Exploits, and Russians and Brazilians, Oh My!

Hi folks,

Well, it's been an interesting day today. Firstly, a public exploit has been published for this months VML vulnerability. Microsoft patched it on January 9, and the public version came out on January 16th. Pretty quick, really. Fortunately, this version doesn't work all the time on English/ US versions of XP, but we should assume that all the Bad Guys are anxiously trying to fix that right at this moment. Last September's VML exploit is pretty much a standard part of the major web exploit gang's reportoires. Naturally, we've released a signature for it, so LinkScanner users have little to fear.

And not only that, but just yesterday the boys over at WebSense noticed that, arguably for the first time, Brazilian hackers were using using exploits, notably WebAttcker, to install their banking trojans. Up until now, they mostly just tried to trick people into installing the trojan, and the use of WebAttacker was a significant escalation.

The second interesting event for the day is that today we have another example of Russians teaming up with Brazilians to use exploits to install banking trojans. This time it's the venerable MS06-014, which still seems to work great on people who do their banking at work (because corporates don't patch very often).

The scam works like this ... first they set up a bogus greeting card site on something like geocities in Brazil, and simply send out a fake greeting card. The victim clicks the card and is taken to the fake site. If they're not patched ... voila... they have some new programs, downloaded from somewhere in Russia, installed for free. MS06-014 is not really that important, but it means the Brazilian Carders are really investigating using exploits and vulnerabilities. It's another escalation.

Keep safe,

Roger