|
Mila Parkour <milaparkour@gmail.com> |
|
The file "Office2010-kb2289161-fullfile-x64-glb.exe" has been suspended |
Wednesday, September 7, 2011
Mediafire DMCA Office2010-kb2289161-fullfile-x64-glb.exe patch email
Saturday, September 3, 2011
So long and thanks for all the phish
I will be away until Sept 17 and will not be posting until at least Sept 25.
My internet connection will be intermittent but I will reply to all messages
as soon as I can ~ Mila
Sept 3. Liberating Taiwan: one phish at a time. 2010-2011
 |
| chineseposters.net |
I will be traveling most of September but I wanted to leave you with something to play with while I am away.
These 175 phishing messages were received over the course of 18 months by one recipient, who also happens to be a former Taiwan government official and an expert on China. The recent exploits used are mostly CVE-2010-3333 and CVE-2011-0611 and CVE-2010-2883 but you will find a good variety, as well as a lot of RAR files with RTLO and exe. The senders and the recipient are in Asia so these document give you a good idea about the phishing landscape there (in many ways it is similar to what you see in USA, for understandable reasons)
There might be a few documents that are not malicious, esp. image files.
The first folder inside zip contains files named as DATERECEIVED_NAME.EXT and the second has the same files named DATERECEIVED_SENDERADDR_SUBJECT_NAME.EXT. Use whichever works for you better. I also posted details about two messages to give you an idea.
Monday, August 29, 2011
Aug 28 Morto / Tsclient - RDP worm with DDoS features
I can add that it runs what it looks like a quick DoS test against one Google IP. In addition, it creates a lot of traffic: RDP scans, downloads, receiving commands, and interesting DNS queries for command and control servers.
Judging by the domain owners of CC servers (China) and their location (Hong Kong), I would say it is likely it be cybercrimeware originating in erm,...Asia. I don't know how difficult it is for a foreigner to register domains with Jiangsu Bangning Science & technology Co. Ltd.in China. One of the domains existed for a few years and changed several Chinese registrars and hosting companies. Like in Russia, DDoS attack crimes are very common in China (I don't have stats for other Asian countries but I am guessing common there too :)
I want to thank jsunpack.jeek.org and malc0de.com for the sample.
Thursday, August 11, 2011
Targeted attacks against personal Gmail accounts Part II - CNAS Report
 |
| popartmachine.com |
I received a phishing email sample indicating that the attackers described in the above post continue their efforts with a very slight modifications to the original themes and I must note that this incident is even more simple than the previous one. I don't know if any accounts were compromised this time, I hope the public disclosure of the previous attacks along with the notifications on Forward rules and two-factor authentication in Gmail helped prevent most if not all compromises.
P.S. Google are aware of this, there is not much they can do to prevent these from coming in but I am sure they are trying. If you are concerned about your account safety, please use two-factor authentication and change your passwords often.
Wednesday, August 10, 2011
Microsoft and Adobe Flash patches vs corresponding document and web exploits (non PDF, CVE numbered)
Again, thanks to Malware Tracker keeping exploit timeline for Microsoft products (MS Office, HTML help, Windows thumbnail), these are the patches you need to have installed for protection or should not *not* have if you want successful sandbox testing of these exploits.
Some of these like Flash were also used as Web exploits. The table below includes only exploits used in documents.
There are too many Flash exploits to list with the links, however, the two lists below allow very easy correlation
Tuesday, August 9, 2011
Adobe Reader versions vs corresponding exploits (CVE numbered) - Downloads for testing
Building VM sandbox environment for testing malicious documents? I found that sometimes tracking all the full versions and minor updates of Adobe Reader via Old Apps or Adobe.com and corresponding CVE numbers is more time consuming than actual testing. Here are all the necessary for testing versions available from Contagio download. In some cases you need to install the base version and then apply all the incremental updates to get to the version you needMany thanks to Malware tracker for making this easier - see their PDF threats timeline post here Current PDF Threats
Or, Download all together from HERE
Subscribe to:
Posts (Atom)