Am I ashamed of myself? Not at all. I’d prefer to offer protection against a growing threat to personal and business security than to bury my head in the sand and defend my stance with wild accusation.
 
Your post very much accuses security vendors of FUD, sowing Fear, Uncertainty and Doubt. I hope I have demonstrated that is very much not the case. Maybe your outburst was more a case of MUD? Myopic Unalloyed Denial.
 

used by permission from flattop341 Flickr photostream

Trend Micro and the FBI are very pleased to announce today the dismantling of a criminal botnet, in what is the biggest cybercriminal takedown in history.
 
This concerted action against an entrenched criminal gang is highly significant and represents the biggest cybercriminal takedown in history. Six people have been arrested through multinational law enforcement cooperation based on solid intelligence supplied by Trend Micro and other industry partners. more than 4 million victims in over 100 countries have been rescued from the malign influence of this botnet and an infrastructure of over 100 criminal servers has been dismantled with minimal disruption to the innocent victims.
 
If you are worried that you might have been a victim of this criminal activity, the FBI have made an online tool available which will allow you to check if your DNS server settings have been tampered with.
 
First you will need to discover what your current DNS server settings are:
 
On a PC, open the Start menu by clicking the Start button or the Windows icon in the lower left of your screen, in the  Search box type “cmd” and hit return (for Windows 95 users, select “Start“, then “Run“).This should open a black window with white text. In this window type “ipconfig /all” and hit return. Look for the entry that reads “DNS Servers” and note down the numeric addresses that are listed there.
 
On a Mac (yes they can be victims too), click on the Apple icon in the top left of your screen and select “System Preferences“, from the Preferences panel select the “Network” icon. Once this window opens, select the currently active network connection on the left column and over on the right select the DNS tab. note down the addresses of the DNS servers that your computer is configured to use.
 
You can check to see if these addresses correspond to servers used by the criminals behind Operation Ghost Click by using this online tool provided by the FBI, simply enter the IP addreses, one by one and click the “check ip” button.
 
If you feel that you computer may have been infected, you can visit Trend Micro’s HouseCall for a free scan and clean-up and notify the FBI by submitting this form. You should also contact your Internet Service Provider for advice on restoring your legitimate DNS settings.
 
Ongoing updates on this threat can be found on our Operation Ghost Click landing page.
 

 
The history of mobile malware begins back in 2004 with the appearance of Cabir, the forerunner of many later variants. Cabir was aimed at infecting Symbian based devices, it first emerged as a proof-of-concept but was rapidly picked up and abused by those with criminal intent. Cabir made money by sending premium rate SMS messages from infected devices. This means of turning a profit turned out to be so effective that by 2009 SMS fraud Trojans made up a large bulk of mobile malware and that trend has continued and grown with the rise of the smartphone. In fact, the first ever Trojan for Android based devices was also an SMS fraud trojan, known as ANDROIDOS_DROIDSMS.A
 
Malware exists for all major mobile platforms in fact, renowned mobile securtity researcher Charlie Miller announced yesterday that he had devised a way to embed functionality in apps for Apple’s iPhone which allowed them to download and run code after the intial application had been installed. His proof of concept app had been checked by Apple and was available in the App Store since September.
 
If you are interested in finding out more about the history of mobile malware you can download my paper on that very subject right here.
 
The TrendLabs mobile threats information hub can be found here.
 

Tweet from the New York Times after they fell victim to criminal ads

  
Web site owners use trusted content networks to provide advertisements for their websites, and criminals are actively targeting this trust relationship as it represents a weak link in the chain of content control. Criminals create shell companies to place advertisements that hide malicious content in ads that are subsequently placed with high profile advertising networks. These malvertisements are then syndicated across many hundreds of web sites silently infecting as many victims as possible, as these examples illustrate.
  
Malvertisments, as they are referred to, have become increasingly common over the past few years and continue to be a growing problem. The potential number of victims available to criminals through a syndicated ad will often far outstrips the potential return for compromising an individual website. Internet users are unknowingly putting themselves at risk when they visit legitimate websites, which happen to be carrying malvertisements, designed to invisibly and automatically infect them through drive-by downloads. A drive-by download usually involves a chain of events; the victim visits a website which in this case is carrying a malvertisement, the malvertisement will contain content (most often JavaScript or Adobe Flash) which will be automatically executed by the browser. The purpose of the JavaScript is to automatically and invisible redirect the browser to a server hosting exploits (commonly a criminal exploit kit such as Yes!, Eleonore or Phoenix for example) these exploits are then used to push out the final malicious payload of the criminal’s choosing. In some cases exploits for technologies such as Adobe Flash are embedded directly within the malvertisements and this has the same end result of delivering a malicious payload. Once infected, your PC is compromised or your virtual wallet lifted in a number of ways; from pushing fake security software which attempts to fool the you into believing that your PC is infected with any number of entirely bogus malware which only this (paid-for) application can remove, to criminals stealing your personal or financial details and/or obtaining remote access to your PC.
  
So where does the responsibility lie? Is it with the web site that is hosting the malicious adverts, the network distributing them, or the consumer who visits the website? Really the responsibility, as well as the potential for damage, is shared. Web site owners and ad-networks alike suffer embarrassing brand damage when their customers are infected and the victim of course suffers the pain of information or identity theft and financial loss.
  
It is certainly true to say that if the right checks and balances were in place the problem would largely cease to exist, at least on legitimate websites. Clients of ad-networks should be applying pressure to their provider of choice to ensure that the appropriate checks are made before the advert goes out. Ideally, automated systems need to be in place at the advertising content providers, to run the ads through a sandbox before they are released into the public domain, checking for any kind of active or malicious code. Third party providers should perform specific checks to verify URLs and detect any unexpected or unwanted behaviour such as automated redirections, even if not malicious no web user wants to be bounced off to a third party website simply as a result of rendering an ad in their browser and no website owner would want their visitors stolen in this way either!
  
In the meantime, Internauts should ensure that they have the appropriate anti-malware software installed on their PC to minimise the risk. Free options include tools such as Browser Guard, which blocks exploit attempts and detects malicious JavaScript, stopping it from executing. When choosing anti-malware software, it’s important not to focus purely on software that will scan for bad files, but also that will stop PCs (and not just browsers) from connecting to malicious destinations.
 

used with permission from Anonymous9000 under creative commons

  
On the eve of an EU summit set to discuss the ongoing military action in Libya, the European nuclear program and the debt crisis, key systems have been shut down and warning issued to staff as a result of what a spokesperson called “a serious cyber attack“.
  
Details on the nature, extent and consequences of the attack are currently very few but the timing and targeting are highly reminiscent of the attack against the French finance ministry two weeks ago which reportedly targeted information relating to the G20 summit.
  
A spokesperson for the European Commission stated that the commission is often “targeted” by cyber attacks, but that the extent of this one was far larger than those more regular events. Staff have been asked to change their passwords, external access to email and to the Commission’s intranet was temporarily suspended, in order to “prevent the disclosure of unauthorised information”. EUObserver reports having seen an internal mail that warned all staff
 

“We have found evidence that both the commission and EEAS [European External Action Service] are the subject of an ongoing widespread cyber attack.“

  
According to the AFP report, EU spokesperson Antony Gravili blamed the attack on malware, “rather than any attempt to unearth secret documents relating to summit issues”. Given the nature of contemporary attacks on commercial and government institutions, in reality it’s very difficult to draw the line between those two eventualities. Malware is simply one of the tools in the criminal and international espionage bag of tricks and making such a clear distinction before a thorough investigation has been completed may be counter-productive to say the least.
  
International cyber-espionage and criminal theft of information for commercial advantage has been going on for several years now but only really caught the public imagination with the furore surrounding the Aurora attacks in 2009/2010. Since that time, the mood for public disclosure of these attacks has rapidly changed and may contribute somewhat to the impression that they are increasing in frequency.
  
Nevertheless, Aurora, Night Dragon, Stuxnet and the attacks on the G20 and EU summits graphically illustrate the new reality. Cyberespionage, just like cybercrime is more simple to perpetrate, more difficult to spot and  carries much less risk than the more traditional methods. This is the new front line.
 

Image from MJ/TR Flickr under Creative Commons

“I’m the developer of the original Guitar Solo Lite. I noticed the rogue app a bit more than a week ago (I was receiving crash reports sent from the pirated version of the app). I notified Google about this through all the channels I could think of: DCMA notice, malicious app reporting, Android Market Help…they have yet to respond. Thankfully this was posted on Reddit, since after the post the rogue dev and all his apps have been removed from the market. There really should be a faster/easier way to get Google to act on it!”

 
Trend Micro detect this threat (popularly known as DroidDream) as ANDROIDOS_LOTOOR.A, further details in the link.
 
During the five days these apps were available an estimated 50,000 downloads have taken place. Google have now pulled the apps and blocked the rogue developer from Android marketplace, they have also remotely removed the apps from affected handsets. Of course this remote kill switch will not remove any other code that may have been dropped onto the device as a result of the initial infection. So if you are one of the estimated 50,000 people who have downloaded these malicious apps it could be worth your while investigating the possibility of getting a replacement handset or reinstalling the operating system on the one you have if possible.
 
The Android app ecosystem is by definition open, there is a wide array of app stores available and apps can be published to the user community in minutes. This greater openness of the developer environment has been argued to foster an atmosphere of creativity, but as Facebook have already discovered it is also a very attractive criminal playground.
 
It is worth remembering that full security suites are now available for Google Android, such as this one. The number of threats to mobile platforms is growing and growing at a steady rate. Of course the sheer volume of mobile malware  is a long way from the epidemic proportions of Windows based malware, but criminal interest is clearly there and growing. We see multi-platform attacks distributed by the same criminal groups that traditionally have focused on Wintel systems, and the growth in complexity of threats, for example ZeuS malware now incorporating mobile elements aimed at intercepting SMS banking authentication codes is striking. Criminals are driven by consumer behaviour and as the money-making opportunities move to mobile platforms criminals will, in fact already are, following.
 
A full list of the trojanised apps, published by Myournet, is:

• Falling Down
• Super Guitar Solo
• Super History Eraser
• Photo Editor
• Super Ringtone Maker
• Super Sex Positions
• Hot Sexy Videos
• Chess
• 下坠滚球_Falldown
• Hilton Sex Sound
• Screaming Sexy Japanese Girls
• Falling Ball Dodge
• Scientific Calculator
• Dice Roller
• 躲避弹球
• Advanced Currency Converter
• App Uninstaller
• 几何战机_PewPew
• Funny Paint
• Spider Man
• 蜘蛛侠

 
The Guardian have published an expanded list of apps believed to be trojanised in this way here.