madison

Zero Day

Ryan Naraine and Dancho Danchev

Malicious Japan quake spam leads to scareware

By | March 18, 2011, 6:51am PDT

Summary: M86 Security and Kaspersky Lab are reporting on a currently ongoing Japan quake themed spam campaign which leads to scareware and client-side exploits.

M86 Security and Kaspersky Lab are reporting on a currently ongoing Japan quake themed spam campaign which leads to scareware and client-side exploits. Spammed using the Cutwail/Pushdo botnet, the campaign is using an event-based social engineering theme in order to trick users into clicking on the malicious links.

Upon clicking on the link the user is exposed to client-side vulnerabilities, ultimately dropping a scareware variant.

Millions of users continuing to clicking on links in spam emails.

Meanwhile, users are advised to browse the Web in a sandboxed environment, using least privilege accounts, NoScript for Firefox, and ensuring that they are free of client-side exploitable flaws.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, malware and cybercrime incident response.

Disclosure

Dancho Danchev

More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile.

Biography

Dancho Danchev

Dancho Danchev is an independent security consultant and cyber threats analyst, with extensive experience in open source intelligence gathering, and cybercrime incident response. He's been an active security blogger since 2007, and maintains a popular security blog sharing real-time threats intelligence data with the rest of the community on a daily basis. More details on Dancho Danchev's current and past professional affiliations, can be found in his LinkedIn profile. You can also follow him on Twitter

Talkback Most Recent of 14 Talkback(s)

  • RE: Malicious Japan quake spam leads to scareware
    Is this a Windows only problem?

    Thanks in advance for your answer.

    PS. I think in the future it would help to state the affected OS.
    ZDNet Gravatar
    Return_of_the_jedi
    18th Mar
  • Decency?
    @Return_of_the_jedi

    Is this a Windows only problem?

    Transparent attempt to turn this into an OS war. Is there any topic that you will not use for your petty "my OS is better than yours" peddling?
    ZDNet Gravatar
    honeymonster
    18th Mar
  • RE: Malicious Japan quake spam leads to scareware
    @honeymonster

    Obviously you don't have/know the answer.

    Thanks for nothing, just like the article.
    ZDNet Gravatar
    Return_of_the_jedi
    19th Mar
  • RE: Malicious Japan quake spam leads to scareware
    @Return_of_the_jedi
    Clicking on the links we get VBS scripts, Active X ,Trojan-Downloader.VBS.Small.iz, sounds Windowish.

    Mac and Linux users left out again.
    ZDNet Gravatar
    Chipesh
    20th Mar
  • RE:Decency?
    >>>Transparent attempt to turn this into an OS war. Is there any topic that you will not use for your petty "my OS is better than yours" peddling?

    While that may be his intent, it is a reasonable question. This is a tech forum, and little things like which OS is affected would be good to know.
    ZDNet Gravatar
    richdave
    18th Mar
  • RE: Malicious Japan quake spam leads to scareware
    And so it goes on. Scum like this ply their evil, trying to prey on decent people's concerns regarding the tragedy that is unfolding in Japan. Wicked
    ZDNet Gravatar
    bumble4657@...
    18th Mar
  • ZDNet Gravatar
    Just True
    18th Mar
  • There are more important things about this quake than talking of spam...
    What is common between this Japan quake; the US, Russian, Chinese HAARP and illegal export of Plutonium?

    To make it short - if you'll analyze how the reactor has been blown, you'll find that they were aware that the reactor was overheating. Even if the water system was damaged by the earthquake (that is unlikely - it should be manmade), anyway - THEY intentionally did not cool down the reactor by the sea water before it was too late to prevent.

    If you will search the internet you'll find that at the time of the catastrophe people discovered the signatures of using HAARP stations in the US, Russia and China--SIMULTANEOUSLY.

    What is common between those who made these orders in different countries (presidents, ...)? All of them belong to those, who named THEMSELVES as the "chosens" = THEY are one team, that fools the people that THEY are on the opposite sides.

    It means that this earthquake (and not only this) was planned to be used as an excuse to blow up the reactor. THEY thought that all mankind will blame Nature, but not the real reason - the "chosens" in power and their plan to eliminate more than 6 billion people (read THEIR memo on the Georgia Guidestones).

    Why do THEY need to damage the reactor(s)?

    Watch what Japanise officials told regarding the future of the nucleate fuel - they will utilize it = it will disappear.

    It means that THEY planed this catastrophe because THEY needed to steal this nucleate fuel. In this case, it should be stolen before the catastrophe. That explains why radioactive pollution is not near that bad as the Chernobyl one.

    For what? Obviously not for powering another nuclear plant. So, the only one logical reason - to sell it to a country for making secret nucleate bombs - in this case no one will look for the missing Japanese Plutonium = people won't be alerted about... It means that top-rank Japanese officials are a part of the crime.

    How these bombs will be used? Apparently to initiate the Third World War and because THEY plan all THEIR events according to the Mayan calendar, THEY will start the WWIII at December 21, 2012. When this (or these) patcy-country will use these nuclear bombs and will fake their origin - it will be an excuse for the "chosens" to eliminate the entire human kind by the will of humankind.

    How? The "chosens," who currently are in power in all developed countries, will help each other to exterminate nations, which THEY officially have to protect as presidents, etc. THEY already built for THEMSELVES underground cities and believe that after WWIII THEY will replace the mankind with remotely managed bio-robots (implanted former humans).

    Thus, the main question is - what people have to do with: to go as the sheep to THEIR slaughterhouse, or what?

    For example, should you buy THEIR goods in order to make these non-humanoid species, like Bill Gates, Rothchilds, Rockefellers, ... reacher and encourage THEM to kill you faster, or it's better to go with the OSS = take away some power from THEM?

    Decide - are you a sheep or human? If you believe you are a human, then act accordingly...

    P.S. Did you notice that there were no reports regarding abnormal animal activity as it should be days before any NATURAL earthquake? HAARP-made feature?
    ZDNet Gravatar
    Just True
    18th Mar
  • RE: Malicious Japan quake spam leads to scareware
    @Just True
    Excuse me sir, I do believe you dropped your left testicle.
    ZDNet Gravatar
    Yiu Korochko
    21st Mar
  • RE: Malicious Japan quake spam leads to scareware
    @Just True Oh my god!! Thank you for pointing that out to me.

    That is 2 minutes of my life I will never get back, were you dropped on your head a lot when you were a baby?
    ZDNet Gravatar
    Parassassin
    21st Mar
  • There are more important things about this quake than talking of spam...
    Spam issues is not suitable to compare with the issue on the disaster that had happened in Japan. Incidents like the meltdown in Japan at the nuclear power plant can trigger paranoia about nuclear power. The nuclear industry in The United States, however, isn't likely to boom anytime soon as a result of fallout over the incidents in Japan in the court of public opinion, and also due to Congressional spending budget slashes. Nuclear energy, though, is able to generate more power at lower cost than other methods, and putting the industry on ice would be a real shame.
    ZDNet Gravatar
    marzian12
    22nd Mar
  • RE: Malicious Japan quake spam leads to scareware
    Just True, i'm sorry but if you truly believe that your a idiot, it wasn't the earthquake that killed the generators, it was also the millions of gallons of sea water that destroyed access roads delaying the workers to get to the plant to activate the pumps. As I understand several of the generators had to be serviced from flood damage and the batt backup expired before they could get them running again, or hooked back to the grid to run the pumps. It was the 1-2 punch of the largest earthquake in recent history, AND the most destructive Tsunami ever that caused the reactor disaster, not a conspiracy.
    ZDNet Gravatar
    raptorep@...
    22nd Mar
  • RE: Malicious Japan quake spam leads to scareware
    Well done! Thank you very much for professional templates and community edition
    sesli chat sesli sohbet
    ZDNet Gravatar
    talih
    12th Aug
  • Sad...
    Yeah, this is a bummer. Glad the M86 Security people are staying on top of stuff like this.
    ZDNet Gravatar
    willy1000
    22nd Sep

Talkback - Tell Us What You Think

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
Click Here

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources