Zero-day: Number 1 search Engine Attack via Internet Explorer

Everyone is talking about China because of Google's decision to reevaluate its business operations due to its attack to their systems as one of te primary reasons.
It has been reported that the said attack distinctively targets Gmail accounts of Chinese human rights advocates in the United States, Europe and China.

Other search engines have similar report cases such as Yahoo! Dow Chemicals, and Northrop Grumman.

Security researches found thattargeted attcks use several vectors. In some cases, email messages loaded with malicious file attachments were sent to users. An exploit code taking advantage of the recently-patched vulnerability in Adobe Reader and Acrobat (CVE-2009-4324) was used to drop malware on affected systems.

Some of the attack's use of previous undetected vulnerabilty of Internet Explorer except 5.01 (CVE-2010-0249). In its recent Security Advisory, Microsoft acknowledged that this bug was indeed used to launch attacks against Google and other organizations, and recommended several workaround solutions to help reduce the impact of this bug on IE users.

In some recent work-around, I guess we could try using other web browser like Firefox. So I recommend update your browser or aplications with its latest patch. As I could see most of the malware now attack users which are not yet patch.

Virus Payload

1. Installation: How the malware is able to setup itself on the system to be able to run properly

2. Propagation: An act of malware to replicate for the purpose of spreading across different computers

3. Payload: Any malicious activity being done by the malware aside from installation and propagation

Know the Basic about Malware

Before anything else we need to know the basic about malware. As my trainer said, as malware now is so complex and vey hard to detect, clean or to remove we still have to know the basic about malware so we could easily learn the best aproach how to deal with it.

Malware is malicious software or computer program that performs malicious activities

Types of Malware

1. Virus
- Infect files
- Executable codes / programs
- Inserted into another executable code / program
Examples
- Boot virus
- Binary file infectors
- Multipartite viruses
- Macro viruses
- Script viruses

2. Worm
- A form of malware that creates a copy of itself and then sends itself over the network to infect other systems
- Methods of worm propagation
Email
Internet Relay Chat (IRC)
Instant Messaging (IM) Applications
Peer-to-Peer File Sharing Applications
Network Shares
Vulnerability Exploits

3. Trojan

- A Trojan Horse is malware that does not have the capability to spread or propagate.
- Trojan Horse malware cannot propagate by themselves because they do not have the mechanism to send their own copy to another computer
- It gets into a users machine by riding on a third-party application that is trusted by the user
- The user is unaware that the system is infected

These are just the basic types of malware. I will share more information as we go with our journey in having a free malware world. Which I hope is possible.