VBMania: When Minutes Count

Some malware attacks come so quickly that by the time you react, it’s too late. That was a lesson learned the hard way by thousands of organizations last week with VBMania, otherwise known as the “Here You Have” email worm. In stark contrast to Advanced Persistent Threats (APTs) such as Operation Aurora, the VBMania worm spread uncontrollably with over 200,000 systems detections in just days. With thousands of organizations having their defenses rendered, well… defenseless, how can you avoid being the next victim?

VBMania steps to infection (See McAfee labs blog post):
1. Victim receives the “Here You Have” email with link to a PDF
2. Victim clicks a PDF link; link is actually a malicious SCR file download
3. SCR malware file downloads and executes
4. Malware harvests email addresses from Outlook
5. The “Here You Have” email self propagates via email contacts
6. Malware also downloads additional files, including password recovery tools and malicious HOSTS files (to interrupt security updates)
7. Also infects USBs and network shares

To defend against rapidly spreading attacks like these, you need a threat model that is both predictive and ultra-responsive. McAfee Labs and McAfee Global Threat Intelligence works off these principles, providing predictive, reputation-based intelligence to make real-time decisions about whether or not to block potentially malicious activity.

McAfee offers multiple products that incorporate real-time McAfee Global Threat Intelligence feeds. Let’s take a look at a couple of them – McAfee Firewall Enterprise and McAfee Network Security Platform – to see how they used real-time threat feeds from McAfee Global Threat Intelligence to block VBMania.

McAfee Network Security products block VBMania at multiple points in the process outlined above:

User tries to access bad URL (See step 2 above)
• With VBMania, the SCR file download was disguised as a link to a PDF
• The URL hosting the SCR download had a bad reputation (dating back to April 2010)
• McAfee Firewall customers with Global Threat Intelligence would have not been able to access the Web site

This is an example of the value of predictive defenses based on reputation. McAfee’s Global Threat Intelligence recognized that the network connection harbored malicious content and the firewall prevented users from accessing it. Can your firewall do that?

Malicious executable file is downloaded (See steps 3 & 6 above)
• In cases where the McAfee Firewall wasn’t in place or didn’t have Global Threat Intelligence turned on (tsk-tsk), McAfee Network Security Platform also covered the attack
• McAfee Network Security Platform includes file reputation feeds directly from McAfee Global Threat Intelligence allowing it to intercept suspicious files
• Once the McAfee Global Threat Intelligence file reputation database flagged the malicious SCR file on September 10, 11:34 EDT, all Global Threat Intelligence enabled Network Security Platform sensors would be capable of blocking VBMania

Like most Network IPS solutions, McAfee Network Security Platform includes thousands of local intrusion prevention signatures to protect against known threats. Unlike most Network IPS solutions, its protocol analysis based detection also provides coverage for many unknown threats. Additionally, it is also able to query McAfee Global Threat Intelligence file reputation database – including 35 million suspicious file samples – in real-time, which allows McAfee Network Security Platform to catch more threats faster.

The “Here You Have” email self propagates (See step 5 above)
• Immediately after infection, VBMania uses email contact lists to self propagate (When attacks come from within your internal network, preventing this step can be extremely difficult)
• McAfee Labs released a signature for the VBMania outbreak shortly after discovering the network activities
• Organizations with McAfee Network Security Platform download the new signature
• Internal network segments with McAfee Network Security Platform would now be protected against spread of VBMania from within

Many outbreaks come from within. When that happens, perimeter defenses are useless. The quick response of McAfee Labs with this signature prevented propagation of network traffic containing the VBMania. Even if you didn’t have McAfee Global Threat Intelligence enabled on your perimeter (which you should have), McAfee Network Security Platform sensors could still have prevented spread of the attack using in-line defenses on internal networks.

These are just a few examples of how McAfee Labs and McAfee Global Threat Intelligence help provide predictive, ultra-responsive protection to the latest malware attacks. Visit the McAfee Threat Center for more information on VBMania and how to protect your networks.

Tags: Network Security