November 28, 2007 - Current Activity

Search Engines Results Linking to Malicious Web Sites

US-CERT is aware of public reports of popular search engines returning results with links to malicious web sites. The reports suggest that attackers have utilized methods to increase the ranking of their web sites to facilitate these attacks.

More information regarding this can be found in the SANS Internet Storm Center.

US-CERT recommends the following to help mitigate the impact of these attacks:

• Do not follow search results that link to unknown or questionable web sites.
  
• Install anti-virus software, and keep its virus signature files up-to-date.
• Maintain patches and updates for your operating system.
  

Vulnerability in Apple QuickTime

US-CERT is aware of publicly available exploit code for a vulnerability in Apple QuickTime.  This vulnerability may allow an attacker to execute arbitrary code or cause a denial-of-service condition on an affected system.

US-CERT encourages users and administrators to follow mitigation strategies in the Vulnerability Notes Database and consider following the best security practices found in the Securing Your Web Browser document.   

iFrame Attack Affects Monster.com

US-CERT is aware of an iFrame attack that affected Monster.com, causing it to take down a portion of its web site yesterday. Attackers embedded malicious iFrames that redirected users to another web site that when visited, could download and install malware on the user's system.

Monster.com has sanitized its web site and restored the portions of the site it had taken down. Monster.com believes that only a very small percentage of those visiting during this time were potentially infected. In addition, Monster.com has stated that users running Windows with the most recent updates applied were not affected.

US-CERT urges users and administrators to take the following preventative measures to help mitigate the security risks:

• Configure your web browser as described in the Securing Your Web Browser document.
• Install anti-virus software, and keep its virus signature files up-to-date.
• Install latest versions of software to ensure that is is up-to-date
  

Department of Justice Fraudulent Spam Email Variant

US-CERT is aware of reports of a variant of spam e-mail messages claiming to be from the Department of Justice (DOJ), previously reported in "Justice Depart Warns Public of Fraudulent Spam Email." These messages contain a malicious attachment that supposedly contains information regarding complaints filed against the recipient's company with the DOJ. The attachment launches malware on the user's system when opened.

To help protect against this type of attack, US-CERT recommends that users never open attachments from unsolicited email messages. More information on how to safely utilize email attachments can be found in the US-CERT "Using Caution with Email Attachments" Cyber Security Tip.

Trojan Spreading via MSN Messenger

US-CERT is aware of reports of a Trojan spreading via MSN Messenger.  The Trojan arrives as a chat message that appears to contain an image file, that when opened, downloads and installs a Internet Relay Chat Bot. These messages may appear to come from a known contact.

US-CERT urges users and administrators to take the following preventative measures to help mitigate the security risks:

• Install anti-virus software, and keep virus signature files up-to-date.
• Refer to the Avoiding Social Engineering and Phishing Attacks document for more information on social engineering attacks.

Mac OS X Leopard Firewall Changes

Apple's Mac OS X Leopard includes an application-based firewall feature. US-CERT is aware of ambiguities in the way the firewall components supplied with Leopard report the status of the firewall configuration. Users may be misinformed of the status of their firewall rule set, thus placing listening network services at an increased risk.

Apple has published Mac OS X v10.5.1 Update to address this issue.  US-CERT encourages users to apply this update to mitigate this risk.

Apple Releases Security Updates to Address Multiple Vulnerabilities

Apple has released Mac OS X 10.4.11 and Security Update 2007-008 to address multiple vulnerabilities.  These vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, or access the system with escalated privileges.

More information regarding the vulnerabilities and remediation information can be found in:

• Technical Cyber Security Alert TA-07-319A
• Vulnerability Notes Database
• Apple Support Article ID: 307041