Obama attacks

happygeek 0 Tallied Votes 614 Views Share

We all knew it was going to happen, and that there was nothing we could do to stop it. In fact, it was only a matter of time until the polls had closed and Barack Obama had officially become the President-elect of the United States of America. It is not the election of Obama himself that I am talking about, but rather the inevitable malware that was quick to emerge as a result of that election process.

I stayed up late to watch the results come in, despite not being American, despite living in the UK, like many across the world I have a real interest in the US political landscape. Not least because the small matter of who is President impacts upon my life almost as much as it does yours if you are an American.

And so it was I sat in awe at the historic announcement, at 4am GMT, that Obama had got enough electoral seats to have won the Presidency. So it was at 5am GMT that I wiped away a tear during that truly historic speech.

At 8am GMT I went to bed for a couple of hours of sleep, only to discover when I awoke that my mailbox had already got its first taste of Barack Obama malware in the guise of a spam purporting to have news of the historic events of the night before.

Of course, what you get is a link to a faked up news website which wants you to view video footage of that speech. Something that many who were not able to stay up and watch live might be tempted into doing. No prizes for guessing that those who do will be greeted not with an Adobe Flash video to view, but rather a piece of malware which will vary depending upon exactly what the cybercriminals feel like serving up at that time. What remains constant is that it will come by way of a file that the site says you need to update Adobe Flash in order to view the non-existent video footage.

Sophos tracked one bit of Obama malware, a Trojan complete with rootkit software, backdoor access, data stealing keyloggers and password hunters, to a server in Kiev, Russia.

I wonder how long it will be before the Obama Porn Star spam reappears, or we hear of a malicious version of the Obama and Plain Kick Ass video?

Dani AI

Generated

As notes, high-profile events are predictable bait for opportunistic spam and malware. A short, practical checklist for readers and admins will help reduce risk and speed recovery without repeating the specific samples already mentioned in the thread.

For end users: treat unsolicited event-related mail as suspicious. Do not follow links or run downloads from unsolicited messages. Verify video or news items on official news sites or the publisher's verified social accounts before clicking. Keep the OS, browser, and security software patched, enable automatic updates where reasonable, and use multi-factor authentication on important accounts.

For mail and network admins: enforce SPF, DKIM and DMARC; apply gateway-level scanning and sandboxing for attachments; strip or quarantine executable and archive types by policy; throttle or quarantine surge-topic mail that matches trending keywords; and enable logging and alerting for unexpected mass-delivery patterns. A quick rule example for Postfix header_checks to block some dangerous attachment headers:

/Content-Type:.application\/x-msdownload/ REJECT Executable attachments blocked
/Content-Disposition:.
filename=.*.(exe|scr|pif|bat|com|js|vbs)$/ REJECT Dangerous attachment extension

Quick troubleshooting commands that help triage a suspicious .eml file:

grep -Eo 'https?://[^ >]+' message.eml | sort -u
formail -X "From:" -X "Subject:" -X "Received:" < message.eml

If compromise is suspected: isolate the host, preserve logs and a sample email, collect indicators of compromise, run endpoint scans and EDR queries for lateral movement, rotate credentials and enforce MFA, and restore from verified backups if needed. Submit samples to your AV vendor or a trusted analysis service for further IOC extraction and signatures.

Prepare now: tabletop the scenario of event-driven campaigns, update gateway rulesets, and run a short refresher for staff so the next spike is handled quickly and consistently.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.