Scribd Logo
Upload

Welcome to Scribd!

  • 40 views

    Swef

    Uploaded by

    Andrew Andres
    Tinba is a Trojan malware that was originally discovered in 2012 infecting thousands of Turkish computers. It has since undergone revisions making it harder to detect. Tinba is a modified version of ZeuS Trojan but is smaller in size at just 20KB, which also makes it harder to detect. Tinba infects websites, lures victims via phishing emails and fraudulent ads, and replicates itself on vulnerable systems in hidden folders. It can modify browsers to disable warnings and allows HTTP content on HTTPS sites without prompts. Tinba encrypts its communications and has local config files to maintain availability when disconnected from command and control servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Swef

    Uploaded by

    Andrew Andres
    40 views7 pages
    Tinba is a Trojan malware that was originally discovered in 2012 infecting thousands of Turkish computers. It has since undergone revisions making it harder to detect. Tinba is a modified version of ZeuS Trojan but is smaller in size at just 20KB, which also makes it harder to detect. Tinba infects websites, lures victims via phishing emails and fraudulent ads, and replicates itself on vulnerable systems in hidden folders. It can modify browsers to disable warnings and allows HTTP content on HTTPS sites without prompts. Tinba encrypts its communications and has local config files to maintain availability when disconnected from command and control servers.

    Original Description:

    deserve

    Original Title

    swef

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Tinba is a Trojan malware that was originally discovered in 2012 infecting thousands of Turkish computers. It has since undergone revisions making it harder to detect. Tinba is a modified version of ZeuS Trojan but is smaller in size at just 20KB, which also makes it harder to detect. Tinba infects websites, lures victims via phishing emails and fraudulent ads, and replicates itself on vulnerable systems in hidden folders. It can modify browsers to disable warnings and allows HTTP content on HTTPS sites without prompts. Tinba encrypts its communications and has local config files to maintain availability when disconnected from command and control servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    40 views7 pages

    Swef

    Uploaded by

    Andrew Andres
    Tinba is a Trojan malware that was originally discovered in 2012 infecting thousands of Turkish computers. It has since undergone revisions making it harder to detect. Tinba is a modified version of ZeuS Trojan but is smaller in size at just 20KB, which also makes it harder to detect. Tinba infects websites, lures victims via phishing emails and fraudulent ads, and replicates itself on vulnerable systems in hidden folders. It can modify browsers to disable warnings and allows HTTP content on HTTPS sites without prompts. Tinba encrypts its communications and has local config files to maintain availability when disconnected from command and control servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    of 7

    First discovered in 2012, the 

    Trojan initially infected thousands of Turkish computers. Once it


    was discovered, the original source code for the malware was leaked online and has since
    undergone various revisions, making it much more difficult for financial institutions to detect.
    Tinba is a modified version of ZeuS Trojan, which used a similar attack mechanism, but the main
    difference is that Tinba is much smaller in size. Smaller malware is much harder to detect. Tinba
    is the smallest known Trojan at just 20KB.

    Infected websites can distribute Tiny Banker, with victims lured via phishing emails and
    fraudulent advertising content. When a vulnerable system runs Tinba, it replicates it under
    the name bin.exe to the %AppData% folder.
    Various versions of Tinba ended up in different folders—variants created folders with randomly
    generated names based on information about the infected system. Tinba encrypts its memory
    usage to avoid detection.
    When an infected system restarts, bin.exe runs and Tiny Banker persists on the computer.
    Tinba can modify web browsers such as Explorer and Firefox, disabling warning messages and
    enabling HTTP content to be displayed on HTTPS websites without prompts. Tiny Banker targets
    processes such as explorer.exe and svchost.exe on Windows, as well as other running
    processes.
    TBT encrypts its communications with command and control servers and
    maintains availability by using four C&C domains. It has local config files it can use when
    unable to connect to a server.

    4. SHLAYER VIRUS- Shlayer is a trojan-type virus designed to proliferate various


    adware/potentially unwanted applications (PUAs) and promote fake search engines. It is
    typically disguised as a Adobe Flash Player installer and various software cracking tools.
    In most cases, users encounter this virus when visiting dubious Torrent websites that are full of
    intrusive advertisements and deceptive downloads. Using Torrent and other deceptive sites
    as a malware distribution channel is very common amongst cyber criminals. These
    people present viruses as legitimate software, thereby tricking users into running
    malicious executables. Shlayer is one of these viruses and is designed to promote
    adware, unwanted applications, and fake search engines.
    Shlayer typically promotes the following products: Chumsearch Safari web browser
    extension (which assigns certain browser settings to chumsearch.com and prevents
    users from reverting these
    changes); MyShopCoupon and mediaDownloader adware; Advanced Mac
    Cleaner, Mac Cleanup Pro, and; MyMacUpdater unwanted applications.
    As with the Chumsearch extension, Shlayer is also designed to assign installed
    browsers (these viruses usually target Safari, Google Chrome, and Mozilla Firefox) new
    tab URL, default search engine, and homepage options to
    chumsearch.com, weknow.ac, or search-operator.com.

    5. KLEZ VIRUS -  is a computer worm that propagates via e-mail. It first appeared in


    October 2001. A number of variants of the worm exist.
    Klez infects Microsoft Windows systems, exploiting a vulnerability in Internet
    Explorer's Trident layout engine, used by both Microsoft Outlook and Outlook Express to
    render HTML mail.
    The e-mail through which the worm spreads always includes a text portion and one or more
    attachments. The text portion consists of either an HTML internal frame tag which causes buggy
    e-mail clients to automatically execute the worm, or a few lines of text that attempt to induce
    the recipient to execute the worm by opening the attachment (sometimes by claiming that the
    attachment is a patch from Microsoft; sometimes by claiming that the attachment is an
    antidote for the Klez worm). The first attachment is always the worm, whose internals vary.
    Once the worm is executed, either automatically by the buggy HTML engine or manually by a
    user, it searches for addresses to send itself to. When it sends itself out, it may attach a file
    from the infected machine, leading to possible privacy breaches.
    Later variants of the worm would use a false From address, picking an e-mail address at random
    from the infected machine's Outlook or Outlook Express address book, making it impossible for
    casual observers to determine which machine is infected, and making it difficult for experts to
    determine anything more than the infected machine's Internet Service Provider.
    SOME GUIDELINES TO SECURING THE DEVICES AND DATA

    1. Encrypt your data

    Data encryption isn't just for technology geeks; modern tools make it possible for anyone
    to encrypt emails and other information. "Encryption used to be the sole province of geeks and
    mathematicians, but a lot has changed in recent years. In particular, various publicly available
    tools have taken the rocket science out of encrypting (and decrypting) email and files. GPG for
    Mail, for example, is an open source plug-in for the Apple Mail program that makes it easy to
    encrypt, decrypt, sign and verify emails using the OpenPGP standard. And for protecting files,
    newer versions of Apple's OS X operating system come with FileVault, a program that encrypts
    the hard drive of a computer. Those running Microsoft Windows have a similar program. This
    software will scramble your data, but won't protect you from government authorities
    demanding your encryption key under the Regulation of Investigatory Powers Act (2000), which
    is why some aficionados recommend TrueCrypt, a program with some very interesting
    facilities," explains John Naughton in an article for The Guardian. Twitter: @guardian

    2. Backup your data


    One of the most basic, yet often overlooked, data protection tips is backing up your data.
    Basically, this creates a duplicate copy of your data so that if a device is lost, stolen, or
    compromised, you don't also lose your important information. As the U.S. Chamber of
    Commerce and insurance company Nationwide points out, "According to Nationwide, 68% of
    small businesses don’t have a disaster recovery plan. The problem with this is the longer it
    takes you to restore your data, the more money you’ll lose. Gartner found that this downtime
    can cost companies as much as $300,000 an hour." Twitter: @growwithco

    3. Make your old computers' hard drives unreadable


    Much information can be gleaned through old computing devices, but you can protect your
    personal data by making hard drives unreadable before disposing of them. "Make old
    computers’ hard-drives unreadable. After you back up your data and transfer the files
    elsewhere, you should sanitize by disk shredding, magnetically cleaning the disk, or using
    software to wipe the disk clean. Destroy old computer disks and backup tapes," according to
    the Florida Office of the Attorney General. Twitter: @AGPamBondi

    4. Secure your wireless network at your home or business


    A valuable tip for both small business owners and individuals or families, it's always
    recommended to secure your wireless network with a password. This prevents unauthorized
    individuals within proximity to hijack your wireless network. Even if they're merely attempting
    to get free Wi-Fi access, you don't want to inadvertently share private information with other
    people who are using your network without permission. "If you have a Wi-Fi network for your
    workplace, make sure it is secure, encrypted, and hidden. To hide your Wi-Fi network, set up
    your wireless access point or router so it does not broadcast the network name, known as the
    Service Set Identifier (SSID). Password protect access to the router," says FCC.gov in an article
    offering data protection tips for small businesses. Twitter: @FCC

    5. Use a firewall
    "Firewalls assist in blocking dangerous programs, viruses or spyware before they
    infiltrate your system. Various software companies offer firewall protection, but hardware-
    based firewalls, like those frequently built into network routers, provide a better level of
    security," says Geek Squad. Twitter: @GeekSquad

    6. Consciously check and configure app privacy settings

    Most apps offer privacy settings for users, enabling you to determine how much and
    what types of information are shared or stored. Always choose the least amount of data-
    sharing possible. Casey Chin from Wired explains, "You probably spend a lot of your day inside
    apps: catching up on the news, playing music and movies, keeping in touch with friends, racing
    cartoon characters around a track, and so on. Every once in a while though, it's worth running
    an audit on these apps to make sure they're not overreaching and going beyond their remit—
    collecting more data about you and controlling more of your devices than you'd like."
    Twitter: @WIRED

    7. Enable remote location and device-wiping

    "If your gadget is lost or stolen, tracking apps can tell you exactly where your phone is. These
    apps also let you wipe sensitive information remotely. If your phone does end up landing in the
    wrong hands, you can at least make sure they don't get your information," says Kim
    Komando. Twitter: @kimkomando
    8. Take care of privacy settings immediately upon setup

    When configuring a new device or operating system, configuring privacy settings should be the
    first order of business. This ensures that you're not inadvertently sharing sensitive information
    as you set up your standard apps and services. "The minute you download and install iOS 8, the
    latest version of Apple's mobile operating system for iPhone and iPad, you should take note of
    these privacy steps in order to lock down your device. iOS 8 has a number of new features tied
    to your location. It also has new privacy settings, allowing users to limit how long data is stored
    for, such as message expiry features and new private browsing settings...Before you do
    anything like customizing your phone, loading new apps, or syncing your data for the first time,
    these first seven settings need to be checked, and if necessary, changed," explains Zack
    Whittaker in an article appearing on ZDNet. Twitter: @zackwhittaker

    9. Use MyPermissions.com to control app permissions in one fell swoop

    While it's not all-inclusive, MyPermissions.com is a handy tool that allows you to check your
    permission settings across a multitude of apps, get reminders to clean your permissions with
    mobile-friendly apps, and get alerts when apps access your personal information so that you
    can remove it with a single click. Twitter: @mypermissions

    10. Lock your smartphone and tablet devices

    Practically everyone has a smartphone, tablet, or both these days. All it takes is a single mishap
    where your device slips out of your pocket or briefcase at a restaurant or on public
    transportation, and your data could wind up in the hands of someone who will use it
    maliciously. You can take steps to protect your data in the event of a lost or stolen device,
    however, beginning with locking your device. When your device is locked, a thief must crack
    your password before gaining access to your apps or personal information, adding a layer of
    protection. Unfortunately, many don’t lock their devices, says Monica Anderson of Pew
    Research, "More than a quarter (28%) of smartphone owners say they do not use a screen lock
    or other security features to access their phone." Twitter: @pewresearch

    11. Disable automatic uploading


    Some devices automatically backup your data to the cloud, and some apps used on
    smartphones or tablets store information in remote servers. Yes, having a backup of your data
    is a good thing, but the backup should be accessible only by you or someone you authorize. You
    can prevent your devices from sharing your personal photos and other information with the
    cloud for the world to see by disabling automatic backup settings on your device and on
    individual apps. In an article on BBC, Colin Barras explains, "As cloud services grow it’s
    becoming common for devices like smartphones to upload user data to remote servers by
    default. If you’re at all worried about some of your photos falling into the hands of malicious
    parties it’s probably not a bad idea to check your phone settings to see what data is being
    automatically backed up to the cloud, and disable automatic uploading."
    Twitter: @BBC_Future

    12. Disable Bluetooth when you're not using it


    Bluetooth technology has offered incredible conveniences to the mobile world, but it also
    opens the door for vulnerabilities. Most threats exploiting Bluetooth connectivity are
    dependent on the active Bluetooth connection, and while they aren't typically devastating or
    dangerous, they're certainly inconvenient and can be serious. "Bluetooth attacks depend on
    exploiting the permission request/grant process that is the backbone of Bluetooth connectivity.
    Regardless of the security features on your device, the only way to completely prevent
    attackers from exploiting that permission request/grant process is to power off your device’s
    Bluetooth function when you’re not using it — not putting it into an invisible or undetectable
    mode, but completely turning it off (there are bad apps that can power your device back on,
    just one more reason overall app security is vital)," advises Kaspersky Lab.
    Twitter: @kaspersky

    13. Get anti-virus or anti-malware protection for your mobile devices


    Anti-malware protection software is a given for most computer users, but many consumers still
    overlook the importance of protecting mobile devices from the growing number of malware
    programs impacting all types of mobile devices. Just a few years ago, however, security options
    for mobile devices offered mediocre protection against threats, at best. "Besides antivirus and
    malware scanning, security apps for Android also offer a full McAfee LiveSafe 2014 Android
    screenshot McAfee for Android security suite with features such as device location, remote
    wipe, backup, and suspicious-URL blocking. These extra features usually require a premium
    subscription, but most apps offer a minimal, basic level of protection for free, including
    malware scanning," according to an article on PCWorld. Twitter: @pcworld

    RESOURCES:
    1. https://www.techtarget.com/searchsecurity/definition/ILOVEYOU-virus
    2.https://www.trellix.com/en-us/security-awareness/ransomware/what-is-stuxnet.html
    3. https://www.imperva.com/learn/application-security/tiny-banker-trojan-tbt-tinba/
    4.https://www.pcrisk.com/removal-guides/14355-shlayer-trojan-mac
    5. https://en.wikipedia.org/wiki/Klez
    6. https://digitalguardian.com/blog/101-data-protection-tips-how-keep-your-passwords-
    financial-personal-information-safe

    You might also like