November 05, 2007 - Current Activity

Possible Faults in Mac OS X Leopard Application-Based Firewall

US-CERT is aware of reports of possible flaws in the Application-Based Firewall in Mac OS X Leopard. According to these reports, users may be misinformed of the status of their firewall rule set, thus placing users with listening network services at an increased risk.

Users are urged to exercise caution when relying on the firewall rules for access control.

US-CERT will provide additional information as it becomes available.

Mac DNS Changer Trojan

US-CERT is aware of a Mac DNS changer Trojan. If executed, this Trojan will change the DNS settings of a user's machine and then report back to a command and control server. The Trojan appears as a DMG archive file which, if downloaded and installed, will run the Trojan on a user's system.

More information regarding this Trojan can be found in the SANS Internet Storm Center.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Federal Trade Commission Spoofed Email

US-CERT is aware of fraudulent email messages purporting to be from the Federal Trade Commission's (FTC) "Fraud Department".  These messages refer to a complaint filed against the email's recipient and appear to be from "frauddep@ftc.gov". The email messages contain a link to malicious software and should not be followed. Please see the Federal Trade Commission website for additional information.

More information can also be found in the US-CERT Cyber Security Alert SA07-303A.

US-CERT encourages users to take the following preventative measures to help mitigate this risk:

• Do not follow unsolicited links in email messages.
• Install anti-virus software, and keep its virus signature files up-to-date.
• Review the Reducing Spam Cyber Security Tip.
• Review the Avoiding Social Engineering and Phishing Attacks Cyber Security Tip.

Active Exploitation of Microsoft Windows URI Protocol Handling Vulnerability

Microsoft has released a revision to Microsoft Security Advisory (943521), which was previously reported by US-CERT in the Microsoft Windows URI Protocol Handling Vulnerability Current Activity. This revision states that because of an active exploitation the severity rating has been increased.

More information regarding this vulnerability can be found in the following:

• Vulnerability Note VU#403150
• Microsoft Security Advisory
• MSRC Blog
  

New Storm Worm Variant Disables Security Software

US-CERT is aware of a new Storm Worm variant. Functionality in this variant can cause certain types of programs, including anti-virus and network access control programs, to appear as if they are functioning correctly, though the process(es) have been disabled by the worm.

More information can be found in the eWEEK Security News and Sophos Security Information Blog.

US-CERT urges users and administrators to take the following preventative measures to mitigate the security risks:

• Install anti-virus software, and keep its virus signature files up-to-date.
• Block executable and unknown file types at the email gateway.
• Refer to the Recognizing and Avoiding Email Scams document for more information on avoiding email scams.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.
  

California Wildfires Spawn Phishing Sites

US-CERT has received reports of multiple phishing sites that attempt to trick users into donating funds to fraudulent foundations in the aftermath of the California Wildfires. US-CERT warns users to expect an increase in targeted phishing emails due to the recent events in California.

Phishing emails may appear as requests from a charitable organization asking the users to click on a link that will then take them to a fraudulent site that appears to be a legitimate charity. The users are then asked to provide personal information that can further expose them to future compromises.

Users are encouraged to take the following measures to protect themselves from this type of phishing attack:

1. Do not follow unsolicited web links received in email messages.
2. Contact your financial institution immediately if you believe your account/and or financial information has been compromised.

Active Exploitation of Vulnerabilities in Adobe Acrobat and Adobe Reader

US-CERT is aware of active exploitation of a previously reported vulnerability in Adobe Acrobat, Adobe Reader, and other Adobe PDF products. Adobe has released an update and provided a workaround to address this vulnerability.

US-CERT encourages users to apply the update or workaround as soon as possible to mitigate this risk.

More information is available in the Adobe Security Advisory APSB07-18.