Japan's GENO = Gumblar

The security community is an international one and researchers from the respective companies are a pretty collaborative group. I was reminded of just how international it is when a colleague from G-Data dropped me an email earlier today. Their Japan partners had contacted them, saying the Gumblar reports from ScanSafe sounded very much like the GENO reports that had also been circulating in Japan. And as it turns out, indeed they were the same.

ScanSafe termed the compromises Gumblar because that was the name of the second stage malware domain used. Security folks in Japan termed the compromises GENO because one of the more high profile victims of the compromises in Japan apparently was a site named GENO.

And unfortunately for our friends in Japan, it appears these Gumblar/GENO compromises are causing just as much headache there.

So folks doing Gumblar research via the Web would do well to add GENO in as a search term. For those who don't speak or read Japanese, Google's translator seems to do a pretty good job of it.

Comments

[Yoshiko]

Hi, I'm from Japan. Indeed it's widely called "GENO virus" in Japan. It's a good idea to include the word GENO in your search.

Many anime, manga and game related websites are reported to have fallen victims of Gumblar/GENO/whatever. If there are people out there who regularly visit anime/manga/game sites for photos and/or drawings, it is strongly advised to take extra precaution, especially when they don't read Japanese. Among other websites are webshops, domestic businesses and a cable TV station, which I believe are less risky for international users.

On another note, Google's translator quite often messes up the sentence in Japanese-English translation. Yahoo! Japan's translation ("Yahoo! Honyaku" in Japanese) is far better. It can even handle colloquial expressions to some extent. Trust me because I'm a English-Japanese translator.

Yahoo! Japan translator:
http://honyaku.yahoo.co.jp/transtext

Paste the Japanese text on the left-hand side text area, check the second radio-button - it's for "Japanese to English" - and click on the "translate (翻訳)" button at the bottom.

Examples:
[Original text in Japanese] Adobe ReaderやAdobe Flash Playerの脆弱性を突いた新種のコンピュータウイルスです。

[Google] Adobe Reader and Adobe Flash Player is a new breed of computer virus突ITA vulnerabilities.

[Yahoo!] It is the new variety of computer virus which pointed out weakness of Adobe Reader and Adobe Flash Player.

[My human translation (very rough)] It is a new variety of computer virus which exploits vulnerabilities of Adobe Reader and Adobe Flash Player.

Best regards,
Yoshiko