Kaspersky : Shamoon Malware Nothing More Than 'Quick And Dirty'

Summary: Kaspersky's analysis of Shamoon malware has concluded it was a job pulled off by talented amateurs. 

The malware attacked the hard drives of 30,000 workstations owned by Saudi oil firm Saudi Aramco. After pro-actively disabling network channels, the system was cleaned before major damage could be done -- and Kaspersky Lab consider the attack nothing more than a "quick and dirty" job.

The lab's specialist Dmitry Tarakanov published an research of the viruses after taking apart its value, and the research places innovative programming such as Stuxnet and Fire into an entirely different group.

A number of "silly" errors were made, such as using defective time frame evaluation and replacing lower situation for higher situation characters -- something the specialist views a indication of hurry which effects the potency of the attack:

"But instead of a correct structure sequence, the viruses author used "%S%S%d.%s" with an uppercase "S". This causes a "sprintf" operate failing and no complete direction sequence is designed. Deficiency of complete direction means that no information file is decreased. No information file, no performance. So, the Shamoon viruses does not have a performance to perform other applications."
The addition of Wikipedia's losing banner image under its unique name US_flag_burning.jpg was regarded an "intentional" idea for the image to be found.

This is the image that is used to overwite the expert start history of hard disks, although the newest version also overwrites 192KB prevents of information with at random produced information.

Recognized as W32.Disttrack, the viruses also changes the effective categories of an contaminated device and baby wipes "priority" information files marked with obtain, papers, image, music, video and pc. Once the clearing off 'death' time frame is read from a .pnf information file and assessments out, the windsheild wiper is triggered.

Tarakanov also refers to a complicated element of Shamoon -- the fact that it uses genuine finalized individuals of Eldos’ application RawDisk. At first they thought that it was done for spinning requirements, but Windows seven gives conventional individual accessibility without the need for a finalized third-party car owner. Yet, Shamoon needs to run with manager rights anyway, so the programming seems useless.

The specialist concluded:

    "We've got other signs that individuals behind developing the Shamoon viruses are not high-profile developers and the characteristics of their errors indicates that they are beginners at the same time competent beginners as they did make a quite possible piece of self-replicating dangerous viruses.

    Unfortunately, we see that the alerts given of harmful application using genuine kernel-mode applications is not fear but truth. Designers of individuals should always keep in mind that cybercriminals and other individuals who make viruses search for concealed ways to accessibility a body Ring0."

The viruses first hit Aramco on 15 Aug. Reviews have recommended that a similar strike on Qatar-based natural gas company RasGas may be down to Shamoon, but this is yet to be verified.

Posted by Unknown Friday, September 14, 2012

Bitdefender Releases Tool For Removing Gauss Financial Malware

Summary: Multiple security firms are now offering clean-up tools that target the password- and cookie-stealing malware, and both Kaspersky and Bitdefender reckon it's another state-sponsored security issue.

The protection company Bitdefender has launched a clean-up resource for those who think their PCs might be contaminated with the Gauss viruses.

Gauss, which was outed by Kaspersky the other day, is economical espionage viruses that holds some likeness to the Fire computer virus, found returning in May. Gauss can grab sign in experience and treats, and objectives e-banking, online community and e-mail options.

Like Kaspersky, Bitdefender is of the viewpoint that Gauss is a "state-sponsored cyber-weapon", of the same ilk as Fire and Stuxnet.

"This encourages us about the point that cyber-warfare is going into the economical sector: searching the roots and location of cash, and who is financing what functions," Bitdefender primary protection specialist Catalin Cosoi said in a declaration.

Stuxnet is commonly considered to have been designed by the US and Israel. Two decades ago it was used to ruin Iranian atomic features.

Gauss has so far been used to grab information from Lebanese financial institutions such as the Financial institution of Beirut and Credit score Libanais, although Citibank and PayPal clients have also been focused.

The viruses has one particularly inquisitive characteristic: it seems to set up a customized typeface known as Palida Filter onto victims' computer systems. This creates the job of elimination resources from Bitdefender and Kaspersky somewhat simpler, as they can look for the distinguishing typeface.

Posted by Unknown Monday, August 13, 2012