« March 2011 | Main | May 2011 »

April 2011

Wednesday, 27 April 2011

Coreflood Detection and Removal

Following the search and seizure of Coreflood botnet operations, the FBI has been examining traffic received at the servers they placed in substitution for Coreflood's C&C servers, and has notified many ISPs and businesses as they identified infected IPs on these public and private networks.  To further help with remediation, the FBI has also made the following information available to the security and operations communities to assist network administrators in identifying the presence of PCs infected with the AFcore malware.

Detecting Coreflood Infections

To determine whether infected PCs reside on your network, examine outbound traffic or security, event or traffic logs for HTTP/80 traffic to these IP addresses over the indicated range of dates:

        149.20.51.124   - 4/12/2011 to present/future
        207.210.74.74   - 4/12/2011 to 4/20/2011

In addition, examine outbound traffic or logs for DNS queries that attempt to resolve the following host names:

taxadvice.ehostville[dot]com
taxfree[dot]nethostplus[dot]net
onlinebooking[dot]nethostplus[dot]net
accounts[dot]nethostplus[dot]net
logon[dot]nethostplus[dot]net
imap[dot]nethostplus[dot]net
pop3[dot]nethostplus[dot]net
schedules[dot]nethostplus[dot]net
mediastream[dot]nethostplus[dot]net
ticket.hostnetline[dot]com
flu.medicalcarenews[dot]org
vaccine.medinnovation[dot]org
ipadnews[dot]netwebplus[dot]net
acdsee.licensevalidate[dot]net
savupdate.licensevalidate[dot]net
wellness.hostfields[dot]net
wiki.hostfields[dot]net
a-gps.vip-studions[dot]net
old.antrexhost[dot]com
marker.antrexhost[dot]com
spamblocker.antrexhost[dot]com
ads.antrexhost[dot]com
cafe.antrexhost[dot]com
coffeeshop.antrexhost[dot]com
dru.realgoday[dot]net
brew.fishbonetree[dot]biz
jane.unreadmsg[dot]net
exchange.stafilocox[dot]net
ns1.diplodoger[dot]com

How to Remove Coreflood

According to the FBI and Microsoft's Digital Crimes Unit, the following methods can be used to remove Coreflood from infected computers you identify:

Download and run the most current version of the Microsoft Malicious Software Removal Tool (MSRT) which will detect and remove Coreflood. MSRT works on Windows 7/Vista/XP and Windows Server 2003/2008. Note that MSRT targets specific malware (MSRT is also available via Microsoft Update, Windows Update and the Microsoft Download Center). For a more thorough scan and removal of other malware as well, download and run the most current version of Microsoft Safety Scanner.

Alternatively, update and run a full scan from your installed Anti-Virus software.  Most legitimate Anti-Virus software should now detect and remove Coreflood. A full scan is recommended because the AFCore malware has download-and-execute capabilities which can be used to install other malware in addition to the well-publicized key logging capabilities.

Posted at 03:31 PM in Anti-Malware and Anti-phishing | | Comments (0) | TrackBack (0)

Monday, 25 April 2011

Lessons learned from Amazon/AWS outage

Phil Wainewright's seven lessons learned from the Amazon outage run the gamut from the benevolent "customers will forgive Amazon because they are Amazon" to a finger-wagging "Did I not warn you to read the label?" However, the most important lessons Phil warns us to learn underscore the concerns I expressed regarding cloud marketing a short while ago.

Cloud security is ultimately bounded by the same constraints as the enterprise - expertise, quality of processes and workflows, technology, monitoring, review, testing... - and also subject to the same if not expanded attack surface [1].

The irony we witnessed from the AWS outages is that putting all your faith and assets into a single cloud puts you into a single point of failure scenario.

Phil warns us not to take cloud provider assurances for granted., supplement your cloud provider's services with resilience/recovery measures of your own, and be prepared to pay more than the cloud invoice every month, because resiliency comes at a cost.

 

Posted at 10:52 AM | | Comments (0) | TrackBack (0)

Next »
Find me on Mastodon and Facebook

Spotlight Posts

  • Interisle Study Reveals Alarming Rise in Online Abuse and Identifies Exploitable Links in Cybercriminal Supply Chains
    My Interisle colleagues and I today published our 2024 Cybercrime Suppy Chain study. We analyzed 16 million cybercrime events to expose a dramatic rise in criminal exploitation of name, address, hosting, and financial supply chains. Our year-over-year findings show that cybercriminals exploit lax policies to easily and cheaply obtain resources for phishing, malware, and spam campaigns. In our report, we provide actionable insights for those aiming to curb cybercrime. Among the major findings in the study, Interisle reports that: The total number of malware, phishing, and spam attacks grew year-over-year by nearly 54%, to nearly 16.3 million attacks. Spam doubled,...
  • Malware quarterly reports for July-September
    Malware quarterly reports for July-September 2024 is now posted at the Cybercrime Information Center. For the period... Malware identified as targeting endpoint devices increased 277% over the prior period. WordPress blog sites used for malware accounted for nearly all the malicious documents reported for this period. We continue to see an uptick in malicious scripts. IPv4 addresses reported for exhibiting characteristics of attackware and traffic injectors increased 38% to just under 1 million. ASNs in China and India again have the most IPv4 addresses reported for hosting malware. More malware trends for the period at https://www.cybercrimeinfocenter.org/malware-trends-july-september-2024. For historical reporting of...
  • Interisle's Phishing Landscape 2024 is here
    Our Interisle team today announced the publication of an industry report, Phishing Landscape 2024, A Study of the Scope and Distribution of Phishing. Interisle’s fourth annual study examines nearly four million phishing reports collected from May 2023 to April 2024 and provides historical measurements using over 15 million phishing reports collected at the Cybercrime Information Center over a four year period. Findings from the study: • The total number of phishing attacks grew to ~1.9 million incidents worldwide. • Phishing attacks hosted at subdomain providers increased by 450,000+ reported names, representing 24% of all phishing attacks. • The use of...
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....
  • Malware Trends, January - March, 2024 posted at the Cybercrime Information Center
    2024 began with a rise in domain names reported for hosting malware unlike any we have seen since we began measuring malware attacks in 2021. The 1Q2024 Top 20 TLDs included 10 new gTLDs, 6 ccTLDs, and 4 legacy gTLDs. Only three TLDs remained in the top 5 TLDs (COM, NET, INFO) from the prior quarter. The ORG and BR TLDs were replaced by SHOP (over 3,000% increase) and TOP (over 700% increase). All but one registrar in 1Q2024’s Top 20 registrar ranking showed increases of 100% or more. Several registrars had 4- and 5-figure percentage increases in domains reported....

Search

My Photo

Categories