PlugX and its implications

A new Remote Administration Tool has been discovered called PlugX which is a Remote Access Tool (RAT). It has also been named as Korplug. PlugX has been detected in targeted attacks not only against military, government or political organizations, but also against more or less ordinary companies. The attack starts with a phishing email containing a malicious attachment, usually an archived, bundled or specially crafted document that exploits either a vulnerability.

PlugX has been witnessed to be delivered with the three file components, namely:

• A legitimate file
• A malicious DLL that is loaded by the legitimate file
• A binary file that contains the malicious codes loaded by the DLL.

Cyber Espionage

"Kaspersky Security Bulletin" talks about Cyber-espionage or "hacktivism" and naton-state cyberattacks, apart from legal surveillance, cloud based network attacks, cyber extortion of individuals and companies. The number of reported cases of cyberespionage is growing, with high-value, highly visible data emerging as the primary target, say  Patricia Titus, VP, chief information security office, Unisys. Cyberespionage perpetrators are people with excellent technical skills and psychological understanding of human behavior capable of manipulating their targets within an organization, since the universal statement is people are always the weakest security link. An increased use of zero-day exploits, coupled with malware which is often not detected by anti-virus vendors is used for building cyber espionage tools. The mobile malware will start shaping the digital security landscape in the forthcoming years painting a different picture. This apart there is a surge in fake security certificates, coupled with skillfully coded malware fostering the nationally authorized cyber attacks leading to a cold cyber war across developed countries.

Second International Conference of the South Asian Society of Criminology and Victimology

The South Asian Society of Criminology and Victimology (SASCV) and Department of Criminology and Criminal Justice at Manonmaniam Sundaranar University are organizing their Second International Conference from 11 to 13 January, 2013 at Kanyakumari, Chennai under the theme of  "REVISITING INTERPERSONAL CRIMES AND VICTIMIZATION"

Shamoon attack

A new malware surfaced during August 2012 as reported by the various security agencies.  The malware has been  dubbed by the code name  "Shamoon". The attack is called "Shamoon", due to a filename i.e. string of a folder name within the malware executable called as Shamoon. ("C:\Shamoon\ArabianGulf\wiper\release\wiper.pdb").The spyware infects all the computers in an internal network.

The main executable contains 3 resources, each maintains a ciphered program. PKCS12:112, PKCS7:113 and X509:116,  according to Dmitry. Symantec said that the malware, which it calls "W32:Disttrack," had infected fewer than 50 machines worldwide. The main Shamoon module has a resource PKCS7:113 that maintains an executable which is saved to disk as %WINDIR%\System32\NETINIT.EXE says Dmitry Tarakanov. He adds that the malware waits for CNC communication as evident from its communication module. He also talks about PKCS12:112 another module playing an important role. The details of shamoon's operation is explained  by Dmitry here.  Shamoon, is being used in targeted attacks against at least one organization in the energy sector, according to Symantec.

Mariposa Botnet

Understanding Bots as a technology has emerged as a critical skill in the information era. This article is focused in understanding Mariposa. Botnet Mariposa was reported by defense intelligence some time during May of 2009. Trend micro says that the worm has been in existence as early as December 2008. It is learnt that the reported botnet was named after the Spanish word for "butterfly" as documented across the Internet. It had silently enrolled almost 13 million computers in more than 190 countries.