May 22nd, 2012:

Kaspersky Labs shares a highly advanced new Facebook worm.  This new Javascript based worm can spread from three different browsers (IE, Chrome, and Firefox) providing a cross platform attack.

Facebook – Advanced New LilyJade Cross Platform Worm
http://www.securelist.com/en/blog/706/Worm_2_0_or_LilyJade_in_action

It is quite rare to analyze a malicious file written in the form of a cross-platform browser plugin. It is, however, even rarer to come across plugins created using cross-browser engines. In this post, we will look into a Facebook worm that was written using the Crossrider system – a system still in beta testing.

It uses The Crossrider system, which is intended for writing unified plugins for Internet Explorer (version 7 onwards), Mozilla Firefox 3.5 and Google Chrome. This malicious program is a an excellent example of Malware 2.0-class programs based on modern web technologies, using social networks to propagate themselves and generating illegal incomes for their owners by spoofing various services.

A new malicious IM attack is circulating in the Facebook environment, as document by Trend Security

Facebook – New STECKCT worm spreads Instant Messaging
http://blog.trendmicro.com/worm-spreads-via-facebook-private-messages-instant-messengers/

QUOTE:  We recently received reports about private messages found on Facebook and distributing a link, which is a shortened URL pointing to an archive file “May09-Picture18.JPG_www.facebook.com.zip”. This archive contains a malicious file named “May09-Picture18.JPG_www.facebook.com” and uses the extension “.COM”.   Once executed, this malware (detected as WORM_STECKCT.EVL) terminates services and processes related to antivirus (AV) software, effectively disabling AV software from detection or removal of the worm. WORM_STECKCT.EVL also connects to specific websites to send and receive information.

Another noteworthy routine is that this worm downloads and executes another worm, one detected as WORM_EBOOM.AC. Based on our analysis, WORM_EBOOM.AC is capable of monitoring an affected user’s browsing activity such as message posting, deleted posted messages and private messages sent on the following websites such as Facebook, Myspace, Twitter, WordPress, and Meebo. It is also capable of spreading through the mentioned sites by posting messages containing a link to a copy of itself.

Nmap is an excellent analytical tool used in the past and the new version 6 has been officially released

https://isc.sans.edu/diary/nmap+6+released/13267

http://nmap.org/6/

QUOTE:  May 21, 2012—The Nmap Project is pleased to announce the immediate, free availability of the Nmap Security Scanner version 6.00 from http://nmap.org/. It is the product of almost three years of work, 3,924 code commits, and more than a dozen point releases since the big Nmap 5 release in July 2009. Nmap 6 includes a more powerful Nmap Scripting Engine, 289 new scripts, better web scanning, full IPv6 support, the Nping packet prober, faster scans, and much more! We recommend that all current users upgrade.

Contents:

1. About Nmap
2. Top 6 Improvements in Nmap 6
3. Press
4. Screen Shots
5. Detailed Improvements
6. Moving Forward (Future Plans)
7. Acknowledgments
8. Download and updates

Please ensure your Windows and Office environments are up-to-date to ensure the best levels of protection.  A number of patches were rated as critical this month.

Microsoft Security Bulletin Summary for May 2012
http://technet.microsoft.com/en-us/security/bulletin/ms12-may

Microsoft Security – ISC analysis for May 2012
https://isc.sans.edu/diary.html?storyid=13159