cso online
Close
Thank you
Your message has been sent.
Close
Sorry
There was an error emailing this page.
Criminals are using malware stored in Dropbox in phishing campaign aimed at corporate employees, security researcher says
By Antone Gonsalves
CSO
|
Jun 6, 2014 5:38 PM
‘);//–“;
var adDivString = “”;
placementDiff = applyInsert($(this), adDivString);
if (debug) {
console.log(“Just placed an ad and the placementDiff is: ” + placementDiff);
}
placementTarget = cumulativeHeight + placementDiff + interModuleHeight + adHeightBuffer;
}
else {
var moduleDivString = “”;
var elementId = “drr-mod-“+moduleCounter;
moduleDivString = “”;
modules.push(elementId);
placementDiff = applyInsert($(this), moduleDivString);
if (debug) {
console.log(“Just placed a module and the placementDiff is: ” + placementDiff);
}
placementTarget = cumulativeHeight + placementDiff + interModuleHeight + moduleHeightBuffer;
moduleCounter++;
}
loopCounter++;
}
// Avoid placing elements too soon due to non-large figures inflating the cumulative height
if ($(this).is(“figure”) !$(this).is(“figure.large”)) {
cumulativeHeight += grafHeight;
}
else {
cumulativeHeight += $(this).height() + grafHeight;
}
}
});
// clone Related Stories module m-15 to come in after 2nd para in article body for mobile breakpoint display
var $relatedStories = $(‘.related-promo-wrapper’);
if ($relatedStories.length) {
var $relatedStoriesClone = $relatedStories.clone();
$relatedStoriesClone.insertAfter( “#drr-container p:eq(1)”);
}
var $insiderPromo = $(‘.insider-promo-wrapper’);
if ($insiderPromo.length) {
var $insiderPromoClone = $insiderPromo.clone();
$insiderPromoClone.insertAfter( “#drr-container p:eq(1)”);
}
//place left side element
cumulativeHeight = 0;
var leftPlacementTarget = tagHeight = leftPlacementTarget) {
if (debug) {
console.log(“congratulations… we’ve passed the initial start point”);
}
if (leftPlacementIndex == null) {
//it’s not good enough to not be a left avoid – it also shouldn’t be a
with an immediately preceding small or medium image left avoid.
if (!isLeftAvoid($(this)) noPrevFigures($(this)) ) {
leftPlacementIndex = $(this).index();
$leftPlacementElement = $(this);
leftPlacementLookaheadStart = cumulativeHeight;
if (debug) {
console.log(“is not a left avoid and no prev figures. ########## set placementIndex (“+leftPlacementIndex+”) and lookaheadStart (“+leftPlacementLookaheadStart+”) ##########”);
}
} else {
if (debug) {
console.log(“is a left avoid or has previous figures. continue”);
}
}
} else {
if (debug) {
console.log(“#### leftPlacementIndex already set to “+leftPlacementIndex+”. looking ahead…”);
}
//not null; has been set
if ((cumulativeHeight – leftPlacementLookaheadStart) leftIntervalHeight) {
if (debug) {
console.log(“###### THRESHOLD REACHED. LOOKAHEAD COMPLETE. END ###### (cumulativeHeight – leftPlacementLookaheadStart) (“+(cumulativeHeight-leftPlacementLookaheadStart)+”) leftIntervalHeight (“+leftIntervalHeight+”).”);
}
return false;
} else {
if (debug) {
console.log(“threshold not reached: (cumulativeHeight – leftPlacementLookaheadStart) (“+(cumulativeHeight-leftPlacementLookaheadStart)+”) tags
if (!(isLeftAvoid($(this)) ($(this).hasClass(‘small’) || $(this).hasClass(‘inline-small’) || $(this).hasClass(‘medium’) || $(this).hasClass(‘inline-medium’) || $(this).hasClass(‘apart’) ))) {
cumulativeHeight += $(this).height() + grafHeight;
}
if (debug) {
console.log(“——————– set cumulativeHeight(“+cumulativeHeight+”) —————“);
console.log(“”);
}
}
});
}
if (leftPlacementIndex != null elementNotNearEnd($leftPlacementElement, leftPixelWindow)) {
if (debug) {
console.log(” insert into index “+leftPlacementIndex);
}
$(“#drr-container”).children().eq(leftPlacementIndex).before(“
“);
}
IDG.GPT.trackOmniture();
// Add Right rail module content
for (var i=0; i= 0) {
referrerValue = getReferrerArticle(“”, previousUrl); // sets _article if ajax returns article
if (_article != null) {
if (_article.categories instanceof Array _article.categories.length 0) {
var referrerCatId = _article.categories[0];
epoParams += “catId=” + referrerCatId + “referrer=article”;
}
}
else {
epoParams += “typeId=” + defaultTypeId + “referrer=home”; // default is ‘home’ behavior
}
}
// From SEARCH: Show article with catId same as current article
else if (previousUrl.indexOf(“google”) = 0 || previousUrl.indexOf(“yahoo”) = 0 || previousUrl.indexOf(“bing”) = 0) {
var categories = [3302];
if (categories instanceof Array categories.length 0) {
var primaryCatId = categories[0];
epoParams += “catId=” + primaryCatId + “referrer=search”;
}
else {
epoParams += “typeId=” + defaultTypeId + “referrer=home”; // default is ‘home’ behavior
}
}
// Default is to show like coming from homepage
else {
epoParams += “typeId=” + defaultTypeId + “referrer=home”; // default is ‘home’ behavior
}
return epoParams;
}
/**
* @param jqo Original jquery object target
* @param divString The div to be inserted.
* @return Difference in height between original placement target and final target.
* Checks first 6 elements for an allowable placement (600 pixel window).
* If none, check nearby for elements that are not right avoids.
* If none, place element before current target.
*/
function applyInsert(jqo, divString) {
if (debug) {
console.log(“applyInsert at top and jqo index is: ” + jqo.index());
}
for (var i=0; i 0) {
children = $(“#drr-container”).children().slice(jqo.index(), allowElement.index() );
}
else {
children = $(“#drr-container”).children().slice(allowElement.index(), jqo.index());
}
if (children != null) {
children.each(function(i) {
if (debug) {
console.log(“About to add this element’s height to heigh diff offset”);
console.log($(this));
}
height += $(this).height();
});
}
if (offset 300) {
if (debug) {
console.log(“isRightAvoid: found pre. return true”);
}
return true;
}
if (jqo.is(“figure”) jqo.hasClass(‘large’)) {
if (debug) {
console.log(“isRightAvoid: found figure.large return true”);
}
return true;
}
if (jqo.is(“figure”) jqo.hasClass(‘medium’) jqo.hasClass(‘inline’)) {
if (debug) {
console.log(“isRightAvoid: found figure has class medium and inline.”);
}
return true;
}
if (jqo.hasClass(‘download-asset’)) {
if (debug) {
console.log(“isRightAvoid: found class download-asset return true”);
}
return true;
}
if (jqo.is(“aside”) jqo.hasClass(‘tableLarge’)) {
if (debug) {
console.log(“isRightAvoid: found class download-asset return true”);
}
return true;
}
}
return false;
}
// Returns true if height of all elements after this one is more than 500; false otherwise
function elementNotNearEnd(element, pixelWindow) {
if (pixelWindow == null) {
pixelWindow = 500;
}
if (element == null) {
return false;
}
var remainingHeight = 0;
var children = $(“#drr-container”).children().slice(element.index());
if (children == null) {
return false;
}
children.each(function(i){
remainingHeight += $(this).height();
});
if ( remainingHeight pixelWindow) {
return true;
}
else {
if (debug) {
console.log(“Element too close to end. Remaining height is: ” + remainingHeight + ” and window is ” + pixelWindow);
}
return false;
}
}
/**
* Return true if need to avoid this element when placing left module.
*/
function isLeftAvoid(jqo) {
if (jqo.is(“figure”)) {
if (debug) {
console.log(“isLeftAvoid: found figure. return true”);
}
return true;
}
if (jqo.is(“aside.pullquote”)) {
if (debug) {
console.log(“isLeftAvoid: found pullquote. return true”);
}
return true;
}
if (jqo.is(“pre”)) {
if (debug) {
console.log(“isLeftAvoid: found pre. return true”);
}
return true;
}
if (jqo.is(“div.gist”)) {
if (debug) {
console.log(“isLeftAvoid: found github code block. return true”);
}
return true;
}
if (jqo.hasClass(“statsTable”)) {
if (debug) {
console.log(“isLeftAvoid: found class statsTable. return true”);
}
return true;
}
return false;
}
/**
* return true if there are no figures before the target placement that might bleed down into placement element
*/
function noPrevFigures($originalTarget) {
var targetIndex = $originalTarget.index();
var numElementsLookBack = 5;
var figureIndex = null;
var figureHeight = null;
var startIndex = targetIndex – numElementsLookBack
Corporate employees familiar with Dropbox should take extra precautions to avoid becoming a victim of a phishing attack that uses the popular file-sharing service.
Cybercriminals have been sending out emails with malicious links pointing to a ZIP file on Dropbox that contains a screensaver that is actually ransomware similar to one known as CryptoLocker, security vendor PhishMe reported Friday.
[Brown HIV researchers make Dropbox secure with nCrypted Cloud]
The attackers try to trick the recipients into clicking on the link through a variety of ploys, including disguising the email, so that the link appears to point to an invoice or a fax report or message.
If someone receives the email at work, “they may think that they’re receiving a fax and it’s something they need to look at, which makes them inclined to go ahead and open it,” Ronnie Tokazowski, senior researcher at PhishMe, said.
Clicking on the link to the ZIP file and then the screensaver file inside launches the malware that encrypts files on the victim’s hard drive. PhishMe estimates that victims have had as many as 20,000 files encrypted. Files typically affected by such ransomware include documents, archive files, executables and JPEGs.
Once executed, the malware launches a page on the victim’s default browser, demanding that $500 in Bitcoins be deposited in the criminals’ electronic wallet. Failing to do so after a certain amount of time leads to the ransom doubling to $1,000.
Based on an examination of three of the attackers’ wallets, the scammers have collected at least $62,000, Tokazowski estimates. The ransom demand and payment transactions are conducted over the Tor anonymity network.
The attack does not exploit a vulnerability on Dropbox. PhishMe had not discussed the phishing campaign with Dropbox, which did not respond to a request for comment.
PhishMe discovered the scam after its own employees received the phishing emails, Tokazowski said. Almost 20 of the company’s 50 employees received the messages.
PhishMe does not believe it was directly targeted in the campaign, but was just one of many companies whose employees might have received the emails.
“There’s been no evidence that they (the attackers) have been specifically going after us,” Tokazowski said.
To avoid becoming a victim, companies should advise employees to be wary of downloading ZIP files and emails like the ones described above that have no recognizable sender.
-
-
What is social engineering? What are the most common and current tactics? A guide on how to stop…
-
From passwords on sticky notes to sensitive contracts left in a pile by the printer, many office…
-
-
3 lessons learned by the participants of a recent cyber war strategic exercise that offer insights…
-
Yesterday brought news that there was a database breach that exposed the personal details of 16,000
In a letter to the California Attorney General’s Office (OAG), American Express says that 76,608 people
Sign up for our CSO Update newsletter
A vulnerability patched in the GnuTLS library can potentially be exploited from malicious servers to
Are your employees using free file sync and share (FSS) applications for sharing sensitive enterprise
ATT’s plans for a location-based service that would track a mobile phone user to prevent credit-card
3 lessons learned by the participants of a recent cyber war strategic exercise that offer insights into
Yesterday brought news that there was a database breach that exposed the personal details of 16,000
The flaw allows man-in-the-middle attackers to decrypt traffic between clients and servers that use
<!–