Saudi Oil Producer’s Computers Restored After Cyberattack

The following is an excerpt from an article in 

The New York Times
Monday, August 27, 2012

Saudi Oil Producer’s Computers Restored After Cyberattack

By REUTERS DUBAI (Reuters) — Saudi Aramco, the world’s biggest oil producer, has resumed operating its main internal computer networks after a virus infected about 30,000 of its workstations earlier this month, the company said Sunday.

Immediately after the Aug. 15 attack, the company announced it had cut off its electronic systems from outside access to prevent further attacks.

On Sunday, Saudi Aramco said the workstations had been cleansed of the virus and restored to service. Oil exploration and production were not affected because they operate on isolated systems, it said.

“We would like to emphasize and assure our stakeholders, customers and partners that our core businesses of oil and gas exploration, production and distribution from the wellhead to the distribution network were unaffected and are functioning as reliably as ever,” Saudi Aramco’s chief executive, Khalid al-Falih, said in a statement.

However, one of Saudi Aramco’s Web sites taken offline after the attack — www.aramco.com — remained down on Sunday. E-mails sent by Reuters to people within the company continued to bounce back.

The company said that the virus “originated from external sources,” and that an investigation into the causes of the incident and those responsible was continuing. It did not elaborate.

For more, visit www.nytimes.com.

FBI Internet Scam Alerts

From the FBI:

Internet Crime Complaint Center's (IC3)
Scam Alerts

February 17, 2012

This report, which is based upon information from law enforcement and complaints submitted to the IC3, details recent cyber crime trends, new twists to previously-existing cyber scams, and announcements.

MYSTERY SHOPPER SCAM TO EVALUATE WIRE TRANSFER SERVICES

The IC3 has recently received over 250 complaints reporting a new twist to the online employment scam. The scam involves individuals who responded to online ads or were contacted via e-mail as a result of their resume being posted on job websites. The perpetrator posed as a research company and requested participants to complete a paid survey regarding services provided at wire transfer locations to improve the effectiveness of the company's money-transfer services.

Complainants were hired and then mailed a cashier's check or money order. They received instructions to cash the check/money order at their local bank, keep a portion as payment, and wire the remaining amount via wire transfer to a designated recipient. Victims were then asked to immediately e-mail their employer with the transfer number, amount wired, recipient's name and address, and the name of the wire transfer location evaluated. Upon sending the information, victims received a questionnaire form regarding their overall wire transfer experience to complete and return. Those who did not promptly follow through with the instructions received threatening e-mails stating if they did not respond within 24 hours, their information would be forwarded to the FBI and they could face 25 years in jail.

Shortly after the transactions, victims were informed by their banks that the checks were counterfeit and were held responsible for reimbursing their banks. Most victims owed their bank over $2,500.

SPAM REFERENCING U.S. MILITARY MEMBERS AND GADDAFI

Criminals continue to explore new avenues to lure victims, most recently by claiming to be a US military contractor, who was performing reconstruction work in Libya. Fraudsters sent unsolicited e-mails claiming that several metal boxes were found in cellars of high-rise buildings built and occupied by Muammar Gaddafi. Each box purportedly contained large sums of money, in addition to guns, armor, bullets, and drugs. The e-mails requested the recipient’s assistance with transferring the money out of Libya. The fraudsters also told the e-mail recipients that they were expected to receive, secure, and protect the boxes until the overseas assignment elapsed and promised the victims a 30 percent profit.

Often times in online scams, once communication with the fraudsters begins, they will request personal information, including but not limited to bank account details, claiming funds are needed to cover various expenses.

Be wary of any unsolicited e-mail, especially those requesting personal information or soliciting the submission of money for any reason. Unsolicited e-mails should not be opened, as they often contain viruses or other malicious software.

POX PARTY ONLINE ADVERTISEMENTS

Recently, the IC3 received a complaint from an individual reporting an advertisement on a social media site that offered ways to obtain "natural immunity" from the chickenpox by sharing lollipops licked by children infected with the virus. Parents have been known to take their child to a "Pox Party" as an alternative to vaccinating children from varicella, otherwise known as chickenpox, but sending virus-covered lollipops through the mail is against Federal law.

One individual posted a message stating "fresh batch of pox in Nashville shipping of suckers, spit, and Q-tips available tomorrow 50 dollars."

As a disclaimer, the social media site posted the following notice on their page:

"This page has never condoned the mailing of infectious diseases. For our members: The mailing of infectious items, such as lollipops, rags, etc, is a federal offense. This page is not private and can been seen by members and non members alike. You may post on the page that you have the pox and are willing to share in YOUR AREA but please keep your specifics in private messages between members. Again, this page can be seen by anyone and mailing is a federal offense. We are all intelligent adults but these guidelines will help protect your privacy."

According to the Center for Disease Control's (CDC) website, www.cdc.gov, chickenpox is spread in the air when an infected person coughs or sneezes. It can also be spread by touching or breathing in the virus particles that come from the chickenpox blisters. The CDC also discourages chickenpox parties because the disease can be serious. Dangerous diseases like hepatitis A and strep can be transmitted via saliva according to the CDC's website. Therefore, not only is the contaminated candy not likely to provide exposure to chickenpox, it could expose children to an entirely different disease.

Beware of Valentine's Day Malware Distribution

News release from Panda Security:

Beware of Valentine’s Day Malware Distribution Campaigns, PandaLabs reports

• Here are some examples of malware that used social engineering to infect users on this festive occasion
• PandaLabs offers tips to avoid computer viruses on Valentine’s Day

Malware that uses events like Valentine’s Day, Christmas or Halloween as a lure to trick users and infect computers is now a well-established feature of the IT security calendar. Once again, this year it will be no surprise to see numerous emails in circulation with links for downloading romantic greeting cards, videos, gift ideas, or Facebook and Twitter messages related to Valentine’s Day.

Social engineering is cyber-crooks’ preferred technique for deceiving users. In these cases it basically involves obtaining confidential information from users by convincing them to take a series of actions. Crimeware and social engineering go hand-in-hand: a carefully selected social engineering ploy convinces users to hand over their data or install a malicious program which captures information and sends it on to the fraudsters.

Cyber-crooks, however, are also exploiting other channels, such as Facebook, Twitter or Google+, and given the access to millions of users that these social networks provide, they have become just as popular among the criminal fraternity for spreading malware as email.

A new Facebook attack has recently been discovered that uses users’ walls to spread. An apparently harmless message invites users to install a Valentine’s Day theme on Facebook. However, if the user clicks the wall post, they are redirected to a page where they are prompted to install the theme. This installs a malware file which, once run, displays ads from other websites. It also downloads an extension that monitors Web activities and redirects sessions to survey pages that request sensitive information like phone numbers.

Some weeks ago, the PandaLabs blog reported on a link included in a Twitter profile that took users to a dating site: http://pandalabs.pandasecurity.com/sex-lies-and-twitter/. Special dates like Valentine’s Day can see a proliferation of malicious Twitter posts used to steal users’ confidential data and empty their bank accounts through social engineering.

Here is a collection of some of the Valentine’s Day-themed malware campaigns detected by PandaLabs, the anti-malware laboratory of Panda Security, in recent years:

Waledac.C: This worm spread by email trying to pass itself off as a greeting card. The email message included a link to download the card. However, if the user clicked the link and accepted the subsequent file download they were actually letting the Waledac.C worm into their computer. Once it infected the computer, the worm used the affected user’s email to send out spam.

I Love.exe you: This was a RAT (Remote Access Trojan) that gave attackers access to the victim’s computer and all their personal information. The Trojan allowed the virus creator to access target computers remotely, steal passwords and manage files.

Nuwar.OL: This worm spread in email messages with subjects like “I love You So Much”, “Inside My Heart” or “You in My Dreams”. The text of the email included a link to a website that downloaded the malicious code. The page was very simple and looked like a romantic greeting card with a large pink heart. Once it infected a computer, the worm sent out a large amount of emails, creating a heavy load on networks and slowing down computers.

Website that downloaded the Nuwar.OL worm

Valentin.E: This worm spread by email in messages with subjects like “Searching for True Love” or “True Love” and an attached file called “friends4u”. If the targeted user opened the file, a copy of the worm was downloaded. Then, the worm sent out emails with copies of itself from the infected computer to spread and infect more users.

Desktop wallpaper displayed by Valentin.E.

Storm Worm: This worm spread via email by employing a number of lures, one of them exploiting Valentine’s Day. If the targeted user clicked the link in the email, a Web page was displayed while the worm was downloaded in the background.

Web page displayed by Storm Worm

PandaLabs offers users a series of tips to avoid falling victim to computer threats:

• Do not open emails or messages received on social networks from unknown senders.

• Do not click any links included in email messages, even though they may come from reliable sources. It is better to type the URL directly in the browser. This rule applies to messages received through any mail client, as well as those in Facebook, Twitter, or other social networks or messaging applications, etc. If you do click on any such links, take a close look at the page you arrive at. If you don’t recognize it, close your browser.

• Do not run attached files that come from unknown sources. Especially these days, stay on the alert for files that claim to be Valentine Day’s greeting cards, romantic videos, etc.
• Even if the page seems legitimate, but asks you to download something, you should be suspicious and don’t accept the download. If, in any event, you download and install any type of executable file and you begin to see unusual messages on your computer, you have probably been infected with malware.
• If you are making any purchases online, type the address of the store in the browser, rather than going through any links that have been sent to you. Only buy online from sites that have a solid reputation and offer secure transactions, encrypting all information that is entered in the page.

• Do not use shared or public computers, or an unsecured WiFi connection, for making transactions or operations that require you to enter passwords or other personal details.

• Have an effective security solution installed, capable of detecting both known and new malware strains.

Panda Security offers you several free tools for scanning computers for malware, like Panda Cloud Antivirus:www.cloudantivirus.com

Malware Creation Hit Record High in 2011

News release from Panda Security:

January 31, 2012

Malware Creation hit a New Record High in 2011 with 26 million samples

• Trojans continue to be the most pervasive malware threat
• China, Thailand and Taiwan are the world’s most infected countries
• Data theft, social media and cyber-war take the spotlight
• The full report is available at http://press.pandasecurity.com/press-room/reports/

PandaLabs, the antimalware laboratory of Panda Security, has released its 2011 Annual Security Report, which details an extremely interesting year of data theft, social networking attacks and cyber-warfare. According to the report, malware creation hit a new record high in 2011 with 26 million new strains in circulation, nearly one-third of all malware that has ever existed and been classified by the company (88 million).

These figures show cyber-criminals’ sheer capacity to automate the creation of new malware variants, further evidenced by the average number of new threats created and released every day increasing from 63,000 to 73,000 since last year. Panda Security leverages Collective Intelligence, a cloud-based proprietary system that automatically detects, analyzes and classifies 99.4 percent of all malware received, leaving just 0.6 percent to be dealt with manually. In November 2011, PandaLabs announced that Collective Intelligence had reached a historic milestone by processing 200 million files, and this number has already reached 210 million.

Malware

In 2011, Trojans dominated the threat landscape more than ever before. Whereas in 2009 Trojans made up 60 percent of all malware, the percentage dropped to 56 percent in 2010. Last year, however, the percentage jumped up to 73 percent, so that three out of every four new malware strains created were Trojans, followed by viruses (14.24 percent) and worms (8.13 percent).

The countries leading the list of most infections are once again Thailand, China and Taiwan, with 60, 56 and 52 percent of infected computers respectively. These are actually the only countries that exceed the worldwide average of 38.49 percent.

2011: The year of cyber-attacks, social media and cyber-war

The report offers a general view of the most important events regarding computer security in 2011. Sony suffered a massive breach that led to the theft of data belonging to 100 million user accounts in what is probably the largest-ever Internet security break-in, whereas the Steam video game service, used by 35 million people, was also compromised by hackers.

Social networking sites, mainly Facebook and Twitter, play a vital role in the life of Internet users and are extensively covered in the report. 2011 witnessed the launch of a new social media service in a bid to rival Facebook: Google+. Despite its rapid growth, with more than 25 million users registered in just few weeks, Google+ is still far away from its direct competitor, Facebook, which makes it less of a target for cyber-crooks.

Cyber-war also grabbed headlines in 2011. The number of cyber-attacks multiplied all over the world, affecting governments and government contractors -like weapons manufacturers- alike.  Besides offering an overview of the most significant events in the computer security field, the 2011 Annual Security Report also forecasts future trends for 2012.

The full report is available at: http://press.pandasecurity.com/press-room/reports/. Visit the PandaLabs blog for more information about these and other threats:  http://pandalabs.pandasecurity.com/