TECHNOLOGY, Malware Campaign Targets Russia, Allies

Trend Micro has uncovered evidence of a major targeted malware attack that has managed to infect more than 1400 computers in Russia and its former Soviet satellite states.
After penetrating the command and control servers connected to a gang using the widely-circulating 'Lurid' downloader malware toolkit, the company discovered a list of 47 different victims, 1,465 infected PCs by IP address, across 61 different countries.
Overwhelmingly, the infected systems were in former Soviet republics, with Russia accounting for over a thousand, with smaller numbers in Kazakhstan, Ukraine, Uzbekistan, Belarus, Kyrgystan, plus some in other states such as Vietnam, India and China. (See also "How to Avoid Malware.")
The breadth of the attack across this geographical region strongly suggests a targeted campaign as does the victim types identified which included "diplomatic missions, government ministries, space-related government agencies and other companies and research institutions."
Trend was not able to identify the organization or state behind the attacks but the vector -- exploiting a range of known software vulnerabilities for common apps such as Adobe's Reader -- is identical to attacks that have been made public elsewhere in the world in recent times.
"Although our research didn't reveal precisely which data was being targeted, we were able to determine that, in some cases, the attackers attempted to steal specific documents and spreadsheets," said Trend's note on the discovery.
The use of the Lurid toolkit plus large numbers of old vulnerabilities puts the attacks in a less sophisticated category to the Night Dragon campaign uncovered by McAfee earlier this year which had used a mixture of zero-day malware and direct server hacking to target Western energy companies.

Read More

TECHNOLOGY, 'Lurid' Malware Hits Russia, CIS Countries

The latest espionage-related hacking campaign detailed by security vendor Trend Micro is most notable for the country it does not implicate: China.
Researchers from Trend wrote on Thursday that they discovered a series of hacking attacks targeting space-related government agencies, diplomatic missions, research institutions and companies located mostly in Russia but also Vietnam and Commonwealth of Independent States countries. In total, the attacks targeted 1,465 computers in 61 countries.
The attacks, which Trend dubbed "Lurid," are not particularly unusual compared to other stealthy, long-range hacking campaigns publicized recently, said Rik Ferguson, director of security research and communication for Europe. Targeted e-mails were sent to employees that were engineered to attack unpatched software and sought to steal spreadsheets, Word documents and other information.
Those pilfered documents were then uploaded to Web sites hosted on command-and-control servers in the U.S and the U.K. Ferguson said. The location of the servers in these attacks shows that hackers can choose servers anywhere in the world to collect stolen information, which is not an indication of where the hackers may be located, he said.
China has endured frequent accusations that it is complicit in hacking since many high-profile attacks have originated from infrastructure within the country. But Ferguson said there are many tools ranging from VPNs (Virtual Private Networks) to e-mail spoofing techniques that can mislead hacking investigations.
"What do we do now?" Ferguson asked. "Point the finger at the U.S. and U.K.?"
Trend classified the Lurid attacks as an "advanced persistent threat" or APT, a relatively new term applied to hacking campaigns that endure for long periods of time undetected. Lurid has been active since at least August 2010.
Lurid uses a downloader program known as "Enfal" to steal documents. The downloader has been around since at least 2006, although it is not known to be sold on underground criminal forums, Ferguson said.
The e-mails sent to victims contained an attached file that looked for vulnerabilities in software on the computer. This particular series of attacks often exploited a vulnerability in Adobe Reader that dates back to 2009, Ferguson said. If the companies or organizations have not patched their software, they may be vulnerable: Security experts generally recommend patching as soon as a fix has been released.
Trend found that the hackers also assigned a special code to individual pieces of malware in order to identity their victims. Although the Lurid attacks touched on many organizations, most of the attacks were targeted at just three.
Ferguson said Trend identified 301 different campaign codes, with 115 campaigns focused on just one victim and 64 others hitting just two more organizations.
The information exfiltrated from compromised computers was sent encrypted to the command-and-control servers via HTTP POST requests. Since the stolen information was encrypted and appeared to be normal Web traffic, it can be difficult for organizations to detect that they may have been compromised, he said.
Ferguson said Trend had contacted Computer Emergency Response Teams in the affected countries and is also working with the U.K.'s Serious Organised Crime Agency, which includes hacking as part of its remit.

Read More

Embassy of Russia in the United Kingdom says that hackers hit website

LONDON | Sun September 11, 2011 8:59 am EST

London (Reuters)-the Embassy of Russia in London, said on Sunday that their site crashed in a hacker attack suspect shortly before Prime Minister David Cameron begins the first visit by a British leader to Moscow since the killing of 2006 in London of a critic of the Kremlin.

The Embassy said that he had created a "mirror" site (www.rusemborguk.ru) to meet the growing interest of the public and the media for information before Cameron flies to Russia on Sunday.

The Embassy "before the visit of Prime Minister David Cameron, the Russia, the site of the Russian Embassy in London (www.rusemb.org.uk) was shot down by a DDoS attack (distributed denial of service) suspect," said in a statement.

A DDoS attack is one in which hackers flood a site with information requests, making it unavailable to legitimate users.

Britain's relations with Russia have been soured by a dispute over the murder of 2006 in London critic of Kremlin Alexander Litvinenko, a former Russian spy who died of poisoning by radioactive Polonium-210.

Russia has refused to extradite Andrei Lugovoy, a bodyguard for former KGB Britain wants to process by the murder of Litvinenko. That sent the ties between the countries which plunges to a low of cold war and led to diplomatic expulsions tit for tat.

Relations have improved slightly since Cameron took power in Britain last year at the head of a coalition Government, and since that Dmitry Medvedev became President of Russia in 2008.

A spokesman for the Russian Embassy said problems with the site began on Friday night. The location was accessible for some time on Saturday, but went down again on Sunday, he said.

The site features articles by Russian Foreign Minister Sergei Lavrov and by Alexander Yakovenko, Russia's Ambassador in London in 12:0 am visit Cameron.

(Report by Adrian Croft; Edited by Janet Lawrence)

View the original article here

Peliculas Online

Read More