Tag Archives: Malware

Avira

Shortcut Express to Infected & Phishing Websites

URL shorteners are a relatively new Internet service. As many social services on the Internet impose character limitations (Twitter is a prime example), these URL are very practical…

For example, you’d spend 64 characters to point to Wiki’s article about URL shorteners: http://en.wikipedia.org/wiki/URL_shortening. With an URL shortener, you can cut that down to 16 characters: http://bit.ly/c1htE.

URL shorteners, however, can be used to hide the real target of a link. Cyber criminals appreciate this “feature” – and use it to hide links to phishing or infected websites. These services usually have terms and conditions comparable to TinyURL:

“TinyURL was created as a free service to make posting long URLs easier, and may only be used for actual URLs. Using it for spamming or illegal purposes is forbidden and any such use will result in the TinyURL being disabled and you may be reported to all ISPs involved and to the proper governmental agencies. This service is provided without warranty of any kind.”

Few seem to care about these terms, which are regularly flaunted in the pursuit of profit. Happily, however, certain services have started to filter shortened links through special services, even if this has so far failed to stem the flow of shortened SPAM URLs.

Below are statistics with the percentage of malicious links identified on 22 popular URL shortener services:

Phishing

Malware
# Shortener % Shortener %
1 tinyurl.com 41.30 k.im 27.87
2 bit.ly 15.29 notlong.com 27.05
3 r2me.com 12.04 tinyurl.com 18.85
4 snipurl.com 7.16 cli.gs 7.38
5 lu.mu 6.50 bit.ly 7.38
6 doiop.com 4.52 doiop.com 4.10
7 notlong.com 3.55 ad.ag 2.46
8 is.gd 1.93 is.gd 1.64
9 tiny.cc 1.81 tr.im 0.82
10 sn.im 1.69 snipurl.com 0.82
11 k.im 0.96 ow.ly 0.82
12 shorl.com 0.66 dwarfURL.com 0.82
13 tr.im 0.60 zi.ma 0.00
14 goo.gl 0.54 u.nu 0.00
15 ow.ly 0.48 tiny.cc 0.00
16 cli.gs 0.30 sn.im 0.00
17 u.nu 0.18 shorl.com 0.00
18 moourl.com 0.18 r2me.com 0.00
19 idek.net 0.12 moourl.com 0.00
20 dwarfURL.com 0.12 lu.mu 0.00
21 zi.ma 0.06 idek.net 0.00
22 ad.ag 0.00 goo.gl 0.00

Source: Avira Virus Lab, taken from the month of July, 2010.

Shortened Links Can Mask A Threat

To give you an example, would you click on the following link?

www.ssl-albion-netbank.com/143.027.902

Probably not… The bank’s made-up name and use of random numbers would rightly give you misgivings. However, under a shortened guise – http://goo.gl/mDNuMg – one would not know that it’s a phishing website (in this case, a dead link).

Recommendations:

The bottom line is that if you can, avoid clicking on shortened URL links. If you do need to click on shortened links, copy and paste the link into a link lengthener – such as http://longurl.org/, which displays the full version of the links without having to click on it (exists also as a browser extension for Chrome and Firefox).

Finally, we recommend you equip yourself with Avira’s free Browser Safety extension, also for Chrome and Firefox, which blocks infected websites before they load. To learn more about Browser Safety, visit Avira’s website here: https://www.avira.com/en/avira-browser-safety

The post Shortcut Express to Infected & Phishing Websites appeared first on Avira Blog.

Panda Security

Over 20 million new strains of malware were identified in Q3 2014

The growth of malware appears unstoppable. In total, some 20 million new strains were created worldwide in the third quarter of the year, at a rate of 227,747 new samples every day.

Similarly, the global infection ratio was 37.93%, slightly up on the previous quarter (36.87%).

These are just a few of the figures presented by Luis Corrons, Technical Director of PandaLabs, from the latest quarterly report.

luis-corrons-malware

As you can see, this latest presentation had a slightly different feel to it from others in the past. We’ll show you more later. ;)

Trojans are on the increase

Trojans are still the most common type of malware (78.08%). A long way behind in second place come viruses (8.89), followed by worms (3.92%).

Luis explained that “In these last months we have seen how cyber-crime has continued to grow. Criminals haven’t ceased to create malware in order to infect as many systems as possible so as to access sensitive or confidential information.”

“Corporate environments are also under attack,” he added. “In the last three months many large companies have been drawn into numerous scandals, including the so-called ‘Celebgate’, where nude photos of actresses and models hosted on Apple’s iCloud service were leaked, or the theft of passwords for Gmail and Dropbox.”

Trojan infections rise while PUPs drop

On the other hand, Trojans also accounted for most infections during this period, some 75% of the total, compared with 62.80% in the previous quarter.

PUPs are still in second place, responsible for 14.55% of all infections, which is down on the second quarter figure of 24.77. These are followed by adware/spyware (6.88%), worms (2.09%), and viruses (1,48).

Infections by country

With respect to the data across different countries, China still has the highest infection rates, at 49.83%, followed by Peru (42.38%) and Bolivia (42.12%).

In fact, the ranking of countries with the highest infection rates is dominated by Asian and Latin American countries. Spain (at 38.37%) is also among the countries with infection rates above the global average.

Europe is the region with least infections, with nine countries in the top ten most secure. Norway (23.07%) and Sweden (23.44%) top the list, followed by Japan (24.02%), the only non-European country in the ranking.

Presentation of the PandaLabs Quarterly Report

As we mentioned before, this quarter’s presentation had a slightly spooky feel to it, with skulls, ghosts, presents and plenty of other surprises!

Here are some photos of our Halloween presentation.

panda-press-release

panda-report-presentation

panda-awards

panda-lottery

The post Over 20 million new strains of malware were identified in Q3 2014 appeared first on MediaCenter Panda Security.

ESET

“More human” carder malware emerges for sale in dark web

A tool for cybercriminals that promises to use stolen credit card details in a more ‘human way’ to bypass fraud detection has been found on sale for as little as $180, according to The Register. “Voxis Platform” is described as “advanced cash out software”, which will help cybercriminals earn “astronomical amounts” by mimicking human behavior on different

The post “More human” carder malware emerges for sale in dark web appeared first on We Live Security.

Security

Dyreza Banker Trojan Attackers Exploiting CVE-2014-4114 Windows Flaw

The Dyreza Trojan is nothing if not ambitious. The malware has been spotted doing a variety of interesting things in the last year, including bypassing SSL and targeting users of specific business apps. Now the Trojan is exploiting the recently disclosed CVE-2014-4114 vulnerability in Windows that was first used by the Sandworm attackers. Researchers at […]