Since Saturday evening, we have been experiencing multiple attacks targeting websites under gov.pl domain. Most of the attacks are DDoS, attributed to Anonymous who declared radical protests after Polish government revealed plans to sign the ACTA treaty on January 26th. Websites of the Polish Parliament, Ministry of Foreign Affairs and Internal Security Agency were among victims of these attacks. List of targets, as well as links to LOIC-based software for launching the attacks and VPN clients for anonymisation are distributed via twitter, Facebook (13000 likes as of today!) and the anonops IRC server.

Read more

Jeśli podczas surfowania w Internecie natkniemy się na witryny kuszące tytułową frazą, radzimy nie cieszyć się przedwcześnie. Najprawdopodobniej trafiliśmy na kolejną stronę, która w bardziej bądź mniej sprytny sposób próbuje wyłudzić od nas pieniądze. W tym przypadku jest to skłonienie nas do wykupienia usługi dostępu do „super gadżetów: gier java, dzwonków tapet i innych”. Płatność odbywa się za pomocą SMS Premium (2,46 PLN/SMS – 4 SMS/tydzień lub 7,38 PLN/SMS – 1 SMS/tydzień). Organizatorem „promocji” jest firma holenderska. Aby zobrazować rząd wielkości korzyści majątkowych pochodzących z nieuwagi internautów, można przytoczyć informację prasową o przejęciu wspomnianej spółki przez spółkę niemiecką (obie działające w tym samym obszarze rynku). Wartość przejęcia: 20 milionów euro w gotówce oraz 1,9 miliona euro w nowowyemitowanych akcjach a także spłata długu w wysokości 9,8 miliona euro. Przewidywany roczny przychód nowej spółki – 95 milionów euro, zysk EBITA – 18 milionów euro.

Read more

In the autumn of 2011 we observed new malware infections, which looked similar to Zeus. Subsequent analysis of the malicious software mechanism start up, the process of hiding and storing of configuration indeed verified that it was ZeuS. However, monitoring of infected machines failed to uncover the characteristic communicatation with a C&C. After closer examination it appeared that the sample was probably a new version based on the source code of ZeuS that was accidentally made public.

In the new version of the Trojan, the authors focus on eliminating the weakest link – a centralized system of information distribution.
Previous versions of Zeus were based on one (or few) predefined addresses which were used for botnet management. This allowed for relatively easy tracking and blocking of servers, thus rendering the botnet useless. However, the analysed variant of the Trojan used two new channels of communication to receive orders (figure on right):

1. Communication in a peer-to-peer network
2. Domain names Generation Mechanism

This variant has been analyzed to some extent by other researchers before – there is information on the web on the new variant of Zeus (eg abuse.ch ), however – based on our knowledge – previous research has focused on registering and monitoring traffic to Zeus domains. In our work we focus on understanding the P2P network communication mechanisms, mapping out the network, and monitoring the exchange of information in this particular network.

Read more