Novel Approach to Malware Discovery in today’s Threat Landscape

There are a number of similarities between biological viruses and those which infect our PC’s. For one, both types of infections rely on mutations to evade detection and survive. The faster the mutations, the more difficult an infection is to combat. This is because those who spend their time and effort fighting such infections are likely to miss a mutation and therefor lack the chance to create a cure. This point is especially true with traditional antivirus technology where discovery and detection techniques have not kept up with the rapid pace of mutations common in today’s threat landscape. The recent NY Times article ‘Outmaneuvered at Their Own Game, Antivirus Makers Struggle to Adapt’ reported that, “On average, it took almost a month for antivirus products to update their detection mechanisms and spot the new viruses.”

Meet the Webroot Intelligence Network (WIN), a novel new approach to malware intelligence, discovery, detection and protection which scales with the pace of the malware industry. How did we do it? By first creating the most powerful threat intelligence engine the world has ever seen. A cloud hosted engine which correlates live data from millions of user endpoints, honeypots, and sensor networks from around the globe, all in real-time. This engine has populated the Webroot Intelligence Network with detailed data on millions of malicious programs, is aware of over 8.7 billion URL’s, 550 million IP addresses and 2 million mobile applications. WIN provides the necessary visibility into a rapidly mutating and evolving threat landscape to provide Webroot products the intelligence needed to keep users secure.

One key element to the success of WIN has been leveraging the power of our users. By turning every customer endpoint into a malware discovery node capable of sending newly discovered file data to WIN, Webroot researchers around the world are able to analyze and classify incoming data in real time. When a new malicious program, URL or IP is discovered, the entire user-base is immediately protected; no definition updates required. There are a number of benefits to this approach; one of the biggest being that malware variants don’t slip through the cracks. If a Webroot user is the first to see a new infection, it is only a matter of minutes before a researcher discovers the infection and creates a rule to detect and protect the entire user-base. Compare this to traditional signature based AV’s which must first collect the sample (if they can find it – in many cases samples are missed due to the intentionally short lifespan of today’s malware variants), analyze it, and finally release a new detection signature which lastly has to be sent to the endpoint. As the NY Times article mentions, “Part of the problem is that antivirus products are inherently reactive. Just as medical researchers have to study a virus before they can create a vaccine, antivirus makers must capture a computer virus, take it apart and identify its “signature” — unique signs in its code — before they can write a program that removes it. That process can take as little as a few hours or as long as several years.” Most often, by the time a new signature is released, the malware variant it is designed to detect is no longer relevant.

The strength of a security solution is directly related to the quality of its intelligence. By enabling our products to participate in the discovery of new infections, WIN ensures our researchers have the visibility needed to keep up with a malware landscape which relies heavily upon flooding the market with newly compiled infections designed specifically to evade traditional AV methodologies. In many ways, the AV industry is responsible for the current day problem. The lack of innovation and adaptation to the problem created an easy out for malware authors. Webroot aims to change this paradigm by including the force of its entire user-base to combat the problem. It has long been said that the AV industry is at a disadvantage because for every security researcher fighting these infections, there were certainly 100 if not 1,000 hackers creating such infections. Webroot has upped the ante by recruiting its millions of users to help in the fight to keep our personal data and online activities secure. Malware has nowhere to hide when up against the Webroot Intelligence Network.

A peek inside a boutique cybercrime-friendly E-shop – part six

A peek inside a boutique cybercrime-friendly E-shop – part six

In 2012, we started the “A Peek Inside a Boutique Cybercrime-Friendly E-shop” series, in response to the emerging market segment largely driven by novice cybercriminals relying on ubiquitous E-shop templates to sell their fraudulently obtained assets.

In this post, I’ll profile one of the most diversified (in terms of quantity and type of fraudulently obtained assets) boutique cybercrime-friendly E-shops I’ve come across since the launch of the series.

More details:

(more…)

‘Attention! Changes in the bank reports!’ themed emails lead to Black Hole Exploit Kit

‘Attention! Changes in the bank reports!’ themed emails lead to Black Hole Exploit Kit

Cybercriminals are currently spamvertising tens of thousands of emails in an attempt to impersonate the recipients’ bank, tricking them into thinking that the Ministry of Finance in their country has introduced new rules for records keeping, and that they need to print and sign a non-existent document.

Once users click on the links found in the malicious emails, they’re automatically exposed to the client-side exploits served by the latest version of the Black Hole Exploit Kit.

More details:

(more…)

Fake BBB (Better Business Bureau) Notifications lead to Black Hole Exploit Kit

Fake BBB (Better Business Bureau) Notifications lead to Black Hole Exploit Kit

Cybercriminals have recently launched yet another massive spam campaign, impersonating a rather popular brand used in a decent percentage of social engineering driven email campaigns – the BBB (Better Business Bureau).

Once users click on any of the links in the malicious emails, they’re automatically exposed to the client-side exploits served by the Black Hole Exploit kit.

More details:

(more…)

Spamvertised ‘Your Recent eBill from Verizon Wireless’ themed emails serve client-side exploits and malware

Spamvertised ‘Your Recent eBill from Verizon Wireless’ themed emails serve client-side exploits and malware

Throughout 2012, we intercepted two malicious campaigns impersonating Verizon Wireless in an attempt to trick its customers into clicking on links pointing to fake eBills.

It appears that cybercriminals are back in the game, with yet another Verizon Wireless themed malicious campaign, enticing users to click on the malicious link found in the email. Once users click on the link, they’re automatically exposed to the client-side exploits served by the latest version of the Black Hole Exploit Kit.

More details:

(more…)

Fake ‘UPS Delivery Confirmation Failed’ themed emails lead to Black Hole Exploit Kit

Fake ‘UPS Delivery Confirmation Failed’ themed emails lead to Black Hole Exploit Kit

Continuing their well proven social engineering tactic of impersonating the market leading courier services, cybercriminals are currently mass mailing tens of thousands of emails impersonating UPS, in an attempt to trick users into clicking on the malicious links found in the legitimate-looking emails.

Once they click on the links, they’re automatically exposed to the client-side exploits served by the Black Hole Exploit kit.

More details:

(more…)

Pharmaceutical scammers spamvertise YouTube themed emails, entice users into purchasing counterfeit drugs

Pharmaceutical scammers spamvertise YouTube themed emails, entice users into purchasing counterfeit drugs

Pharmaceutical scammers are currently spamvertising a YouTube themed email campaign, attempting to socially engineer users into clicking on the links found in the legitimately looking emails.

Upon clicking on the fake YouTube personal message notification, users are redirected to a website reselling popular counterfeit drugs. The cybercriminals behind the campaign then earn revenue through an affiliate network.

More details:

(more…)