About Me

Jorge Arias

Jorge Arias
Malware Researcher - McAfee Labs

Read More

Blogs

Feeds & Podcasts

Meet the Bloggers

Archive

Tags

"McAfee FOCUS 12", "McAfee FOCUS 2012", #12scams, #McAfeeFOCUS, #MerryMcAfee, #MFETrivia, #MobileMyths, #SecChat, #SecurityLegos, #SecWebinar, #SextRegret, $1 million guarantee, .pre, 0day vulnerability, 1-day, 3DS, 3G, 3Rs, 12 Scams of Christmas, 49ers, 99 things, 419 scam, 2011 Threats Predictions, 2012, 2012 Gartner Magic Quadrant, 2012 London Olympics, 2012 Security Predictions, 2012 Virtual Sales Kickoff, 2013, 2013 predictions, 2013 threat predictions, 2013 threats, Aaron Swartz, Abbreviation, ABC, ABC News, access to live fraud resolution agents, Accountability, Account hacked, Account Takeover Scams, Accredited Channel Engineer, ACE, ACE certification partner, ACE Incentive Rebate, ACH, Acquisition, ActionScript, addiction, addiction to Facebook, Adobe, Adobe Flash, Adobe Reader, adult entertainment, adult online content, advance-fee fraud, Advanced Persistent Threat, advanced persistent threats, adware, AET, affiliate marketing schemes, Aishwarya Rai videos, alephzain, Alex Merton-McCann, Alex Thurber, All Access, AllAccess, AllAcess, Amazon, American jobs, Amitabh Bachchan dies, AMTSO, Amy Chua, analysis, and Data Loss Prevention, Android, Android/FakeToken, Android/FakeUpdates, Android/FkSite, Android/FkSite.A, Android/JobFraud, Android/NickiSpy, android antivirus, Android Bot analysis, Android Dropper, Android Exploit, Android Malware, Android Malware Analysis, Android Market, Android Mobile Malware, Android Rooting Exploit, Android security, android security app, Android slide, Android SMS broadcast, animation, anit-spam, Annual Channel Partner Satisfaction Survey, Annual Partner Survey, Anonymous, Anonymous Group, anti-malware, anti-phishing, anti-phishing phishing spam anti-spam anti-malware “identity theft” “computer security” scams firewall, anti-pshing, anti-spam, anti-spyware, anti-theft, anti-virus, anti-virus program pops up, Antievasion, antimalware, Antisec, antivirus, Antivirus software, APIs, App Alert, AppContainer, Apple, Apple iOS, application blacklisting, application control, application developers, applications, application security, App Lock, AppLocker, app protection, apps, app safety, app security, app store, app stores, APT, APTs, arrests, Arun Sabapathy, ASIC, Ask Toolbar, ASL, ASLR, ATM scams, ATM skimming, ATS, attack, attackers, attacks, Australia, authentication, AutoIt, automated clearing house, automated transaction server, automobile, automotive, Autorun, AutoRun malware, AV, AV-TEST.org, avatar, award, awards, AxizWorkgroup, Aylesbury, Backdoor, Backscript, Back To School, backup data, Backup Security, bad-reputation URLs, Bad Apps, balanced scorecard, bank accounts, bank fraud, banking, banking applications, banking fraud, banking trojan, banks, Barcelona, Barrett Brown, basic security protection, basic security software rates, batchwiper, Battle Hymn of the Tiger Mother, bCyberwise, behavior-based detection, Belarus, Bernie Madoff, best practices, beyond the PC, Big Data, big security data, bill collectors call for nonpayment, Bill Rancic, binaries, binary, Bin Laden Scams, Biological Computer, biometric authentication, biometrics, Bios, Bioskit, birthday greetings, Bitcoin, BlackBerry, Blackhat, Black Hat, black hat hackers, Blackhole Exploit Kit, Bloomberg, blue screen, Blue Toad, Bluetooth, Bollywood, book, bootkit, bot, botnet, botnets, bots, box.com, box.net, boyfriend, Brazil, BRB, breach, breakup, breakups, Brent Sanders, Bring your own device, broker, bueno, buffer overflow, business continuity, businesses, Business IT, byod, C&C command bot, C&C communication, C&C Server, C-SAVE program, CA, CallWindowProcA, Cameron Diaz, Canada, canada online scams, Canadian celebrities, CanSecWest, car hacking, case study, Cayman Islands, CD9, celebrities, celebrity, celebrity phone hack, Celebrity video in Facebook, cell phone, cell phones, certificate authority, certification, CES, CES 2013, Chainfire, chain mails, Change Control, channel partner, Channel Partners, Channel Partner Town Hall, Channel Program, Channels Town Hall, Channelwise Awards, Charity Phishing Scams, chat, chat rooms, check in, Checklist to keep teenagers safe online, child identity theft, children online safety, children safety online, child safety, Chile, China, Chinese, chris barton, Christian Morales, christmas, Christmas scams, christmas shopping, Christmas shopping concerns, Christmas shopping crimes, chromebook, CIO Insomnia Project, Cisco, CISO, CISO Executive Summit, Citadel, Citrix, Civil War, class action lawsuit, clickjacking, cloud, cloud-based, cloud-based collaboration, cloud application, cloud apps, cloud based application, Cloud city, Cloud computing, Cloud Expo, cloud security, Club Penguin, CMP, CNBC, CNN, codes malveillants, Cofer Black, cold boot, collaboration, college students, Colombia, Command and Control, Commercial/SMB, Commercial and Enterprise Deal Registration, Compliance, Comprehensive Malware Protection, Compromised Sites, computer, computer issues, computer loss, computers, computer security, computer security protection, computer setup, computer support, computer theft, computerworld, conference, Conficker, conférence utilisateur, Connected Home, consolidation, Consumer, consumer internet users, consumerization, consumerization of IT, consumer mobile, consumer PCs, consumers, Consumer Security, consumer threat alert, Consumer Threat Notices, consumer threats, Consumer Threats Alert, Content Protection, content security, Continuing Education, cookies, Cool Exploit Kit, corporate data, corporate network, Corporate Responsibility, cost of losing your smartphone, counter identity theft, creating safe passwords, creating strong passwords, credit card fraud, credit card fraud and protection, credit card skimming, credit card thefts, credit fraud alerts, credit monitoring, credit monitoring and resolution, credit scores, crimeware, criminal hacking, critical infrastructure, CRN, cross-site scripting, CSP, CTO, Culture, cupcake, currency, customer service, Cutwail, CVE-2010-3333, CVE-2012-0158, CVE-2013-0633, CVE-2013-0634, CVE 2012-1535, CVE 2012-1889, CVE2013-0422, Cyber, cyber addiction, cyber attack, Cyberattack, cyberattacks, cyber attacks, cyber bullying, cyberbullying, Cybercrime, cybercrime, cybercriminal, cyber criminals, cybercriminals, cybercrooks, Cyber Defense Symposium 2012, cyberdéfense, Cyber Ed, cyber education, cyberespionage, cyber ethics, cyber fraud, Cyber Insurance, Cyber Intelligence Sharing and Protection Act of 2011, cybermom, Cyber Monday, Cyber Monday shopping, cyber mum, cybermum, Cybermum India, Cyber risks, cybersafe, cybersafety, cyber safety for women, Cyber safety tips, Cyber savvy mom, cyber scams, cyberscams and identity theft, cyber scrooges, cybersecurity, cyber security, cyber security awareness, cybersecurity concerns, Cyber Security Mom, cybersecurity mom, cybersquatter, cybersquatting, cyber stalking, cyberterrorists, cyber threat, cyberthreats, cyberwar, cyberwarfare, cyber warfare, DAM, dangerous searches, Darkshell, DAT 6807/6808, data, Database, database activity monitoring, database security, data breach, data breaches, data center, Datacenter, data centers, data center security, Data Classification, data loss, Data Loss Prevention, Data Protection, Data Protection Act, data theft, dating, dating scams, dating site, Dave DeWalt, Dave Marcus, David Small, DDoS, Deal Registration, decade of cybercrime, deceptive online promotions, decline, dedicated security appliances, Deep Command, Deep Defender, DeepDefender, Deepika Padukone, Deep parsing, DeepSAFE, DefCon, DefCon Kids, Defender 2013, Delta Goodrem, democracy, denial of service, denied credit, Denmark, DEP, Department of Commerce, department of defense, depression, development, device, Device Control, devices, dewalt, DEX, digital assets, digital assets worth, Digital Certificates, digital devices, Digital divide, digital gadgets, digital music and movie report, digital reputation, digital retail, digital security, distributed denial of service, distributor, DLP, Dmitri Alperovitch, dmp stealing, DNS, DNS changer, DNSChanger, DoCoMo 110 Dialer, DOD, Dorgbot Skype, Dorifel, DoS, DougaLeaker, download, downloader, downloaders, doxxing, drawing cyber lines, drive-by downloads, drivers license, drivers license identity theft, dropbox, dumpster diving, Duqu, e-card scams, e-gold, e-mail id, earnings, easter, Easter scam, eBay, EBC, ecards, ecard spam, eCommerce, Ecuador, education, educational games, Eelectric Vehicle, EFF, ELAM, elcomsoft, election, Electronic Medical Records, electronic voting, email, Email & Web Security, Email & Web Security, email accounts, email content security, Email Protection, emails, email scam, email scams, email security, email spoofing, embedded, embedded devices, Embedded Security, EMEA, Emerging Markets, Emerging Market Security, EMM, emma watson, emma watson pictures, employee policies, employment fraud, Employment Identity Theft Scams, encoding, encryption, Encryption App, end-to-end security architecture, Endpoint Protection, Endpoint Security, Endpoint security suite upgrade, energy, Enhanced Deal Registration, enterprise, enterprise-grade DLP, enterprise firewall, enterprise mobility, enterprise resource planning, enterprise scurity, enterprise security, envy, Envy on Facebook:A Hidden Threat to Users’ Life Satisfaction?, epayment, ePHI, epo, ePO Deep Command, ePO DeepCommand, ePolicy Orchestrator, Epsilon, epsilon security breach, ERP, ESM, espionage, etiquette, EU, European teen research, EV, evasion, Evernote, evoting, Executive Briefing Center, Exif, ex partners, exploit, Exploit-CVE2013-0422, Exploit-CVE2013-0422 Analysis, Exploit-Kits, Exploit Analysis, exploitation, Exploit for Android, exploiting real brand names, Exploit Kit, exploits, Exynos, Ezzidine Al-Qassam, facebook, Facebook friends, Facebook likes, Facebook photos, Facebook safety, Facebook Scam, Facebook Security, Facebook spam, Facebook Threat, Facial recongnition, factory reset, fake-av, fake alert, fake ant, fake anti-virus software, Fake AntiVirus, fake anti virus, Fake Anti Virus Scams, FAKEAV, fake emails, Fake Identity, fake installer, FakeRean, fake security software, fake software, fake system tool programs, faketoken, fake updates, fake websites, Fake YouTube plugin, false, false news, families online, family, family identity safety, family online safety, family online safety tips, family protection, Family Safety, Farmville, FBI, FBI warning, FDCC, Federal Cybersecurity, Federal ID, Festi, fictitious identity theft, FIFA, file scanning, file sharing, filtering products, financal, Finance, Financial Fraud, financial industry, financial institutions, Financial Market Security, financial organizations, financial scams, Financial Security, financial software, Firesheep, firewall, FISMA, Fixed Function Devices, Flame, Flamer, Flash, flashback, Flash Player, Focus, Focus11, FOCUS12, FOCUS 2011, forrester, forwards, Foundstone, Fourth Quarter 2012, France, France Law, Français, fraud, fraud resolution, fraud resolution agent assistance, fraudulent credit card or bank charges, free, Free gift card scam, Free giveaway scam, freely downloadable morphing tool, free money scam, free money scams, free offers, free WiFi spots, french, French Law, Friday Security Highlights, friends, FTC, functions calls, fuzz, fuzzing, G-J Schenk, Galaxy SIII, gambling, games, gaming, gaming consoles, Garter, Gartner, Gartner Security and Risk Management Summit, Gauss, Gavin Struthers, Gaza, geolocation, George Kurtz, George W Bush, geotag, geotagging, Gert-Jan Schenk, GFIRST, GhostShell, gift cards and iPad promotions online, gift online shopping, gifts, gift scams, girlfriend, Giveaway, global channel partner, Global Cybersecurity, global education program, Global Payments, Global Risk 2012 report, Global SecurityAlliance Partner Summit, Global Threat Intellgence, global threat intelligence, Global unprotected rates, gmail, gold software support, good parenting, google, Google booth, google code, Google Play, government, government networks, governments, Gozi, GPS, graphs, gratis, GSM, GTI, Guardian Analytics, hack, hacked mobile phones, Hacked Sites, hacker, Hackers, hackers steal credit card numbers and sensitive personal data, hacking, Hacking Exposed, Hackitivism, Hacktivism, hacktivists, Hacktivity, halloween, Happy Families, harassment, Harbowl, hard token, Hashtag, HASHTAG as a name, HB1140, Healthcare, Healthcare Security, Healthy Harold, Heat Map, heidi klum, Here you have worm, Heuristics, Hi5, highroller, HIMSS12, HIPAA, hips, Hispanic, HITECH, hoax, hoax - slayer, holiday, holiday gifts, holiday malware, Holidays, holiday scams, holiday screensavers, holiday shopping, holiday shopping fraud, holiday shopping scams, holiday snaps, holiday websites, home network issues, homework, host intrusion prevention, Host IPS, household devices, how to check computer, how to keep teens safe online, how to protect, how to protect devices, how to search online, how to secure wireless connection, how to set up wi fi, how to talk to kids, how to talk to teens, HTML5, HV, Hybrid Vehicle, IaaS, iCloud, ICS, IDC, identify potential cyber-threats, identify spam, identity as a service, identity exposure, identity fraud, identity fraud scams, Identity Management, identity protection, identity protection $1 million guarantee, identity protection alerts, identity protection fraud, identity protection surveillance, identity surveillance, identity theft, identity theft. app privacy, identity theft celebrities, identity theft expert, identity theft fraud, identity theft McAfee, identity theft protection, identity theft protection identity protection fraud, identity theft protection product, identity theft resolution, identity theft ring, identity theft risk, identity theft scams, identity theft tax scams, Identity thieves and cybercriminals, identity threat protection, IDF, IDF 2011, IDF 2012, IDK, IDS, ID theft, IE 10, iframe, IIM Bengaluru suicide case, illegal immigrants, image.exe, Image stealing, image stealing trojan, images uploaded to FTP, image theft, impersonation, in.cgi, Incident Response, Incumbency Advantage Program, indentity, India, India cybermum, Indian Celebrity video, Indian kids, Indonesia, industrial control systems, infected mobile apps, infographic, information, information collected by advertisers or social media marketing, information growth, Information leak, Information Protection, Information Security, Information Warfare, Infrastructure, Initiative to Fight Cybercrime, in love, in lurve, innovation, insiders, Insider Threats, Instagram, integration, Integrity, Integrity Control, intel, Intel Cloud SSO, Intel Developer Forum, intellectual property, internet, Internet access, Internet Access cut off, internet addiction, internet connected devices, Internet evolution, Internet Explorer, Internet Explorer 10, Internet filtering, internet identity trading surveillance, Internet monitoring, Internet Phishing Scams, internet privacy, Internet Safety, internet safety list for 2013, Internet Safety News, internet safety software, internet safety tips, Internet scams, internet security, internet security tips, Internet settings, Internet slang, internet time limits, Internet voting, Interop, in the cloud, introduction to social networking, IntruShield, intrusion detection, intrusion prevention, Intrusion prevention systems, In vehicle Infotainment, investment scams, iOS, iOS 6.1, IP, iPad, iPad scams, iphone, Iphone 5, iphone security, IPS, IPv6, Iran, IRC bot, IRCBOT for android, IRCE 2012, IronPort, IRS, IRS scams, I Series, ISP, Israel, Israeli Defense Force, IT, IT as a Service, IT market, itouch, IT Security, IT Security market, Japan, japan earthquake malware, japan earthquake safe donation, japan earthquake scams, japan tsunami scams, java, Java exploit, JavaScript, Java update, Java virus, Java Vulnerability, jelly bean, jihad, job applications, Joe Sexton, John Bernard Campbell, JPEG, JPEG Commands, jpg, Julia Gillard, julian Assange, July 9, Justin Coulson, kama sutra koobface, Katrina Kaif, keep family PC safe, keeping kids safe online, keep mobile smartphone safe, Kelihos, kernel, Kernel 0day vulnerability, kernel mode, keycatchers, keyloggers, key logging, kids, kids on internet, kids on iPhone, kids online, kids online behavior, Kids online behaviour, kids online safety, kids on twitter, kids safety, king county, KnowledgeBase, koobface, Kraken, kurtz, labs, laptops, Larry Ponemon, LART, Last Resort, Late Payment Scam, law, law enforcement, LCEN, leaked passwords, leaked personal information, legal, legal identifier, legal risk, Legos, Lethic, Life Education, LilyJade, linkedin, Linux, Linux/Exploit:Looter Analysis, Linux and Windows, Little Red Box, live-tweeting, live access to fraud resolution agents, lizamoon, Lloyds, loader, location data, Location services, locked-, Lockheed Martin, logging out of accounts, login details, LOIC, LOL, London, loneliness, Looter Analysis, Lori Drew, loss of gadgets, lost, lost computer, lost or stolen driver’s license credit cards debit card store cards, lost or stolen Social Security card or Social Security number, lost or stolen wallet, lost PC, lost wallet protection, lottery, love, Love Relationships and Technology, luckysploit, LulzSec, M&A, Maazben, mac, mac/OSX, Mac antivirus, mac malware, Mac malware and threats, Mac OSX, Mac OS X, Mac passwords, Mac security, mac threat, Magento, Magic Quadrant, mailbox raiding, Mail fraud, mail order bride spam, make passwords secure\, Malaysia, maleware, Mali, Malicious Android Application, malicious apps, malicious code, malicious files, malicious program, Malicious QR Code, malicious sites, malicious software, malicious website, malicious websites, malware, malware analysis, Malware Experience, malware forums, malware protection, Malware research, malware samples, malware spread through chat link, malware statistics, malware stealing credentials, malware threats, malware using skype as spreading vector, malweb, managed security services, Managed Services, Management, managing personal affairs online, Mandatory Security Hotfix, map, mapping the mal web, maps, Marc Olesen, Mariposa, mass mailing worm, mass sql injection, master boot record, mastercard, Maturity Model, MBeanInstantiator vulnerability, MBR, mcaf.ee, McAfee, Mcafee's Who Broke the Internet, McAfee-Synovate study, McAfee Advice Center, mcafee all access, McAfee and Verizon keeping customers safe, McAfee AntiSpyware, McAfee Antivirus Plus, McAfee Application Control, McAfee Asset Manager, McAfee Channel, McAfee Channel, mcafee channel chief, McAfee Channel Partner, McAfee Cloud Security Platform, McAfee Consumer Threat Alert, McAfee Data Loss Prevention, McAfee Deep Command, McAfee Deep Defender, McAfee Digital Divide study, Mcafee DLP, McAfee Email Gateway, McAfee Email Gateway 7.0, McAfee Email Protection Suite, McAfee Email Security, McAfee EMM, McAfee Employees, McAfee Endpoint Encryption, McAfee Enterprise Mobility Management, McAfee Enterprise Mobility Manager, McAfee Enterprise Security Manager, McAfee ePO, McAfee ePolicy Orchestrator, McAfee Exploring Digital Divide Study, McAfee Facebook page, McAfee Family Protection, McAfee Family Protection for Android, McAfee Firewall Enterprise, McAfee FOCUS, McAfee FOCUS 2011, McAfee free tool, McAfee Global Unprotected Rates Study, McAfee Identity Protection, mcafee identity theft protection, McAfee Initiative to Fight Cybercrime, McAfee Internet Security, McAfee Internet Security for Mac, mcafee internet security for mac; mcafee family protection for mac, McAfee Labs, McAfee Labs Q3 Threat Report, McAfee Labs Report, McAfee Labs Threats Report, McAfee managed Service Provider Program, mcafee mobile, McAfee Mobile Security, McAfee MobileSecurity, McAfee MOVE, McAfee MOVE AV, McAfee Network Intrusion Prevention Systems, McAfee Network Security, Mcafee Network Security Manager, McAfee Network Security Platform, McAfee NSP, McAfee One Time Password, McAfee Partner, McAfee Partner Learning Center, McAfee Partner Locator, McAfee Partner of the Year Award, McAfee Partner Portal, McAfee Partner Program, McAfee Partner Summit, McAfee Partner Summit 2012, McAfee Policy Auditor, McAfee Profitability Stack, McAfee Q2 Threat report, McAfee Q3 Threat Report, McAfee Q4 2011 Threat report, McAfee Rebates, McAfee research, McAfee Rewards, McAfee Risk Advisor, McAfee Safe Eyes, McAfee Safe Eyes Mobile, McAfee SafeKey, McAfee Scan and Repair, McAfeeSECURE, McAfee SECURE, mcafee secure shopping, McAfee Security, McAfee SecurityAlliance, McAfee Security Journal, McAfee Security Management, McAfee security products, McAfee Security Scanner, McAfee security software, McAfee security software offer, McAfee Security Webinars, McAfee Site advisor, McAfee SiteAdvisor, McAfee Social Protection, McAfee Software, mcafee spamcapella, McAfee Stack Challenge, McAfee survey, McAfee TechMaster services, McAfee Technology Centre, McAfee Threat Predictions, mcafee threat report, McAfee Threats Report, McAfee Total Access for Endpoint, McAfee Total Access for Servers, mcafee total protection, McAfee Vulnerability Manager, McAfee Vulnerability Manager for Databases, mcafee wavesecure, McAfee Web Gateway, McAfee® Internet Security Suite, McCain, mCommerce, MDM, media, medical device security, medical identify theft, Medical identity theft, medical records, Medicare, Menaces, Metro, Mexico, michael jackson, Microsoft, Microsoft Security Bulletin, Microsoft SQL Server database, Microsoft XML Core Services, Mid-Market, Middle East, Mike Decesare, Mike Fey, Millennium@EDU, MMORPG, MMS, Mobile, mobile antivirus, mobile app, mobile applications, mobile apps, mobile banking, mobile carriers, Mobile Commerce, mobile computing, mobile data communications, Mobile Data Protection, mobile data protocols, mobile device, Mobile Device Management, mobile devices, mobile devices and security threats, mobile device security, mobile devices issues, mobile exploit, mobile identity security, mobile malware, mobile myths, mobile passwords, mobile payments, mobile phones, mobile phone spyware, mobile PIN, mobile platform, mobile protection, mobile safety, mobile safety tips, mobile scam, mobile security, mobile security app, Mobile Security Premium Protection, mobile security software, mobile shopping, mobile shopping threats, mobile smartphone security, mobile software platforms, mobile spam, mobiles security, mobile threats, mobile trends, mobile Wi-Fi, mobile wireless internet security concerns, Mobile World Congress, moghava.a, Moira, Moira Cronin, mom, money laundering, monitor a child’s identity, monitor credit and personal information, monitoring, Monkif, Mornings, Morphing, Moshi Monsters, most dangerous celebrities, most risky, Mother's day, mothering, mothering advice, mothering boys, mothering Internet safety, Mother’s day spam, movies, MS12-020, M Series, msn spaces, MSP, msvcr71.dll, multifactor authentication, multilayer security system, Multiplatform FakeAV, multiple devices, multiple social security numbers, MultiRogue, multitenancy, mum, Mummy blogger, MWC, mwc13, myAut2Exe, Mybios, myspace, MySQL, mystery shoppers, mythbusters, NACACS, Narilam, national cybersecurity awareness month, National Cyber Security Awareness Week, national identification card, NATO, NBC News, NCSA, ndr, near field communication, negative online experiences, Netbook, netbooks, netiquette, nettraveler, network, Network Access, Network Behavior Analysis, Network Evasions, Network IPS, Network Perimeter Security, Network Security, Network Security; Email & Web Security; Security-as-a-Service, Network Security Manager, Network Security Platform, network security server security, network threat behavior analysis, New age names, New online safety survey, news, New teen survey, New Year, new year resolution, new year resolutions, New Year’s resolutions, New York Times, next-gen IPS, Next Generation, next generation data center, Next Generation IPS, NFC, NGFW, NGIPS, ngrbot, NickiSpy, Nigerian 419 Scam, nigerian scam, Night Dragon, NIST, Nitol, Nitro Security, NitroSecurity, NitroView, Niwa, NMU, Nobel Prize, north america, North Korea, NotCompatible, NSP, NSP 7.5, NSS Labs, NTBA, Nuclear Exploit-Kit, Nuquel, NY Times, Oak Ridge National Laboratory, obama, Obfuscation, Occupy Wall Street, OCTO, OHR, OLE, olympics, Olympic scams, OMB, one-time password, online, Online Ads, Online Backup, online banking, online banking safely, Online Behavior, online behaviour, online bettings, online book shopping, online bookstore, online child safety, online coupon scams, online credit fraud, online danger, online dangers, online dating, online e-tailers, online ethics, online fraud, online game, online games, online game spam, online gaming, online gangs, online harassment, online holiday shopping, online marketing sites, online marketplace, online payment, online personal data protection, online predators, online retail, online safety, online safety for kids, online safety of kids, Online safety of teens, online safety resolutions, online safety tips, Online scammers, online scams, online search, online security, online security education, online shopping, online shopping risks, online shopping scams, online shopping threats, online spam, online stores, online surfing, online survey scam, online threat, onlinethreats, online threats, online video, online voter registration, Open Source, operational risk, Operation Aurora, Operation High Roller, Operation Last Resort, Operation Shady RAT, OpLastResort, Optimized, optimize PC, Orange, organized crime, organized criminals, OS, OS/X, oscars, OTP, outages, outlook, over-achieving children, OWASP, P2P, packed, packers, packing, PARC, parental advice, Parental control, parental controls, parental permission, parents, partner, Partner Acceleration Resource Center, Partner Care, Partner Connected, Partner Learning Connection, Partner Portal, partners, Partner Summit, PartnerTalk newsletter, passport, passware, password, password complexity check, password management, passwords, password security, password stealer, Pastebin, pat calhoun, patch, PatchGuard, Patch Tuesday, Patmos, Paul Otellini, PAW, pay-per-install malware, paycash, Payload, payment, paypal, PC, PC Addiction, PCI, PCI Compliance, PCI DSS, PC passwords, pc protection, PCs, pc security, PC setup, PDF, pedro bueno, peer to peer, Peer to Peer file sharing, Pemberton, perception, personal data, personal identity fraud, personal identity theft, personal identity theft fraud, personal information, personal information loss, personal information over mobile phones, personal information protection, Personal information security, personal privacy, personal protection, personal tablet, Peru, peter king, Phantom websites, PHI, phishing, phishing kits, phishing scams, phishing shareware, photo privacy, photo protection, Photo sharing, pic.exe, pickpockets, pic sharing, piers morgan, PII, pins, Pin scams, pinterest scam, piracy, PixSteal Trojan, Playstation, Podcast, Poetry Group, Poland, Police, policies, Ponemon Institute, Ponzi scam, POP, Pop Tropica, pop ups, pornography, Postcode Lottery, posting inappropriate content, posting videos online, PostScript, potential employers, Potentially unwanted program, POTS, power grid, power loss, Pre-detection, Pre-Installed Malware, pre-teens on FB, predictions, Premium SMS Trojan, presidential election, president obama, Primary School students, Prinimalka, Printers, privacy, Privacy Awareness Week, privacy law, privacy setting, privacy settings, Privacy settings on Google +, private data, Proactive Corporation, proactive identity protection, proactive identity surveillance, proactive security, Products, Profitability Calculator, Profitability Stack, profits, Project Blitzkrieg, promotion, Protect all devices, protect devices, protect digital assets, protecting kids online, protecting photos, protecting teens, protection, protect kids online, protect teens, provide live access to fraud resolution agents, Public-Private partnerships, public policy, Public Sector, puget sound, Pune Police, pup, puppy love, Pushbot, PWN2OWN, pws, Q1 Threats Report, Q2 Threats Report, Q3 Threats Report, Q4, QRCode, qr code, QR codes, Quarterly Global Channels Webcast, quarterly threat report, Quervar, raj samani, Ramnit, Ransom-AAY.gen.b, ransomeware, Ransomware, rançonnage, raonsomware, Rapport, RAR, RAT, Ravens, RC4 algorithm, RC4 encryption, rdp, realtec, Real Time ePO, Realtime ePO, Rebecca Black, Recent Facebook Scam, Recent Facebook threat, Records phone conversations, recover files, Red Exploit-Kit, Red Kit, Red October, reference architecture, regulation, regulations, reinfect mbr, relationships, remote evoting, Renee James, replacing your smartphone, reporting, reputational risk, Rep Weiner, research, reseller, resolutions, responsible mail, Responsible netizens, restore credit and personal identity, retail, reverse engineering, RFID, riches, ring tones, risk, Risk Advisor, risk and, Risk and Compliance, Risk Management, risk of personal information loss, risks of online shopping, risky, risky app, risky celebrity searches, risky celebrity to search, risqué photos, Riverbed, Robert Siciliano, roberts siciliano, ROFL, rogue anti-virus software, rogue antivirus, rogue applications, Rogue Certificates, rogue security software, ROI, role playing games for kids, romance scams, Rookits, root exploit, Rooting Exploit, rootkit, RootkitRemover, Rootkits, ROP, RPM Italian, RSA, RSA 2012, RSAC, RTF, ruins, rules/guidelines for kids' cyber safety, Russia, s, SaaS, SaaS Monthly Specialization, SaaS security solutions, safe, safe email tips, Safe Eyes, SafeKey, safe online shopping, safe password tips, Safe search, safe searching, safe search tips, safe shopping, safe shopping tips, Safe surf, safe surfing, safe transactions, safety tips, SAIC, sales conversions, Salesforce.com, Samsung, Samsung Galaxy SIII, sandbox, San Jose, Santa, Saudi Arabia, Saviynt Access Manager, SCADA, scam, scammers, scams, Scam Video, SCAP, scareware, scarface, SchmooCon, schools, SC Magazine, screensavers, sear, search, Search engine optimization, Search engine poisoning, SEC Guidance, secrecy, Secret Life of Teens, Secret Life of Teens research, Secret Lives of Teens, SecTor, Secure Boot, secure cloud computing, Secure Computing, secure container, secure data, secure devices, Secure Electronic Registration and Voting Experiment, Secure Email Gateway, secure mobile devices, secure new devices, secure passwords, secure smartphone, secure wi fi, Securing new devices, security, Security-as-a-Service, Security 101, Security and Defense Agenda, security attacks, security awareness, Security best practice, security branding, security breach, security breaches, security conferences, Security Connected, Security Connected Reference Architecture, Security Education, Security Influence, security information and event management, Security Innovation Alliance, security landscape, security management, security metrics, security optimization, security partner, security policy, security policy enforcement, security research, Security Seals, security software, Security Summit, security threats, security trends, self-defence, selling like, sensitive data, sensitive documents, sensitive information, Sentrigo acquisition, SEO, seo abuse, SEPA, SERVE, server, settings, sexting, Shady RAT, SharePoint, sharing photos, shellcode, Shop.org, shopping scams, shortened URLs, short url, shoulder surfing, SIA, SIA Partners, SIEM, signature-based detection, signed drivers, Silent Circle, Silent Text, simple safety tips, SiteAdvisor, site advisor, siteadvisor research, Sitting On Top Of The World, Situational Awareness, skype.exe, Skype malware, SkyWiper, Skywyper, SlowLoris, Small busines, Small Business, Smart Grid, smart phone, smartphone, smartphones, smartphone safety, smartphone security, smart phone threats, SmartScreen, SMB, SMB Advisor Tool, SMB Deal Registration, SMB Extravaganza, SMBs, SMB security, SMB Specialization, smishing, sms, SMS Lingo, sniffing tools, SNS Addiction, social business, social comparison, social connections, social engineering, Social Engineering tricks by malware, social media, social media online scams, social media passwords, social media scams, social media threats, social network, social networking, social networking best practices, social networking scams, social networking sites, social networking sites security, social networks, social responsibility, Social Security, Social Security Card, social security number, Social Security number fraud, social security number theft, Social Security number thefts, social skills, Sofia Vergara, soft token, software, Software-as-a-Service, software installation, solid state drive, Sony, Sophos, South Africa, South Korea, spam, spam mail, Spams, spear, Spearphishing, Spellstar, sport, SpyEye, Spyware, sql attacks, SQL Injection, SSN fraud, Ssucl, st. patricks day, Stack Challenge, stamper.a, State of Security, stay protected online, stay safe from phishing, stay safe online, stay safe tips, Stealth, stealth attack, stealth crimeware, stealth detection, stealthy attack, steganography, Steve Jobs, Stinger, stolen cards, stolen computer, stolen email addresses, stolen mail, stolen medical card, stolen passwords, stolen PC, stolen Social Security number thefts, Stop.Think.Connect, storage, student loan applications, Stuxnet, subscription, substation, Suites, summer activities, summer games, Summer holidays, Summer Olympics, summer vacation, Superbowl, Support, Support Notification Service, support services, surfing, survey, survive reboot, suspicious messages, suspicious URLs, Swartz, swine flu, Symbian, Sype, System Progressive Protection, sécurité informatique, T-Mobile, tablet computers, tablets, tablet security, TAGITM, Tags: Cybermum, targeted attack, targeted attacks, taxes, tax filing tips, taxpayer warning, Tax Preparer Scams, tax returns, tax scams, tax season reminder, TCO, teacher abuse over the internet, Teaming Plan, Tech Data, tech gifts, technical support, technology, technology development, technology trends, Tech Savvy Teenagers, tech services, tech support, teenage, teen behavior, teen hate video, teen love, Teen Online Research, teens, teens and porn, teens online, teens online dating, teens online safety, Teens on social networking sites, teens posting video, Telecommunications, terrorism, Testing, Tetris, text message, text messaging, Thailand, The Age of Cyber Warfare, The Profitability Stack, The Stack, The Tallinn Manual on the International Law Applicable to Cyber Warfare, The Use of the Internet for Terrorist Purposes, The VARGuy, threat, threat intelligence, threat predictions, threat reduction, threat report, Threats, threats on women's day, Threats Predictictions, thumb drive, thurber, Tiered Pricing, Tiger mother, Tips, tips and tricks, Tips for a secured password, Tips for Consumers, tips to mobile security, tips to stay safe online, TITUS, TJX, Todd Gebhart, toolkit scam, tools, Top 25 Companies to Partner With, Total Access, Total Access for Business, Total Access for Business Promotion, Total Protrection 2012, TPM, traffic manager, transfer data, travel, travel related online scams, travel risk, travel scams, travel security, Travnet, trending topics, trends, Trevi, trojan, trojan banker, trojans, troubleshoot PC, Trust and Safety, Trusted Computing Module, trustedsource, trusted websites and web merchants, Trusteer, trustmark, Trustmark Security, TSA, TSB and STP, Tulane, Tumblr, tweens, tweet, Tweets, twitter, Twitter celebrities, Twitter chat, Twitter online security, Twitter Spam, twitter spam; phishing; twitter scam, type in website address incorrectly, types of phishing, typing in incorrect URLs, typos, typosquatting, U.S. Cyber Challenge Camps, U.S. Economy, UAE, ukash, Ultrabook, Ultrabooks, Ultrabook security, unauthorized credit card transactions, Underground Economies, uninitialized local variable, unique password, United Arab Emirates, Unix, unlimited technical support, unpacking, unprotected PCs, unprotected rate research, unsecured computers, unsecured internet risk, unsecured unprotected wireless, unsecured unprotected wireless security risks, unsecured wireless, Unsecure websites, unsubscribe, update computer, UPS scam, UPS scams, UPX, urchin.js, URL hijacking, URL shortening services, USB drives, use after free, use of cookies advertising personal security, use of Social Security number (SSN) as national ID, user identification, user mode, US ESTA Fee Scam, US passport, USSC, USSD, US Visa Waiver Program scam, UTM, vacations, Valentine's Day, valentine scams, valentines day scams; romance scams; email spam, valentines day scams; romance scams; valentine threats, ValidEdge, ValidEdge sandboxing, Vanity Fair, VB6, vbs, Vericept DLP, verify website's legitimacy, Verizon DBIR, Verizon Mobile Security with Total Equipment Protection, ViaForensics, video game, Video of Nayanthara and Simbu, video shot of infosys girl, vinoo thomas, violent video games, virtual arguments, Virtualization, VIrtual Machines, Virtual Sales Kickoff 2012, Virtual Sales Kickoff 2013, virus, Viruses, Virus protection, virusscan, VirusScan Enterprise with ePO 8.8, VirusTotal, visa, vista, Vista Defender 2013, Visual Basic 6, VMworld 2011, Vontu DLP, VorVzakone, voter registration, voting, vPro, vulnerabilities, vulnerability, vulnerability management, Vulnerability Manager, vulnerability manager for databases, W32/XDocCrypt.a, waledac, Wall Street Journal, WAN, water facility, water pumps hacked, water treatment facilities hacked, wave secure, web, Web 2.0, Webcast, web filtering, web gateway, Webinar, web mobs, web protection, web searches, web security, Websense DSS, Web services, web sites, web threats, welfare fraud, wells fargo, Westinghouse, what to do when your wallet is lost missing or stolen, white hat hackers, Whitelisting, Wi-Fi WEP WAP protection breach, wifi, Wii, wikileaks, Win7 Defender 2013, Win 8, window, windows, Windows 7, Windows 8, Windows 8 Metro, Windows Credential, Windows Defender, windows malware, Windows Mobile, Windows Runtime, Windows Server 2012, Windows Store, Wind River, WinRT, winsh, work with victim restore identity, World Cup, world of warcraft, worm, Worm/Autorun, worm:Win32/Nuquel, Worms, wrong transaction scam emails, www.counteridentitytheft.com, Xbox, XDA-Developers, XDocCrypt, Xerox, XFA, xirtem, xmas, XPDefender 2013, xss, XtremeRAT, Yahoo!, Yahoo password hacked, yousendit, youth, youtube, Youtube Scam, you tube videos, Zbot, Zero-Day, Zero-Day Attack, ZeroAccess, zero padding, zeus, ZIP, zombie, zombie computers, zombies, • Facebook etiquette, • Most dangerous celebrity, • Parental control

South Korean Banks, Media Companies Targeted by Destructive Malware

Wednesday, March 20, 2013 at 5:18pm by
Jorge Arias

A massive computer shutdown of two South Korean banks and media companies occurred Wednesday via an Internet malware attack. The malware wiped out the master boot records on the hard drives of the infected computers, overwriting the MBR with either one of these strings:

  • PRINCPES
  • PR!NCPES
  • HASTATI.

jarias-MBR

Figure 1: Snapshot of MBR after infection.

The attack also overwrote random parts of the file system with the same strings, rendering several files unrecoverable. So even if the MBR is recovered, the files on disk will be compromised too.

After that, the system is forced to reboot via the following command:

  • shutdown -r -t 0

That action causes the computers to be unable to start because the MBR is corrupted.

jarias-Corrupted MBR

Figure 2: Error message after reboot

Furthermore, before overwriting the MBR, the malware attempted to kill the main processes of two Korean antivirus products, Ahnlab and Hauri:

  • taskkill /F /IM pasvc.exe
  • taskkill /F /IM Clisvc.exe

The malware code does not contain any function related to network communication, and we don’t have any indication that it can communicate with a remote host.

Also, it didn’t make any other changes in the system such as dropping files or changing registry keys. The goal of the attack appears to be solely to make the targeted computers unusable.

A dropper was found that seems to be the original dropper for this attack. The 418KB file is UPX packed, with the following hash:

  • 9263E40D9823AECF9388B64DE34EAE54

This dropper dropped the MBR-killing module as AgentBase.exe in the %TEMP% folder, and started it.

It also dropped two clean files, Putty SSH client and Putty SCP client in %TEMP%. It then scanned the file system looking for the configuration files of two SSH clients:

  • Felix Deimel’s mRemote
    %sAppData\Local\Felix_Deimel\mRemote\confCons.xml
  • VanDyke’s Secure CRT
    %sAppData\Roaming\VanDyke\Config\Sessions

If the malware finds a configuration file, it looks for any entry for a “root” user on a remote system, extracts the connection information, and uses the Putty clients to check if access to the system is available:

  • %s -batch -P %s -l %s -pw %s %s %s:/tmp/cups
  • %s -batch -P %s -l %s -pw %s %s “chmod 755 /tmp/cups;/tmp/cups”

The malware then drops another file in %TEMP% named “pr1.tmp,” which is a BASH shell script that attempts to perform partition killing on three Unix types: Linux, HP-UX, and SunOS.

jarias-shellscript

Figure 3: Part of the shell script used in the Unix attack.

This script checks the system, and then calls a specific function for each OS in an attempt to overwrite the disk partitions. In case the operation cannot be executed, it also tries to delete the following folders:

  • /kernel/
  • /usr/
  • /etc/
  • /home/

McAfee Labs was able to identify the following hashes related to this attack:

Wiper module

  • DB4BBDC36A78A8807AD9B15A562515C4  ApcRunCmd.exe
  • F0E045210E3258DAD91D7B6B4D64E7F3  ApcRunCmd.exe
  • 0A8032CD6B4A710B1771A080FA09FB87  mb_join.exe
  • 5FCD6E1DACE6B0599429D913850F0364  OthDown.exe

Dropper

  • 9263E40D9823AECF9388B64DE34EAE54  APCRunCmd.DRP

Unix Shell Script

  • DC789DEE20087C5E1552804492B042CD  pr1.tmp

As we looked in our sample database for related files, we identified two other samples that have the same basic structure as the preceding samples, but they don’t have the MBR-killing capabilities:

  • E4F66C3CD27B97649976F6F0DAAD9032 E4F66C3CD27B97649976F6F0DAAD9032.bin
  • 50E03200C3A0BECBF33B3788DAC8CD46  jar_cache1221312510715123682.tmp

These samples were found in the wild in August and October 2012. They share the same basic stub for the MBR-killing malware, but they are simple downloaders and don’t have commands to kill antivirus processes. They have only MS-DOS commands to remove themselves after executing.

Based on our analysis, these samples are not related to the attack, but they may be the same malware stub used by the attackers to create the MBR-killing code, sort of a template Trojan that can be tweaked to execute any function.

It’s possible to see the differences in the payload on the following images:

jarias-old

Figure 4: Payload of old samples.

jarias-new

Figure 5: Payload of new samples.

As we can see, the commands executed are different but the data structure is the same.

McAfee detects the samples involved in the attack as KillMBR-FBIA and Dropper-FDH.

 

Tags: , , , , , ,

Submit your own comments / message for this post

Your email is never published nor shared. Required fields are marked *

 

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Comments (0)