Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of our corporate twitter accounts recently started sending out DMs to its followers. Looking at the content of these it seems we'd become infected with Troj/Mdrop-EML. All computers on our company network should be up to date with Symantec Anti Virus / on the latest virus definitions.

Is there a way to see if this virus is covered by Symantec (ideally is there some generic way to check this for any popular anti-virus software, so this post is useful to others)?

We'll investigate further to see if users were using the corporate account from home machines or if our anti-virus coverage has any holes which we hadn't spotted, but I thought it would be useful to know if this virus is something that protected machines would have been protected from before investigating further.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Double check that one of the users has not used the Twitter credentials at home, or on their mobile device. (this is what happened here)

Use virus total to see which anti-virus tools would find this one: for example: VirusTotal page for Troj/MDrop-EML. in your case it looks like a file called "FlashPlayerV10.1.57.108.exe" was downloaded. That's a typical infection mechanism for this according to VirusTotal.

It may be worth using this as an education event as to why your IT policy for social media is important and remind everyone of their responsibilities

share|improve this answer
1  
Thanks for the link - that's exactly what I was after. –  JohnLBevan Nov 28 '12 at 17:53

What you can do is:

  • set up a sandbox computer installed with your AV
  • infect it with the virus and see if it's detected

Or you can upload the file to https://www.virustotal.com/ and see if it's detected by symantec.

share|improve this answer
    
Thanks @LucasKauffman. Sadly I can't reproduce this as we don't know which machine's infected - the only reason we spotted the virus is a DM from our company account to one of my test accounts, followed by a Google search on the scenario which brought up this: news.cnet.com/8301-1009_3-57519494-83/…. Good advice for other scenarios though, so thumbs up. –  JohnLBevan Nov 28 '12 at 17:52

I suspect that this is a HTTP-based vulnerability that took a user's session credentials and sent them to a third party webserver. That server then took those credentials and started using them (from a different IP).

I recommend changing that user's twitter password which might also have the side effect of invalidating the session that resides on other computers (legitimate or not).

I don't think the traditional AV program can scan for this type of attack. My guess this is a confused deputy problem, that caused the webbrowser to do something insecure. The specific mode of attack may be a CSRF, clickjacking, or browser agent (BHO, or extension) that reads passwords and that was exploited.

Another possibility is that the user misspelled twitter.com, or was otherwise lead to a phishing page that looks just like twitter's login, and they entered the credentials there.

Just know that most attacks I've seen start several hours after the exploit is done. For my test accounts, this means the posts were done either while I was asleep (or statistically not using the account according to past posts)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.