How to tell what viruses are covered by your anti-virus software

Question

One of our corporate twitter accounts recently started sending out DMs to its followers. Looking at the content of these it seems we'd become infected with Troj/Mdrop-EML. All computers on our company network should be up to date with Symantec Anti Virus / on the latest virus definitions.

Is there a way to see if this virus is covered by Symantec (ideally is there some generic way to check this for any popular anti-virus software, so this post is useful to others)?

We'll investigate further to see if users were using the corporate account from home machines or if our anti-virus coverage has any holes which we hadn't spotted, but I thought it would be useful to know if this virus is something that protected machines would have been protected from before investigating further.

Answer 1

Double check that one of the users has not used the Twitter credentials at home, or on their mobile device. (this is what happened here)

Use virus total to see which anti-virus tools would find this one: for example: VirusTotal page for Troj/MDrop-EML. in your case it looks like a file called "FlashPlayerV10.1.57.108.exe" was downloaded. That's a typical infection mechanism for this according to VirusTotal.

It may be worth using this as an education event as to why your IT policy for social media is important and remind everyone of their responsibilities

Answer 2

What you can do is:

• set up a sandbox computer installed with your AV
• infect it with the virus and see if it's detected

Or you can upload the file to https://www.virustotal.com/ and see if it's detected by symantec.

Answer 3

I suspect that this is a HTTP-based vulnerability that took a user's session credentials and sent them to a third party webserver. That server then took those credentials and started using them (from a different IP).

I recommend changing that user's twitter password which might also have the side effect of invalidating the session that resides on other computers (legitimate or not).

I don't think the traditional AV program can scan for this type of attack. My guess this is a confused deputy problem, that caused the webbrowser to do something insecure. The specific mode of attack may be a CSRF, clickjacking, or browser agent (BHO, or extension) that reads passwords and that was exploited.

Another possibility is that the user misspelled twitter.com, or was otherwise lead to a phishing page that looks just like twitter's login, and they entered the credentials there.

Just know that most attacks I've seen start several hours after the exploit is done. For my test accounts, this means the posts were done either while I was asleep (or statistically not using the account according to past posts)