ThreatVlog Episode 4: ThreatVlog SMS Fake Installer tricking Android Users

by

In this episode of ThreatVlog, Nathan Collier covers the old, but still around, SMS Fake Installer, a Russian based program used to trick phone users to send premium text messages, costing money to the user. Nathan talks about how these threats work, how this threat is different, and the easiest way to stay protected on your Android powered phone.

Continue Reading »

DIY malicious Android APK generating ‘sensitive information stealer’ spotted in the wild

by

Back in June, 2013, we offered a peek inside a DIY Android .apk decompiler/injector that was not only capable of ‘binding’ malicious Android malware to virtually any legitimate app, but also, was developed to work exclusively with a publicly obtainable Android-based trojan horse. In this post, I’ll profile a similar, recently released cybercrime-friendly Windows-based tool that’s capable of generating malicious ‘sensitive information stealing’ Android .apk apps, emphasize on its core features, and most importantly, discuss in depth the implications this type of tool could have on the overall state of the Android malware market. More details:

Continue Reading »

ThreatVlog Episode 3: NYT, Twitter, and HuffPost hacked by Syrian Electronic Army

by

In this episode of ThreatVlog, Grayson Milbourne covers the information behind the Syrian Electronic Army’s hacking of New York Times, Twitter, and Huffington Post. Grayson includes a breakdown of the hack as well as information on how to keep your own websites protected form this malicious behavior.

Continue Reading »

Changes to the Webroot ThreatBlog

by

Over the next few days, you will begin to see some changes to the Webroot ThreatBlog.  As the company has grown, so has the need for our threat research to be delivered in a clearer, more concise manner.  We have worked long and hard on the new blog, including adding new content like the ThreatVlog, as well as highlighting the individuals behind all the great threat research done here at Webroot. So with all that, we want to welcome you to the brand new Webroot ThreatVlog.  It is more than a URL update, but a whole new look to help you […]

Continue Reading »

Cybercrime-friendly underground traffic exchanges help facilitate fraudulent and malicious activity – part two

by

The list of monetization tactics a cybercriminal can take advantage of, once they manage to hijack a huge portion of Web traffic, is virtually limitless and is entirely based on his experience within the cybercrime ecosystem. Through the utilization of blackhat SEO (search engine optimization), RFI (Remote File Inclusion), DNS cache poisoning, or direct impersonation of popular brands in spam/phishing campaigns tactics, on a daily basis, traffic is sold and resold for achieving a customer’s or a seller’s fraudulent/malicious objectives, and is then most commonly converted to malware-infected hosts. In this post, I’ll profile two cybercrime-friendly iFrame traffic exchanges, with the […]

Continue Reading »

Cybercriminals offer spam-ready SMTP servers for rent/direct managed purchase

by

We continue to observe an increase in underground market propositions for spam-ready bulletproof SMTP servers, with the cybercriminals behind them trying to differentiate their unique value proposition (UVP) in an attempt to attract more customers. Let’s profile the underground market propositions of what appears to be a novice cybercriminal offering such spam-ready SMTP servers and discuss their potential, as well as the re-emergence of bulletproof SMTP servers as a propagation method of choice. More details:

Continue Reading »

ThreatVlog Episode 2: Keyloggers and your privacy

by

Commercial and black hat keyloggers can infect any device, from your PC at home to the phone in your hand.  What exactly are these programs trying to steal?  How can this data be used harmfully against you?  And what can you do to protect all your data and devices from this malicious data gathering?  In this episode of Webroot ThreatVlog, Grayson Milbourne talks about security, your data, and protecting yourself. [youtube=http://youtu.be/BvBybxTCicU] Did you miss the first episode?  Be sure to check it out here:  http://blog.webroot.com/2013/08/20/tor-and-apple-exploits-revealed/

Continue Reading »

DIY automatic cybercrime-friendly ‘redirectors generating’ service spotted in the wild

by

Redirectors are a popular tactic used by cybercriminal on their way to trick Web filtering solutions. And just as we’ve seen in virtually ever segment of the underground marketplace, demand always meets supply. A newly launched, DIY ‘redirectors’ generating service, aims to make it easier for cybercriminals to hide the true intentions of their campaign through the use of ‘bulletproof redirector domains’. Let’s take a peek inside the cybercriminal’s interface, list all the currently active redirectors, as well as the actual pseudo-randomly generated redirection URLs. More details:

Continue Reading »