Date leak of MegaFon became the largest in Runet

Kaspersky Lab analyzed a situation with cyberthreats in July, 2011. The personal data leakage from the website of MegaFon, said in the report of producer of anti-virus solutions became key event of the last month.

In daylight saving time malefactors do not reduce activity in a cyberspace: the new Trojan for Android is detected, and because of frequent use of co.cc for distribution of pseudo-antiviruses and carrying out drive-by of the attacks of Google excluded these domains from search issue.

In July the cases of a personal data leakage which became the most large-scale for all history of Runet were recorded. On July 18 texts of 8 thousand SMS which were sent by users via the website of MegaFon got to a cache of the search system "Yandex". Text messages were in open access within several hours.

Later at the search query made definitely users of Google, Yandex and Mail.ru could obtain the complete information about customers of erotic shops and also data on buyers of the train tickets using one of the profile Russian websites.

Experts of Kaspersky Lab note that the module of service " Yandex.metrics " which is incorrectly installed on the website of MegaFon which is used for measurement of attendance of the website and the analysis of behavior of users became the cause of the incident. This system transferred pages with messages to indexation of the search engine. Experts add that a problem also in incorrectly configured robots.txt file which is responsible for indexing of pages. And responsibility for it lays down on administrators of the websites.

In July mobile virus writers the next time filled up the arsenal. The new representative of the Trojan spy of ZitMo, mobile option of sensational ZeuS is detected. This Trojan is aimed at theft of the mTAN code – the one-time password for commission of remote transaction which the client of bank receives in the message of the SMS. If there were modifications of ZitMo earlier under Symbian, Windows Mobile and BlackBerry, then the new version capable to attack Android appeared now.

The number of the cyberthreats proceeding from one of the world's largest domain zones forced Google to take radical measures: in July, 2011 the searcher excluded more than 11 million addresses of the domain zone co.cc from the search issue. In most cases domains with such addresses are used by malefactors for distribution of pseudo-antiviruses and carrying out drive-by of the attacks.

Experts of Kaspersky Lab ambiguously estimate advantage of operations of Google: malefactors became really more rare to use domains on "co.cc", but began to use services of registrars of other zones more actively.