We are monitoring Internet threat landscape for outbreaks of Koobface and other malware

What are the popular ways that spammers have leveraged on social
networking sites to target victims?

Spammers have leveraged social networking sites in many ways to send spam.
One of the popular methods is fake invitations which usually contains a link
that redirects to the user to spam website. This vector targets all users,
regardless of whether they have an account or not. Other popular methods being
sending spoofed 'Merge account' notification, fake photo tag/comment messages,
third party applications, and delivering notifications to spread malware. In one
example, spammers sent messages prompting users to download a social networks
toolbar, which was actually a Trojan.

Has Symantec come across any new techniques used by cyber criminals
targeting social networking site users?

Symantec, recently, witnessed an instance of botmasters tweeting their
commands to zombie computers, through smartphones. Symantec has detected a new
Trojan botnet creator tool, called "TwitterNet Builder." The threat, called
Trojan. Twebot, uses a Twitter account to issue instructions to the Trojans
created by the builder. When building Trojan. Twebot, the user is able to supply
a public Twitter account for Trojan. Twebot to follow. Because Trojan. Twebot
does not try to obfuscate commands on Twitter, it will not be difficult for
security staff to find and close accounts abusing their service in this way.
Cyber criminals are also leveraging social networking sites to drop Trojans into
unsuspecting users' systems. For example, spam e-mails such as the one on the
left have been doing the rounds on the Internet hoping to lure recipients into
downloading a Facebook toolbar.

What are the new things that cyber criminals look at when attacking users
other than passwords or email addresses?

Apart from passwords and e-mail IDs, cyber criminals could be looking at
tricking users into revealing their credit card information with tempting offers
— ranging from discounted goods to attractive job options. They could also look
at fooling victims into parting with their money to purchase
counterfeit/ineffective products. Since social networking sites are trusted
environments, they have also become a playground for cyber criminals to carry
out social engineering attacks. More and more, attackers are going directly
after the end user and attempting to trick them into downloading malware or
divulging sensitive information under the auspice that they are doing something
perfectly innocent.

A year has passed since Koobface was first detected; yet it's still
active. What is Symantec doing in this regard?

The Koobface worm infects users by using social engineering attacks. It
spreads by abusing social networking websites or by employing search engine
optimization techniques to lure potential victims to malicious sites. Symantec's
security products are designed to remove malware such as Koobface by disabling
system restore (Windows Me/XP), updating virus definitions, running a full
system scan and deleting any values added to the registry.

The company is also constantly monitoring Internet threat landscape for
outbreaks of Koobface and other malware through Global Intelligence Network,
which includes researchers throughout the world collecting information about
online fraud, malicious code and security risks, analyzing them to figure out
how they work, and then developing real time updates to Symantec products that
protect computers at homes and in workplaces around the world.

What are the simple steps a user can take to check a malicious mail?

One of the ways to check malicious mail is to unsubscribe from legitimate
mailings that you no longer want to receive. When signing up to receive mail,
verify what additional items you are opting for at the same time. Deselect items
that you do not want to receive. Further, one should avoid publishing e-mail
address on the Internet and delete all spams regularly. One should avoid
clicking on suspicious links in e-mails or IMs as these may be links to spoofed
websites.

When visiting a website it is better to type the Web addresses directly into
the browser rather than relying upon links within messages.

Sharath Kumar

Source: CIOL