F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Copyright (c) 2007 F-Secure Corporation. All Rights Reserved. tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001911.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Today there's a phishing run underway in Twitter, using Direct Messages ("DMs"). These are private one-to-one Tweets inside Twitter.<br /><br />The messages look like these:<br /><br /><img border="1" src="http://www.f-secure.com/weblog/archives/mhansen1.png" alt="you should change ur photo u took here - did i tell you that ur here" title="you should change ur photo u took here - did i tell you that ur here"><br /><br />If you follow the link, you end up to a fake Twitter page:<br /><br /><img border="1" src="http://www.f-secure.com/weblog/archives/mhansen2.png" alt="mhansenhome.org"><br /><br />If you mistakenly give out your credentials, the attackers will start sending similar Direct Messages to your contacts, posing as you.<br /><br />The ultimate goal of the attackers is to gain access to a large amount of valid Twitter accounts, then use these account to post Tweets with URLs pointing to malicious websites which will take over users computers when clicked.<br /><br />Lets have a closer look at the domain <b>mhansenhome.org</b>.<br /><br />The front page seems to be an active Myspace phishing page. Nice.<br /><br /><img width="760" border="1" src="http://www.f-secure.com/weblog/archives/mhansen3.png" alt="mhansenhome.org"><br /><br />The good news is that Twitter is already filtering these from being posted, although it's unclear if they are also removing already-delivered DMs. <br /><br />Also, the Twitter built-in link shorteners (twt.tl and bit.ly) already detect the URLs as malicious:<br /><br /><img border="1" src="http://www.f-secure.com/weblog/archives/mhansen4.png" alt="mhansenhome.org"><br /><br /><img border="1" src="http://www.f-secure.com/weblog/archives/mhansen5.png" alt="mhansenhome.org"><br /> <p>On 21/03/10 At 01:41 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001910.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com We regularly learn of cases where criminals have gained access to credit card numbers via <b>keyloggers</b>, <b>skimmers</b> or <b>online hacks</b>.<br /><br />Once they have the credit card numbers, they basically have three ways to turn them into cash:<br /><br /><ul><li>Sell them<br /><li>Make fraudulent purchases on them<br /><li>Create real-world cards out of them</ul><br />To create real-world cards, you need blank cards to start with. These are known in the underground as "<b>blank plastic</b>".<br /><br />And there are online stores for blank plastic. Here are some pictures from one:<br /><br /><img border="1" src="http://www.f-secure.com/weblog/archives/imagine_cards_1.png" alt="cards"><br /><br />Above: Collection of "blank" Visa and Master Card cards.<br /><br /><br /><img border="2" src="http://www.f-secure.com/weblog/archives/imagine_cards_2.png" alt="cards"><br /><br />Above: Gold embossing demo. Still missing the hologram sticker.<br /><br /><br /><img border="3" src="http://www.f-secure.com/weblog/archives/imagine_cards_3.png" alt="cards"><br /><br />Above: Finished product. <B>Notice the card holder's name...</b><br /><br />PS. Also see our post about <a href="http://www.f-secure.com/weblog/archives/00001651.html">credit card holograms</a>. <p>On 18/03/10 At 03:42 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001909.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com <img border="0" src="http://www.f-secure.com/weblog/archives/stock_trade.png" alt="Online stock trading companies" title="Online stock trading companies"><br /><br />Buying and selling stock online is big business. It also carries it's own risks. And we don't mean the risk of doing bad investments; we mean loosing access to your trading account because your computer got infected by a keylogger.<br /><br />Take a case of Mr. <b>Valery Maltsev</b> from St. Petersburg.<br /><br />Maltsev runs an investment company called <b>Broco Investments</b> (available online at www.brocompany.com).<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/broco.png" alt="Broco Investments"><br /><br />Unfortunately (to him), Maltsev was yesterday <b>charged</b> by US Securities & Exchange commission.<br /><br />They claim that Maltsev's extraordinary gains in thinly traded <b>NASDAQ </b>and <b>NYSE</b> stocks were not a co-incidence. Apparently Maltsev used malware with keyloggers to gain access to other people's online trading accounts. With such accounts, he could buy stocks at inflated prices, and use his real account to sell the same stock, for instant gains.<br /><br />Quoting from the SEC Complaint:<br /><br /><i>On December 21,2009, at <b>13:37</b>, BroCo bought shares of <b>Ameriserv Financial, Inc</b> (<a href="http://www.google.com/finance?client=ob&q=NASDAQ:ASRV">ASRV</a>) at a price of $1.51 per share. Approximately one minute later, three accounts at Scottrade were illegally accessed and used to purchase shares of ASRV at prices ranging from $1.545 to $1.828 per share. While this was happening, BroCo sold shares of ASRV at prices ranging from $1.70 to $1.80 per share, finishing at <b>13:52</b>. By trading shares of ASRV within minutes of unauthorized trading through the compromised accounts, Maltsev and BroCo grossed $141,500 in approximately <b>fifteen minutes</b>, realizing a <b>net profit of $17,760</b>. </i><br /><br />Here's the stock chart for Ameriserv Financial. You can clearly see the unusually high trading levels on December 21st.<br /><br /><a href="http://www.google.com/finance?client=ob&q=NASDAQ:ASRV"><img border="0" src="http://www.f-secure.com/weblog/archives/asrv_stock.png" alt="Ameriserv Financial, Inc "> </a><br /><br />SEC claims that overall, Maltsev made more than <b>$250,000</b>. More details in the original <a href="http://www.sec.gov/litigation/complaints/2010/comp21452.pdf">SEC Complaint</a> (PDF file)<br /><br />And this is not the first time we've seen this. There was a very similar case in 2006, where Mr. <B>Jevgeny Gashichev</B> was running a fake Estonian company called <b>Grand Logistics</b><br /><br /><img border="1" src="http://www.f-secure.com/weblog/archives/grand_logistics.png" alt="Grand Logistics"><br /><br />His tactic was almost identical: he used keyloggers and phishing attacks to gain access to stock trading passwords, inflated the price of a penny stocks and cashed in.<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/aripaev_grand_logistics.png" alt="Aripaev"><br /><br />SEC claims that Gashichev made more than <b>$350,000</b>. Again, more details in the original <a href="http://www.sec.gov/litigation/complaints/2006/comp19949.pdf">SEC Complaint</a> (PDF file) <p>On 17/03/10 At 01:50 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001908.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Over the years, we have multiple times posted examples of what kind of booby-trapped document files have been used in targeted (espionage) attacks.<br /><br />For example:<br /><br /><ul><li><a href="http://www.f-secure.com/weblog/archives/00001672.html">Targeted examples</a><br /><li><a href="http://www.f-secure.com/weblog/archives/00001735.html">New set of bait files</a><br /><li><a href="http://www.f-secure.com/weblog/archives/00001688.html">H1N1 Themed Targeted Attack</a><br /><li><a href="http://www.f-secure.com/weblog/archives/00001862.html">Intelligence Sector Hit by a Targeted Attack</a><br /><li><a href="http://www.f-secure.com/weblog/archives/00001406.html">Targeted Malware Attacks Against Pro-Tibet Groups</a><br /><li><a href="http://www.f-secure.com/weblog/archives/00001859.html">On-going Targeted Attacks Against US Military Contractors</a></ul><br /><br />However, we've rarely shown <b>how these documents were delivered to the targeted</b>, i.e. <b>what the emails looked like</b>.<br /><br />For that kind of information, we can recommend you to visit a blog called <a href="http://contagiodump.blogspot.com/">Contagio Malware Dump</a>.<br /><br />This blog, run by Mila & co analyses targeted attacks in detail, typically showing the original spoofed emails that started the attacks.<br /><br />Some good examples below — some of them are quite convincing. Would you have opened the PDFs?<br /><br /><img width="759" height="469" border="1" src="http://www.f-secure.com/weblog/archives/contagio_targeted_attack_email_1.png" alt="contagio malware dump"><br /><br /><img width="690" height="634" border="1" src="http://www.f-secure.com/weblog/archives/contagio_targeted_attack_email_2.png" alt="contagio malware dump"><br /><br /><img width="627" height="624" border="1" src="http://www.f-secure.com/weblog/archives/contagio_targeted_attack_email_3.png" alt="contagio malware dump"><br /><br />More at: <a href="http://contagiodump.blogspot.com/">contagiodump.blogspot.com</a> <p>On 16/03/10 At 02:56 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001907.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com An Estonian virus writer has been sentenced to jail in Harju, Estonia.<br /><br />The author of the <a href="http://www.f-secure.com/v-descs/allaple_a.shtml">Allaple</a> virus family, 44-year old Mr. <b>Artur Boiko</b> pleaded not guilty.<br /><br />Nevertheless, he was found guilty and sentenced to <b>2 years and 7 months</b> in prison.<br /><br />Allaple is a complex worm using polymorphic encryption. It spreads over network shares and by modifying local HTML files. When such HTML files are uploaded to public websites, they spread the infection further.<br /><br />Apparently Mr. Boiko had been in a car accident and had ended up in dispute over his insurance claim with <a href="http://www.if-insurance.com">If Insurance</a>. As a result, his worm launches DDoS attacks against these sites:<br /><br />    www.if.ee             (website of the insurance company)<br />    www.online.if.ee    (customer online interface of the insurance company)<br />    www.starman.ee    (website of a local ISP)<br /><br />The DDoS attacks were quite serious — see <a href="http://isc.sans.org/diary.html?storyid=2451">this post</a> from ISC Diary in 2007.<br /><br />We detected several variants of Allaple during 2006-2007. The problem is that this is not a botnet — these worms have no command and control channel. The infected machines will attack their targets until they are cleaned. There are still thousands of active, infected computers today around the world, and they are still attacking. And the worm is still spreading further.<br /><br /><img width="494" height="338" border="1" src="http://www.f-secure.com/weblog/archives/allaple.png" alt="Snapshot from F-Secure interface showing new samples on 11th of March 2010"><br /><i>Snapshot from F-Secure interface showing new samples on 11th of March 2010</i><br /><br />Boiko was sentenced to prison, where he has already been awaiting his trial for 19 months. He was also sentenced to pay the following sums to cover losses:<br /><br />To <b>If Insurance</b>: <b>5.1 Million</b> Estonian Kroons (about <b>330000</b> Euros or <b>450000</b> USD)<br />To <b>Starman</b> ISP: <b>1.4 Million</b> Estonian Kroons (about <b>91000</b> Euros or <b>130000</b> USD)<br /><br />More info (in Estonian) from <a href="http://uudised.err.ee/index.php?06196827">ERR Uudised</a> <p>On 11/03/10 At 11:20 AM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001906.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com F-Secure has an additional blog that launched today. It's called <a href="http://safeandsavvy.f-secure.com/">Safe and Savvy</a>.<br /><br /><img width="260" height="85" border="0" src="http://www.f-secure.com/weblog/archives/Safe_and_Savvy.png" alt="Safe and Savvy" /><br /><br />You'll notice that the name is pink. That's part of our new brand but it also reflects the authorship. Safe and Savvy's contributors are the female employees of F-Secure (mostly).<br /><br />Hetta, Marja, Annika, Alia, Melody-Jane, (and Jason) have already gotten started.<br /><br />Read more of <a href="http://safeandsavvy.f-secure.com/2010/03/09/get-savvy-and-get-free-internet-security/">Hetta's latest post</a> to learn about six free months of our Internet Security 2010.<br /><br /><br /><br /><br /><br /><hr> <p>On 10/03/10 At 05:29 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001905.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com I wasn't sure I'd see <a href="http://support.microsoft.com/kb/976002">this Browser Choice update</a>:<br /><br /><img width="610" height="195" border="0" src="http://www.f-secure.com/weblog/archives/KB976002.png" alt="KB976002" /><br /><br />I set my computer's Regional Options for the United States even though it's physically located in Finland (I'm an American after all).<br /><br />Regional settings might trump my IP address, I thought… but it seems not. I manually ran Microsoft Update and was provided access to KB976002. Cool.<br /><br />If you're located outside of Europe and are wondering what's this is all about, <a href="http://news.bbc.co.uk/2/hi/8524019.stm">read this</a> from the BBC.<br /><br />Microsoft is offering alternative browser options to European Windows users to settle an anti-trust lawsuit. The update component points users to <a href="http://www.browserchoice.eu/">browserchoice.eu</a> — from where they can select from 12 different web browsers.<br /><br />On a somewhat not completely unrelated note: Microsoft Security Advisory (<a href="http://www.microsoft.com/technet/security/advisory/981374.mspx">981374</a>) was published yesterday.<br /><br />"Microsoft is investigating new, public reports of a vulnerability in Internet Explorer 6 and Internet Explorer 7."<br /><br />The vulnerability could allow for remote code execution.<br /><br />Once again, that browser choice link is <a href="http://www.browserchoice.eu/">browserchoice.eu</a>. Share it with your family and friends.<br /><br />Signing off,<br />Sean<br /><br /><br /><br /><br /><br /><hr> <p>On 10/03/10 At 05:00 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001904.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com ATM skimmers are installed like this:<br /><br /><img width="736" height="516" border="1" src="http://www.f-secure.com/weblog/archives/skimmer-install.gif" alt="Skimmer install"><br /><br />Video source: <a href="http://www.spiegel.de/netzwelt/web/0,1518,682345,00.html">Spiegel.de</a> & German Federal Criminal Office (Bundeskriminalamt) <p>On 10/03/10 At 12:06 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001903.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Microsoft schedules <a href="http://www.microsoft.com/technet/security/bulletin/ms10-mar.mspx">its security updates</a> on the second Tuesday of the month. Adobe recently began following this schedule as well, and while there are no Adobe updates today, there was an <a href="http://www.adobe.com/support/security/bulletins/apsb10-07.html">out-of-cycle security update</a> two weeks ago.<br /><br />That update should now be applied if you haven't already done so.<br /><br />Why?<br /><br />Because we're now seeing the vulnerability (CVE-2010-0188) being exploited in targeted attacks (<a href="http://blogs.technet.com/mmpc/archive/2010/03/08/cve-2010-0188-patched-adobe-reader-vulnerability-is-actively-exploited-in-the-wild.aspx">Microsoft also</a>).<br /><br />Our sample was submitted by a European financial organization and the file name includes a reference to the <a href="http://en.wikipedia.org/wiki/G-20_major_economies">G20</a>. The exploit drops a downloader and attempts to make a connection to tiantian.ninth.biz. We detect this attack as Exploit:W32/PDFExploit.G.<br /><br />It doesn't surprise us to see this Adobe Reader vulnerability utilized so quickly.<br /><br />Looking through our sample management system, we see a growing number of targeted attack files.<br /><br />There were <a href="http://www.f-secure.com/weblog/archives/00001676.html">1968 files in 2008</a>. The number was 2195 during the year 2009. That isn't a very large increase in the overall total from 2008 to 2009 but we did see a greater percentage targeting Adobe.<br /><br />And how about the first two months of 2010?<br /><br />Well, so far the number is 895, which will more than double last year's number if the current pace continues.<br /><br />The percentage targeting Adobe Reader continues to rise.<br /><br />Here's a graph with a breakdown of the most common attack vectors used in targeted (espionage) attacks:<br /><br /><img width="650" height="475" border="0" src="http://www.f-secure.com/weblog/archives/targeted-attacks-2008-2009-2010.png" alt="Targeted attacks 2008, 2009, 2010 (Jan/Feb)" /><br /><br /><b>Updated to add</b>: A couple of readers noticed that our graph's 2009 percentages were slightly off — it's been corrected. <p>On 09/03/10 At 03:30 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001902.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com As "<a href="http://www.f-secure.com/weblog/archives/00001857.html">JiLsi</a>" — one of the online criminals from <a href="http://www.f-secure.com/weblog/archives/00001679.html">Darkmarket</a> — was sentenced last week to almost five years in prison, we have received some media queries on the case.<br /><br />In particular, one journalist wanted to know what <b>JiLsi</b> (aka Renu Subramaniam), <b>Matrix001</b> (aka Markus Kellerer) and <b>Cha0</b> (aka Çağatay Evyapan) looked like when they were posting to the Darkmarket forum.<br /><br />So I went back to my notes and dug up example posts from the guys, complete with their avatar icons. Perhaps these are interesting for our blog readers too.<br /><br /><img width="698" height="572" border="1" src="http://www.f-secure.com/weblog/archives/darkmarket_matrix001.png" alt="Darkmarket matrix001"><br /><br /><img width="668" height="222" border="1" src="http://www.f-secure.com/weblog/archives/darkmarket_JiLsi.png" alt="Darkmarket JiLsi"><br /><br /><img width="666" height="238" border="1" src="http://www.f-secure.com/weblog/archives/darkmarket_cha0.png" alt="Darkmarket cha0"><br /><br /><img width="650" height="606" border="1" src="http://www.f-secure.com/weblog/archives/darkmarket_matrix002.png" alt="Darkmarket matrix"><br /><br />Cheers,<br />Mikko <p>On 08/03/10 At 11:19 AM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001901.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Somebody is trying to pose as us. If you see an email like the one below, please ignore it:<br /><br /><font face="Courier"><b>     From: security@f-secure.com<br />     Reply-To: securitysupport@hotxf.com<br />     Subject: Security Maintenance.F-Secure HTK4S<br />     Date: Fri, 5 Mar 2010 18:11:05 -0000<br />     To: undisclosed-recipients:;<br />     <br />     Dear Email Subscriber, <br />     <br />     Your e-mail account needs to be improved with our new <br />     F-Secure HTK4S anti-virus/anti-spam 2010-version. <br />     Fill in the columns below or your account will be <br />     temporarily excluded from our services. <br />     <br />     E-mail Address:<br />     Password:<br />     Phone Number:<br />     <br />     Please note that your password is encrypted <br />     with 1024-bit RSA keys for increased security. <br />     <br />     Management. <br />     <br />     Copyright 2009. All Rights Reserved.</b></font><br /><br />Before you ask: No, we've never heard of "F-Secure HTK4S anti-virus" either.<br /><br /><br /><br /><br /><br /><hr> <p>On 05/03/10 At 10:26 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001900.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Just when we thought <a href="http://www.f-secure.com/weblog/archives/00001899.html">SEO using Flash</a> was as interesting as SEO poisoning can get, it seems it's getting even sneakier…<br /><br />Imagine a PDF file posted by someone evil online. Of course, Google being Google, the file is recognized as a PDF.<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/joe_corvo_3hrsago.PNG" alt="Joe Corvo" height="294" width="700" /><br /><br />And when we open it, it really is a PDF. No evil codes inside, just a good old vanilla PDF file.<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/joe_corvo_pdf.PNG" alt="Joe Corvo PDF" height="457" width="553" /><br /><br />Three hours later… Google still says the file is a PDF. Brod (one of our geeky guys here) is attributing this to Google's cache.<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/joe_corvo_3hrslater.PNG" alt="Joe Corvo, 3hrs later" height="101" width="541" /><br /><br />But is it really a PDF this time around?<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/joe_corvo_html.PNG" alt="Joe Corvo HTML" height="711" width="476" /><br /><br />It morphed! And it even has different topics this time. Topics which, when you follow them, will lead you to another PDF:<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/jaypolhill_pdf.PNG" alt="Jay Polhill PDF" height="710" width="496" /><br /><br />At least for a few hours before it becomes…<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/jaypolhill_html.PNG" alt="Jay Polhill HTML" height="525" width="496" /><br /><br />It's a vicious cycle, but a pretty neat trick. Who would suspect a non-malicious PDF file right? At least before it becomes an HTML file. And the end result is a rogue antivirus scam.<br /><br />Response post by — Christine and Mina <p>On 05/03/10 At 07:00 AM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001899.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Another day, another news, and well… another SEO poisoning stint.<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/pdf_google.PNG" alt="PDF Google" height="404" width="611" /><br /><br />Using PDF files in SEO poisoning is recent, but not exactly fresh news. So we were thinking of just adding the malicious URLs to our Browsing Protection and creating detections for the corresponding files… Then, we saw something:<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/isitpossibletobehappy_swf.PNG" alt="isitpossibletobehappy swf" height="66" width="624" /><br /><br />Ok, could be a one time thing, so we checked the other sites:<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/olympiccoverage_swf.PNG" alt="olympiccoverage swf" height="82" width="623" /><br /><br />And in the usual geeky fashion in the lab… we got excited.<br /><br />When decompressed, the SWF contains this:<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/swf_code.PNG" alt="swf code" height="69" width="622" /><br /><br />Since a lot of websites use SWF, most users have already installed Flash support in their browsers, thereby also enabling support for the malware behavior.<br /><br />The SWF is of course the key to getting to:<br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/pdf_scandownload.PNG" alt="pdf scandownload" height="373" width="700" /><br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/pdf_secantidownload.PNG" alt="pdf security antivirus download" height="284" width="558" /><br /><br /><img border="0" src="http://www.f-secure.com/weblog/archives/pdf_roguescan.PNG" alt="pdf rogue scan" height="509" width="700" /><br /><br />It seems that the bad guys want the malicious URLs to be hidden inside the SWF.<br /><br />Perhaps it makes them sleep better at night thinking that their sites won't be discovered very soon.<br /><br />The malicious URLs are now blocked via our Browsing Protection and malicious files are detected.<br /><br />Response post by — Christine and Mina <p>On 04/03/10 At 10:06 AM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z tag:www.f-secure.com,2010-03-21:%2Fweblog%2Farchives%2F00001898.html F-Secure Antivirus Research Team weblog\@PLEASE-REMOVE-THIS.f-secure.com Remember Microsoft's <a href="http://www.f-secure.com/weblog/archives/00001892.html">action against 277 Waledac domains</a> last week? Well, that's one way of going after a botnet…<br /><br />Another way of shutting down a botnet? Arrest the botmasters!<br /><br />Three Spanish citizens have been arrested for running the "Mariposa" botnet. The three reportedly have no criminal records and have limited hacking skills. Mariposa is a Butterfly Kit based botnet, and the kit is no longer for sale.<br /><br />Details are available from the <a href="http://news.bbc.co.uk/2/hi/technology/8547453.stm">BBC</a> and <a href="http://www.theregister.co.uk/2010/03/03/mariposa_botnet_bust_analysis/">The Register</a>. Kudos to those involved in the arrests. <p>On 03/03/10 At 04:43 PM</p> 2010-03-21T13:41:54Z 2010-03-21T13:41:54Z XML::Atom::SimpleFeed 2010-03-21T13:41:54Z Weblog of F-Secure Antivirus Research Team