An investigation by Kaspersky Lab has revealed that Russian media sites using the AdFox teaser system on their pages unwittingly infected visitors to their sites.
A simple teaser of Internet news headlines was the launch-pad for a unique malware attack, with cybercriminals creating malicious code which operated without creating files on the infected system. Experts from Kaspersky Lab uncovered the hidden attack, which exploited a vulnerability in the teasers used by a number of popular Russian news sources – and warn that similar attacks could be used to target users outside of Russia.
The investigation by Kaspersky Lab shows that Russian media websites using the AdFox teaser system on their pages unwittingly infected visitors to their pages. While downloading the news teaser, the user’s browser was secretly redirected to a malicious website containing a Java-exploit. However, unlike standard drive by-attacks, the malicious program was not loaded to the hard drive, but appeared only in the operating memory of the computer, making it much more complicated to track it down using anti-virus solutions.
Acting as a bot, the malware was sending requests and information about the user’s browsing history to a control server. If that data included any sign of using e-banking services, the cybercriminals installed the banking Trojan Lurk to steal confidential user information required to access the online banking systems of a number of major Russian banks.
The investigation has shown, however, that the AdFox network itself was not the source of the infection. News banners were modified by adding links to the malicious website code via the hacked account of an AdFox client. Modifying the code in the teaser system allowed cybercriminals to attack not only visitors to a single news site but also to other resources using the same system. As a result, tens of thousands of potential victims may have been attacked.
“We are dealing with a unique attack. A teaser network used by cybercriminals is one of the most effective ways to install a malicious code, as many popular resources contain links to it,” says Aleksander Gostev, Kaspersky Lab’s Chief Security Expert. “Moreover, for the first time in recent years, we faced a rare type of malware – the so-called ‘bodiless’ malware which does not exist as a file on the drive but appears in the operating memory of the infected machine, making its detection much more complicated. This incident was targeting Russian users. The same exploit and bodiless bot may well be used against users in other countries as they can be distributed via similar foreign banner and teaser networks. At the same time it’s highly probable that not only Lurk Trojan, but also other malware, is used for these purposes”.
Despite such programs being able to operate only until the operating system is restarted, it is quite likely that the user will return to the infected news site again. Kaspersky Lab’s experts warn that the only reliable protection is the timely installation of updates. In this case, to remove the CVE-2011-3544 Java vulnerability, we recommend installing the Oracle patch – which can be downloaded at http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html.
The detailed results of the investigation by Kaspersky Lab experts are available at www.securelist.com.
* Follow Gadget on Twitter on @gadgetza
Telcos want one face
The investments that telecommunications service providers are making in reshaping their online properties into customer-centric portals reflects the growing maturity of self-service and Internet uptake in the industry, says KEVIN MELTZER of Consology.
Many telcos around the world are overhauling their websites to offer customers more holistic portals that give them a single point of entry into the organisation.
They are doing so because they recognise that service will be a key point of differentiation for their businesses in a market that is becoming increasingly competitive. They have also realised that they have a major opportunity to shift customers away from expensive contact centres towards low-cost electronic channels.
In the past, most telecommunications operators ran multiple sites across multiple domains and subdomains. These web-based properties were built around the way that telcos structured their own businesses rather than around the needs of the customer. But we are now seeing the leading operators take a more user-centric approach to the way that they design their web and mobile sites.
This coincides with a change in the industry from slicing customers into numerous segments and then serving them across a range of functional and product areas. For example, many operators split customers into prepaid and postpaid segments or voice and data users, distinctions that are becoming less meaningful in a world of technology convergence. They now want to present a single face to the customer rather than servicing the subscriber through silos.
These changes are starting to percolate through to operators’ customer service and sales strategies. Telcos are starting to pull together disparate products and services that once resided across multiple sites into customer service portals.
These sites put a wide range of information at the subscriber’s fingertips, he adds. Increasingly, for example, subscribers can log directly into their accounts from the operator’s homepage and then access a wealth of services and information. This marks an evolution from the fractured and inconsistent customer experience of the past.
Leading operators are even thinking about how their Self-Service platforms should be integrated with social media strategies to allow customers to pay their electronic bills or top up airtime with a single click from within a social network.
Whereas Self-Service portals on telco sites were once purely about account management functions, they increasingly offer far richer functionality. In addition to allowing subscribers to pay their bills and check their account information, they are also increasingly becoming the first stop for service and commerce.
Operators have started to recognise that splintering their e-commerce, service and account management functions simply makes no sense. Customers want to be able to do everything through one interface rather than needing to visit two or three Web sites, or eventually possibly needing to phone a call centre or visit a store for certain transactions.
Integrated and easy to use online customer service channels will be central for telco operators who want to be competitive in the markets of tomorrow. They form an advantage in an industry where it will be customer relationships rather than cost or service that drive loyalty and purchasing decisions.
Talk for less with MWEB Talk
Today, MWEB announced its consumer VoIP package called MWEB Talk, which allows users to make free network calls and get discounted rates made to landlines and mobile phones.
MWEB, today launched its new Voice over IP (VoIP) offering to South African consumers. The service, MWEB Talk, will offer users’ free on network calls to fellow MWEB Talk users’ and cheap calls to landline and mobile phone numbers. This follows the success and demand of the ISP’s existing VoIP products in recent months.
‚”We have seen a noticeable transformation in users’ Internet behaviour with consumers wanting services that complement their ADSL connectivity solution. We have seen phenomenal growth and by the end of the year will deliver over 100 million minutes on our VoIP platform,‚” says Carolyn Holgate, General Manager of MWEB Connect, the ISP’s Consumer and Small Office/ Home Office Division.
MWEB has made significant investments in its infrastructure and VoIP has been prioritised on its network to ensure performance and stability of the MWEB Talk service for both businesses and consumers.
‚”In addition to the high quality of the service, MWEB Talk is also simple to set-up and users’ should experience a significant reduction in their telephone bills. By implementing a VoIP service consumers and small businesses can cut their monthly telecommunication bills by up to 55% to landline and mobile numbers,‚” says Holgate.
With no subscription fee, existing MWEB customers can log into their MWEB account, register for the service and download the application for PC and Mac as well as mobile applications that turn an iPhone, Android, and Nokia smartphone into a VoIP phone. Customers will also be able to purchase a Desktop VoIP Handset for R99 which will be HD voice ready and will support multi-extensions.
‚”We believe that VoIP is the future of telephony in South Africa and we are extremely excited to see the consumer market shift into the VoIP space,‚” concludes Holgate.