Link: here
- wong chee tat :)
Showing posts with label maleware. Show all posts
Showing posts with label maleware. Show all posts
Friday, June 17, 2016
Thursday, June 16, 2016
Scams exploiting infocomm tech on the rise in Singapore: Police
Scams exploiting infocomm tech on the rise in Singapore: Police
From January to April this year, authorities received at least 190 reports of internet love scams involving approximately S$7.5 million, almost matching the 198 cases involving S$8.8 million for the whole of 2014.
By Loke Kok Fai
Posted 15 Jun 2016 00:20 Updated 15 Jun 2016 23:30
SINGAPORE: The 19-year-old man entered a 7-Eleven store along Yishun Avenue 5 around 2am, wanting to buy an iTunes gift card.
But when Rosida Arshad saw that he was already holding a gift card worth about S$100 in his hands, the quick-thinking sales assistant decided to caution him that the card was non-refundable and non-exchangeable.
She also showed him an information card given by the police that explained a common scam - an attractive lady on social networking app WeChat approaches and convinces victims to buy and transfer online credit from gift cards, for the promise of a date or sexual services which never materialise.
"Once he saw it, he said: 'I've been scammed'," said 47-year-old Madam Rosida.
FRAUDSTERS USING SOCIAL MEDIA TO PROFILE VICTIMS: POLICE
Police said that the number of such scams, which exploit infocomm technologies, has surged in Singapore since the start of the year and are involving increasingly large sums of money.
Police Superintendent Chew Jingwei, who heads the Commercial Affairs Department's Syndicated Fraud Branch, said fraudsters have been able to exploit the cloak of anonymity afforded by the internet and the increasing popularity of social media platforms in Singapore to reach across borders "within seconds".
"Today's internet users share quite a bit of their social lives and personal information on social media platforms, so it's easy for fraudsters in certain scams to target who exactly they want as victims by doing a bit of profiling on the internet," said Supt Chew. "For example in credit-for-sex scams, we see that the victims are all men who are looking for female friends on Chinese-based social media platforms."
While he said the police will continue to intensify public education efforts to increase awareness of such scams, they appear to face an uphill task.
Despite police community engagement efforts in the Yishun North neighbourhood since September 2015, Madam Rosida said more are falling victim to scams. She told Channel NewsAsia that what used to be a single customer demanding a refund for purchasing gift cards every two or three weeks has slowly grown to one or two customers every one or two weeks.
"I show them the poster and tell them ‘no refund or exchanges’. I ask them to read - I don't know whether they read it or not, but they just look at the poster and insist on buying," she said.
These customers often return after half an hour trying to insist on refunds or exchanges. When they are rejected, Madam Rosida often spots them pacing outside the shop and talking on the phone.
"Then I know that this guy has been scammed," she said.
Police said 200 cases of credit-for-sex scams have been reported from January to April this year, involving at least S$422,200 in total. These figures surpass the 66 cases involving S$118,000 reported for the whole of 2014.
In the same time period this year, authorities received at least 190 reports of internet love scams involving approximately S$7.5 million, almost matching the 198 cases involving S$8.8 million for the whole of 2014.
Most victims of such scams are women aged between 30 and 59, and holding professional jobs. They are approached on social media platforms such as Facebook, Meetup.com and Skout, and form relationships with online "lovers", who then feign financial difficulties and ask for money.
Internet love scams such as these cheated victims of the greatest amount of money in the first four months of this year out of the scams involving infocomm technologies, followed by scams involving fraudsters impersonating authorities from China or Singapore who tell victims that parcels containing illegal items have been shipped in their name.
Using convincing methods such as spoofed local phone numbers and addresses for the appearance of greater authenticity, the impersonators trick victims into transferring funds into foreign bank accounts or into disclosing personal information to "settle the case". To date, more than 50 such scams have been reported, involving around S$4 million.
Impersonation scams and internet love scams account for the top 10 largest single cheating cases in the first four months of the year, with an impersonation scam claiming the highest amount lost by a victim in a single case this year - S$2.3 million.
- CNA/mz
- wong chee tat :)
From January to April this year, authorities received at least 190 reports of internet love scams involving approximately S$7.5 million, almost matching the 198 cases involving S$8.8 million for the whole of 2014.
By Loke Kok Fai
Posted 15 Jun 2016 00:20 Updated 15 Jun 2016 23:30
SINGAPORE: The 19-year-old man entered a 7-Eleven store along Yishun Avenue 5 around 2am, wanting to buy an iTunes gift card.
But when Rosida Arshad saw that he was already holding a gift card worth about S$100 in his hands, the quick-thinking sales assistant decided to caution him that the card was non-refundable and non-exchangeable.
She also showed him an information card given by the police that explained a common scam - an attractive lady on social networking app WeChat approaches and convinces victims to buy and transfer online credit from gift cards, for the promise of a date or sexual services which never materialise.
"Once he saw it, he said: 'I've been scammed'," said 47-year-old Madam Rosida.
FRAUDSTERS USING SOCIAL MEDIA TO PROFILE VICTIMS: POLICE
Police said that the number of such scams, which exploit infocomm technologies, has surged in Singapore since the start of the year and are involving increasingly large sums of money.
Police Superintendent Chew Jingwei, who heads the Commercial Affairs Department's Syndicated Fraud Branch, said fraudsters have been able to exploit the cloak of anonymity afforded by the internet and the increasing popularity of social media platforms in Singapore to reach across borders "within seconds".
"Today's internet users share quite a bit of their social lives and personal information on social media platforms, so it's easy for fraudsters in certain scams to target who exactly they want as victims by doing a bit of profiling on the internet," said Supt Chew. "For example in credit-for-sex scams, we see that the victims are all men who are looking for female friends on Chinese-based social media platforms."
While he said the police will continue to intensify public education efforts to increase awareness of such scams, they appear to face an uphill task.
Despite police community engagement efforts in the Yishun North neighbourhood since September 2015, Madam Rosida said more are falling victim to scams. She told Channel NewsAsia that what used to be a single customer demanding a refund for purchasing gift cards every two or three weeks has slowly grown to one or two customers every one or two weeks.
"I show them the poster and tell them ‘no refund or exchanges’. I ask them to read - I don't know whether they read it or not, but they just look at the poster and insist on buying," she said.
These customers often return after half an hour trying to insist on refunds or exchanges. When they are rejected, Madam Rosida often spots them pacing outside the shop and talking on the phone.
"Then I know that this guy has been scammed," she said.
Police said 200 cases of credit-for-sex scams have been reported from January to April this year, involving at least S$422,200 in total. These figures surpass the 66 cases involving S$118,000 reported for the whole of 2014.
In the same time period this year, authorities received at least 190 reports of internet love scams involving approximately S$7.5 million, almost matching the 198 cases involving S$8.8 million for the whole of 2014.
Most victims of such scams are women aged between 30 and 59, and holding professional jobs. They are approached on social media platforms such as Facebook, Meetup.com and Skout, and form relationships with online "lovers", who then feign financial difficulties and ask for money.
Internet love scams such as these cheated victims of the greatest amount of money in the first four months of this year out of the scams involving infocomm technologies, followed by scams involving fraudsters impersonating authorities from China or Singapore who tell victims that parcels containing illegal items have been shipped in their name.
Using convincing methods such as spoofed local phone numbers and addresses for the appearance of greater authenticity, the impersonators trick victims into transferring funds into foreign bank accounts or into disclosing personal information to "settle the case". To date, more than 50 such scams have been reported, involving around S$4 million.
Impersonation scams and internet love scams account for the top 10 largest single cheating cases in the first four months of the year, with an impersonation scam claiming the highest amount lost by a victim in a single case this year - S$2.3 million.
- CNA/mz
- wong chee tat :)
Tuesday, June 7, 2016
Monday, July 21, 2014
Manic malware Mayhem spreads through Linux, FreeBSD web servers
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
By Iain Thomson, 18 Jul 2014
Malware dubbed Mayhem is spreading through Linux and FreeBSD web servers, researchers say. The software nasty uses a grab bag of plugins to cause mischief, and infects systems that are not up to date with security patches.
Andrej Kovalev, Konstantin Ostrashkevich and Evgeny Sidorov, who work at Russian internet portal Yandex, discovered the malware targeting *nix servers. They traced transmissions from compromised computers to two command and control (C&C) servers. So far they have found 1,400 machines that have fallen to the code, with potentially thousands more to come.
"In the *nix world, autoupdate technologies aren't widely used, especially in comparison with desktops and smartphones. The vast majority of web masters and system administrators have to update their software manually and test that their infrastructure works correctly," the trio wrote in a technical report for Virus Bulletin.
"For ordinary websites, serious maintenance is quite expensive and often webmasters don't have an opportunity to do it. This means it is easy for hackers to find vulnerable web servers and to use such servers in their botnets."
Mayhem spreads by finding servers hosting websites with a remote file inclusion (RFI) vulnerability – it even uses Google's /humans.txt to test for this. If the ad giant rewrote this file, specifically changing the words "we can shake", Mayhem infections would be slowed – until its rfiscan.so plugin is updated.
Once the malware exploits an RFI, or some other weakness, to run a PHP script on a victim, it drops a shared object called libworker.so onto the infected system and pings its C&C servers.
It then creates a hidden file system, usually called sd0, and downloads eight plugins, none of which were picked up by the VirusTotal malware scanning tool.
These include a couple of brute-force password crackers targeting FTP, Wordpress and Joomla accounts – presumably to spread the malware further – and information-gathering web crawlers, one of which hunts for other sites with RFI holes.
Some of the vulnerable web applications Mayhem scans for ... click for slightly larger version (Credit: Kovalev, Otrashkevich, Sidorov)
The Yandex trio warn there may be other plugins in circulation, based on data found on the two cracked C&C servers. These include a tool specifically to exploit systems that haven't patched the Heartbleed vulnerability in OpenSSL.
The team notes that the Mayhem code does bear several similarities to the Trololo_mod and Effusion families of malware, which target Apache and Nginx servers respectively. They recommend system administrators check their servers to make sure Mayhem's spread is limited. ®
- wong chee tat :)
And how Google could cripple infection rate in a second
By Iain Thomson, 18 Jul 2014
Malware dubbed Mayhem is spreading through Linux and FreeBSD web servers, researchers say. The software nasty uses a grab bag of plugins to cause mischief, and infects systems that are not up to date with security patches.
Andrej Kovalev, Konstantin Ostrashkevich and Evgeny Sidorov, who work at Russian internet portal Yandex, discovered the malware targeting *nix servers. They traced transmissions from compromised computers to two command and control (C&C) servers. So far they have found 1,400 machines that have fallen to the code, with potentially thousands more to come.
"In the *nix world, autoupdate technologies aren't widely used, especially in comparison with desktops and smartphones. The vast majority of web masters and system administrators have to update their software manually and test that their infrastructure works correctly," the trio wrote in a technical report for Virus Bulletin.
"For ordinary websites, serious maintenance is quite expensive and often webmasters don't have an opportunity to do it. This means it is easy for hackers to find vulnerable web servers and to use such servers in their botnets."
Mayhem spreads by finding servers hosting websites with a remote file inclusion (RFI) vulnerability – it even uses Google's /humans.txt to test for this. If the ad giant rewrote this file, specifically changing the words "we can shake", Mayhem infections would be slowed – until its rfiscan.so plugin is updated.
Once the malware exploits an RFI, or some other weakness, to run a PHP script on a victim, it drops a shared object called libworker.so onto the infected system and pings its C&C servers.
It then creates a hidden file system, usually called sd0, and downloads eight plugins, none of which were picked up by the VirusTotal malware scanning tool.
These include a couple of brute-force password crackers targeting FTP, Wordpress and Joomla accounts – presumably to spread the malware further – and information-gathering web crawlers, one of which hunts for other sites with RFI holes.
Some of the vulnerable web applications Mayhem scans for ... click for slightly larger version (Credit: Kovalev, Otrashkevich, Sidorov)
The Yandex trio warn there may be other plugins in circulation, based on data found on the two cracked C&C servers. These include a tool specifically to exploit systems that haven't patched the Heartbleed vulnerability in OpenSSL.
The team notes that the Mayhem code does bear several similarities to the Trololo_mod and Effusion families of malware, which target Apache and Nginx servers respectively. They recommend system administrators check their servers to make sure Mayhem's spread is limited. ®
- wong chee tat :)
Subscribe to:
Posts (Atom)