2010年3月25日 星期四

FW: Newsbank: Malware attack uses China World Expo guise


-------------------------------------------
From: Jon Clay (MKT-US)
Sent: Thursday, March 25, 2010 11:14:31 PM
To: Elizabeth Bookman (Corp Marke-UK); Newsbank
Subject: RE: Newsbank: Malware attack uses China World Expo guise
Auto forwarded by a Rule


Do we have the file mentioned below that Kaspersky catches but we don’t?

 

Thanks,


Jon Clay

Sr. Core Technology Marketing Manager

(970) 419-0611

From: Elizabeth Bookman (Corp Marke-UK)
Sent: Thursday, March 25, 2010 5:25 AM
To: Newsbank
Subject: Newsbank: Malware attack uses China World Expo guise

 

http://www.networkworld.com/news/2010/032510-malware-attack-uses-china-world.html

 

With reference to the article (pasted below), please also see our blog - http://blog.trendmicro.com/shanghai-expo-spam-carries-backdoor/

Analysis of this threat is ongoing, but this story will likely garner HUGE attention.  

I am in process of activating our alert banners on TM.com and we are putting together an advisory with further information.

 

Thanks

 

Liz

 

 

Malware attack uses China World Expo guise

 

An e-mail with a malicious attachment was sent to at least three foreign journalists in China

By Owen Fletcher, IDG News Service
March 25, 2010 06:21 AM ET

A malware attack dressed up as an e-mail from organizers of the upcoming Shanghai World Expo targeted at least three foreign journalists in China, in the latest sign of increasingly sophisticated cyberattacks from the country.

The e-mail appeared to be sent from the inbox of the Expo news office, but it was not sent by the Expo and may be targeting journalists who signed up to cover the event, a reporters' advocacy group in China told members in an e-mail on Thursday.

The 2009 Handbook of Application Delivery: Download now

Google drew global attention to cyberattacks from China two months ago, when the company said it had detected hacking attempts from the country partly aimed at the Gmail accounts of Chinese human rights activists. Google also said the attacks had caused the loss of Google intellectual property and that at least 20 other large companies were targeted. Chinese authorities use various methods to keep political dissidents under surveillance, but Google did not blame the Chinese government for the attacks.

There was also no evidence to suggest that the e-mail sent to foreign journalists had any tie to the government. But at least one version of the e-mail, which was sent by an attacker to IDG News Service, clearly targeted people who had filled out a spreadsheet to register for the Expo. The e-mail had a .pdf attachment that exploited a recently patched vulnerability in Adobe Reader, according to scan results on the Wepawet malware analysis Web site.

There seems to be a [definite] increase in sophisticated, targeted attacks coming out of China," said Paul Ferguson, a researcher at Trend Micro, in an instant message.

Eastern Europe is a base for many cybercriminals who aim to profit by illicitly obtaining credit-card and banking information from victims. But large-scale attacks from China are often aimed at stealing intelligence or intellectual property, Ferguson said.

The World Expo will be a months-long show in Shanghai this year where dozens of countries will set up displays. The government sees the event as a display of China's rising influence abroad.

The alert sent out by the reporters' group in China said .pdf attachments had become a common mode of attack and that antivirus tools often do not pick up the types of malware involved. On Thursday afternoon in China, Kaspersky was the only vendor out of 42 tested by VirusTotal that labeled the file in the fake Expo e-mail as malicious.

China has repeatedly said its laws ban cybercrime including hacking attacks when asked about accusations of government involvement in attacks.

The IDG News Service is a Network World affiliate.

 

 

 

 

 

Elizabeth Bookman | Marketing Manager - Free Tools & Threat Awareness

Pacific House, Third Avenue, Globe Business Park, Marlow, Buckinghamshire, SL7 1YL. UK

Office: +44 1628 400 513 | Mobile: +44 7956 396104

 

 

 

 

 

 

 

沒有留言: