12345

9/05/2012

[Caution] Spreading malicious files masqueraded as Facebook image.

1. Introduction

INCA Internet response team detected malicious files disguised as sent from Facebook. Facebook is a social networking service launched in February 2004, owned and operated by Facebook, Inc. As of June 2012, Facebook has over 955 million active users, more than half of them using Facebook on a mobile device. Security threats for SNS have been increased since the number of Facebook user has grown. Therefore, Facebook users need to understand these security threats and to be careful from attachment on e-mail. Because of social engineering, an understood to mean the art of manipulating people into performing actions or divulging confidential information, is consistently used, users need to be careful from malicious behaviors.



2. Spreading path

[Warning] Malicious e-mails disguising as image file were found.
http://en-erteam.nprotect.com/2012/07/warning-malicious-e-mails-disguising-as.html

[Warning] Malicious personal message from fake LinkedIn friend
http://en-erteam.nprotect.com/2012/06/warning-malicious-personal-message-from.html

[Warning] Malicious files are spreading through Facebook chat window
http://en-erteam.nprotect.com/2012/02/warningmalicious-files-are-spreading.html

Spreading fake e-mails from Twitter or Facebook have been being found on uncertain interval. It's really classical, though, it is the strongest way to spread malicious files. Reported case on Aug. 28, 2012 is as following.


To create and propagate malicious files are very intelligent. Following image was sent from on Aug. 29, 2012. Besides, receiver's mail address is hidden.


Each e-mail contains malicious file as a ZIP form, which name is "New_Photo_with_You_on_Facebook_PHOTOIDJKG3JSP0.zip" and "Your_Friend_New_photos-updates_id929690899.zip".

Each ZIP file contains executable malicious file.


It contains "New_Photo_with_your_friend_on_Facebook.jpeg.exe", "Your_Friend_New_Photos-and-Updates.jpeg.exe". If a user checked to hide known extension name, .exe will be invisible.


Upon executed malicious file, it will create "svchost.exe" on "All Users" folder and perform malicious behaviors such as collecting or leaking device info.


INCA Internet response team added these patterns to our AVS, so users are needed to update latest version for being safe from these malicious files.

3. Summary

Spreading fake e-mails from Twitter or Facebook are really classical, though, it is the strongest way to spread malicious files. To use PC safely from security threats of these malicious attachments, we recommend you download latest security updates and obey following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) runs responding system against various security threats.
nProtect Anti-Virus/Spyware v3.0 diagnoses and treats various variant files.

Free installation link of nProtect AVS : http://avs.nprotect.com/

45 comments:

  1. After the fiasco of the Galaxy Note 7 battery, Samsung is all set to regain the reputation of the coveted tablet series with the upcoming Galaxy Note 8. The much-anticipated device is expected to make its debut a couple of months later. So want to know more about the Samsung Galaxy Note 8? Check out this website Samsung Galaxy Note 8

    ReplyDelete
  2. Ngoại trừ trường hợp dùng Fucoidan để điều trị bệnh ung thư, người bệnh cần tuân thủ liều dùng do các bác sĩ chỉ định thì trong những trường hợp còn lại, chúng ta nên để cho cơ thể làm quen và thẩm thấu từ từ Fucoidan. Thuốc Fucoidan http://muathuoctot.com/bo-3-san-pham-doctors-best-fucoidan-phuong-phap-ho-tro-dieu-tri-ung-thu-1216.html
    Fucoidan được liệt vào danh sách thực phẩm chức năng, cho nên việc dùng fucoidan cũng như cách chúng ta ăn uống hàng ngày, cần phải cung cấp từ từ trong thời gian dài và duy trì liên tục một lượng nhỏ hàng ngày. Nếu dùng nhiều trong một lần rồi nghỉ thì có thể nói là không có hiệu quả, đây cũng chính là sai lầm của khá nhiều người. Thuoc Best Fucoidan 70 https://www.amazon.com/Doctors-Best-Fucoidan-Vegetable-Capsules/product-reviews/B000NRVXSI
    Fucoidan có tác dụng thanh lọc cơ thể và cung cấp dinh dưỡng cần thiết để nuôi dưỡng tế bào, cho nên việc cung cấp cho cơ thể một lượng nhất định với thời gian dài giúp cơ thể giải phóng dần cho đến hết các tế các chất gây hại cho cơ thể, đồng thời nuôi dưỡng và tăng cường sức miễn dịch đến từng tế bào. Thuoc Fucoidan tri ung thu http://muathuoctot.com/bo-5-san-pham-doctors-best-best-fucoidan-ngan-ngua-va-ho-tro-dieu-tri-benh-ung-thu-1217.html
    Khi dùng Fucoidan đúng cách trong thời gian dài này khiến chon những tế bào trên bề mặt da mạnh khỏe hơn, da dẻ hồng hào hơn do khả năng cung cấp máu đến từng tế bào của Fucoidan https://www.linkedin.com/pulse/thuốc-fucoidan-trị-ung-thư-bán-ở-đâu-giá-bao-nhiêu-huynh-quan Best Fucoidan 70% – Doctor's Best có nguồn gốc từ tảo nâu phòng chống ung thư, chống oxy hóa. Khoa học đã chứng minh khả năng tiêu diệt tế bào ung thư

    ReplyDelete
  3. Thank you for posting such a great article! I found your website perfect for my needs
    visit our website

    ReplyDelete
  4. I've just read like 10 of your blog posts and can completely understand why you have the traffic you do! Awesome blog!
    Refer:https://www.topessayservices.com/

    ReplyDelete
  5. Thanks for sharing, nice post! Post really provice useful information!

    Giaonhan247 chuyên dịch vụ cách mua hàng trên amazon cũng như hướng dẫn mua hàng trên amazon uy tín với vận chuyển hàng trung quốc cũng như dịch vụ mua hàng trên pandora úc và giải đáp nước hoa pháp chính hãng uy tín.

    ReplyDelete
  6. Currently it looks like blogspot and is the top blogging platform available right now.
    (from what I've read) Is that what you are using on your blog? mygiftcardsite balance check

    ReplyDelete
  7. Good evening Today I am sharing some amazing New year Photos and messages with your which you haven’t seen yet. The new year is one of the most precious festivals which we all celebrate on the first day of the year.

    Happy New Year 2019

    Happy New Year Meme 2019 

    Happy New Year Status 2019

    Happy New Year 2019 Images

    Happy New Year Quotes 2019

    ReplyDelete
  8. Thank you for sharing your experience with this post.
    Regards, kinemaster apk

    ReplyDelete
  9. The article you have shared here very awesome. I really like and appreciated your work. I read deeply your article, the points you have mentioned in this article are useful
    gun mayhem 2

    ReplyDelete
  10. now a days various online malware and viruses are attacking on system and encrypts all the files on the computer. to decrypt needs a key and he have to pay some ransome for that. to make your files secure from these kind of malware you can get Norton setup with a product key.

    ReplyDelete
  11. شركة نقل اثاث بالرياض  http://tiny.cc/syph5y  نقل عفش بتعتبر أعمال نقل العفش من أهم الأعمال على الاطلاق ؛فالكثير من الأفراد يحتاجون الى القيام بأعمال النقل المميزة لحمايه كافه أجزاء الاثاث من التعرض للتكسير أو الخدوش وغيرها من الأمور الأخرى ؛لذلك نحن شركة نقل عفش بالرياض التى تعتمد على أفضل العاملين المتخصصين وأفضل الأساليب الحديثة للقيام بنقل جميع أجزاء الاثاث سواء غرف النوم والسفر والصالونات وغيرها من الأدوات المكتبية والأدوات الخاصه بالأمور الفندقية وغيرها من أجزاء الاثاث التى تتعلق بالشقق والقصور والفلل وجميع الأمور الأخرى .

    تتخصص الشركة فى أعمال نقل الأجهزة الكهربية وغيرها من الأمور الأخرى التى تتعلق بالمطابخ وغيرها من الأمور الأخرى ؛فقط نحن شركة نقل عفش بالرياض التى تعتمد على أفضل الأساليب الحديثة والطرق المميزة للقيام بأعمال نقل العفش .… اقرأ المزيد

    المصدر: شركة نقل اثاث بالرياض

    ReplyDelete
  12. Pretty section of content. I just stumbled upon your website and in accession capital to assert that I acquire actually enjoyed account your blog posts.
    cb01 streaming ita

    ReplyDelete
  13. This comment has been removed by the author.

    ReplyDelete
  14. Coursework Help have employed a vast pool of dissertation help writers, holding considerable expertise in PhD coursework writing. These writers are chosen after a rigorous method of assessment and have never failed to keep up with the various requirements of the students, no matter how diverse they are. Dissertation Methodology Experts treat your academic papers with utmost sincerity and ensure that every specification suggested by you,

    ReplyDelete
  15. One of the most prominent issues the students have to deal with while writing assignments is plagiarism. Hence, they extensively use plagiarism checker to check if there are any copied content in the paper.
    Another major reason for using plagiarism checker is that universities do not accept plagiarized content. Plagiarism is a serious offence. Hence, if found, the students are suspended or might even lose the grades. Choose Myassignmenthelp.
    Due to these limitations, it is evident that the plagiarism checking & wordcounter tool are not at all effective to check plagiarism. The term plagiarism is actually very broad. It is merely not coping with words. But these tools, unfortunately, detect words but not ideas. Hence, the chances of plagiarized papers remain.

    ReplyDelete
  16. Excellent article. Very interesting to read.I really love to read such a nice article. Thanks! keep rocking.

    www-norton.com/setup

    ReplyDelete
  17. Nursing Students always find out the best research paper writing services in usa since its very difficult because they require extensive research and most students lack the appropriate skills of researching. Students also seek help of top custom essay services.

    ReplyDelete
  18. We are the best online custom research paper services around, and you will not have to worry about submitting an assignment that has been written in the wrong context but you seek for our argumentative essay writing services.

    ReplyDelete
  19. Thanks for the valuable information and insights you have so provided here.
    read manga online

    ReplyDelete
  20. very good post thanks for nice sharing,we found very interesting what subjects are needed to become a fashion designer

    ReplyDelete
  21. norton.com/setup to install setup product key, Learn how to download, install, and put into outfill Norton Setup concerning speaking the subject of your Windows and Mac device.
    http://norton-comnortonnorton.com

    ReplyDelete
  22. Get all Steps for installation and download, activate MS office setup. Enter your Office product key on office.com/setup.
    http://office-comofficecom.com

    ReplyDelete
  23. After visiting office.com/setup login to microsoft account to take steps sticking together of covenant of office setup, Any complexity in office.com/setup our accomplished will calm for office install.
    http://officecomoffiice.com

    ReplyDelete
  24. I'm looking for some good blog sites for Office.com/setup. I was searching for search engines and found your blog site. Keep doing it .To install MS Office, make certain that you have a fine internet connection.
    http://officecom-officeoffice.com

    ReplyDelete
  25. Log in to your Microsoft account using the login accreditations and after that type a veritable Office.com/setup key.
    http://office-comofficeoffice.com/

    ReplyDelete
  26. You can furthermore download the same product in the middle of insinuation to the subject of new devices by selecting Send a Download Link Norton.com/setup. After the successful activation of your product.
    http://nor-norton.com/setup/

    ReplyDelete
  27. We are the best writing company providing Buy College Papers Online to students across the globe.We are a UK based company and have been operational since 2005 where we have assisted thousands of students in attaining high marks in Custom College Essay Writing Service.

    ReplyDelete
  28. USPS tracking by tracking number provides you the easiest and simplest way to track your courier and mails. It's a website that serves worldwide. If you feel trouble in tracking your courier then you can undoubtedly rely on https://uspstrackings.co

    ReplyDelete
  29. Office setup is a brand that needs no introduction whether you operate as a working professional in the corporate world, or a school student or operate through a remote

    workstation, there is no way for you to not have heard the name. Get your hands on office.com/setup by searching www.office.com/setup on your browser.
    www.office.com/setup
    office setup

    ReplyDelete

  30. office setup is the software setup file with this setup file you can install on your PC and some of the supported device to make use of office setup. Not only the

    office.com/setup but all the software for all time has the setup file, and it is very significant, without the setup file the software turn ineffective
    office setup
    www.office.com/setup

    ReplyDelete
  31. Get the easiest way of setup and install Norton Setup with Product Key from norton.com/setup. Norton proves to be
    one important aspects for all theinternet users to act as a shield against the increasing number of viruses, worms, spyware, and Trojan horses.
    norton setup

    ReplyDelete
  32. Iran Tourism has been affected by many political, social and economic factors in the recent decades. But what is important is that Tourism in Iran is growing these days. Iran Tourism blog

    ReplyDelete