Code Shikara: Difference between revisions
Content deleted Content added
mNo edit summary |
No edit summary |
||
| (29 intermediate revisions by 22 users not shown) | |||
| Line 1: | Line 1: | ||
{{short description|Computer worm}} |
|||
{{merge to|Dorkbot (malware)|discuss=Talk:Dorkbot (malware)#Merge proposal|date=June 2024}} |
|||
'''''Code Shikara''''' is a [[computer worm]], related to the [[Dorkbot (malware)|Dorkbot family]], that attacks through [[Social engineering attack|social engineering]]. |
'''''Code Shikara''''' is a [[computer worm]], related to the [[Dorkbot (malware)|Dorkbot family]], that attacks through [[Social engineering attack|social engineering]]. |
||
== Timeline == |
== Timeline == |
||
In 2011 the Code was first identified by the Danish [[cyber security]] company |
In 2011, the Code was first identified by the Danish [[cyber security]] company CSIS. The [[Antivirus software|AV]]-company [[Sophos]] reported in November 2011 that this threat mainly spreads itself through malicious links through the social network [[Facebook]].<ref>{{cite web|url=https://www.csis.dk/|title=CSIS - Exceptional threat intelligence|publisher=}}</ref><ref name=autogenerated1>{{cite web|url=https://nakedsecurity.sophos.com/2011/11/29/facebook-worm-two-blonde-women/|title=Facebook worm poses as two blonde women|date=29 November 2011|publisher=}}</ref> |
||
In 2013 |
In 2013, [[Bitdefender Labs]] caught and blocked the worm, which is capable of [[Spyware|spying]] on users' [[Web navigation|browsing activities]], meanwhile stealing their personal online/offline information and/or credentials, commonly known as [[cybercrime]]. The [[Vector (malware)|infection]] was originally flagged by the [[online backup service]] [[MediaFire]], who detected that the worm was being distributed camouflaged as an [[image file]]. Despite the misleading extension, MediaFire successfully identified the malicious image as an [[.exe]]-file. The malicious Shikara Code poses as a [[.jpeg]] image, but is indeed an [[executable file]]. As an [[IRC bot]], the malware is simply integrated by the attackers from a [[control and command server]]. Besides stealing usernames and passwords, the [[bot herder]] may also order additional malware downloads.{{Citation needed |date=June 2024}} |
||
MediaFire had then taken steps to address incorrect and misleading file extensions in an [[Patch (computing)|update]], which identified and displayed a short description by identifying specific file types. To help users for this specific threat, the [[file sharing]] service also blocked files with double extensions, such as .jpg.exe, .png.exe, or .bmp.exe. Just like usual malware, the [[Backdoor.IRCBot.Dorkbot]] can update itself once installed on the victim's computer or other related [[Peripheral|devices]].<ref>{{cite web|url=https://hotforsecurity.bitdefender.com/blog/dorkbot-malware-infects-facebook-users-spies-browser-activities-and-grabs-data-6165.html|title=Dorkbot Malware Infects Facebook Users; Spies Browser Activities...|date=14 May 2013|publisher=}}</ref> |
|||
The biggest risk is that someone's Facebook contacts may have had their account already compromised (due to sloppy password security, or granting access to a [[rogue application]]) and that the account user has been allured by clicking on a link seemingly posted by one of their friends. |
The biggest risk is that someone's Facebook contacts may have had their account already compromised (due to sloppy password security, or granting access to a [[rogue application]]) and that the account user has been allured by clicking on a link seemingly posted by one of their friends.{{Citation needed |date=June 2024}} |
||
Although the links pretend to point to an image, the truth is that a malicious |
Although the links pretend to point to an image, the truth is that a malicious [[screensaver]] is hidden behind an icon of two blonde women. After the code is launched, it attempts to download further malicious software hosted on a specific compromised Israeli domain. The malware is currently not present on the Israeli website. All that remains is a message, seemingly from the intruders, that says: |
||
::::::::::::::::::: |
:::::::::::::::::::<big>Hacked By ExpLodeMaSTer & By Ufuq</big> |
||
It is likely that they are using additional or other websites in continuing spreading their |
It is likely that they are using additional or other websites in continuing spreading their cyberattack(s). Some other popular baits tricking users to click on malicious links include [[Rihanna]] or [[Taylor Swift]] [[sex tape]]s.<ref name=autogenerated1 /><ref>{{cite web|url=https://nakedsecurity.sophos.com/2011/12/05/facebook-chat-worm-continues-spread/|title=Facebook chat worm continues to spread|date=5 December 2011|publisher=}}</ref> |
||
== Statistics == |
|||
* '''''Niger:''''' Due to Information from the [[Kaspersky Cybermap]], ''Shikara Spam Code'' has been ranking in April 2017 the Top number 1 in the country of [[Niger]] with 77.51 % . Place #2 sits as ''[[Linguistic Analysis]]'' far behind, with 14.7 % .<ref name="kaspersky.com">{{cite web|url=https://cybermap.kaspersky.com/stats/#country=208&type=kas&period=m|title=Kaspersky Cyberthreat real-time map|publisher=}}</ref> |
|||
* '''''Code Shikara''''' mainly circulates in following Countries (STATISTICS - April 22nd 2017): |
|||
: Afghanistan (81.27 %) |
|||
: Romania (78.58 %) |
|||
: Algeria (78.56 %) |
|||
: India (78.46 %) |
|||
: Niger (77.51 %) |
|||
: Turkey (75.49 % <small>'''Turkey % per Week !'''</small>) <ref name="kaspersky.com"/> |
|||
== See also == |
== See also == |
||
* |
*{{annotated link|Alert (TA15-337A)}} |
||
* |
*{{annotated link|Computer worm}} |
||
* |
*{{annotated link|Dorkbot (malware)}} |
||
* |
*{{annotated link|Malware}} |
||
==References== |
==References== |
||
{{reflist}} |
{{reflist}} |
||
== External links == |
== External links == |
||
*[https://www.us-cert.gov/ncas/alerts/TA15-337A Alert (TA15-337A) @ United States Computer Emergency Readiness Team] (''[[US-CERT]]'') |
*[https://www.us-cert.gov/ncas/alerts/TA15-337A Alert (TA15-337A) @ United States Computer Emergency Readiness Team] (''[[US-CERT]]'') |
||
| Line 43: | Line 36: | ||
{{Software distribution}} |
{{Software distribution}} |
||
[[Category:2011 in |
[[Category:2011 in computing]] |
||
[[Category:Botnets]] |
[[Category:Botnets]] |
||
| ⚫ | |||
[[Category:Cybercrime]] |
|||
[[Category:Cyberwarfare]] |
|||
[[Category:Denial-of-service attacks]] |
|||
[[Category:Email worms]] |
[[Category:Email worms]] |
||
[[Category:Exploit-based worms]] |
[[Category:Exploit-based worms]] |
||
[[Category:File sharing]] |
[[Category:File sharing]] |
||
[[Category:Hacking (computer security)]] |
|||
[[Category:Hacking in the 2010s]] |
[[Category:Hacking in the 2010s]] |
||
[[Category:Identity theft]] |
[[Category:Identity theft]] |
||
[[Category:Instant messaging]] |
[[Category:Instant messaging]] |
||
[[Category:Internet fraud]] |
|||
[[Category:Internet Relay Chat]] |
|||
[[Category:Internet Relay Chat bots]] |
|||
[[Category:Malware]] |
|||
[[Category:Multi-agent systems]] |
|||
[[Category:Password authentication]] |
[[Category:Password authentication]] |
||
[[Category:Social engineering ( |
[[Category:Social engineering (security)]] |
||
[[Category:Spammers]] |
|||
[[Category:Spamming]] |
[[Category:Spamming]] |
||
[[Category:Spyware]] |
[[Category:Spyware]] |
||
[[Category:Windows malware]] |
[[Category:Windows malware]] |
||
| ⚫ | |||
Latest revision as of 16:18, 12 June 2024
 | It has been suggested that this article be merged into Dorkbot (malware). (Discuss) Proposed since June 2024. |
Code Shikara is a computer worm, related to the Dorkbot family, that attacks through social engineering.
Timeline
[edit]In 2011, the Code was first identified by the Danish cyber security company CSIS. The AV-company Sophos reported in November 2011 that this threat mainly spreads itself through malicious links through the social network Facebook.[1][2]
In 2013, Bitdefender Labs caught and blocked the worm, which is capable of spying on users' browsing activities, meanwhile stealing their personal online/offline information and/or credentials, commonly known as cybercrime. The infection was originally flagged by the online backup service MediaFire, who detected that the worm was being distributed camouflaged as an image file. Despite the misleading extension, MediaFire successfully identified the malicious image as an .exe-file. The malicious Shikara Code poses as a .jpeg image, but is indeed an executable file. As an IRC bot, the malware is simply integrated by the attackers from a control and command server. Besides stealing usernames and passwords, the bot herder may also order additional malware downloads.[citation needed]
MediaFire had then taken steps to address incorrect and misleading file extensions in an update, which identified and displayed a short description by identifying specific file types. To help users for this specific threat, the file sharing service also blocked files with double extensions, such as .jpg.exe, .png.exe, or .bmp.exe. Just like usual malware, the Backdoor.IRCBot.Dorkbot can update itself once installed on the victim's computer or other related devices.[3]
The biggest risk is that someone's Facebook contacts may have had their account already compromised (due to sloppy password security, or granting access to a rogue application) and that the account user has been allured by clicking on a link seemingly posted by one of their friends.[citation needed]
Although the links pretend to point to an image, the truth is that a malicious screensaver is hidden behind an icon of two blonde women. After the code is launched, it attempts to download further malicious software hosted on a specific compromised Israeli domain. The malware is currently not present on the Israeli website. All that remains is a message, seemingly from the intruders, that says:
- Hacked By ExpLodeMaSTer & By Ufuq
It is likely that they are using additional or other websites in continuing spreading their cyberattack(s). Some other popular baits tricking users to click on malicious links include Rihanna or Taylor Swift sex tapes.[2][4]
See also
[edit]- Alert (TA15-337A) – Family of malware worms that spreads through instant messaging
- Computer worm – Self-replicating malware program
- Dorkbot (malware) – Family of malware worms that spreads through instant messaging
- Malware – Malicious software
References
[edit]- ^ "CSIS - Exceptional threat intelligence".
- ^ a b "Facebook worm poses as two blonde women". 29 November 2011.
- ^ "Dorkbot Malware Infects Facebook Users; Spies Browser Activities..." 14 May 2013.
- ^ "Facebook chat worm continues to spread". 5 December 2011.