The Virtual Vision Google+ Hangout Series has been going strong for four weeks with Hangouts from NetBackup, Clearwell and Enterprise Vault and Backup Exec.

Couldn’t attend one of the previous Hangouts? Don’t worry, you can catch the recordings, view the supporting documents, or ask questions via the Google+ event pages.

Make sure to mark your calendars for the upcoming events throughout the rest of July and August. You can RSVP, view more details about the events and watch recordings after the events have taken place all on the Google+ event pages.

Check back here to see updates on the sessions, or follow @Symantec on Twitter, add +Symantec to your Google+ Circles or like us on Facebook for the latest updates.

During the events you can submit questions that will be answered in real time using the hashtag #SYMChangout via Twitter or comment on the Google+ event page.

We look forward to hanging out with you!

In a continuation of this blog, my original thought was to outline the Cyber Defense aspects.  However, I think it important to discuss the Vigilante aspect first.  There’s a lot more in the news lately about the potential for companies and/or individuals to consider “Hacking Back” to recover their data, whatever it is.  I have to say, it’s an interesting notion and one that I know is not lost on the American spirit when you consider the long lost days of the Wild West where everyone in one form or another had to take matters into their own hands because law enforcement either wasn’t available or non-existent.  Now fast forward to today and the internet.  I’ve always maintained that the internet is pretty much the Wild West in electronic form where you have good law abiding folks and folks that tend to teeter one way or the other and then folks that are out to do whatever they want even to the wanton destruction of others.  So what do we do in today’s world where law enforcement and government haven’t quite caught up to the bad guys in an effective way to protect individuals or companies for that matter and your attacker is half way around the world? 

In a previous blog, we talked about the rise of remote access tools (RAT) written in Java that are capable of running on multiple operating systems. With the growing popularity of the Android operating system, it comes as no surprise that the Android OS is the latest target and is not immune to RATs. Since late last year, underground forums have been offering a free Android RAT known as AndroRAT (Android.Dandro). Now, unsurprisingly, the underground economy that caters to the needs of cybercriminals has created the first tools (called “binders”) that easily allow users to repackage and Trojanize legitimate Android applications with AndroRAT.
 

Figure 1.A “binder” tool being sold on underground forums advertised as the first binder ever
 

Back in November 2012, an open source RAT for Android named AndroRAT was published and made accessible to everyone on the Internet. Like other RATs, it allows a remote attacker to control the infected device using a user friendly control panel. For example, when running on a device, AndroRAT can monitor and make phone calls and SMS messages, get the device’s GPS coordinates, activate and use the camera and microphone and access files stored on the device.
 

Figure 2.AndroRAT’s control panel
 

The RAT comes in the form of an APK which is the standard application format for Android. When used in conjunction with the AndroRAT APK binder, it easily allows an attacker with limited expertise to automate the process of infecting any legitimate Android application with AndroRAT, thus Trojanizing the app. When the Trojanized version of the legitimate app is installed on the device, the user unsuspectingly installs AndroRAT alongside the legitimate app they intended to install. This allows the attacker to circumvent elements of the Android security model through deception. To date, Symantec has counted 23 cases of popular legitimate apps being Trojanized in the wild with AndroRAT.

Subsequently, we have also spotted a commercial Java RAT named Adwind (Backdoor.Adwind) that already supports multiple operating systems and seems to be in the process of incorporating an Android module based off the AndroRAT open source code. Again, this RAT also features a graphical user interface allowing the attackers to manage and control the RAT remotely.
 

Figure 3.Adwind main control panel
 

A demonstration video that shows Adwind working with Android also shows the presence of AndroRAT on the infected phone, suggesting that the authors of Adwind may be customizing the AndroRAT tool to incorporate it into Adwind. This development comes as no surprise, as the open source nature of the AndroRAT code means it can be easily customized into new threats and tools.
 

Figure 4. Screenshot of Adwind video showing AndroRAT’s presence on the infected device
 

At present, Symantec telemetry shows only several hundred infections of Android.Dandro worldwide, with the United States and Turkey being the most targeted countries. However, the telemetry is reporting a rise in infection numbers as of late, which we expect will continue as both the availability and sophistication of tools for AndroRAT increase.
 

Figure 5. Heat map of infections
 

The evolution of remote access tools moving onto the Android platform was predicted. While AndroRAT is not showing a particularly high level of sophistication just yet, with the open source nature of its code and with its popularity growing, it has potential to evolve and grow into a more serious threat.

We recommend installing a security app, such as Norton Mobile Security, which detects this threat as Android.Dandro. For general safety tips for smartphones and tablets, please visit our Mobile Security website.

In the sales world when we look at the sales cycle we tend to see everything as a funnel.  It has a wide open mouth at the top with narrower pipe at the end representing our sales.  As a business leader you look at each portion of the sales process to evaluate your success at each point to maximize the effectiveness of your marketing efforts.  Customer conversion rates are highly important.  Abandoned shopping carts are worrisome.  The checkout process for online retail sales is critical.  So how can you use security technology to drive customer conversion?  How can you widen the portion of the sales “funnel” at the checkout process and drive more sales?

At Symantec we have two very strong options you can leverage.

1. Leverage the power of the Norton Secured Seal, the most trusted seal on the web.  Take a look at this interesting infographic by Conversion Voodoo, specialists in online retail optimization.   This infographic takes 6 of the most common problems in the online retail process and provides solid solutions.  Scroll down to the second problem “Customers don’t trust the site.”  What is the first solution?  “Clearly display security logos.”  US Cutter used the Norton Secure seal and they saw an 11% increase in their conversion rate and a 52% lift in sales from paid search.   If you have Symantec SSL/TLS certificates for your site you can use the Norton Secured Seal free of charge; just go to the install page.  Need some?  Visit our site.
2. Using Extended Validation (EV) certificates makes a strong impact to anyone visiting your site.  Why?  It will turn the address bar on site green.  Customers will see the lock and will know you have a secured site.  Furthermore any potential customers using Norton AntiVirus will see the Norton Secured Seal next to your site’s listing in search results.  This drives more traffic to your site.  See the address bar on this blog?  Note the green bar, lock, and the "s" after "http."

The added benefits that Symantec SSL certificates bring to the table are:

• Daily malware scanning
• Vulnerability assessments
• Expanded warranty coverage
• SGC (Server gated cryptography) which means customers using older web browsers can access your site safely.

Trust is paramount in converting browsers to buyers and the Norton Secured Seal drives that customer confidence.  Curious about what our customers think?  Click here to see how the seal has increased trust and revenue for ecommerce sites everywhere.  Do you have a seal success story you’d like to share? Please feel free to contact me at Brook_Chelmo@symantec.com

En el panorama actual de amenazas las divisiones entre las herramientas cibernéticas de investigación y las de espionaje se vuelven cada vez más borrosas. El descubrimiento reciente de dos nuevas amenazas es un hecho que confirma este punto.

Hace unos días, en un blog, Intego presentó información sobre el troyano llamado “Crisis” dirigido al sistema operativo Mac OS y que forma parte de una herramienta de vigilancia encubierta avanzada que está a la venta en línea y que está enfocada en las necesidades de investigación cibernética gubernamentales. Los detalles sobre esta amenaza, denominada por Symantec como OSX.Crisis,  fueron discutidos en un blog anterior. Por otra parte, Citizenlab.org dio a conocer detalles sobre FinFisher, amenaza identificada por Symantec como Backdoor.Finfish, la cual es otra herramienta de vigilancia encubierta que se comercializa como una solución de TI gubernamental de intrusión y monitoreo remoto.

Ambas soluciones se venden con la intención de ser usadas de manera legal. Sin embargo, diferentes reportes y artículos publicados sobre estos temas en medios de comunicación de todo el mundo, sugieren que las herramientas son utilizadas con fines cuestionables. En este sentido, la siguiente lista de capacidades de esta herramienta despierta inquietudes con respecto a la privacidad, especialmente en caso de que los productos fueran utilizados de forma ilegal:

• Soporte multiplataforma (Windows, Mac OSX and Linux)
• Registro de información tecleada (key logging)
• Vigilancia en tiempo real a través de webcam y micrófono
• Identificación de ubicación
• Extracción silenciosa de archivos en discos duros
• Monitoreo de Skype

La lista anterior también coincide con la promoción identificada para uno de estos productos en Internet, como se puede ver en la siguiente imagen:

Symantec cuenta con detección para OSX.Crisis y  Backdoor.Finfish y además monitorea de cerca el panorama actual de amenazas para identificar la evolución de este tipo de herramientas, las cuales se reporta que son utilizadas principalmente por intereses políticos.

Por otra parte, dado que los costos relacionados con el uso de este tipo de herramientas son altos y prohibitivos para las masas, no esperamos ver una gran cantidad de actividad relacionada con ellas en estado natural. Sin embargo, Symantec recomienda a los usuarios y organizaciones que utilicen una solución de seguridad integral más allá del antivirus y que la mantengan actualizada para brindar una mejor protección frente a éste y otro tipo de amenazas. Además, al usar Skype u otros programas similares, es importante asegurarse que se está utilizando la versión más reciente o actualizada con el fin de reducir los riesgos.

Improving effectiveness of phishing bait is always at the top of any phishers’ agenda. They prefer to use bait that reflects enticing subjects in order to catch the attention of as many users as possible. Recently, we have seen phishers moving one step ahead. In addition to having eye-catching bait, they are compelling users to spread the word. In today’s example, phishers used free cell phone airtime as the phishing bait.

The phishing site requested Indian Facebook users to verify their account by entering their login credentials in order to get the fake offer of free cell phone airtime. But phishers, not content with just duping one user and eager to target even more, start off by saying the offer is only valid after posting this same offer on the profile pages of a number of friends. Phishers devised this strategy because obviously receiving messages from friends is more convincing than from unknown sources. The method phishers are using in effect enlists unsuspecting users into spamming for them.
 

Figure 1. Facebook account verification
 

Figure 2."Like us" enticement
 

Figure 3. Sharing enticement
 

Figure 4. Sharing enticement and personal information request
 

The first page of the phishing site asked users to verify their Facebook account. Users were then alerted that all information should be entered correctly. The second page of the phishing site displayed an image of a selection of Indian cell phone network operators. The phishing page stated that free airtime worth "Rs. 500" is available from the offer after following four additional steps. The steps were essentially to like, subscribe, share, and post the offer to at least 10 friends. Finally, in order to complete the process, the phishing site asked users for personal information including name, email address, cell phone number, network operator, and cellular zone. If any user fell victim to the phishing site, phishers would have successfully stolen personal user information for identity theft.

Users are advised to follow best practices to avoid phishing attacks:

• Do not click on suspicious links in email messages
• Do not provide any personal information when answering an email
• Do not enter personal information in a pop-up page or screen
• Ensure the website is encrypted with an SSL certificate by looking for the padlock, “https,” or the green address bar when entering personal or financial information
• Use comprehensive security software such as Norton Internet Security or Norton 360, which protects you from phishing scams and social network scams
• Report fake websites and email (for Facebook, send phishing complaints to phish@fb.com)

Do you ever feel like managing your organization’s data is a daunting task? You are not alone. With the rapid growth of unstructured  dark data, organizations face increasing risk of inappropriate data access as well as rising compliance and storage costs.  So what can be done to get a handle on data?  The first step is data governance.

In this session, you will learn how to:

• Use Data Insight to understand your files
• Go beyond meta-data to understand who owns the files
• Understand data ownership allowing  you to broker conversations with the business
• Archive relevant content to Enterprise Vault
• Govern to increase business value, reduce risk and lower costs

Please join Symantec’s experts Christine Emilie Lim, Robert Mossi and Ketan Shah on Wednesday, July 24th at 9:30 am PT to learn how Data Insight and Enterprise Vault enable organizations to reduce risks, decrease costs and provide intelligence for business decisions.

Mark your calendars:

Title:  Google+ Hangout On Air: Managing Dark Data and File Governance

Date: Wednesday, July 24, 2013

Time: Starts at 9:30 a.m. PT / 12:30 p.m. ET

Length: 1 hour

Where:  Google+ Hangout: http://bit.ly/18Sdnsn

Do you ever feel like managing your organization’s data is a daunting task? You are not alone. With the rapid growth of unstructured  dark data, organizations face increasing risk of inappropriate data access as well as rising compliance and storage costs.  So what can be done to get a handle on data?  The first step is data governance.

In this session, you will learn how to:

• Use Data Insight to understand your files
• Go beyond meta-data to understand who owns the files
• Understand data ownership allowing  you to broker conversations with the business
• Archive relevant content to Enterprise Vault
• Govern to increase business value, reduce risk and lower costs

Please join Symantec’s experts Christine Emilie Lim, Robert Mossi and Ketan Shah on Wednesday, July 24th at 9:30 am PT to learn how Data Insight and Enterprise Vault enable organizations to reduce risks, decrease costs and provide intelligence for business decisions.

Mark your calendars:

Title:  Google+ Hangout On Air: Managing Dark Data and File Governance

Date: Wednesday, July 24, 2013

Time: Starts at 9:30 a.m. PT / 12:30 p.m. ET

Length: 1 hour

Where:  Google+ Hangout: http://bit.ly/18Sdnsn

Be honest. Do you really read the warning messages that your browser displays to you? Or do you blindly click the phishing site warnings or the SSL mismatch dialog away? Apparently most users don’t seem to care too much about those warnings and click through them quickly. And I doubt that they have memorized the meaning of the warnings and reflect on the consequences each time.

An interesting study from Google and Berkeley University analyzed 25.4 million warnings from the Google Chrome and Mozilla Firefox browsers. According to their research, on average, 15.1 percent of the users click through the warning for malware-infected sites. Interestingly enough, Mozilla Firefox users on Windows have a click-through rate of only 7.1 percent compared to Google Chrome users on Windows with a 23.5 percent click-through rate, about three times as click-happy.

For phishing site warnings, the average click-through rate is 20.4 percent. In this phishing category, Linux users, with 32.9 percent, click through the warnings a lot more often than the others. Maybe they are more tech-savvy and think that they know what they are doing. The study only analyzed warnings where the user had the option to bypass it. Those are typically shown when there is a chance that it might be a false positive, so it doesn’t necessarily mean that something malicious is going on every time a warning is shown

For SSL warnings, the results are even higher, with an average click-through rate of 73.4 percent for Google Chrome users and 36.7 percent for Firefox users. The researchers are not sure why Chrome users are twice as likely to ignore the SSL warnings. Of course, the SSL warning does not always mean malicious intent. Some people use self-signed certs at home and sometimes servers are just badly configured. So clicking through the warning does not necessarily mean that the warning was ignored, the user may have just made a well educated decision to bypass it.

Nevertheless, the researchers suspect that many people tire of these warning messages and start ignoring them. A phenomenon that we all remember from the early anti-virus solutions in the past was when people got bored of dialog boxes asking if “svchost.exe” was allowed to access the Internet or not. Warnings can be helpful, but they have to be used in the right way.

When ignoring these warnings becomes a habit, people are more likely to fall for malicious websites in the future, for example, the classic man-in-the-middle (MITM) attacks often seen at free hotspots at airports or restaurants. Many people do not realize that some attackers are setting up malicious access points that will serve self-signed certificates for all sites. If the user accepts those certificates, the attacker can eavesdrop on the traffic and might read passwords for online services. Certification pinning, as introduced by Google, can help against such MITM attacks since the user will not get the chance to bypass the warning for major websites. The study showed that around 20 percent of the Chrome SSL warnings cannot be bypassed by the users. A percentage of this may have been from MITM attacks.

Ignoring the malware warning can also be foolish. Symantec’s Internet Security Threat Report (ISTR) showed that 61 percent of the infected websites were hijacked legitimate websites. Therefore, knowing the site does not prove that it is clean, even if you visited it before. It may have been compromised since your last visit and is now serving up malware through exploits.

We recommend reading the browser warnings and taking them seriously. If you have read and understood them, you can of course click through if you know that the website is not a security risk. Just don’t make it a habit of blindly clicking through all those warnings.

Figure. Firefox malware site warning

Symantec would like to announce the new update of the Validation and ID Protection Service (VIP), with new functionality for VIP Manager and Enterprise Gateway v9.3.

Three new groups features – user groups, admin groups, and a Super Admin group – in this release provide greater flexibility in policy-driven identity management to meet diverse needs, as well as reduce risk and complexity for keeping administrator rights up-to-date. Additionally, there is now the option to use Device Identification and Intelligent Authentication independent of each other, for added protection as part of a multi-factor authentication policy. These new features and others are available now in your VIP Manager. Please ensure you download the Enterprise Gateway v9.3 update to use these features.

Summary of New Features

1. Ability to manage credential policies by user group
2. Ability to manage administrator groups and synchronize with LDAP/AD User Stores
3. Creation of Super Admin group
4. Separation of Device Fingerprint and Intelligent Authentication policies
5. Feature enhancements for end users 

Feature Highlights

Ability to manage credential policies by user group

• Users can now be grouped in VIP Manager and administrators can manage the credential policies for each group, including:
  • Customizing hardware and software credentials available by user group
  • Customizing number of credentials available by user group
• New easy-to-use interface for creating, editing and removing user groups
• Added support to filter user groups for user search

Figure 1: Manage User Groups Interface (VIP Gateway)

Figure 2: Add User Group (VIP Gateway)

Figure 3: User Group Configuration for User Store (Enterprise Gateway)

Ability to manage administrator groups and synchronize with LDAP/AD User Store

• Import admins from the Active Directory and assign them VIP Manager administration rights
• Enable synchronization of administrator records from the LDAP User Store, for automatic additions, deletions, and updates to group membership
• New easy-to-use interface for creating, editing and removing administrator groups
• New permissions added for administrator group and user group management

Figure 4: Find/Modify VIP Administrator Group (VIP Manager)

Figure 5: Admin Group Configuration (Enterprise Gateway)

Creation of Super Admin group

• New group for super administrators with access to all administrator permissions   
• Super Admin group cannot be deleted, providing protection from lockout
• Recommended if you are using LDAP Synchronization

Separation of Device Fingerprint and Intelligent Authentication policies

• Admins now have flexibility to manage device ID policy independent from the risk-based policy, whereas the policies were previously tied together
• New option to always require a security code from unrecognized devices

Figure 6: VIP Intelligent Authentication tab (VIP Manager)

Feature enhancements for end users

• Users who have extensions associated with their phone number will now be able to receive out-of-band one-time password security codes, i.e. a user with the phone number and extension 650-555-1234x1111 will be able to get a one-time password by voice message
• For accounts with Intelligent Authentication enabled, pop-ups requesting a user’s security code will now be localized to the same language as in the browser settings
• For users with Internet Explorer on Windows 8 Desktop, the Registered Computer feature is now supported on this browser
• Users can edit the names of Registered Devices in the Self Service Portal

Additional Features for VIP Enterprise Gateway

• VIP Enterprise Gateway now supports Windows Server 2012
• New Installer available for VIP SSP IDP Proxy Service on Windows and Linux platforms

Third-Party Plug-Ins

• Microsoft IIS 7.x and 8.x (Windows Server 2012 and 2008 R2): VIP services integration plugin now integrates with Microsoft IIS 8.x, providing strong authentication to newer versions of applications hosted on these servers
• Cisco Identity Services Engine (ISE): VIP services now integrates with Cisco ISE device identification, which can enhance user validation and protect user identity
• Cisco ASA firewall: VIP services have been enabled to provide strong authentication to these devices and supports the latest versions
• Citrix Ready Xchange Marketplace: Symantec VIP has been qualified as “Citrix Ready” and compatible with Citrix XenApp and XenDesktop products to provide significant enterprise security and identity protection. For more information, please visit the Citrix Ready Xchange Marketplace

Technical Support

We value your business and are committed to customer care.  Please contact us if we can assist or answer any questions. Symantec Support can be reached via email at: enterprise_vipsupport@symantec.com or by phone at +1-650-426-3535 or 1-800-579-2848. You can also visit the VIP support Knowledge Center.

Don’t forget to follow us on Twitter: @SymantecVIP

先日のブログでお伝えしたように、Java で記述されているために複数のオペレーティングシステムで実行できるリモートアクセスツール（RAT）の活動が活発化しています。Android オペレーティングシステムが急速に普及している状況で、Android OS が最新の標的となり、RAT に対して無防備なのは当然です。アンダーグラウンドフォーラムでは、昨年の終わり頃から AndroRAT（Android.Dandro）として知られる無償の Android 版 RAT が公開されています。そして最近、AndroRAT を使って簡単に正規のアプリを再パッケージ化し、トロイの木馬を仕掛けることのできるツールが初めて登場しました。アンダーグラウンド経済がサイバー犯罪者の需要に応えようとすることを考えれば、これも当然の流れでしょう。
 

図 1.世界最初のバインダを謳ってアンダーグラウンドで販売されている「バインダ」ツール

オープンソースの Android 版 RAT である AndroRAT が公開され、インターネット上で誰でも入手できるようになったのは、2012 年 11 月のことです。他の RAT と同様に AndroRAT でも、攻撃者はわかりやすいコントロールパネルを使って侵入先のデバイスを制御できます。たとえば、デバイス上で実行されている AndroRAT は、電話をかけたり監視したりするほか、SMS メッセージを送信する、デバイスの GPS 座標を取得する、カメラとマイクを有効化して利用する、デバイスに保存されたファイルにアクセスするといったことが可能です。
 

図 2. AndroRAT のコントロールパネル
 

RAT は、Android の標準アプリケーションフォーマットである APK の形で提供されます。AndroRAT APK バインダと組み合わせて使えば、専門知識の乏しい攻撃者でも AndroRAT を使って簡単に、正規の Android アプリに感染するプロセスを自動化し、トロイの木馬を仕掛けることができます。トロイの木馬を仕掛けられた正規のアプリがデバイスにインストールされると、ユーザーは何も知らずに、目的の正規アプリとともに AndroRAT もインストールすることになります。攻撃者は、ユーザーを欺いて Android セキュリティモデルの機能をすり抜けられるわけです。シマンテックは現在までに、人気のある 23 種類の正規アプリが AndroRAT によって実際にトロイの木馬を仕掛けられていることを確認しています。

これに続いて、シマンテックは有償版の Java RAT も確認しています。これが Adwind（Backdoor.Adwind）で、すでに複数のオペレーティングシステムに対応しているうえに、AndroRAT のオープンソースコードに基づいて Android モジュールを取り込みつつあるようです。有償版のこの RAT にも、リモートで RAT を管理制御できるグラフィカルユーザーインターフェースが装備されています。

図 3. Adwind のメインコントロールパネル
 

Adwind が Android で動作するところを解説したデモンストレーション用ビデオでも、感染したデバイス上に AndroRAT が存在していることが示され、Adwind の作成者が AndroRAT ツールをカスタマイズして Adwind に取り込んでいる可能性が示唆されています。AndroRAT のコードが、カスタマイズして新しい脅威やツールを簡単に作成できるというオープンソースの性質を備えている以上、こうした展開もなんら不思議なことではありません。
 

図 4. 感染したデバイス上に AndroRAT が存在することを示す Adwind のビデオからのスクリーンショット

シマンテックの現在の遠隔測定によると、米国とトルコが最も頻繁に Android.Dandro の標的になっています。感染数は全世界でも数百件どまりですが、遠隔測定では、最近になって感染数が増えていることも報告されています。AndroRAT 用のツールがますます流通し高機能になっていることを考えれば、増加傾向は今後も続くものとシマンテックは予測しています。
 

図 5.感染の分布図
 

リモートアクセスツールの進化が Android プラットフォームに向かうことは、以前から予期されていました。AndroRAT は今のところ、それほど高機能ではなさそうですが、コードがオープンソースであり人気も高くなっている以上、さらに深刻な脅威に発展する恐れは十分にあります。

この脅威を Android.Dandro として検出する、ノートン モバイルセキュリティなどのセキュリティアプリをインストールすることをお勧めします。スマートフォンとタブレットの安全性に関する一般的なヒントについては、モバイルセキュリティの Web サイト（英語）を参照してください。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

As many people will have seen, if you cleverly subscribe to the RSS feeds on the Connect forums, Enterprise Vault 10.0.4 has reached General Availability.  There is a bunch of new stuff, and lots of fixes.  Take a look at the official blog:

http://www.symantec.com/connect/blogs/enterprise-vault-1004-now-generally-available

フィッシングのエサをどれだけ効果的にできるか。フィッシング詐欺師が最優先で考えているのは、常にその一点です。詐欺師は、できるだけ多くのユーザーの関心をひくような話題を反映したエサを好んで使いますが、最近の手口はさらに一歩進んでいます。目をひくエサを使うだけではなく、ユーザーが詐欺の片棒をかつぐように仕向けているのです。今回の例では、携帯電話の無料通話時間がエサとして使われました。

このフィッシングサイトは、インドの Facebook ユーザーに対して、携帯電話の無料通話サービスを利用するために、ログイン情報を入力してアカウントを確認するよう求めていました。ところが、このフィッシング詐欺師は 1 人のユーザーを欺くだけでは満足せず、もっと多くのユーザーを狙おうとします。このサービスを利用するには、一定数以上の友達のプロフィールページに、同じ広告を投稿する必要があると煽るのです。こうした手口をとるのは、言うまでもなく、出所が不明なメッセージより友達から届くメッセージのほうが説得力があるからです。この手口を使えば、労せずして無防備なユーザーがスパム送信に協力してくれます。

図 1. Facebook のアカウント確認
 

図 2.「いいね」を求める
 

図 3.共有を誘う
 

図 4.共有を誘い、個人情報の入力を求める
 

フィッシングサイトの最初のページでは、Facebook アカウントを確認するよう求められ、すべての情報を正しく入力する必要があるという注意書きも表示されます。2 ページ目では、インドの携帯電話事業者を抜粋した一覧画像が表示され、あと 4 つのステップを完了すれば「500 ルピー」相当の無料通話時間を利用できるようになると説明されます。必要なステップは基本的に、「いいね」を押すこと、購読、共有、そして 10 人以上の友達のプロフィールページにこの広告を投稿することです。プロセスの最終段階では、名前、メールアドレス、携帯電話番号、回線事業者、セルラーゾーンなどの個人情報の入力を要求されます。このフィッシングサイトに騙されたユーザーは、個人情報を盗まれ、なりすまし犯罪に使われてしまいます。

フィッシング攻撃を防ぐためにできる限りの対策を講じることを推奨します。

• 電子メールメッセージの中の疑わしいリンクはクリックしない。
• 電子メールに返信するときに個人情報を記述しない。
• ポップアップページやポップアップ画面に個人情報を入力しない。
• 個人情報や口座情報を入力する際には、鍵マーク、「https」の文字、緑色のアドレスバーなどが使われていることを確かめ、その Web サイトが SSL で暗号化されていることを確認する。
• ノートン インターネットセキュリティやノートン 360など、フィッシング詐欺およびソーシャルネットワーク詐欺から保護する統合セキュリティソフトウェアを使う。
• 偽の Web サイトや電子メールを見かけたら通知する（Facebook の場合、フィッシング報告の送信先は phish@fb.com）。

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

読者のみなさんにお聞きします。ブラウザで表示される警告メッセージ、本当に読んでいますか。フィッシングサイトの警告や SSL 証明書不一致のダイアログを読み飛ばしてクリックしていませんか。ほとんどのユーザーはこうした警告に無頓着で、すぐにクリックして閉じてしまう傾向があるようです。警告の内容を覚えていたり、毎回その重要性を熟考したりする人がいるとは思えません。

Google 社とカリフォルニア大学バークレー校は、Google Chrome と Mozilla Firefox で表示された 2,540 万回の警告を分析するという興味深い研究を実施しました。その調査によると、平均して 15.1% のユーザーがマルウェア感染サイトの警告を無視してクリックしています。そのなかでは、何でもすぐクリックしてしまうユーザーの率が、Windows 版 Mozilla Firefox では 7.1% にとどまっているのに対して、Windows 版 Google Chrome では 23.5% と、実に 3 倍以上に達していることが注目に値します。

フィッシングサイトの警告の場合、無視してクリックする率は平均で 20.4% ですが、Linux ユーザーに限っては 32.9% と、他のプラットフォームより高くなっています。おそらくこれは、Linux ユーザーのほうが技術に詳しいため、操作に自信があるからでしょう。この研究で分析の対象になったのは、無視して続行するオプションがある警告だけで、そのような警告が表示される場合にはたいてい誤認の可能性があります。したがって、警告が表示されたからといって必ずしも悪質なことが行われるとは限りません。

SSL 警告の場合、結果の数値はもっと高く、無視してクリックする率は Google Chrome で 73.4%、Firefox で 36.7% となっています。Chrome ユーザーのほうが 2 倍も警告を無視する傾向がありますが、その理由については不明です。もちろん、SSL 警告も常に悪意の存在を意味するとは限らず、ユーザーが自宅では自己署名証明書を使っていることもあれば、サーバーの設定に問題があるだけのこともあります。したがって、クリックしたからといって警告を無視しているわけではなく、十分な知識に基づく判断で素通りしたのかもしれません。

それでも、多くのユーザーがこうした警告メッセージに飽き飽きし、無視し始めているのだという懸念を研究者は抱いています。これは、かつて初期のウイルス対策ソリューションでお馴染みだった現象です。「svchost.exe がインターネットにアクセスすることを許可するかどうか」という確認ダイアログにユーザーはうんざりさせられたものでした。警告は重要な機能ですが、うまく使う必要があるということです。

このような警告を無視することが習慣化してしまうと、悪質な Web サイトに引っかかりやすくなり、たとえば空港やレストランの無料ホットスポットで典型的な中間者（MITM）攻撃に狙われたりします。あらゆるサイトに対して自己署名証明書として機能する悪質なアクセスポイントを設定している攻撃者もいるということを、多くのユーザーは知りません。この証明書を受け入れてしまうと攻撃者にトラフィックを傍受され、オンラインサービス用のパスワードを読み取られる可能性もあります。Google が導入したような認証のピンニングを使うと、主な Web サイトでユーザーが警告を無視できなくなるので、MITM 攻撃対策に有効です。調査結果でも、Chrome の SSL 警告のおよそ 20% はユーザーが無視できないものでした。この比率は、MITM 攻撃に由来するものでしょう。

マルウェア警告を無視するのは、賢明でもありません。シマンテックの『インターネットセキュリティ脅威レポート』（ISTR）によると、感染した Web サイトの 61% は、正規の Web サイトが乗っ取られたものでした。つまり、過去にアクセスしたことがある既知のサイトだからといって安全とは限りません。前回のアクセス以降に感染し、今では悪用を通じてマルウェアに利用されているかもしれないからです。

ブラウザの警告は必ず読み、真剣に受け止めることをお勧めします。読んで内容を理解したうえで、その Web サイトにセキュリティ上のリスクがないことがわかっているのであれば、クリックすればいいのです。ろくに確かめもせず、やみくもに警告を無視してクリックしてしまうことだけは避けてください。

図. Firefox のマルウェア感染サイト警告

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

As one of the leading security and storage companies in the world, Symantec already does so much for the global community. Its mission, to enable people, businesses, and governments to protect and manage their information so they can focus on achieving their aspirations, is already promoting our most fundamental and most basic human rights.  

Symantec is a large corporation, and due to its size, I personally believe it has a corporate responsibility to not only uphold and maintain its mission but to also make great contributions in philanthropic and volunteering opportunities for the betterment of our world and our future. It would bring me great pride, joy and honour to work for a global organization that aims to achieve a triple bottom line. Every corporation strives for acclaimed performance and high profits; but a corporation can distinguish itself even further by making corporate responsibility just as important of an objective. With great responsibility comes great power. Corporations, like Symantec, have the social responsibility and the power to make a positive difference in our global community.

And it has. Through Intern Volunteer Week, interns all over the globe were given the chance to give back to their communities. When introducing Intern Volunteer Week, the University Relations team stated:

“Symantec strongly encourages employees to volunteer in their local communities. We believe that involved, engaged employees are happier and more satisfied, and that communities in which Symantec is located will be healthier and more vibrant because of our presence.”

At Symantec, interns are not only encouraged to succeed and add value in their respective departments, but also share their knowledge and skills through volunteer programs that promote learning and education. Local volunteer programs that were featured included Resource Area For Teachers (RAFT) in Mountain View, "iNeed Help with my Gadget Workshop” in Culver City, and “Kid to Read” in Beijing.

In Mountain View, 20 interns gave their time to volunteer at RAFT on Tuesday, July 16th.

RAFT’s website states:

“Every year with the assistance of volunteers, RAFT assembles and distributes over 50,000 hands-on Math, Science, and Art Activity Kits made from repurposed materials, thereby keeping them out of landfills. Volunteers help keep the cost of these Activity Kits down by sorting the different raw materials that are donated and assembling them into retail-ready kits that RAFT members can purchase.”

The interns helped with two projects. One project involved organizing cardstock in packets at a discounted price for teachers; the other project was to make hovercraft science experiment kits for elementary students using recycled CDs, bottle caps, balloons, and instruction manuals. For two hours, interns assembled, organized, and chatted. All enjoyed taking a break from work, but more importantly, enjoyed giving their time to tasks that would benefit hundreds of students. Here are some quotes from the interns who volunteered at RAFT:

“It was a good event and it brought awareness to the fact that without proper activities to bring out their curiosity, kids might be ruling out a subject that they might actually end up liking! It is always a good feeling to know that we are contributing to the betterment of the future generations.” - Kavya Thota, Marketing Intern

“Volunteering is about stepping outside of yourself and serving others for the greater benefit of our society and world. Volunteering at RAFT allowed Symantec interns to contribute to lowering the cost of education and providing science experiments to encourage kids to not be intimidated by science and technology.” – Sebastian Feye, Finance Intern

“Every day spent working at Symantec makes the world a better place, but volunteering at RAFT gave us the unique opportunity to affect thousands of kids’ lives, hopefully sparking a life-long love of Math, Science and the Arts.” – Brandon Page, Gateway Security Intern

As for my personal journey at Symantec, every day of the last three weeks has been informative, exciting, and an absolute joy. Just like the many employees I have spoken to, it’s the people who work here and the opportunities provided that make Symantec the best place to be. As an intern, I am a little fish in a big pond. There is so much that must be learned and experienced. Because of all the support I witness around me, I feel at ease to ask questions, embrace learning, and try new things. I am more than fortunate to have had my first real corporate internship here at Symantec. Symantec employees are of the highest caliber, show great commitment, and are open and willing to change. I am excited for future opportunities here and have no doubt in the future success of Symantec.

Natasha Marston is a business administration student at California Polytechnic State University, San Luis Obispo; she is also a Summer 2013 intern in Symantec's University Relations department.

We recently published Symantec’s Website Security Threat Report which contains a huge amount of information on the security threat landscape. In this series of blog posts we will focus on topics such as the re-emergence of phishing, the rise of malware and what you need to be aware of to keep your work and personal life secure.

Starting with Phishing…Over the past few years there has been a slight change to the type of phishing attacks we’ve seen. As sites such as Facebook and Twitter have grown in popularity, they have drawn the attention of the cybercriminal fraternity and we’ve seen a significant increase in spam and phishing with criminals following users to these popular sites. What’s equally concerning is that in the last year, online criminals have also started to target newly popular sites such as Instagram, Pinterest, and Tumblr. The typical types of threats that we see include fake gift cards and survey scams use to lure unsuspecting users. These kinds of ‘fake offers’ account for 56 per cent of all the social media attacks that Symantec sees, so they stack up to a pretty substantial threat.

To give you an example of how these work, in one scam the victim sees a post on somebody’s Facebook wall or in their Pinterest feed (where content appears from the people they follow or in specific categories) that says “Click here for a $100 gift voucher.” When the user clicks on the link, they are directed to a site where they are asked to sign up for any number of offers, sharing their personal details in the process. The spammers get a fee for each registration and, of course, there’s no gift card at the end of this process. Another trick that we’ve seen are fake or spoofed website used to persuade a victim to reveal their personal details and passwords; for example, their Facebook or Twitter account information. These phishing scams are insidious and often exploit people’s fascination with celebrities, professional athletes, film stars, or singers. In 2012, we saw more threats targeted on social media websites as well as more and more new channels and platforms opening up, especially those that are available only as mobile applications. It is likely that these mobile social channels will become more targeted in 2013, especially those that are aimed specifically at teenagers and young adults, who may not know how to recognise such attacks and may be a little freer with their personal detail.

One thing that is clear is that social media threats are a business issue. Often companies are unwilling to block access to social media sites altogether, but they do need to find ways to protect themselves against web-based malware on these and other sites. This means multi-layer security software at the gateway and on client PCs. It also requires aggressive patching and updating to reduce the risk of drive-by infections. Finally, user education and clear policies are essential, especially regarding the amount of personal information users disclose online.

In terms of user education many social media sites already follow best practice and use Extended Validation (EV) SSL certificates which make it clear to anyone visiting your site that it is the real thing. EV SSL turns the address bar on the website you are visiting green. Before you enter personal details into any site always take care and investigate that the site is exactly the one you intend it to be before proceeding.

Why do leading sites use EV SSL? One of the primary reasons for the existence of EVSSL is to make it more difficult to mount phishing and other online identity fraud attacks using SSL Certificates;

Before a certificate authority (CA) such as Symantec issues an Extended Validation SSL Certificate we follow a strict and extensive validation process which includes:

• Verifying that your organisation is legally registered and active
• Verifying the address and phone number of your organisation
• Verifying that your organisation has exclusive right to use the domain specified in the EV SSL Certificate
• Verifying that the person ordering the SSL Certificate has been authorised by the organisation
• Verifying that your organisation is not on any government blacklists

You can read more about the EV SSL issuance guidelines here https://cabforum.org/Guidelines_v1_4.pdf

We’ll be following up on this blog post next week picking up on another topic from the WSTR.

Download Symantec’s 2013 Website Security Threat Report

There are reports in the media of a particular ransomware, a type of malware, using the official Symantec Norton logo to dupe victims into believing the ransomware is verified by Symantec. This is a common social engineering technique used by malware authors to deceive victims. It is not the first time that a security company’s logo has being abused by ransomware.

Symantec detects this ransomware as Trojan.Ransomlock.Q and our IPS protection System Infected: Trojan.Ransomlock.Q will also detect its network activities.
 

Figure 1. Trojan.Ransomlock.Q as seen by German users, note the Norton logo (image courtesy of Heise Online)
 

As always, for those affected by these scams—DO NOT PAY THE RANSOM. Instead, follow our removal steps and watch our removal instruction video.

The functionality and modus operandi of ransomware have not changed much over the years and while we’ve countless new designs from one variant to another, they do keep to a certain design convention and usually impersonate official institutions and legitimate security companies to obtain an air of authenticity.

When it comes to Trojan.Ransomlock.Q, (a.k.a., Urausy), the authors are known to be very active and constantly update their designs as the political landscape changes depending on which country is being targeted. They are indeed very crafty and keep up to date with the news. Interestingly they haven’t used the Symantec Norton logo in the Irish version.
 

Figure 2. Trojan.Ransomlock.Q as seen by Irish users