AplusWebMaster
Topic Starter
FYI…
- http://isc.sans.org/diary.html?storyid=4177
Last Updated: 2008-03-21 17:08:39 UTC …(Version: 2) - "There is lots of media coverage on the protests in Tibet. Something that lies under the surface, and rarely gets a blip in the press, are the various targeted cyber attacks that have been taking place against these various communities recently. These attacks are not limited to various Tibetan NGOs and support groups. They have been reported dating back to 2002, and even somewhat before that, and have affected several other communities, including Falun Gong and the Uyghurs. The attacks generally start with a very trustworthy looking e-mail, being spoofed as originating from a known contact, to someone within a community. In some cases, messages have also been distributed to mailing lists. These messages however contain malicious attachments. These are either:
* CHM Help files with embedded objects;
* Acrobat Reader PDF exploits;
* Microsoft Office exploits;
* LHA files exploiting vulnerabilities in WinRAR;
* Exploitation of an ActiveX component through an attached HTML file.
… Anti virus is generally -not- proving effective against the samples distributed in this ongoing attack. We often see similar samples returning, only to have been edited slightly to prevent them from being picked up. Most of the time, the samples then drop very raw trojans that are not restricted much in ability. This means that just investigating the trojan does not always reveal the target data. When investigating such attack, it's actually necessary to find out which commands were submitted to discover what data was actually targeted So far, we have seen attacks that specifically searched the file system for Word documents, e-mail contents and, most interestingly PGP keyrings…"
- http://isc.sans.org/diary.html?storyid=4177
Last Updated: 2008-03-21 17:08:39 UTC …(Version: 2) - "There is lots of media coverage on the protests in Tibet. Something that lies under the surface, and rarely gets a blip in the press, are the various targeted cyber attacks that have been taking place against these various communities recently. These attacks are not limited to various Tibetan NGOs and support groups. They have been reported dating back to 2002, and even somewhat before that, and have affected several other communities, including Falun Gong and the Uyghurs. The attacks generally start with a very trustworthy looking e-mail, being spoofed as originating from a known contact, to someone within a community. In some cases, messages have also been distributed to mailing lists. These messages however contain malicious attachments. These are either:
* CHM Help files with embedded objects;
* Acrobat Reader PDF exploits;
* Microsoft Office exploits;
* LHA files exploiting vulnerabilities in WinRAR;
* Exploitation of an ActiveX component through an attached HTML file.
… Anti virus is generally -not- proving effective against the samples distributed in this ongoing attack. We often see similar samples returning, only to have been edited slightly to prevent them from being picked up. Most of the time, the samples then drop very raw trojans that are not restricted much in ability. This means that just investigating the trojan does not always reveal the target data. When investigating such attack, it's actually necessary to find out which commands were submitted to discover what data was actually targeted So far, we have seen attacks that specifically searched the file system for Word documents, e-mail contents and, most interestingly PGP keyrings…"