An Update on the UrlZone Banker

UrlZone is a banking trojan that appeared in 2009. Searching its name or one of its aliases (Bebloh or Shiotob) reveals a good deal of press from that time period along with a few technical analyses in 2009 [1] [2], 2012 [3], and 2013 [4]. Despite having a reputation of evolution, there doesn’t seem to be very many recent updates on this malware family though. Is UrlZone still a threat and if so, how has it changed?

To explore that, this post takes a look at a recent UrlZone malware sample to see if it is still an active threat. It then gives an update on the command and control (C2) communications as they have changed since being previously documented. These are then put together in some proof of concept code that downloads and decrypts the webinject configuration file (the bread and butter of any banker malware) to see what financial institutions are being targeted.

Sample

The sample analyzed for this post has an MD5 of:

01fd0f1ad59ad5403c9507bfb625fe0c

For the “stop using md5 now” converts, it has the following SHA256:

39bbde33922cd6366d7c2a252c4aadd4dfd7405d5271e3652940a7494b885e88

The sample’s compilation date is 2015-06-12 12:01:03. This date seems legit as Continue reading

Facebook, Amazon, Apple pick up spending on lobbying

Apple, Facebook and Amazon.com have increased their expenses on trying to influence U.S. politicians and policy at the federal level, but Google still outstrips them in spending though it reduced expenditure in the second quarter.Amazon’s spending on lobbying increased by 103 percent to a record US$2.15 million in the second quarter of 2015, according to data collated by advocacy group Consumer Watchdog from filings by the company. Facebook’s expense rose to $2.69 million in the quarter, up 27 percent from $2.12 million in the second quarter of 2014. The social networking company outstripped its first quarter spending of $2.44 million by 10 percent.To read this article in full or to leave a comment, please click here

Add Brocade MLX & VDX Support to HP IMC

HP IMC 7.1 E0303P13 does not support configuration backups for Brocade MLX & VDX devices. But they do have an extensible model, so it’s easy to add support. Here’s how to do it, and how to fix the Brocade ICX support.

Here’s the steps to add support for MLX & VDX devices to HP IMC:

  1. Download the current set of adapters from GitHub.
  2. Unpack the zip file, and copy the adapters into place.
  3. Add Device Series & Device Model definitions.
  4. Restart IMC, re-synchronise, and check file transfer modes.

Going into a bit more detail:

NB: Yes, I do work for Brocade. That doesn’t mean that these adapters are fully supported by Brocade. I’ll help out however I can, but can’t promise anything.

NetOps Custom Adapters

This GitHub repository maintains a set of 3rd-party developed adapters for HP IMC. You can download individual files, create a local copy of the repo using Git, or just download a zip file containing all current scripts from here.

On the IMC server, adapters are stored at (IMC)/server/conf/adapters/ICC. You’ll see directories for all supported vendors there:

[root@imc ~]# cd /opt/iMC/server/conf/adapters/ICC
[root@imc ICC]# ls
3Com    Alcatel-Lucent  Aruba Networks  Avocent  Cabletron  Dell  Enterasys         F5       Fortigate  H3C              Hillstone  IBM                Continue reading

My BIS/Wassenaar comment

This is my comment I submitted to the BIS on their Wassenaar rules:

----
Hi.

I created the first “intrusion prevention system”, as well as many tools and much cybersecurity research over the last 20 years. I would not have done so had these rules been in place. The cost and dangers would have been too high. If you do not roll back the existing language, I will be forced to do something else.

After two months, reading your FAQ, consulting with lawyers and export experts, the cybersecurity industry still hasn’t figured out precisely what your rules mean. The language is so open-ended that it appears to control everything. My latest project is a simple “DNS server”, a piece of software wholly unrelated to cybersecurity. Yet, since hackers exploit “DNS” for malware command-and-control, it appears to be covered by your rules. It’s specifically designed for both the distribution and control of malware. This isn’t my intent, it’s just a consequence of how “DNS” works. I haven’t decided whether to make this tool open-source yet, so therefore traveling to foreign countries with the code on my laptop appears to be a felony violation of export controls.

Of course you don’t intend Continue reading

Google to begin closing Google+ Photos on Aug. 1

The end is near for Google+ Photos, the photo sharing service that’s part of the company’s social network.Google will begin closing down the service on Aug. 1 on Android, with the Web and iOS devices to follow soon after.For a time, Google touted the service as a key element in Google+, with a range of editing tools and image enhancement technologies rolled out over the years.But Google hinted that its days might be numbered when the company rolled out its new Google Photos service at Google I/O in May.To read this article in full or to leave a comment, please click here

Show 246 – Design & Build #4 – Data Center Migration

Join us for a step-by-step discussion of what's involved in a data center migration, including new builds, cloud/hybrid options, power & cooling, team preparation and planning, and execution.

Author information

Ethan Banks

Co-host at Packet Pushers

Ethan Banks, CCIE #20655, has been managing networks for higher ed, government, financials and high tech since 1995. Ethan co-hosts the Packet Pushers Podcast, which has seen over 3M downloads and reaches over 10K listeners. With whatever time is left, Ethan writes for fun & profit, studies for certifications, and enjoys science fiction. @ecbanks
TwitterGoogle+LinkedIn

The post Show 246 – Design & Build #4 – Data Center Migration appeared first on Packet Pushers Podcast and was written by Ethan Banks.

Microsoft patches Windows zero-day found in Hacking Team’s leaked docs

Microsoft today issued one of its sporadic emergency, or "out-of-band," security updates to patch a vulnerability in Windows -- including the yet-to-be-released Windows 10 -- that was uncovered by researchers sifting through the massive cache of emails leaked after a breach of Italian surveillance vendor Hacking Team. The Milan-based vendor sells surveillance software to governments and corporations, and markets zero-day vulnerabilities that its clients can use to silently infect targets with the firm's software. Researchers have found several zero-days -- flaws that were not fixed before they went public -- in the gigabytes of pilfered documents and messages, including three in Adobe's Flash Player, since July 5.To read this article in full or to leave a comment, please click here

IBM’s Q2 sales slide 13 percent on sale of low-end server unit

IBM has reported another quarter of declining revenue and profit, though sales of its new mainframe gave it a lift.Revenue for its second quarter was $20.8 billion, down from $24 billion a year earlier, IBM announced Monday.The big drop is partly from IBM selling its x86 server business to Lenovo, as well as the impact of the strong U.S. dollar. Without those factors, revenue would have declined one percent, IBM said.Net income was $3.45 billion, down 16.6 percent.Revenue from IBM’s giant Global Technology Services segment were down 10 percent to $8.1 billion. Factoring out the currency effect and the sale of the x86 server business, revenues were up one percent, IBM said.To read this article in full or to leave a comment, please click here

Google slams proposed export controls on security tools

A proposed set of software export controls, including controls on selling hacking software outside the U.S., are “dangerously broad and vague,” Google said Monday.Google, commenting on rules proposed by the U.S. Department of Commerce (DOC), said the proposed export controls would hurt the security research community.A DOC Bureau of Industry and Security (BIS) proposal, published in May would require companies planning to export intrusion software, Internet surveillance systems and related technologies to obtain a license before doing so. Exports to Canada would be exempt from the licensing requirement.To read this article in full or to leave a comment, please click here

Google slams proposed export controls on security tools

A proposed set of software export controls, including controls on selling hacking software outside the U.S., are "dangerously broad and vague," Google said Monday.Google, commenting on rules proposed by the U.S. Department of Commerce (DOC), said the proposed export controls would hurt the security research community.A DOC Bureau of Industry and Security (BIS) proposal, published in May would require companies planning to export intrusion software, Internet surveillance systems and related technologies to obtain a license before doing so. Exports to Canada would be exempt from the licensing requirement.To read this article in full or to leave a comment, please click here

Report: Microsoft paying $320 million for cloud security provider Adallom

Microsoft is said to be paying $320 million to acquire Adallom, a cloud security provider whose services might help Microsoft in its new push toward becoming a “cloud-first” company.Adallom provides back-end security tools that gather usage data and detect suspicious activity. Its services are used by Netflix, SAP and Hewlett-Packard, according to the company’s website. The acquisition was reported Monday by the Calcalist financial newspaper.A spokesman for Adallom declined to comment, and Microsoft did not immediately respond to a request for comment.Adallom could help boost the defenses of Microsoft products including Office 365 and Yammer. Adallom’s tools can give businesses more granular control over who has access to Office 365, or identify anomalies in usage patterns for the cloud suite, according to Adallom’s website. An acquisition would bring those tools under Microsoft’s umbrella.To read this article in full or to leave a comment, please click here

Spy’s suicide adds to Hacking Team scandal in South Korea

A South Korean intelligence officer who used a controversial surveillance system from Italy’s Hacking Team was found dead over the weekend in an apparent suicide as controversy swirls in the country over use of the software.The officer, identified by local media only as Lim, was a 20-year cyber-security veteran of the country’s National Intelligence Service (NIS) and ran the department that used the software, according to reports.He was found dead on Saturday in a car south east of Seoul. Burnt coal was found in the car and an autopsy conducted a day after his death on Saturday found he died of asphyxiation, according to reports. Burning charcoal in a confined space is a relatively common method of committing suicide in South Korea and Japan.To read this article in full or to leave a comment, please click here

1 … 3,384 3,385 3,386 3,387 3,388 … 3,835