[Video] ThreatVlog, Episode 2: Keyloggers and your privacy

Commercial and black hat keyloggers can infect any device, from your PC at home to the phone in your hand.  What exactly are these programs trying to steal?  How can this data be used harmfully against you?  And what can you do to protect all your data and devices from this malicious data gathering?  In this episode of Webroot ThreatVlog, Grayson Milbourne talks about security, your data, and protecting yourself.

Did you miss the first episode?  Be sure to check it out here:  http://blog.webroot.com/2013/08/20/tor-and-apple-exploits-revealed/

Weird Malware on Display at Black Hat

By Andrew Brandt

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to Yahoo BuzzAdd to Newsvine

I’m at the Black Hat Briefings this week, the annual confab of the best and brightest in computer security, catching up on the trends and tricks malware authors and data thieves employ. I just saw an impressive demo by a pair of security researchers who took a deep dive into the behaviors of four pieces of highly targeted malware.

The researchers, Nicholas Percoco and Jibran Ilyas of Trustwave, ran a live demonstration of four Trojans designed to steal sensitive information and surreptitiously exfiltrate that data to the criminals. Three of the Trojans had been found installed on the servers of retail businesses, and capture credit card information — including the magnetic stripe data recorded by point-of-sale devices (ie., cash registers). The fourth Trojan, found on the computers of a large military contractor, was designed to steal any files in the My Documents folder, as well as any saved passwords on the system.

Of note was the highly targeted nature of the Trojans. In the case of the military contractor, for example, the criminals had obviously done their research, because the attack had targeted several high-level executives within the firm. According to the researchers, the attack started when a maliciously crafted Adobe PDF file was emailed only to the executives in a forged message that appeared to come from the CEO of the company. The forged message even included the CEO’s customized mail “signature” and the message text sounded convincingly similar to the language the CEO might have used.

Most importantly, all four Trojans did an outstanding job of remaining undetected for a significant period of time, which gave them more time to get the job done. Although one Trojan, which used a rootkit driver, had a tendency to “blue screen” their test machines, even a crash might not alert a victim that their computer hosts an infection. After all, Windows can crash for all kinds of reasons, and a crash isn’t necessarily an indication of a malware infection.

I’m looking forward to seeing more talks from other researchers over the course of the coming week. Of particular interest is a talk being given by Greg Hoglund about identifying the perpetrators of malware infections and even the creator(s) of widely distributed types of malware.

Stepping up to the Loserbar

fake google search result

By Andrew Brandt

Add to FacebookAdd to DiggAdd to Del.icio.usAdd to StumbleuponAdd to RedditAdd to BlinklistAdd to TwitterAdd to TechnoratiAdd to FurlAdd to Newsvine

Last year, we at Webroot (as well as many other people) saw a huge spike in two specific types of malware: Rogue antispyware products — the ineffective, deceptive kind — and the various tricks the companies that sell rogues use to trick you into downloading (and eventually buying) their bogus products, something we refer to, generally, as Fakealerts.

Here’s usually how the trick works: First, you’re fooled into browsing to a Web site which employs any of a number of tricks to install the Fakealert code onto your PC. The Fakealert then begins popping up messages warning you about some sort of infection in the System Tray, or in dialog boxes, and/or by opening browser windows to pages that look uncannily similar to control panels or dialog boxes used by Windows XP and/or Vista. Later, after you’ve been provided a smoke-and-mirrors “free scan” of your system (which, of course, reports all kinds of salacious and undesirable “detections”), you’re directed to a page where, for just $59 you can be rid of your spyware problems forever.

Yeah, right.

The tricks these guys employ get more creative with every new iteration. We’ve seen them drop hundreds of junk files on a hard drive, which are then “detected” as infections; install screensavers that look just like your computer is going through Blue Screen of Death convulsions; and run every dirty trick and cheap gimmick to get a sale.

So it came as no surprise when we encountered yet another Fakealert — we decided to call it Adware-Loserbar — that leads, eventually, to a rogue product. What set this one apart was its sheer gall — and a few new tricks we hadn’t seen before.

Continue reading