SMS Trojans Spreading to the Rest of the World

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="http://www.hungry-hackers.com/wp-content/uploads/2010/07/mobile-phone-being-stolen.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://www.hungry-hackers.com/wp-content/uploads/2010/07/mobile-phone-being-stolen.jpg" /></a></div><br /><br /><div style="color: #333333; font-family: Arial, Helvetica, 'Bitstream Vera Sans', sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 1em; margin-top: 1em; text-align: -webkit-auto;">SMS Trojans that ride along on supposedly benign mobile apps and then send out messages to high-priced numbers have been a problem in some Asian and Eastern European countries for several years now, most notably in Russia and China. But now the attackers have realized that there's a whole big world of users out there to target and have begun going after people in other countries with new strains of SMS malware.</div><div style="color: #333333; font-family: Arial, Helvetica, 'Bitstream Vera Sans', sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 1em; margin-top: 1em; text-align: -webkit-auto;">A new SMS Trojan that has been seen in some limited infections so far, is targeting users in a number of European and western countries right now, including Belgium, Canada, France, Germany, Luxembourg, Spain, Switzerland and the UK. The Trojan has a couple of main functions, each of which is designed to deceive the user and surreptitiously run up charges on her mobile bill.</div><div style="color: #333333; font-family: Arial, Helvetica, 'Bitstream Vera Sans', sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 1em; margin-top: 1em; text-align: -webkit-auto;">The Trojan has been seen thus far hiding inside an app that supposedly monitors the victim's SMS and data usage on the device.</div><div style="color: #333333; font-family: Arial, Helvetica, 'Bitstream Vera Sans', sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 1em; margin-top: 1em; text-align: -webkit-auto;"><br /></div><div style="color: #333333; font-family: Arial, Helvetica, 'Bitstream Vera Sans', sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 1em; margin-top: 1em; text-align: -webkit-auto;"></div><div style="margin-bottom: 1em; margin-top: 1em;">The Android app has shown up on file-sharing sites under the name SuiConFo.apk, according to <a class="ext" href="http://www.securelist.com/en/blog/208193261/SMS_Trojans_all_around_the_world" style="color: #ab0f0e;" target="_blank">research by Kaspersky Lab researcher Denis Maslennikov</a><span class="ext" style="background-attachment: initial; background-clip: initial; background-color: initial; background-image: url(https://threatpost.com/sites/all/modules/extlink/extlink.png); background-origin: initial; background-position: 100% 50%; background-repeat: no-repeat no-repeat; padding-right: 12px;"></span>, and once it's installed on a victim's device, it will initially display an error message saying that the user's device isn't compatible with the app. That's just the beginning, however.</div><div style="margin-bottom: 1em; margin-top: 1em;">"Right after displaying this message the Trojan will call the public method <em>getSimCountryIso</em> in the <em>TelephonyManager</em>class in order to retrieve the ISO country code of the SIM card," Maslennikov wrote. "After defining the country and, therefore, the number and message text, the Trojan will send 4 SMS messages with the help of the<em>sendTextMessage</em> method. SMSReceiver.class is responsible for hiding incoming SMS messages from particular numbers. If there is an incoming SMS message from one of the following numbers: 81001, 35064, 63000, 9903, 60999, 543, 64747, then the Trojan will try to hide it using the <em>abortBroadcast</em> method. The number itself is retrieved from the SMS message with the help of <em>getDisplayOriginatingAddress</em>."</div><div style="margin-bottom: 1em; margin-top: 1em;">So the Trojan will remain in the background, checking for incoming messages from specific SMS numbers, and will then hide those messages from the user so she isn't aware of the infection and the fact that outgoing messages are being sent to premium-rate numbers. The charges for those messages can accumulate quickly, and if the user isn't aware that they're being sent, it can be an expensive infection.</div><div style="margin-bottom: 1em; margin-top: 1em;">Researchers have found similar SMS Trojans going after users in the United States, the UK and the Netherlands in recent months, but infections have been limited so far. That may well change as the popularity of Android devices--which have been the main target for SMS Trojans--continues to increase.</div><br /></div>

SMS Trojans Spreading to the Rest of the World

SMS Trojans that ride along on supposedly benign mobile apps and then send out messages to high-priced numbers have been a problem in some Asian and Eastern European countries for several years now, m…

Read more »

New Facebook Worm installing Zeus Bot in your Computer

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div dir="ltr" style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" trbidi="on"><div class="separator" style="clear: both; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsjXx1q6L-pZg_ul-d4PxEdbHtzjKynJMDD_wun1ky9Q5kYKUpKU0WAPi4c_asGB3KyDI8lcNwI6i_OLKf7AQVbTUMoNjhGwu8z76BzQZKeC7Sp-ImA6pK1fS2JNFkaZjR3BBt9ahzuqRL/s1600/Facebook.jpg" imageanchor="1" rel="nofollow" style="clear: left; color: black; cursor: pointer; float: left; margin-bottom: 1em; margin-left: 0px; margin-right: 1em; margin-top: 0px; outline-color: initial; outline-style: none; outline-width: initial; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-decoration: none;"><img border="0" height="512" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsjXx1q6L-pZg_ul-d4PxEdbHtzjKynJMDD_wun1ky9Q5kYKUpKU0WAPi4c_asGB3KyDI8lcNwI6i_OLKf7AQVbTUMoNjhGwu8z76BzQZKeC7Sp-ImA6pK1fS2JNFkaZjR3BBt9ahzuqRL/s640/Facebook.jpg" style="border-bottom-width: 0px; border-left-width: 0px; border-right-width: 0px; border-top-width: 0px; clear: both; cursor: pointer; margin-bottom: 4px; margin-left: 0px; margin-right: 4px; margin-top: 0px; max-height: 1500px; max-width: 610px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" width="640" /></a></div><span class="Apple-style-span" style="font-size: medium; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;"><br style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" /></span></div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;">Today another new attack on Facebook users with Zeus Bot comes in action. The researchers of Danish security firm <a href="http://www.csis.dk/da/csis/news/3387/" rel="nofollow" style="color: #034e9d; cursor: pointer; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; outline-color: initial; outline-style: none; outline-width: initial; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-decoration: none;">CSIS</a>, has spotted a worm spreading within the Facebook platform. A new worm has popped up on Facebook, using apparently stolen user credentials to log in to victims' accounts and then send out malicious links to their friends. The worm also downloads and installs a variety of malware on users' machines, including a variant of the Zeus bot.</div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;"><br style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" /></div><div class="separator" style="background-color: white; clear: both; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0p4aICz2ilWJ0OwqGfrwHfyss-of8UgcEJg6KQk4_MIFu1Gw_FVN0caj4-u8gbgv_8cXiYyHpnQvb9czqrI8WVZjIbe5G_NoNxPiKfgOwVaduBpNv4TzzpDlgllOGbk9z07-mkMjGV09B/s1600/sn-worm.png" imageanchor="1" rel="nofollow" style="clear: left; color: #034e9d; cursor: pointer; float: left; margin-bottom: 1em; margin-left: 0px; margin-right: 1em; margin-top: 0px; outline-color: initial; outline-style: none; outline-width: initial; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify; text-decoration: none;"><img border="0" height="231" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0p4aICz2ilWJ0OwqGfrwHfyss-of8UgcEJg6KQk4_MIFu1Gw_FVN0caj4-u8gbgv_8cXiYyHpnQvb9czqrI8WVZjIbe5G_NoNxPiKfgOwVaduBpNv4TzzpDlgllOGbk9z07-mkMjGV09B/s400/sn-worm.png" style="border-bottom-width: 0px; border-left-width: 0px; border-right-width: 0px; border-top-width: 0px; clear: both; cursor: pointer; margin-bottom: 4px; margin-left: 0px; margin-right: 4px; margin-top: 0px; max-height: 1500px; max-width: 610px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" width="400" /></a></div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;">If followed, the link takes the potential victim to a page where he or she are offered what appears to be a screensaver for download. Unfortunately, it is not a JPG file, but an executable (b.exe). Once run, it drops a cocktail of malicious files onto the system, including ZeuS, a popular Trojan spyware capable of stealing user information from infected systems. The worm is also found to have anti-VM capabilities, making it useless to execute and test in a virtual environment, such as Oracle VM VirtualBox and VMWare.</div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;"><br style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" /></div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;">Zeus is a common tool in the arsenal of many attackers these days, and is used in a wide variety of attacks and campaigns now. It used to be somewhat less common, but the appearance of cracked versions of the Zeus code has made it somewhat easier for lower-level attackers to get their hands on the malware. Zeus has a range of capabilities, and specializes in stealing sensitive user data such as banking credendtials, from infected machines.</div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;"><br style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" /></div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;">"<i style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;"><span class="Apple-style-span" style="color: #990000; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;">The worm carries a cocktail of malware onto your machine, including a Zbot/ZeuS variant which is a serious threat and stealing sensitive information from the infected machine</span></i>," warn the researchers.The worm is hosted on a variety of domains, so the link in the malicious message may vary. Other servers are used to collect the data sent by the aforementioned malware and to serve additional malicious software.</div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;"><br style="margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px;" /></div><div style="background-color: white; color: #555555; font-family: Arial, Tahoma, 'Century gothic', sans-serif; font-size: 13px; line-height: 24px; margin-bottom: 0px; margin-left: 0px; margin-right: 0px; margin-top: 0px; padding-bottom: 0px; padding-left: 0px; padding-right: 0px; padding-top: 0px; text-align: justify;">This type of thing is very rare to just send to your email without you requesting it so I would advise anyone who thinks that you may have seen an email like this to delete it and mark it as spam right away.</div></div>

• 
• 

1. 1
2. 2

• Previous
• Next

New Facebook Worm installing Zeus Bot in your Computer

Today another new attack on Facebook users with Zeus Bot comes in action. The researchers of Danish security firm CSIS, has spotted a worm spreading within the Facebook platform. A new worm has popped…

Read more »

Ministry of Foreign Affairs Dhaka (Bangladesh) Hacked By KhantastiC haXor & Shadow008

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeXrWkB6yIZj-XPiii8QTeFjaHVkVLAWe9E_Pe_ktBlmJ-Gc-g8NWGfpBXTpUh802lyNMdP8vbv9wCsu3A5FUkaqBPLtZU9yCUcyMu7ECy0jvPs43i9RqbqC-RoiMTDpb9GqlgkQgLXRc/s1600/khan.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="226" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgeXrWkB6yIZj-XPiii8QTeFjaHVkVLAWe9E_Pe_ktBlmJ-Gc-g8NWGfpBXTpUh802lyNMdP8vbv9wCsu3A5FUkaqBPLtZU9yCUcyMu7ECy0jvPs43i9RqbqC-RoiMTDpb9GqlgkQgLXRc/s320/khan.png" width="320" /></a></div><br />Ministry of Foreign Affairs Dhaka (Bangladesh) has been Hacked by the Pakistani Hacker called KhantastiC HaXor & Shadow008. However, the hacker did not full deface the site and has just added a friendly message to there administrators to keep there sites security higher.<br /><br />This is Message which was added on the site:<br /><br /><strong style="background-color: white; color: red; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 15px;"><strong>Hello from Pakistan :D </strong></strong><br /><strong style="background-color: white; color: red; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 15px;"><strong>how re you Bangladesh GOV !! :P</strong></strong><strong style="background-color: white; color: red; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 15px;"><strong> ...</strong></strong><br /><strong style="background-color: white; color: red; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 15px;"><strong>No News is Good News Please Please Secure it :P //... </strong></strong><br /><strong style="background-color: white; color: red; font-family: Helvetica, Arial, sans-serif; font-size: 16px; line-height: 15px;"><strong>thanks contact @ </strong><a href="mailto:h4ck3r@live.com.pk" style="color: #135cae; font-weight: normal; text-decoration: none;">h4ck3r@live.com.pk</a></strong><br /><br />Site Hacked:<br /><a href="http://www.mofa.gov.bd/">http://www.mofa.gov.bd/</a><br /><br />Mirror:<br /><a href="http://www.zone-h.com/mirror/id/15934892">http://www.zone-h.com/mirror/id/15934892</a></div>

Ministry of Foreign Affairs Dhaka (Bangladesh) Hacked By KhantastiC haXor & Shadow008

Ministry of Foreign Affairs Dhaka (Bangladesh) has been Hacked by the Pakistani Hacker called KhantastiC HaXor & Shadow008. However, the hacker did not full deface the site and has just added a friend…

Read more »

1,200 + Indian Sites Hacked By Shadow008 (PakCyberArmy)

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxhfGnDr3p9ADHci_8uLtVJFpX6bJU8xD_3g_MJT-McIrWzYWYjQIswtLwFCJqiYPe6yrZqiKrTEvnnzzwVQxSktt7NYFGkaGO64kVBM0iwCGF1ii_21xiFb8hIPOqqBjP3ioVQ34SI9g/s1600/shadow.JPG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="220" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhxhfGnDr3p9ADHci_8uLtVJFpX6bJU8xD_3g_MJT-McIrWzYWYjQIswtLwFCJqiYPe6yrZqiKrTEvnnzzwVQxSktt7NYFGkaGO64kVBM0iwCGF1ii_21xiFb8hIPOqqBjP3ioVQ34SI9g/s320/shadow.JPG" width="320" /></a></div><br />More then 1,200 + Indian Sites has been hacked by Shadow008 from the team called Pakistan Cyber Army. It was a payber after Indian hackers where trying to spread some kind of virus on Pakistan's Government websites .  However, Pakistani Hackers proved that Pakistani's hackers can also spread virus on Indian websites.<br /><br />Sites Hacked:<br /><a href="http://pastebin.com/dWMmFmrt">http://pastebin.com/dWMmFmrt</a><br /><br />Mirrors:<br /><a href="http://www.zone-h.com/archive/notifier=PakCyberArmy">http://www.zone-h.com/archive/notifier=PakCyberArmy</a></div>

1,200 + Indian Sites Hacked By Shadow008 (PakCyberArmy)

More then 1,200 + Indian Sites has been hacked by Shadow008 from the team called Pakistan Cyber Army. It was a payber after Indian hackers where trying to spread some kind of virus on Pakistan's Gover…

Read more »