Kindsight Blog

As many of us do, before blindly purging Spam folders, you scan for senders that may have been dumped there inadvertently by the Spam filters. Other than a larger amount of emails that are unreadable for a number of reasons, you don’t notice anything unusual.

But wait, what’s this email from the New York State Department of Transportation - “I am in arrears and that I should follow the embedded link to resolve issues.” Since you were in New York State just weeks before, you pause but click on the link in the email anyway.

DO NOT FOLLOW THESE NEXT STEPS. They are for illustration only.

Thankfully, anti-virus software, in this case AVG, was running and up-to-date on the test laptop because…

Wham-o! The Blackhole Exploit. This email is not from the New York State Department but it’s a phishing attack and AVG detected and blocked the malware.

But what would happen if anti-virus software is not running?

Last year we looked into our crystal ball to make some predictions for 2011, including mobile devices and Macs becoming the target of malware and the expansion of banking trojans. All of these came true so we are going to put our perfect record on the line and make some new predictions for 2012.

While mobile malware grew substantially in 2011, most of the attacks lacked sophistication and the ability to make money for the cybercriminals. We see these mobile attacks evolving considerably in 2012, especially for the Android platform.

We also saw the takedown of DNSChanger in 2011 but believe that this is only the tip of the iceberg and expect even more and stealthier botnets in 2012 while also seeing a more coordinated effort to try and stop the growing botnet issue.

The recent takedown of the DNSChanger botnet was easily the biggest to date. This botnet consisted of over four million infected computers worldwide with half a million in North America alone and generated over $14 million in fraudulent Internet advertising revenue over the past 5 years.

With this attack, the configuration of infected computers had been modified by malware to point to rogue DNS servers, now under the control of the FBI. The irony is that although the DNSChanger threat has been neutralized, Internet access for the infected computers will be disrupted when the rogue DNS servers are decommissioned in March and millions of angry users will be calling the help desk to ask what went wrong with their Internet connection. This has left many Internet service providers with a bit of a conundrum.

The AdMob advertising system by Google allows mobile app developers to monetize their applications through targeted advertising. As part of the ongoing research by Kindsight Security Labs, we wondered if the techniques used by malware authors to insert their malicious code into legitimate apps could be used to hijack this interface and steal ad revenue from the original app developers. Our tests have proven this to be true.