Ruan Müller » trojan

Canada Post warns of fraudulent email

Ruan — Tue, 27 Apr 2010 03:18:27 +0000

Canada Post is warning its customers of a fraudulent email disguised as a delivery notification identifying itself as having been sent from Canada Post. The email states that Canada Post is trying to deliver a package and provides further directions for the recipient to open an email attachment in order to proceed with the package delivery.

Canada Post says the email is a fake and likely contains a virus or other malware. Recipients are being strongly cautioned against opening the attachment.

Additionally, Canada Post said that if a tracking number is provided in the email, you can check separately at the agency’s website. If it comes up as invalid, then the tracking number is a fake and the email should be deleted.

First known Mac botnet distributed as Trojan

Ruan — Mon, 20 Apr 2009 23:35:50 +0000

A piece of malicious software unwittingly shared over a peer-to-peer network in January was the key tool in what security researchers are saying was the first known attempt to create a botnet of Mac computers.

Researchers at Symantec say the Trojan, called OSX.Iservice, hid itself in pirated versions of the Apple application iWork ’09 and the Mac version of Adobe Photoshop CS4 that were shared on a popular peer-to-peer bittorrent network.

SecureMac has released a tool to remove the Trojan, and can be downloaded from here.

Via: cbc.ca

New rogue DHCP server malware

Ruan — Tue, 17 Mar 2009 06:00:05 +0000

A bold new type of malware has been identified. Its attack vector is based on hijacking the DNS settings for devices on a local area network. Any device regardless of operating system that depends on an internal or external name server can be affected.

The trojan configures and runs a rogue DHCP daemon on the infected host. Other devices on the same LAN are misled into using name servers settings provided by the trojan DHCP daemon for DNS lookups instead of using the origional configured name servers.

Devices on the network are then sent to fraudulent websites that can be more difficult to identify as imposters since the DNS lookups appear correct.

This is a more advanced attack of a well known vector of attacking a systems hosts file, but by being system agnostic and using the familiar DNS protocol, it is much more effective.

More details can be found at SANS