Quantcast
Channel: Symantec Connect - ブログエントリ
Viewing all 5094 articles
Browse latest View live

How To Create a Single or Multiple GUP

$
0
0

How To Create a GUP

First Installed SEP client on that machine which you want to create as a GUP. and then follow the below mention steps.

1. Login in to SEPM Console.

2. Click on Policy.

3. Then Click on Live Update.

4. Click on Add a LiveUpdate Settings Policy.

5. Then Given the Policy name and discriptions. and check mark on "Enable this Policy"

6. Click on Server Setting under Windows Setting.

7. Check mark on Use a Group update Provider and then click on Group Update Provider tab.

* If you want to create a single GUP:-

Click on Single Group Update Provider IP address or Host.

Given the Ip address of that machine which you want to create as a GUP.

ie. 192.168.x.x

Click ok.

* If you want to create multiple GUP.

Click on multiple Group Update Provider.

Click on Configure Group Update Provider List

Click on Add button.

Salect Computer IP address or Host Name.

Click on Add.

Give the IP address witch you want create as a GUP.

Click ok.

 

 


#Spotthetick to win a £50 Amazon voucher

$
0
0

This Monday, 11 February 2013, we will be giving you the chance to win £50 in Amazon vouchers each week just by Tweeting us the URL of a site where you have spotted the Norton™ Secured Seal.

 

 

The Norton™ Secured Seal was recently found to be the most trusted seal on the web, and it is displayed over half a billion times each day on thousands of websites worldwide, so it shouldn’t be difficult for you to spot!

 

When you do see it just Tweet the following message:

“I spotted the @NortonSecured seal at (insert publicly accessible URL where you found the seal) #SpotTheTick http://bit.ly/14FSOKR”

 

The competition is open to UK residents aged over 18, and all correct entries will be put into a weekly draw to win a £50 Amazon voucher. Last entries are on 31 March 2013, full terms and conditions are detailed below. Good luck from Symantec Website Security Solutions !

 

Full terms and conditions

Symantec UK Limited  (“Symantec“) organizes a prize draw running each week from February 11, 2013 to March 31, 2013 for a total of seven (7) weeks. To participate, entrants should surf the internet to find the new Norton Secured Seal as set out below:

When the Norton Secured Seal is spotted, entrants must tweet the following phrase, with the #SpotTheTick hashtag.

“I spotted the Norton Secured Seal at (insert publicly-accessible URL where you found the seal) #SpotTheTick http://bit.ly/14FSOKR”

Entries must be received during the times specified below in order to qualify for the applicable weekly draw:

 

 

Date

Time

 

Date

Time

Draw

Week 1

11/02/2013

12.01am

to

17/02/2013

12.00am

18/02/2013

Week 2

18/02/2013

12.01am

to

24/02/2013

12.00am

25/02/2013

Week 3

25/02/2013

12.01am

to

03/03/2013

12.00am

04/03/2013

Week 4

04/03/2013

12.01am

to

10/03/2013

12.00am

11/03/2013

Week 5

11/03/2013

12.01am

to

17/03/2013

12.00am

18/03/2013

Week 6

18/03/2013

12.01am

to

24/03/2013

12.00am

25/03/2013

Week 7

25/03/2013

12.01am

to

31/03/2013

12.00am

01/04/2013

 

The prize draw is open only to persons residing in the United Kingdom who are over 18 as of Feb 11 2013. Participation in this prize draw is independent of any purchase of Symantec products. Only one prize draw entry per person is allowed and Symantec reserves the rights to disqualify anyone who submits more than one entry. Registrants from governmental bodies, vendors, employees, officers, directors, agents, representatives, and immediate family and household members of Symantec and their respective affiliates, subsidiaries, and agencies are not eligible to participate. Participants must be of age of majority in the United Kingdom and have permission of their duly authorized representative of their employer (if applicable) to enter the competition. Symantec shall make the draw at random from all correct entries as set put in the table above. The winner(s) will be notified via Twitter within 5 working days of the draw being made. The right to claim the prize is forfeit if the prize cannot be delivered to winner within 1 month as of first notification of the won prize and winner is responsible for such non-delivery. In case of forfeiture of claims or exclusion of winners due to infringement of these Terms and Conditions, Symantec reserves the right to repeat the draw in order to determine an alternative winner. Symantec’s decision on the winner shall be final and binding.

The winner each week will receive a £50 Amazon voucher as a prize.

The total number of prizes is limited to seven (7) (e.g. 1 per week for the seven weeks the prize draw is running). Cash alternatives will not be given in lieu of a prize. No prize substitution is allowed except at the discretion of Symantec. Any problems with the functionality of the prize are subject to the manufacturer's guarantee which is either detailed in the product documentation of the prize or which can be ordered from the manufacturer directly. The winner is responsible to follow all instructions and in case of a guarantee to comply with all regulations to register and raise his claim. To the extent permissible by law, Symantec excludes any representation or warranty, explicit or implicit, as well as any liability in respect to the prize(s) except for damage that is proven to be caused by shipment or processing by Symantec. Details of the winner will be available on written application to Symantec and by entering the competition entrants agree that, in the event of winning a prize, Symantec may use their name and Twitter handle in publicity free of charge. Any tax, social contributions or incidental expenses arising from the award of a prize shall be the sole responsibility of the relevant winner. Symantec reserves its right to change, cancel or postpone this prize draw at any time without prior notice. [Under no circumstances shall Symantec be liable for any Internet malfunctions that may prevent the Participant’s participation in the prize draw as planned. Moreover, Symantec shall accept no liability in the event Participants have made errors or mistakes when registering or participating in the prize draw. 

5 Weeks in.

$
0
0

A lot of questions for Altiris support today. The product is piloting very well to this point with the exception being the Deployment Solutions.

The amount of issues with the product, the oddness of the logic in execution hopefully will be answered by someone in the DS team on a scheduled call today. There is a list of items I'm hoping to get answers for.

1. Hierarchy, why certain things replicate and what for. like Images built for a Child NS server does not replicate up, but the resource guid does. So you can see it at the parent but not assign it as a job.

2. Imaging, lots of issues with the supported method and mechanism that it performs to connect a WinPE machine to a known Guid.

3. PXE or now changed Symantec Boot Services. It behaves badly, and other than restarting services no details or documentations on any possible tweaks.

4. x86 for WinPE has broken Firm files.

5. Replication of PXE configs does not always work.

6. Changing of a newly machine's name booted in from F8 and in WinPE.

7. Import without using UUID? Seriously Symantec?

 

I'll be happy if I get the answer to 2 of the above. If I get 3 answered, Party time!

 

Symantec at the Mobile World Congress 2013 in Barcelona

$
0
0

Symantec at Mobile World Congress 2013 in Barcelona

Symantec’s theme at the upcoming MWC 2013 in Barcelona is ‘Mobility without vulnerability’.

For Communication Service Providers we will discuss:

  • Information Protection as a Service (Cloud and Mobile Services)
  • LTE Infrastructure Protection
  • M2M Security Services
  • Next Generation Network Protection
  • Embedded Security and Availability (interesting topic for NEPs and NSVs)

Interested to learn how CSPs can protect their infrastructure and easily deliver information protection services? Please visit Symantec in hall 5 at booth #5C85. If you like to schedule a meeting in advance, please click here:  Schedule 1-1 meeting at MWC 2013

Looking forward to seeing you at MWC 2013.

Symantec™ Validation and ID Protection Service

$
0
0

Securing access to networks and applications.

Sophisticated network attacks have rendered simple password authentication insufficient to protect an organization against unauthorized access to its network and applications. The ramifications of unauthorized access to confidential information are dire: non-compliance, financial penalties, and theft of intellectual property.

Symantec™ Validation and ID Protection Service (VIP) is a leading cloud-based strong authentication service that can enable your customer’s enterprises to secure access to networks and applications while preventing access by malicious unauthorized attackers.

Features:

  • Cloud-based infrastructure—Secure, reliable, and scalable service delivers authentication without requiring dedicated on-premise server hardware.
  • Transparent risk-based token-less authentication— Leverage device and behavior profiling to block risky logon attempts without changing the legitimate user's logon experience.
  • Multiple two-factor credential options—Deploy one-time password credentials in a variety of hardware, software, or mobile form factors.
  • Free mobile and desktop device credentials—Support for over 900 Android™, iOS®, Blackberry™, Windows® Phone, or J2ME™ or BREW devices.
  • Out-of-band support—Authenticate users via SMS text messages. voice phone calls, or email.
  • Self-service credential provisioning—Deploy strong authentication to endusers without requiring IT helpdesk or administrator configuration or intervention.
  • Enterprise infrastructure support—Integrates with popular enterprise VPNs, webmail, SSO applications, and corporate directories.
  • Web-based application integration—Add strong authentication using the VIP web services API in your preferred programming language.
  • Future-proof - easy delivery of new capabilities, in additional to integration with Symantec™ Global Intelligence Network, Symantec™ Endpoint Protection, Norton™, and Intel® Identity Protection Technology (IPT)- enabled computers; allowing you to stay ahead of emerging threats.

     Read more:

     

Symantec Secures 27 Honors from Redmond Magazine

$
0
0

Redmond Magazine recently announced the winners of its 2013 Reader’s Choice “Best of the Best” Awards and Symantec came out on top, winning the highest number of awards for a single company this year.  Symantec was honored with 27 awards – 7 gold, 10 silver and 10 bronze – with great representation across our diverse portfolio of products.

Redmond Magazine’s 2013 Reader’s Choice Awards seeks to give the customers’ view of which non-Microsoft tools they prefer to configure, optimize, secure, manage and host Microsoft’s core products including Windows, SharePoint, System Server, Exchange, Active Directory and SQL Server. Surveys were sent out to thousands of readers, with responses collected and then examined by a team of experts for accuracy (vendors were not eligible to vote).

Included below is a complete list of Symantec’s wins.

 

Redmond Magazine– 2013 Reader’s Choice Awards

 

Best of the Best: Gold

License Management: Symantec Total Management Suite (Replaced by IT Management Suite)

Software Distribution: Symantec Deployment Solution

Drive Imaging: Symantec Ghost Suite

Group Policy Management: Symantec Control Compliance Suite

Software-Based Firewall: Symantec Enterprise Firewall

Antivirus Tool: Symantec Endpoint Protection

Backup Software: Symantec Backup Exec

 

Best of the Best: Silver

Compliance Management: Symantec Control Compliance Suite

Software Packaging: Symantec Altiris Wise Package Studio

Drive Imaging: Symantec Ghost Suite

Remote Client Management and Troubleshooting Solution: Symantec Client Management Suite

Patch Management: Symantec Total Management Suite (Replaced by IT Management Suite)

Security Auditor Symantec Security Information Manager

Intrusion-Detection System: Symantec Critical System Protection

Secure Messaging Tool or Service (Spam and Content Filtering): Symantec Mail Gateway

Storage Management Software: Symantec Veritas CommandCentral Storage

Clustering and Failover Solution: Symantec Veritas Storage Foundation High Availability for Windows

Virtual Business Continuity and Disaster Recovery Solution: Symantec System Recovery Server Edition

 

Best of the Best: Bronze

Asset Management/Resource Inventory Management: Symantec Altiris Inventory Solution (Now included in IT Management Suite)

Drive Imaging: Symantec Client Management Suite

Overall Migration: Symantec Client Management Suite

Application-Conflict Testing Tool: Symantec Package Studio

Intrusion-Prevention System: Symantec ManHunt

Secure Messaging Tool or Service (Spam and Content Filtering): Symantec Messaging Gateway

Backup Software: Symantec NetBackup

Disaster Recovery Solutions: Symantec Backup Exec System Recovery

Clustering and Failover Solution: Symantec Veritas Cluster Server

Identity and Access Management as a Service: Symantec O3

You Might Be an APT Victim if… - Part 3

$
0
0

In part 1 of this series, we looked at three possible signs you may have been the victim of an APT and how to detect and defend against these activities:  1)Gaps in System and Security Logs; 2) Unexplained Changes in System Configurations; and 3) Anomalous Traffic.  Part Two examined two more potential signs of APT activity:  4) Odd Activity Appearing in Application and/or Database Logs; and 5) Your Organization is Experiencing a DDoS Attack.  In this third installment of the “You Might Be an APT Victim if…” series, we’ll look at two more signs of potential APT activity inside your networks and systems. 
 
Sign 6:  Anomalous User Activity
 
One of the ways that advanced attackers “hide in plain sight” is to steal legitimate user credentials and then poke around the network using those stolen credentials.  This type of activity can be very difficult to detect (assuming you are looking for it at all), allowing attackers to hold access to systems and data for long periods of time while avoiding detection.
 
One key to detecting and stopping this type of activity is the development of a baseline for user behavior.  Knowing what normal activity and usage patterns look like for a given user enables the organization to identify outlying behavior.  While this type of capability has been used in the finance and retail industries for several years to prevent fraudulent transactions, the use of this type of approach to monitor internal users is still emerging.
 
As plans and roadmaps are developed for your security program, this is an area that should be watched and considered as new techniques and technologies come to bear.
 
Sign 7:  Your Supply Chain has Suffered a Breach
 

As illustrated in Symantec’s White Paper on the Elderwood Project, advanced attackers do not always engage in full frontal assaults of their intended tartets.  More and more, we are seeing advanced attackers go after the supply chain of larger organizations in an effort to gain access to the information that they are after.  They often do this because members of the supply chain are not as well defended as their primary target.  They also choose this route as communication of breaches or potential breaches are not always reported upstream.
 
Having a formal vendor risk assessment process in place can help to mitigate this risk and to improve the awareness and defenses of smaller organizations in the supply chain.  Some organizations have taken the step of requiring their suppliers to certify compliance with a given security standard (ISO 27001 is most common) in order to provide an additional level of assurance that proper security controls are in place.
 
Summary

In summary, there are a variety of ways that advanced attacker activity can be detected and prevented.  The short list provided in this series is by no means exhaustive, but hopefully has provided some food for though around the types of things your organization should be doing to protect itself.  If you have additional thoughts on ways to detect and prevent advanced attackers, please add your thoughts in the comments section.

Phishing: The Easy Way to Compromise Twitter Accounts

$
0
0

Last week, Twitter announced that the details of around 250,000 of its users may have been compromised before it discovered and stopped an attack on their network. There is not much you can do when attackers go straight to the service provider to try to steal your data; however, it is also common for attackers to approach the end-user in order to obtain account details. Phishing is a popular tactic used to steal account details this way. When thinking of phishing attacks, people usually think of bank account or credit card details as the type of information that is stolen but social network account details are also a popular commodity for attackers.

Attackers see phishing on social network sites as an easy way to trick users into giving their credentials away. So let me take this opportunity to go over one particular attack that has been taking place on Twitter over the last few months and show you how this type of scam works.

It starts out with spam in the form of a direct message (DM) or a tweet that asks the user to click on a link in order to view a picture of them.
 

Figure 1. Spam message
 

If the link is clicked, the browser is directed to a page that informs the user that they need to sign-in to their account to proceed. The page looks like it belongs to Twitter but it is actually a phishing page hosted on a server prepared by the attacker.

No matter what is entered into the login fields, correct or incorrect credentials, the user will appear back in their session.
 

Figure 2. Fake Twitter login page used in phishing attack
 

However, another fake page informs the user that the page they were attempting to visit does not exist.  The page then redirects back to the legitimate Twitter page and the user is unaware of anything malicious having taken place.
 

Figure 3. Fake page purporting that the  page the user was looking for does not exist
 

Looking at the network data captured during one of these phishing attacks, you will see that the stolen account details were posted to the attacker’s server hosting the fake Twitter login page.
 

Figure 4. Network data showing location stolen data is sent to
 

Later, the account will be hijacked and used to distribute spam that leads to sites such as the one shown in Figure 6 advertising diet supplements.
 

Figure 5. Spam message
 

Figure 6. Advertisement that some spam messages link to
 

Many of you may be watching out for phishing attacks when it comes to entering your bank account or credit card details online, but you may not be as cautious when entering account details related to social networking sites. The attackers are aware of this and use it to their advantage.  The end result in the example discussed in this blog is not incredibly severe, but much more damage can potentially be inflicted depending on the machinations of the attackers.

As mentioned earlier, there is not much you can do when it comes to hackers attacking the service provider to steal your data, but you can definitely protect yourself from scams such as phishing.

Always be suspicious of links sent from unknown users. Also, accounts are hacked all the time so even if a link is sent from someone you know it does not mean it is safe. It is also recommended that users install security software that protects against phishing attacks such as Norton Internet Security.

You can also make sure your online accounts are more secure by using passwords or passphrases that are difficult to guess and are not in the dictionary. Ideally a combination of upper and lower case letters, numbers, and special characters should be used. It is also recommended that different passwords be used for each account; that way, even if one account is compromised, the others will stay safe.


Deep down under the hood

$
0
0

Great call today, Altiris support is like a box of chocolate, unless you are nice to some people and they can get you connected with the right people.

Chatted for a while with Thomas Baird today, he's brilliant like Brent Bishop. 2 of the smartest Altiris guys I've ever had a chance to working with. So on with the items of the day. 

We narrowed our top production issues to 3 main items, with a bunch of sub-issues that I sent to Symantec in an email hoping to have the DS team adress with some efficiency. 

 

Issue 1. Machines gets a Device not capable at times. So the issues stems from inventory more than SBS as we originally thought. The NSE processing as Inventory vs Initial Deploy. So Changes were made to initial deploy and testing continues I will say now image to existing machines do work(See issues 3 for more details) but new machines remains to be tested. So the beta solution is fake a InitialDeployment task and get the NSE in with a higher priority. 

 

Issue 2. x86 WinPE does not work for completing the Ghost job for Unattended.xml copy because of Firm.exe missing from the TaskHandler folder on the PXE servers. Copied file over and all seems ok.

Issue 3. Cannnot deploy a image on a child server due to the image cannot be associated with any serial numbers. There is a kb on Altiris for meta data association, and turns out our image capture did not set the OS to to anything but "Unknown" Changed that in the SQL server to Windows 7 Enterprise and all is ok. 

Comments?

フィッシング: Twitter アカウントへの不正アクセスの手口

$
0
0

先週 Twitter 社は、同社のネットワークが攻撃を受け、攻撃はすぐに止めたものの、それまでの間に約 250,000 人分のユーザー情報が不正アクセスを受けたことを発表しました。攻撃者が直接サービスプロバイダを狙ってデータを盗もうとした場合、個々のユーザーにできる対策はほとんどありませんが、エンドユーザーにアプローチしてアカウント情報を盗み出そうとする攻撃も少なくはありません。そのような場合にアカウント情報の詐取によく使われる手口が、フィッシングです。フィッシング攻撃と言えば、盗み出されるのは銀行口座やクレジットカードのような情報だと思いがちですが、ソーシャルネットワークのアカウントも、攻撃者が好んで狙う情報です。

攻撃者にしてみれば、ソーシャルネットワークサイトに対するフィッシングは、ユーザーを欺いて個人情報を引き出す手段としては手軽な方法です。今回ちょうどよい機会ですので、過去数カ月に Twitter で実際にあった攻撃の手口を確認しながら、この手の詐欺の仕組みを紹介します。

この攻撃は、ダイレクトメッセージ(DM)やツイートを利用したスパムで始まり、そこに記されたリンクをクリックして自分の画像を表示するようユーザーを促します。
 

図 1. スパムメッセージ
 

リンクをクリックすると、以下のようなページが開き、続行するにはアカウントにサインインする必要があると表示されます。このページは Twitter 公式サイトによく似ていますが、実際には攻撃者が用意したサーバーにホストされているフィッシングページです。

ログインフィールドに入力した情報が正しいかどうかにかかわらず、ユーザーは元のセッションに戻されるように見えます。
 

図 2.フィッシング攻撃に使われる偽の Twitter ログインページ
 

ところが、ここで別の偽ページが開き、アクセスしようとしたページは存在しないと表示されます。このページから、今度は正規の Twitter ページにリダイレクトされるので、ユーザーは悪質な処理がすでに実行されたことに気づきません。
 

図 3. ユーザーがアクセスしようとしたページは存在しないと称する偽ページ
 

こうしたフィッシング攻撃の際に取得したネットワークデータを調べてみると、盗み出されたアカウント情報は、偽の Twitter ログインページをホストする攻撃者のサーバーに送信されていることがわかります。
 

図 4.盗み出されたデータの送信先を示すネットワークデータ
 

この後で、このアカウントは乗っ取られ、図 6 のようなダイエットサプリを宣伝するサイトにリンクするスパムの拡散に使われます。
 

図 5. スパムメッセージ
 

図 6. 一部のスパムメッセージからリンクされる広告ページ
 

銀行口座やクレジットカードの情報をオンラインで入力させようとするフィッシング攻撃には警戒を怠らないユーザーでも、ソーシャルネットワークサイトに関連するアカウント情報ということであれば、うっかり入力してしまうかもしれません。攻撃者はそうした傾向を知り尽くしたうえで利用しています。今回説明した例の場合、結果的に深刻な被害には至りませんが、攻撃者の策略しだいでは、もっと甚大な損害につながる可能性もあります。

前述したように、ハッカーがサービスプロバイダを攻撃してデータを盗み出そうとする場合、個々のユーザーには対処のしようもありませんが、フィッシングのような詐欺からは間違いなく身を守ることができます。

よく知らないユーザーから送られてきたリンクは、まず怪しいと考えましょう。また、アカウントのハッキングも常態化しているので、仮に知っている人から届いたリンクでも安全とは限りません。ノートン インターネットセキュリティなど、フィッシング攻撃から保護するセキュリティソフトウェアをインストールすることも必要です。

また、パスワードやパスフレーズには、推測が難しく辞書にも載っていないものを使うようにすることで、オンラインアカウントの安全性を高くすることができます。大文字と小文字、数字、特殊文字を組み合わせて使うのが理想的です。アカウントごとにパスワードを変えることもお勧めします。そうしておけば、1 つのアカウントが侵害されても他のアカウントは安全だからです。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/jaにアクセスしてください。

Is Exchange Journaling insecure?

$
0
0

 

Sounds strange doesn't it? Exchange Journaling, the process used by thousands of Exchange customers all over the world to ensure that have a defensible and reliable eDiscovery position, has been called into question by... Microsoft!

So why would Microsoft state that Journaling is insecure?

Microsoft consider that any data that leaves Exchange is inherently insecure as it no longer resides in the Exchange store. On this basis, that’s any data not in the store: mailboxes in Outlook cached mode, messages viewed on many common mobile devices, OWA 2013 when it caches messages, PST files (yes we all know about PST's). The reality is that "insecure" really boils down to your security practices and perimeters, and your comfort with data extending beyond it.

The other side to this is handling the volumes of messages generated as a result of enabling Exchange Journaling; it can be substantial. Enterprise Vault has customers generating in excess of 5 million messages per day just by journaling. There is no Exchange version which can handled this kind of data storage over the types of periods the data must exist - often counted in years. Mailboxes (even in Exchange 2013) just aren't built for this type of work.

So what is the solution?

Well, Microsoft also provide the answer to this too here: http://technet.microsoft.com/en-gb/library/aa998649.aspx.

They recommend the use of Journaling to a Journal mailbox to help "respond to legal, regulatory and organizational requirements". To avoid this mailbox from filling the Exchange database, thousands of customers use Enterprise Vault to securely archive the resultant Journal receipts so they can be held long term on compliant storage if necessary.

This is the reality behind this confused message. Journaling is a necessity and is something that Enterprise Vault customers have recognized for years. Journaling is the only way to ensure you are defensibly recording inbound and outbound Exchange messages in a compliant store. The use of an external compliant store like Enterprise Vault also means that any data (not just Exchange messages) can be stored in this manner and can be easily found during an eDiscovery event.

Don't be confused by Microsoft's disorganized messaging.

Use Enterprise Vault to securely store Exchange journal items to ensure you have a compliant, defensible record of email messages from which to safely perform eDiscovery searches.

While you're there, take full advantage of the compression and single instance routines built into the Enterprise Vault platform to ensure this data is stored in the smallest possible footprint.

go.symantec.com/exchange-archiving

 

Money Transfer Spam Campaign with HTML Attachment

$
0
0

Phishers love to arouse curiosity and/or fear in the user’s mind and this stimulus can compel people to set aside all caution as well as  any safety measures they might have in place to avoid such scams.

In a recent spam sample seen in our probe network, we observed that by taking advantage of human curiosity, users can easily be duped into disclosing sensitive information to unknown persons. In order to ensure awareness of this campaign, and others like it, we will discuss this phishing scam in more detail.

In a slight variation to the telegraphic transfer spam attack seen in the past, we see that the message has a HTML attachment, instead of an archived executable file. As shown in Figure 1, users are advised to confirm a pending transaction with their bank and also told that there is a copy of a bank slip attached.

Figure 1. Spam message with HTML attachment

If the HTML attachment is opened, users are shown an image of a payment order. It is interesting to note that this image is very faint and very difficult to read. Using the HTML tag HTTP-EQUIV "REFRESH", this image disappears after four seconds. This display of the receipt for a small time period is an attempt to arouse enough interest in the user so that they will venture further into the trap.

Figure 2. Copy of bank slip displayed during scam

The page refreshes after four seconds and a popup appears that states that the user has been signed out of their email account and needs to sign in again to view the bank slip.

Figure 3. Pop-up asking user to sign in to email account

On clicking the only optional button, users are shown a website that resembles a well-known bank login page. If users input their bank credentials or their email address on this page, their information is sent to the scammers and may be used for nefarious purposes.

Symantec advises users to avoid clicking on links or opening attachments in unsolicited emails, no matter how much they peak your curiosity with offers of “free” money. Typing your bank’s website directly into the browser instead of using hyperlinks sent by email is also a good habit to ensure your banking credentials remain safe.

Cyber Threats Increase around Valentine’s Day

$
0
0

Most people are eagerly waiting for Valentine's Day. The day is an opportunity to spread affection and excitement amongst loved ones by exchanging gifts. Last year we observed prominent spam attacks using Valentine’s Day as bait. Messages promoted unbelievably discounted jewelry, dinning opportunities, and expensive gifts.

This year, various Valentine’s Day spam messages have started flowing through Symantec’s Probe Network. The top word combinations used in spam messages include the following:

  • Find-Your-Valentine
  • eCards-for-Valentine
  • Valentine’s-Day-Flowers

The e-card spam message, shown in Figure 1, arrives with a malicious attachment called ValentineCard4you.zip. After opening the attachment, malware is downloaded on to the user's computer. Symantec detects the attachment as Backdoor.Trojan.

Figure 1. E-card spam with malicious attachment

Figure 2. E-card spam

Interestingly, in one spam sample spammers invite users to purchase the advertised product with a fake discount code.  Along with other bogus promises, the message promotes a pre-Valentine’s Day sale and fake watch brands that are no different from the original in terms of:

  • Accuracy
  • Movement
  • Labeling
  • Materials

The discount codes used in the spam attacks, such as vday[RANDOM NUMBERS], are aimed at luring users into clicking a URL link in order to take advantage of the Valentine’s Day offer.

Figure 3. Fake product discount spam

By clicking on the link, the user is redirected to a Web page that asks for personal information. The main motive of these fake promotions is to acquire user’s personal and financial information.

Symantec is observing an increase in spam volume related to Valentine’s Day, which can be seen in the following graph.

Figure 4:Volume trend of Valentine’s Day Spam

Valentine’s Day-related spam may include the following subject lines:

  • Subject: Pre Valentine Discount Code
  • Subject: Pre Valentine Day discounts
  • Subject: Valentines Day is Getting Closer! Order Flowers for Her Right Now!
  • Subject: [REMOVED]@[REMOVED].com :Someone sent you a Valentine Message
  • Subject: Best Valentine's Day Bouquets on Sale!
  • Subject: Don't go Broke over Valentines Day, Quick and Easy Loans Here
  • Subject: You Will Lose 28 Lbs Of Fat By Valentines Day
  • Subject: Send FREE eCards this VALENTINES DAY

Shopping online is generally safe as long as you stay on trusted and secure sites. Symantec advises users to be cautious when handling unsolicited or unexpected emails and to update antispam signatures regularly. Symantec is closely monitoring the Valentine’s Day spam attacks and will keep users updated.

Phishing – La manera más fácil de comprometer las cuentas de Twitter

$
0
0

La semana pasada, Twitter anunció que la información de alrededor de 250,000 usuarios podría haberse comprometido previo a que descubriera y detuviera un ataque a su red. Es poco lo que se puede hacer cuando los cibercriminales van directamente al servicio del proveedor para tratar de robar información; sin embargo, es común que los atacantes se acerquen al usuario final con el fin de obtener los detalles de sus cuentas. El phishing es una táctica popular usada para este propósito. Sin embargo, cuando se habla de phishing, muchas personas generalmente piensan que la información que se roba es solo de cuentas bancarias o información crediticia, pero los datos de las cuentas de redes sociales también son un objetivo de los atacantes.

Los cibercriminales ven el phishing en redes sociales como una manera fácil de engañar a los usuarios para obtener su información. Tomemos como ejemplo un ataque particular que se ha estado presentando con Twitter  durante los últimos meses para demostrar cómo funcionan este tipo de estafas.

Empieza como un spam en forma de mensaje directo (DM por sus siglas en inglés) o un tweet en donde le piden al usuario dar clic en una liga para ver una fotografía  de ellos mismos.

Figura1.Mensajes Spam

Al hacer clic en el enlace, el navegador se dirige a una página que informa al usuario que debe iniciar sesión en su cuenta para continuar. Parece que la página pertenece a Twitter, pero en realidad es una página de phishing alojada en un servidor preparado por el atacante.

No importa lo que se introduce en los campos de inicio de sesión, las credenciales correctas o incorrectas, el usuario aparecerá de nuevo en su sesión.

Figura 2. Página falsa de inicio de sesión de Twitter usada para un ataque de phishing

Sin embargo, otra página falsa informa al usuario que el sitio que estaban tratando de visitar no existe. La página redirige de nuevo a la legítima página de Twitter y el usuario no es consciente de que algo malicioso ha tenido lugar.

Figura 3. Página falsa que pretende informar al usuario que la página a la que intenta acceder no existe

En cuanto a los datos de red capturados durante uno de estos ataques de phishing, se puede ver que los datos de la cuenta robados fueron publicados en el servidor del atacante que aloja la página falsa de inicio de sesión de Twitter.

Figura 4. Información de red que muestra el envío de la información robada  

Posteriormente, la cuenta será hackeada y usada para distribuir spam que lleve a sitios como los de la Figura 6 publicitando varios productos como suplementos de dieta.

Figura 5. Mensaje spam
 

Figura 6. Publicidad a la que algunos mensajes spam redirigen

Muchos de nosotros podemos estar atentos de ataques de phishing cuando se trata de ingresar detalles de cuentas bancarias o tarjetas de crédito en línea, pero no siempre somos tan cautelosos al ingresar detalles de las cuentas asociadas con los sitios de redes sociales. Los atacantes son conscientes de ello y lo utilizan para su beneficio. El resultado final en el ejemplo que citamos en este blog no es muy grave, pero puede causar potencialmente un daño mucho mayor dependiendo de las intenciones de los atacantes.

Como se mencionó anteriormente, no hay mucho que se pueda hacer cuando se trata de cibercriminales atacando los servicios de un proveedor para robar información, pero sin duda alguna es posible protegerse de estafas como el phishing.

Se recomienda siempre sospechar de enlaces enviados por usuarios desconocidos y en un idioma diferente al usual. Asimismo, las cuentas son hackeadas todo el tiempo por lo que incluso si un enlace es enviado por alguien conocido no quiere decir que sea seguro. También se recomienda que los usuarios instalen software de seguridad para protegerse de ataques de phishing, como Norton Internet Security.

Los usuarios también pueden asegurarse de que sus cuentas en línea estén más seguras mediante el uso de contraseñas o frases que son difíciles de adivinar y no están en el diccionario. Lo ideal es utilizar una combinación de letras mayúsculas y minúsculas, números y caracteres especiales. También se recomienda utilizar contraseñas diferentes para cada cuenta, de esta manera, incluso si una cuenta es comprometida, las demás estarán a salvo.

Customer Success: Kwizda Holdings GmbH Selects Altiris to Reduce Costs & Streamline Management

$
0
0

Kwizda, a leading Austrian pharmaceutical company, needed to streamline management and lower costs associated with managing some 900 clients and virtual servers. To further complicate the issue, the clients and servers were scattered across sixteen sites. Kwizda turned to Altiris Client Management Suite from Symantec to address these challenges. As a result, Kwizda has lowered the time required to upgrade to the latest edition of Windows by 40 percent, reduced its investment in unnecessary software licenses and maintenance, and enabled the team to troubleshoot systems 20 percent more quickly. To learn more about Kwizda’s successful implementation of Altiris products, check out this link http://bit.ly/XMwdpw 


Adobe Zero-day Used in LadyBoyle Attack

$
0
0

Yesterday, Adobe released an out of cycle patch that fixed two zero-day vulnerabilities (CVE-2013-0633, CVE-2013-0634) for Adobe Flash Player 11.5.502.146 and earlier versions for both Windows and Macintosh. The patch was released because the zero-days were being actively exploited for attacks in the wild. Symantec recommends applying the patch immediately. 

Reports of the attack seen in the wild using CVE-2013-0633 have been dubbed “LadyBoyle” following FireEye’s initial analysis of the attack. In the analysis they identified a class file, with the name LadyBoyle, that contained the exploit code. Symantec can confirm that these exploits were actively being distributed in targeted attacks in the wild. Figure 1 shows an example of a targeted attack email with a Word document attachment that contains CVE-2013-0633. Symantec Mail Security for Microsoft Exchange blocked the attack on February 4.
 

Figure 1. Targeted email containing exploit
 

If the targeted attack was successful and a victim opened the attached document, the flash object contained within the document would execute the flash zero-day (CVE-2013-0633), as seen in figure 2.
 

Figure 2.  Targeted attack using CVE-2013-0633
 

As seen in Figure 2, Symantec has detections in place for the stages of this attack as Trojan.Mdropper, Trojan.Swifi, and Backdoor.Boda. Once a system has been compromised with Backdoor.Boda it will contact a command-and-control (C&C) server hosted at iee.boeing.job.com, which is currently offline. The following intrusion prevention signature (IPS) will be released later today for CVE-2013-0634, which is known to be actively delivered through malicious Flash (SWF) content hosted on websites:

26455 - Web Attack: Adobe SWF RCE CVE-2013-0634 2

We are currently investigating further protections for this zero-day and will provide an update to this blog when possible. As always, Symantec advises users to ensure that operating systems and software are kept up to date and to avoid clicking on suspicious links and opening suspicious email attachments.

Homework for the weekend.

$
0
0

Sorted a lot of items today, most discovery and not fixes.

Discovery of a lot more issues that is. All DS and imaging related. Here are some of the crazy scenarios.

1. Build a machine with the predefined spread sheet, and the machine did not join the domain. After a manual joining to the domain, the machine enters WinPE every time. In the console there is now 2 instances of it, one with IP and domain info. The other which is just blank.

2. Any machines that needs an image job on our second NS, Jobs gets the error of either "Not Capable", or "Unexpected error while saving this schedule"

3. Image is a crap shoot at this point, there is no telling which service, directory, files to clean up. Like voodoo.

But found 1 cool trick out, you can resize the pesky window sizes if you grab it at the top of the sizing bar(Red dot).

And interesting PXE bounce when the PXE configuration fails to replicate settings from the parent.

 

Hopefully the attachments work.

Malvertising and Dynamic DNS: A Never Ending Story

$
0
0

Contributor: John Harrison

Symantec has been tracking a large malvertising campaign for over 5 months now. The campaign is still active and uses Dynamic Domain Name System (DDNS) to prevent itself from being tracked.

The campaign spread rapidly and compromised popular domains and  adult websites. High profile domains with an Alexa ranking of 5,000 or under have also been compromised. Some compromised websites were cleaned after notice from Symantec products alerted users when the sites were visited. However, many of the domains remain compromised.

The interesting thing about infections delivered through malvertising is that it does not require any user action (like clicking) to compromise the system and it does not exploit any vulnerabilities on the website or the server it is hosted from. Infections delivered through malvertising silently travel through Web page advertisements served by online marketing services.

Symantec has tracked this campaign over the last four months. The campaign is still active and continues to compromise users.

Figure 1. Recent malvertising detections

The infection cycle starts with the attackers creating malicious ads and injecting obfuscated JavaScript. These ads are then hosted on advertising networks across different clean domains which, in turn, compromises the users visiting those domains.

Some obfuscated JavaScript is shown in the following screenshot.

Figure 2. Malvertising using obfuscated JavaScript

The malicious JavaScript can be divided into four parts.

  1. Check for the presence of the Internet Explorer browser with ActiveX enabled because this script only affects Internet Explorer users.

Figure 3. Check for IE browser that has ActiveX enabled

  1. Implement cookies to track compromised computers, deliver targeted ad-redirects, and track URLs.

Figure 4. Tracking implementation

  1. Select random domain name from list. (Symantec has observed the use of over 50 different dynamic domains hosted on multiple servers in the last five months.)

Figure 5. Use of dynamic domains

  1. Create a hidden iFrame and pair dynamic domains with common directory names such as news, finance, songs, and forums.

Figure 6. Pairing dynamic domains with common directory names

This iFrame then redirects users to a final URL created by appending common directory names with dynamic domains. For example:

  • [RANDOM CHARACTERS].blogdns.com/forum
  • [RANDOM CHARACTERS].dyndns.biz/news
  • [RANDOM CHARACTERS].is-an-accountant.com/finance

The final URL generated in the above step then redirects to a page where Java fingerprinting is done and a malicious .jar file is executed accordingly. We have seen variations in .jar file extensions. Apart from “.jar”, we have seen the use of extensions related to image formats (e.g. .gif and .jpg), as seen in Figure 7.

Figure 7. JAR file with .gif file extension

Multiple JAR files are dropped based on the Java runtime version of the affected user. We have observed the JAR files exploiting vulnerabilities identified as Oracle Java Runtime Environment Remote Code Execution Vulnerability (CVE-2012-4681) and Oracle Java Runtime Environment CVE-2013-0422 Multiple Remote Code Execution Vulnerabilities (CVE-2013-0422). The following screenshot shows an obfuscated Java class file extracted from the JAR file which targets CVE-2013-0422.

Figure 8. Java class file targeting CVE-2013-0422

Once the Java vulnerability is exploited successfully and the Java sandbox restriction is bypassed, the JAR file creates dynamic-link library (DLL) entries inside a temporary directory and adds the corresponding registry entries on a compromised computer. The DLL names are randomly generated each time the JAR file is complied. Example file names observed in analysis include:

  • %Temp%\spoolsv.dll
  • %Temp%\winlogon.dll
  • %Temp%\java.dll
  • %Temp%\alg.dll
  • %Temp%\firefox.dll

These DLL files then download other malware onto the compromised computer.

Malvertisement is a growing issue, increasing 20 times over from 2010 to 2012. More than 50 percent of publishers have experienced a malvertising incident one or more times.

Symantec customers are already protected from these attacks using multilayered protection provided by our security products. Symantec Endpoint Protection 11 and 12 include the Network Threat Protection - IPS technology that proactively protects against malvertisements and the resulting drive-by download. Enterprise customers must ensure that they have enabled Network Threat Protection within their product for protection. All Norton solutions have the Network Threat Protection technology automatically enabled in their products.

The following is a partial list of IPS Signatures that block the Web attack toolkit from dropping the malware from the malvertisement:

Symantec antivirus also detects the dropped payload as Backdoor.Trojan and the corresponding JAR files as Trojan.Maljava.

Symantec has recently launched Symantec AdVantage, which is a cloud based anti-malvertisement product with sophisticated detection and reporting capabilities that helps prevent ad publishers and distributors from propagating malware to customers.

Symantec recommends that website owners that include advertising on their websites check out the anti-malvertisement guidelines recommended by the Online Trust Alliance (OTA). The Online Trust Alliance is a non-profit with the mission to enhance online trust, while promoting innovation and the vitality of the Internet.  Symantec is a founding member of the Online Trust Alliance.

Users with the latest Java update (Java 7 update 13) are currently no longer at risk through silent exploitation. To avoid being exploited, it is recommended that users continuously apply the latest updates to their operating systems, software, and antivirus and IPS definitions.

How Steve Jobs Influenced the Modern World of Digital Design

$
0
0

If you are a design professional, chances are one of the Apple computers was where you first learned your trade. You would also be somewhat familiar with one of the original men behind the design of Apple’s legendary products, Steve Jobs.  I just finished reading his biography, and learned that so many things relevant to this field were the direct result of his constant attention to detail and push for perfection.

Steve grew up not only in the heart of Silicon Valley, but also during its inception, when new technology companies were turning the industry on its ears and actual engineers were running the companies. This product-driven business model was proving to be quite successful. He also grew up in an era of free expression within a very open and tolerant culture. His favorite subject in college was typography; he really connected with how fonts influenced the content and audience. He also spent many of these years learning the eastern philosophies and their holistic values. These all later manifested into his well-known product philosophy that Apple still uses to this day – simple, sleek, seamless, integrated design.

The first product that changed the design world dramatically was the invention of the Macintosh computer with its graphical user interface (GUI), integrated graphic software and postscript fonts. Introduced during the 1983 Superbowl with the iconic, award winning 1984 “Big Brother” ad, it was the first mass-market computer specifically made for the creative person in mind. It came with this new input device, the mouse that would allow real-time drawing and precise cursor control – a must for any designer. It also came with MacWrite, MacPaint, and several fonts. These allowed a designer to not only typeset their copy on the fly, but to lay out pages ready to print. No more Exacto knives, hot wax, and galley type. Welcome to the new era of “Desktop Publishing”. Design would never be the same!

Apple’s GUI and “user friendly” operating system became the new standard for all personal computers going forward. GUIs were becoming the norm and were expected by the consumer. As speed and bandwidth grew, even the internet was becoming graphically enhanced. This gave the digital artist a whole new media platform to create for, leading to what we expect to see on the internet today.

After the success of the Macintosh computer, Steve and Apple split for over 10 years, where he pursued other business interests such as NeXt computer and Pixar (which challenged and set the standard for all future animation). He honed his management and product innovation skills, so when Apple asked him back, he was able to take over and move Apple beyond the Macintosh computer which, by this time, had fallen dramatically behind in the market. With this renewed purpose, Apple was able to launch the new iMac and for the professional market, the PowerMac. By taking advantage of and even driving the faster technologies in memory and processing power, Apple was able to bring itself back into the competitive market.

In order to go beyond its competitors, Apple started focusing on integrated software for personal devices like cameras, camcorders, and PDAs. This was known as the Digital Hub Strategy; where, different devices and media link together sharing data and common functions. This worked really well for everything on the market except for digital music players. The devices were clunky and had pretty bad user interfaces, so to fix the problem Steve Jobs had the Apple engineers design a new music player, the iPod. With its essential integrated software counterpart, iTunes, it was the product game changer that Apple needed to surpass its competition. The iPod once again showed Steve Jobs’ design values. It was clean, white, simple and elegant. It also introduced a mobile device user interface to the industry. This was the stepping stone to the next product that would again change the world of design.

Since the beginning of Apple, Steve had a vision of a marketable tablet. During his first term, the Newton had been designed. It was clunky, inelegant and it had no real marketable interest. Several other tablets were designed but they didn’t do well either. Now with the iPod technology, user interface and integrated strategy, Steve felt comfortable having Apple pursue a tablet device again. This device would be able to handle media of all sorts and be part of the digital hub. It would be so intuitive, anyone from a small child to an older grandparent speaking a different language, could use it. It would not be a complete computer needing lots of processing power and it would not need a stylus, keyboard, or mouse (Steve always felt external input devices were crutches and never liked them). Luckily, touch screen technology was well under way, so to Steve, it was the obvious and perfect interface solution.

This first touch screen tablet was subsequently shelved when Steve realized that its many functions also mirrored the new “smart”, internet and music integrated phones. With the phone industry becoming a booming business, Steve saw the opportunity he needed to power Apple up beyond the success of the iPod. In secret meetings with AT&T, his tablet team re-designed it to be a smaller device that could also make phone calls. They expanded on the innovative UI of the iPod, adapting it to touch screen technology and a GUI. The team even introduced features like ear lock-out (so you don’t press buttons with your ear as you talk), gyro synchronous positioning, and GPS maps. In January 2007, the clean, sleek, simple, and elegant iPhone was introduced to the world. Not only did the iPhone (and 3 years later the iPad) jumpstart a whole new industry standard, Apple again, opened another new media platform for design professionals known as Mobile App Design.

A bulk of a professional digital designer’s work is either for the web or application UI elements. All of these will be viewed and experienced through a variety of media devices all originally created or influenced by Apple; the Macintosh with its GUI leading to future print and web design opportunities, the iPod which initiated personal device UI and the Digital Hub Strategy which in turn led to the development of the iPhone and iPad leading to the massive mobile device market and thereby, giving designers even more creative opportunities.

By reading his biography, I learned how Apple, driven by Steve Jobs, has molded and formed the design industry so completely, that it is not only influenced by the media and devices they make, but also by the high quality, successful Apple product advertising and marketing itself. Their marketing always showcases and leads the trends that designers strive to mirror. Apple’s direction is no longer driven by the powerful ideas and motivation of Steve Jobs but let’s hope his legacy of innovation remains strong and constant for the creative industry, giving it many more opportunities to grow and thrive.

Troubleshooting Articles for Repairing the Corrupted Definition

$
0
0

Hi Friends,

In this blog i have added some Troubleshooting Articles which can help to Repairing the Corrupted Definition

 

How to clear corrupt Virus Definitions from SEPM
https://www-secure.symantec.com/connect/articles/how-clear-corrupt-virus-definitions-sepm

Using the "Rx4DefsSEP" utility
http://www.symantec.com/docs/TECH93036

Using the "Rx4Defs64" utility
http://www.symantec.com/docs/TECH105038

Drive Space used by Virus Definitions Updates
http://www.symantec.com/docs/TECH141811

Disk Space Management procedures for the Symantec Endpoint Protection Manager
http://www.symantec.com/docs/TECH96214

How to Backdate Virus Definitions in Symantec Endpoint Protection Manager
http://www.symantec.com/docs/TECH102935

 

Symantec Endpoint Protection Manager (SEPM) 12.1 is not updating 32 or 64 bit virus definitions.
http://www.symantec.com/docs/TECH166923

 

How to update definitions for Symantec Endpoint Protection Manager (SEPM) using a .jdb file
http://www.symantec.com/docs/TECH102607

Script to download Definitions from SEPM
https://www-secure.symantec.com/connect/downloads/script-download-definitions-sepm

How to create a client installation settings to delete previous logs, policies and reset the client-server communication settings?
http://www.symantec.com/docs/TECH93617

Symantec Endpoint Protection: LiveUpdate Troubleshooting Flowchart
http://www.symantec.com/docs/TECH95790

Only 32 Bit Antivirus / Antispyware Definitions are not updating on the 32 Bit / 64 Bit Operating System.
http://www.symantec.com/docs/TECH122857

 

How to determine if virus definitions of Symantec Endpoint Protection client (SEP) 11 or 12 Small Business Edition, are corrupted
http://www.symantec.com/docs/TECH97677

 

Potential Symantec Endpoint Protection content definition corruption
http://www.symantec.com/docs/TECH92043

Remove Virus Definitions
https://www-secure.symantec.com/connect/downloads/remove-virus-definitions

 

Symantec Endpoint Protection 12.1: How to roll back the BASH definitions to a known good version
http://www.symantec.com/docs/HOWTO53366

 

How to update definitions for Symantec Endpoint Protection using the Intelligent Updater
http://www.symantec.com/docs/TECH102606

 

How to clear out definitions for a Symantec Endpoint Protection 12.1 client manually
http://www.symantec.com/docs/HOWTO59193

 

Symantec Endpoint Protection (SEP) 12.1 client is maintaining multiple virus definitions versions on servers.
http://www.symantec.com/docs/TECH180056

 

Hope these are helpful.

 

Thanks

Sumit G.

Viewing all 5094 articles
Browse latest View live




Latest Images