Vulnerabilities / Threats
5/24/2012
11:22 AM
Connect Directly
RSS
E-Mail
50%
50%

London 2012 Olympics Scammers Seek Malicious Gold

Expect escalating levels of malware, fake mobile apps, and online scams in the lead-up to this summer's Olympics, warns the Department of Homeland Security.

Defense Tech: 20 War-Fighting Innovations
Military Transformers: 20 Innovative Defense Technologies
(click image for larger view and for slideshow)
As the start of the Summer Olympics on July 27 in London nears, malware creators continue to try to cash in--using fake mobile apps, online scams, Olympics-themed malware, and even search engine optimization attacks.

That warning comes by way of the recently released "Strategic Outlook: 2012 Summer Olympic Games" report from the Department of Homeland Security's National Cybersecurity and Communications Integration Center. The guide was assembled in conjunction with multiple agencies--at home and abroad--including the U.S. Computer Emergency Readiness Team (US-CERT).

Scams--including many "lottery notifications"--related to the London Summer Olympics date back to at least 2008, according to security vendor Trend Micro. Since then, however, more attackers have begun referencing the Olympics, hoping to trick people into downloading malicious screensavers or opening malicious files.

One recent spam attack, for example, arrives with a malicious attachment titled "Early Check-In 2012 Olympics.doc." Currently, only one-third of virus scanners appear to be blocking the file, which is really a Trojan dropper application used "to deliver an enclosed payload onto a destination host computer," according to Symantec.

[ Want to stop hackers from stealing sensitive data about your users? Consider 7 Lessons From MilitarySingles.com Hack. ]

DHS has also seen an increasing number of attacks using search engine optimization (SEO) poisoning techniques. "Criminals will promote malicious sites with search engine results to distribute malware to victim systems. The most prevalent type of malware distributed through this type of attack is rogueware or fake antivirus, which tricks users into purchasing fake security software," it said. Meanwhile, with Yahoo regularly being the top site to which people go for online Olympics coverage, DHS warned that "it is probable that criminals will target Yahoo for SEO poisoning in an effort to infect the maximum number of systems across the globe."

Another concern will be fake mobile applications, especially with numerous businesses--including the BBC, NBC, Samsung, as well as Visa--launching new applications for the Summer Olympics. "The development and deployment of 2012 Olympics-related mobile applications will be the largest of any previous Olympics," according to the DHS advisory. "Criminals will probably capitalize on this trend and launch fake Olympics-related applications in mobile marketplaces to steal financial and personal information."

To help block attacks, DHS recommended that businesses and organizations monitor all network traffic for signs that they've been breached and log all unsuccessful incoming-email attempts to help identify when a phishing attack is underway. Notably, attackers will typically guess the combination of first and last name used to create internal email addresses. Accordingly, watch for any incoming messages aimed at combinations that aren't used by the organization.

"This is probably the first sign your organization may be targeted," according to the DHS advisory. "By reviewing logs shortly after trigger events, it is possible to learn whether attempts are being made and thus new rule sets can be created to block the sender and alert the individual they are being targeted. Also, if it is determined an attack against an individual or group is possibly occurring, notify the individual or group to be more aware of the threat."

While attention is now focused on the 2012 Summer Olympics, DHS noted that attacks related to the 2014 Winter Olympics, set to be hosted in Sochi, Russia, have already begun. In particular, the Anonymous Kavkaz group (a.k.a. Adiga Hackers)--based in the country's North Caucasus region--have launched "Operation Blackhole" to target the Winter Olympics website as well as the website of Russian mobile phone operator and Olympics sponsor MegaFon.

According to the DHS advisory, Anonymous Kavkaz believes that "the Olympic complex is being built upon mass graves from the Circassian genocide," which occurred in the 19th century. The group has already claimed to have taken down the public websites of Russian president Vladimir Putin and the Kremlin, as well as the Russian Commercial Bank.

"This is the first time Russia has hosted the Olympics (the 1980 Olympic Games were held in the USSR) and officials are actively monitoring the region for any indication of unrest," according to DHS. "Russia has recently deployed military forces to the North Caucasus as part of a broader effort to stabilize the region in the lead-up to the 2014 Olympics."

Interestingly, these aren't the first online attacks related to the 2014 Winter Olympics. In late 2010, the websites of multiple news outlets in Sochi were targeted by online attackers in retaliation for their criticism of proposed Olympics construction being situated near UNESCO-protected sites. According to the DHS advisory, "it is unknown who perpetrated this series of attacks, but their choice of targets indicates the attacker was possibly attempting to subdue opposition." In other words, the Russian government, or people working with the government, appear to have launched the attacks.

Employees and their browsers might be the weak link in your security plan. The new, all-digital Endpoint Insecurity Dark Reading supplement shows how to strengthen them. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.