They are usually installed on victim's computers using drive-by-download techniques, as well as using the typical social engineering stuff we see to distribute any kind of malware through spam. We see this kind of spam on a daily basis, some samples are the usual spam message with a link to a supposed greeting card, others come with a trojan downloader that if run will download & install the rogueware, anothers are links to websites with photos or videos that will ask you to install some fake codecs (rogueware) to see them:

But today we have found an even more smart way to fool users. At first I though it was the typical message flowing around to get valid e-mail addresses:

Once you click on the link it takes you this place:

When clicking on "Download" the user will find out that it was not as free as he could have thought:

Of course the rogueware is not free; in fact it is not at all, as you pay and obtain nothing in exchange. Taking a look at the URL, I've notice that it has the word "antivirus2" in it. Then I removed the "2" and that's what I've obtained: 

Of course it belongs to a diiferent scam from the same guys.

When the lab began looking into the specific effects cybercriminals had on the economy during times of duress, we found a startling and unexpected connection: the criminal economy is closely interrelated with our own economy. Based on our extensive research and analysis of malware patterns, we believe criminal organizations are closely watching market performance and adapting to ensure maximum profit: activity appears to increase during times of fluctuation in the markets and the economy.

Between Sept. 1st and Oct. 9th, as the stock market values continued to drop, the threat activity continually increased: activity on the “malware market” grew substantially as the stock markets declined.

This appears to be a deliberate strategy to infect as many consumers as possible during heightened economic fear as a way of changing the odds in their favor to maximize profits. A notable example is the recent orange alert PandaLabs issued earlier this month: 30 million victims were infected with fake security software, and of those infected 3.5 percent paid out of fear of loss from identity theft due to the compelling pop-ups informing that the computer was severely infected.

Heightened fear during economics crises plays into cybercrime strategies: as the Dow looses significant value, the perception of economic instability leads to more victims succumbing to fake AV software. Essentially out of fear of loosing everything the victim pays. This strategy is working very well as it plays into the lack of confidence in the markets. When timed right it works very well in terms of generating mass revenue ($14 million USD per month) in a short period of time..

Figure 1 shows the general decline of market indicators (average of DJIA, NASDAQ, and S&P 500) for a period of one and a half months with correlating significant spikes in new malware detections.

Figure 2 narrows the range to between Sept. 8 and Sept. 16. The indexes dropped 3.0% on Sept. 9 while malware increased to over 24,000 new threats: over 100% increase from previous day. Sept. 16 saw more than 5.5% decline in value while malware threats climbed to over 31,000 new intances.

Figure # 1 – U.S. stock market vs. malware market 9/1/08 – 10/9/08

Figure # 2 – U.S. stock market vs. malware market 9/8/08 – 9/16/08

As evidenced by this compelling data, there will be no end to the persistence and pervasiveness of cybercriminals and their attempts at exploiting malware for financial gain. Regardless of the economic state we are in, cybercriminals are continually adjusting their strategies, and from this evidence are capitalizing on economic lows to prey on unsuspecting victims and enterprises. With continued analysis, we have a deeper understanding of the relationship between the economy and the evolution of cybercrime. By remaining vigilant and aware of these findings, we can all become better prepared to protect ourselves and the economy from the very real dangers of malware.

EtherPad is a collaborative, real-time text editor created by, among others, two ex-Google employees*. An EtherPad document is quickly set up without any need for registration. You can then share the URL of the document, and others who will visit that page will then be able to see, in real-time, whatever you’re typing**. This has an interesting feel to it because there’s no “security buffer” as in typical chat programs: every letter you write will be shown as you write it, including occasional errors before you fix them.

[Edit: I removed the link to the document now, but you can start your own EtherPad of course...] Please join this EtherPad to give it a try (note your IP will show to others). [Update: I’m told EtherPad allows only 8 users maximum at a time. Thanks Guruz, Rossisen and Kirby!]

Yesterday, EtherPad was temporarily down every now and then, but otherwise quite interesting to use. I only tried it for basic chat, but the creators list use cases like meeting notes, teleconferencing, drafting and editing prose, and phone interviews for developers applying for a job. The EtherPad creators write, “With EtherPad, anyone in a meeting can contribute to the notes, or watch them as they’re typed.” They also say, “For phone calls in general, EtherPad serves as both a communication channel and a shared record”.

But wait, doesn’t Google Docs already offer this functionality? The EtherPad makers think the answer is no:

<<Google Docs is a suite of products that do many things, from word processing to spreadsheets to document management. One thing that Google Docs does not do is real-time collaborative text editing. We think this is an important use case, so we built EtherPad with real-time collaboration as the focus.

For example, with Google Docs it takes about 5 to 15 seconds for a change to make its way from your keyboard to other people’s screens. Imagine if whiteboards or telephones had this kind of delay! In contrast, the EtherPad infrastructure is built to carry your every keystroke at the speed of light, limited only by the time it takes electrons to travel over a wire (such as an “ethernet” cable).>>

Also, the creators say, Google Docs doesn’t allow easy URL-based sharing of document that also can be edited, doesn’t allow undo for someone else’s changes, and won’t colorize edits by someone else. However, Google Spreadsheets, part of the Google Docs suite, does show colored cell borders (only during the time of editing, though), and it also has a document setting that allows anyone to edit without signing in, like for this document. Simlar to EtherPad, Google Spreadsheets also has a chat box next to the spreadsheet.

The company behind this product is called Appjet Inc., and EtherPad is built on top of the AppJet platform. The creators say, “We originally released AppJet as the easiest way to get a new web app online and hosted, starting with print("Hello world!"), and it has since expanded to support simple database-backed web apps. Over 2,500 apps have been built to date using the AppJet site.”

*David Greenspan, Aaron Iba, and J.D. Zamfirescu, the latter two previously at Google.

**Perhaps made possible due to the technique of Comet/ long-polling.

[Via Friendfeed/ TechCrunch.]

[By Philipp Lenssen | Origin: EtherPad | Comments]

[Advertisement] Want to advertise here? Your ad will show in the blog and feed. ]]>