The IT Nerd

I’ve written about Flamer before, and Symantec has now posted additional insights on this Marware threat. Here’s the highlights:

• The malware was under development by a group of at least four developers as early as 2006
• t’s likely the server itself has been used for more attacks than just those related to the Flamer malware.
• The attackers used multiple encryption techniques and made a concerted effort to securely wipe data from the server on a periodic basis.

You should check their blog posting on this as it has far more details, including details on their command and control servers that will send chills down your spine. It’s important that you read this as we’re talking about a very sophisticated piece of Marware, put out by a very sophisticated group with tremendous resources at their disposal.

That’s scary if you ask me.

If you haven’t heard of the Elderwood Project, you might want to pay attention to a report put out by Symantec. A group somewhere out there is active in carrying out large scale, targeted attacks including a 2009 attack on Google, deploying the “Aurora” or Hydraq attack methodology

More facts on the Elderwood Project:

• The group have used 8 zero day vulnerabilities in their attacks. This is a huge number, as Stuxnet only used 4
• The attackers compromise individuals and networks using 2 methods:
  • Spearphishing emails with attachments: E-mails are sent to unsuspecting recipients with attachments, usually documents, which exploit a vulnerability in order to drop a backdoor Trojan (The vulnerabilities are in Internet Explorer and Adobe Flash).
  • “Watering  hole” attacks: The attackers inject the exploit into a website which caters to an audience of interest to the attackers. One of those websites was the Amnesty International Hong Kong website. They are called watering hole attacks because the attackers wait for the victim to come to them, similar to a predator in the wild who lies in wait for its prey.
• The targets of these attacks are mainly manufacturers of components for the defense industry. The second most common target were NGOs
• The vast majority, 72%, of victims were located in the US (Canada ranked 2nd for number of victims)
• Due to the scale and duration of the attacks, the attackers are likely well funded. They are most likely a large criminal organization, attackers supported by a nation state, or a nation state
• The motivation of the attackers would appear to be the theft of intellectual property and intelligence gathering. Intelligence gathered would allow the attackers to identify individuals or information that may be useful for future attacks.

Charming isn’t it? I’d read up on the two articles that I linked to. Then I’d do everything possible to protect yourself. Clearly these are not small time players. They’re a serious threat.

A blog post from Symantec got my attention today. Threats that used to be focused towards Windows PC are now moving to much broader targets:

Of particular note is a threat family called Opfake. This threat covers a wide range of device operating systems, from Symbian, to Windows Mobile, to Android, and even targets iOS devices through an elaborate phishing scam.

It’s not just mobile devices either. While Apple’s Macintosh computers have been targeted by threats here and there, the idea that this computing platform could be compromised en mass is something Internet security experts have warned about for years.

That day has finally arrived. A trojan by the name of Flashback, which first appeared last year, had a breakout performance in April, successfully infecting approximately 600,000 Macs. We discovered the authors behind this threat may have faltered when it came to profiting from it; perhaps taken by surprise at their apparent success. However, other attackers quickly followed in their footsteps, also seeking to exploit the same weaknesses before the vulnerability was closed.

It is clear that attackers are now paying attention to other platforms outside of the Windows world. But perhaps what is even more worrying is that we’re starting to see a move to platform-independent threats.

So, regardless what you happen to use, it’s becoming clear that you have to protect yourself. Simply assuming that you are immune to threats is no longer an option. This blog post has lots of other useful info that is worth paying attention to. Give it a read and take heed of what it says.