to perform functions unintended by the developer. Programs like Web browsers and media players are often targeted by hackers because they can receive files from the Internet and have access to system functions

While most zero day exploits may not cause serious damage to your system, some may be able to corrupt or delete files. Because the security hole is made known the same day the attack is released, zero day exploits are difficult to prevent, even if you have antivirus software installed on your computer. Therefore, it is always good to keep a backup of your data in a safe place so that no hacker attack can cause you to lose your data

We have been following the news very carefully about the zero day exploit in Java 7 and wanted to post a quick reminder to keep not only your RuneScape account safe but your PC as well by being careful about what sites you visit and potentially not upgrading to Java 7 until the exploit is patched. While your computer is in no danger while continuing to play RuneScape, exploit kits such as Redkit, Nuclear Pack, and Blackhole are currently attacking this vulnerability when you visit untrustworthy sites

One way this vulnerability is being used is to add keyloggers onto susceptible PCs. We would remind you to activate JAG on your RuneScape account as an additional level of account security which should help keep your account safe should your PC become compromised

Please keep in mind that the exploit is being distributed through untrustworthy sites and to be careful about your browsing habits. We want to ensure that you get to continue to enjoy the rich world that is Gielinor for many years to come

Be aware of fake Java patches for the zero-day exploits

We and pretty much the rest of IT world, have written about the Java zero-day exploit, about the fast patch that Oracle release to remove some of the market pressure and also about the fact that such a quick move can only mean that even more bugs were probably introduced, which might lead to other exploits.

Such a mass media frenzy couldn’t have get unnoticed and unused by the cybercriminals.
Now, we and other security companies are seeing malware that pretend to be a patch for the well-known Java zero-day exploit. The malware is pretending to be the Java 7 Update 11 which fixes the mentioned zero-day exploit. All Avira product detect it with the name Java/Agent.AR.
If you haven’t uninstalled Java from your system, then learn here how to disable it securely. If you are not sure if you have Java installed, then use Java’s own page for detection.
This is how it must look like if Java is not installed on your computer or it is deactivated:

If you see a website that is displaying some kind of error that it can’t run something because Java is not installed, then don’t let yourself fooled and never install a software, let it be patch or not, from any other source than the producer’s website. In this particular case, visit this URL and download the installation kit from Oracle: http://java.com/en/download/index.jsp .


Source


tecnoblog.avira.com

Read more »