Sep 21 2008 5:10PM GMT
Posted by: Ken Harthun
Security,
Cybercrime,
Malware,
Social Engineering,
Trojan
A variant of Win32/Zlob is being spread by cybercriminals via the fake video codec trick. Through misdirection or outright deception (including social engineering), users are sent to a site that has what appears to be embedded video. When they arrive at the page, there’s a message in the viewer similar to the one shown at “The ZLOB Show: Trojan Poses as Fake Video Codec, Loads More Threats.” If the user falls for the trick, Zlob trojan is downloaded and installed.
The variant, posing as “MediaTubeCodec.1.220.2.exe”–a name that should arouse suspicion in savvy users, but probably looks “official” to the unenlightened–was recently analyzed by Microsoft (see “Another Reason to Avoid Piracy” in their Microsoft Malware Protection Center blog). Microsoft updated its detection signatures to detect this variant as TrojanDownloader:Win32/Zlob.gen!CD. If diagnostics on a user’s PC (netstat, for example) reveal connections to any of the following, assume infection and take appropriate action:
- hxxp://64.247.39.247
- hxxp://second-reason.com
- hxxp://viacodecright2.com
According to the blog, “Only the first two are responding at the time of writing—both appear to be running nginx [pronounced “engine X”] (a lightweight web/mail server), one server is hosted in the USA and the other in China. So please folks—avoid piracy, and be wary when a website insists that you download a new codec in order to watch a video or listen to a song.”
Sep 19 2008 1:30AM GMT
Posted by: Ken Harthun
Anti-malware,
Anti-virus,
Cybercrime,
Malware,
Virus
According to US-CERT, the cybercriminals who are foisting fake antivirus programs, such as Antivirus XP 2008 and 2009 off on innocent users, are now doing more than just ripping people off for the purchase price of their worthless programs–they’re going after personal and financial information. “If the user purchases the bogus software, the attacker may be able to obtain personal and credit card information for use in additional scams and fraudulent activity,” US-CERT reports. Their site has some recommendations on preventive measures to take.
US-CERT encourages users to perform the following preventative measures to help mitigate the risks:
- Install legitimate antivirus software from a trusted vendor, and keep its virus signature files up-to-date.
- Do not follow unsolicited web links found in email messages or instant messages.
- Use caution when visiting untrusted websites.
- Do not install untrusted software.
My bootable linux thumb drive virus scanner will remove this infection, but the best thing is not to get infected in first place.
Be careful out there.
Sep 13 2008 6:32PM GMT
Posted by: Ken Harthun
Anti-malware,
Anti-virus,
IRC bot,
Microsoft Windows,
Security,
Malware,
Secure Computing
It’s funny how sometimes we take for granted things like Microsoft’s Malicious Software Removal Tool (MSRT). That’s probably because it doesn’t do much to make its presence known. Every month, Microsoft offers MSRT (890830) through automatic updates and on the Windows Update site. Once installed, the tool runs in the background and quietly does its job. Many people don’t even know that MSRT can be run from the Microsoft.com website or downloaded and run at will.
System administrators and security researchers benefit from the reporting component that MSRT uses to send malware data to Microsoft. The Microsoft Malware Protection Center Threat Research & Response Blog regularly provides reports on the state of security and is an excellent resource for Internet security issues. “Cleaning Over 10 Million IRC Bots,” posted on September 8, 2008, for example, has a graph that clearly shows a general downward trend in IRC bots activity.
No doubt about it: MSRT and the related websites are powerful additions to anyone’s secure computing toolkit.
Sep 12 2008 2:22AM GMT
Posted by: Ken Harthun
Anti-malware,
Anti-virus,
Trojan,
Hacking,
Linux,
Security,
Malware
Forgive me if I brag a bit in this post, but I think I earned the right. You be the judge.
Last weekend, I noticed strange behavior on my home system. ESET Smart Security kept reporting that it had “found and quarantined m.exe, probably a variant of Win.Qhost trojan.” Every time I plugged in a USB thumb drive, ESET would pop up with the message. I couldn’t run HijackThis. If I tried to go to certain antivirus websites–Avira in particular–my browser closed. Sysinternals Process Explorer wouldn’t run. My thumb drive showed two hidden files: Autorun.inf and m.exe. Hmmm. Running ipconfig /displaydns revealed multiple connections to porn and malware sites. Searching Google led me to some tools that eventually fixed my problem at home. Turns out I had a bigger problem.
Apparently, I had picked up the infection from a client’s Exchange server and during my weekly tour there, I found that the tools I used on my XP machine wouldn’t run on Windows Server 2003. I tried everything in my arsenal; no tool found anything wrong. This thing was very stealthy; even Safe Mode didn’t disable it. I was about to give up. Then I remembered that I’d recently finished making up a bootable Linux thumb drive virus scanner using the AntiVir rescue CD, a tool that allows offline scanning (thank you, Avira, you made it a little easier for me). I booted the server to the thumb drive, ran the scan, rebooted the server, and voila! The infection was gone.
There’s a whole backstory to this incident that I won’t bore you with. Suffice it to say that I’m glad I put in the hours of hacking and research to come up with a really useful tool that I was able to use to help a client. Veni! Vidi! Vici!
Aug 23 2008 2:39AM GMT
Posted by: Ken Harthun
Cybercrime,
Anti-malware,
Anti-virus,
spam,
Malware,
Phishing,
Opinion,
Virus
According to Panda Security, the Oscarbot.UG virus, first detected on August 17, 2008, uses intelligent stealth techniques to avoid detection. “It deletes the original file from which it was run once it is installed on the computer. It uses several methods in order to avoid detection by antivirus companies [one of them being that it] terminates its own execution if it detects that it is being executed in a virtual machine environment, such as VMWare or VirtualPC.”
As reported by Help Net Security, the worm “stops running if it finds that it is being tried on virtual machines such as vmware, a sandbox or in a honeypot (these tools are often used to check in a controlled environment if an executable file is running malicious commands).
The good news is that anyone running a virtual environment is safe from infection: The worm won’t run and when you shut down the virtual machine, it’s gone. The bad news is that malware using this type of intelligent stealth is on the rise, raising the bar for anti-malware researchers.
At what point do we switch from a reactive anti-malware approach (blacklisting) to a pro-active one (whitelisting)? The day is fast approaching (it may already be here) when the programs designed to protect us become so huge and so invasive that they prevent us from getting any useful work done.
The best way to combat malware would be to take the profit out of spam, phishing scams, and other cyber-fraud crimes.
I don’t have the answer for that one.
Jul 31 2008 3:32AM GMT
Posted by: Ken Harthun
Security,
Anti-malware,
Malware
I’m flattered that Windows Secrets took my suggestion and published an article based on it. (Thanks, Scott!) I can’t give you a link because the article is only available to paid subscribers of the newsletter, but I will give you an excerpt:
By modifying the Hosts file yourself, you can prevent anyone using the PC without an administrator account from accessing unwanted sites. Prime candidates for blocking via this method are sites that host advertising, which can sometimes be a conduit for malware, as I explained in my Apr. 17 story.
To block a file served by the DoubleClick ad server, for example, you would add this line to your Hosts file:
127.0.0.1 ad.doubleclick.net
My article on using a hosts file is the basis for this. Do it. You’ll be safer on the web.
Jul 29 2008 10:47AM GMT
Posted by: Ken Harthun
Security,
Anti-malware,
Anti-virus,
Firewalls,
Malware,
Routers
A good many people have responded to my various articles on system security. Most of the feedback has been positive, but many wondered if there might be a simpler approach, some basic things you can do to protect yourself without too much hard work.
You’re in luck. Call it the lazy man’s way to system security; if you install protection against the the three biggest threats to your on-line security–infections by viruses, worms and Trojans, malicious software (spyware, adware, browser hijackers) and crackers who wish to secretly access and control your PC–you’ll be protected from the worst of security problems. One caveat, however: if you go to questionable sites (you know the ones I mean!) and are in the habit of clicking on links in pop-ups and spam emails, you’re out of luck—nothing can help you because you’re inviting infection.
But, for those who generally try to avoid the bad stuff, these are the four bare security essentials: a NAT router; a good antivirus program; a good anti-malware program; and, a good software firewall. Simple, and highly effective for most users.
Before you ask, the answer is yes, you still need a software firewall, even if you already have a NAT router or hardware firewall. Most hardware firewalls are configured to keep bad traffic from getting in, but will let most traffic from your network out, so they don’t keep those sneaky tracking programs from phoning home. A software firewall will at least give you some warning when a program is trying to access the Internet and you can decide whether to allow it. Besides, it gives you an extra layer of protection, just in case.
I highly recommend you read and apply Nine Steps to System Security - 2008, but if you’re feeling a bit lazy today, the four essentials will get you by.
Jul 27 2008 4:09PM GMT
Posted by: Ken Harthun
Security,
Anti-malware,
Anti-virus,
Firewalls,
Malware,
Phishing,
Vulnerabilities,
Email security,
spam,
Microsoft Windows,
Browsers,
NAT,
Routers,
Opinion,
Rootkit
It isn’t getting any better on The Wild, Wild Web, despite state and federal government attempts to arrest and prosecute those responsible for electronically-perpetrated criminal acts. Spyware and malware of all kinds are increasingly more stealthy and difficult to remove thanks to rootkit technology. With the advent of Web 2.0 and its emphasis on sharing and collaboration, web-based attacks are more prevalent than ever, especially those that rely on JavaScript and other scripting languages.
CAN-SPAM did little to deter or eliminate spammers, and today the spam problem is even worse thanks to huge botnets run by organized cyber-crime syndicates. Phishing attacks are harder to detect and more frequent. Recently, I spent the better part of two days cleaning up the aftermath of a mass mailer worm infection for one of our clients; their email is still being blocked by some servers. In its September 2005 issue, Consumer Reports said, “One Third Of Net Users Damaged By Malware.” Considering that article is three years old, I’d wager that the number of infected computers has doubled since then.
In my job as a systems engineer for Connective Computing, Inc., I deal with the effects of malware nearly every day. My previous releases of this article, Seven Steps to System Security - 2004 and Seven Steps to System Security - 2005, and Eight Steps to System Security – 2005, listed the field-proven steps I recommend to everyone I know. It’s been nearly three years since I published my latest version, but those eight steps haven’t changed much; they just need to be brought up to date, and a new step involving disabling scripting in the browser has been added. Computer users still haven’t learned safe surfing practices, however (will they ever?), and must modify their on-line behavior–particularly by applying the first step–for rest of these steps to be truly effective.
Did I mention these things are proven? They are. These are practices have been protecting computer users in homes and businesses for as long as I’ve been using them. This is free advice that’s really worth something:
- Repeat after me: I will NEVER, EVER click on any pop-up of any kind - NEVER, EVER. Not even on the “X” (it’s usually safe, but why take the chance?). Use the key combination Alt-F4 instead; it safely closes the current window. In the slimy world of sleaze-ware, “No” means yes, “Cancel” means yes, “Close” means yes - ANY click on a button means yes. So many times users ask, “How did I get that? I clicked ‘no’ when it asked me!” Well, sorry, but you clicked, so they got you. NEVER, EVER CLICK!
- Although Internet Explorer 7.0 has enhanced security and has been detached somewhat from the Windows operating system, it is still too big a target. Crackers are still writing malware that exploits IE security flaws. I recommend you use Firefox or Opera to browse the Web. (Some web sites still require IE, so you’ll be forced to use it for those, but you should minimize its use otherwise.) Whatever browser you use, be sure you configure your preferences to block all unwanted pop-ups or install a pop-up killer like the Google Tool Bar. And while you’re at it, re-read #1!
- Patch your system. If you’re still running XP, make sure you have at least service pack 2. If you’re a home user, install service pack 3. (I still see systems that are running XP with service pack 1 or 1a, probably because they turned off automatic updates. While some argue against it, I recommend you turn them on.) And be sure to install any recommended security updates and patches for ALL software on your system, - especially Microsoft Office - not just Windows. If you’re running Windows Vista, you benefit from its enhanced security, but you still need to keep ALL of your applications patched. Secunia’s Online Software Inspector is an excellent tool for scanning your system’s applications to discover those that need updates.
- Besides installing a NAT router (see How to Secure Your Computer: Maxim #2), run a properly-configured, proven software firewall. Don’t rely only on Windows XP’s built-in firewall - it blocks inbound attacks only (see this article) and it has flaws of its own (see this article). It will not stop back-door trojans, adware, spyware, and the like from “phoning home” with your sensitive information. (See this article for more info.) While Vista’s firewall does offer outbound filtering, it isn’t much better (see this article for more information). My favorites are the Comodo Personal Firewall (free), and the Sunbelt Kerio Personal Firewall (full-featured for 30 days, then runs free in limited-feature mode, $19.95/yr for full version).
- Run a good anti-virus program. Choices abound. I have used AntiVir Personal Edition (free) and Grisoft’s AVG (free). Other good ones are Avast! and Comodo AntiVirus.
- Run multiple anti-spyware/anti-adware programs and keep them updated. I recommend: a. Spyware Blaster. This free program blocks adware and spyware from installing in the first place and is frequently updated; b. Ad-Aware. Scan weekly, more frequently if you are a heavy surfer; c. Spybot S&D. Run it on the same schedule as Ad-Aware; d. Microsoft’s Windows Defender is an excellent product and is installed by default in Windows Vista. Configure it for real time protection and automatic updates. One of the best commercial anti-spyware applications is Sunbelt Software’s CounterSpy. It is a PC World Best Buy award winner. Comodo BOClean:AntiMalware is also a good one and it’s free.
- Run a spam blocker to isolate junk e-mail. Most malware and all phishing attempts rely on spam. You want to isolate this stuff and delete it. NEVER, I repeat, NEVER, EVER click on a link in any e-mail you are not absolutely certain is legitimate. And to be as safe as possible, always type in the address of your bank, credit card companies, and any other site that you want to keep secure. (See #1 above and apply that principle to links, too!) One of the best programs is Open Field Software’s ella for Spam Control. It uses wizards to “train” it to your personal specifications. There are free and paid versions that work with Outlook, Outlook Express. My clients swear by it. Another good program is Sunbelt Software’s iHate Spam.
- On Windows XP, set up a restricted user account and use that for routine tasks. Only log on with administrative privileges when you need to install or configure software. This will prevent rogue programs from affecting your system - they won’t be able to install. You can activate the “run as” feature so you can do administrative tasks while logged in as a restricted user. Microsoft Knowledge Base article Q294676 explains how to activate and use this feature. If you are running Vista, you don’t have to worry about this step: User Access Control (UAC) takes care of it.
- Finally, disable scripting in your browser. If you use IE (you probably shouldn’t, see Step 2), Tony Bradley gives you an excellent step-by-step procedure to accomplish this. Firefox users have a more elegant solution in the form of an add-on: NoScript. I use it on every PC. Scripts are blocked globally by default, but you can selectively activate them if you trust the site. For example, you can trust the main site’s scripts but keep blocking any advertising or other third party scripts with no ill effects.
While total immunity is impossible - new infections and variations on existing exploits appear daily - these nine steps will help prevent, catch, or clean 98 percent of the junkware out there. As for the other two percent - or if you are already badly infected - you’ll need to hire a geek like me.
Jul 19 2008 12:58AM GMT
Posted by: Ken Harthun
Networking,
NAT,
Routers,
Security,
Firewalls,
Malware,
Vulnerabilities,
Microsoft Windows
I just love stories like this one. On the one hand, Internet Storm Center researchers say an unpatched PC connected to the Internet will be compromised in less than four minutes. On the other hand, a researcher and co-founder of the German Honeypot Project (GHP), Thorsten Holz, claims the survival time is much higher than 4 minutes and in fact is nearer 16 hours. “Compared to the survival time from the Internet Storm Center [ISC] which is currently below five minutes, we measure a higher survival time,” he said in a post to the project’s blog. The blog has some interesting graphs, one of which shows that survival time is just under 1000 minutes, or about 16 hours.
So, which is it? Do we believe ISC or GHP? I can tell you from experience with my own firewall logs that my IP address is probed for common vulnerabilities about every two minutes, sometimes as often as once per minute. Based on this, I’d be inclined to believe ISC’s estimate. The bottom line is it doesn’t really matter who’s right–we all agree that it’s a bad idea to connect an unpatched PC to the Internet. From the ISC diary:
While the survival time measured varies quite a bit across methods used, pretty much all agree that placing an unpatched Windows computer directly onto the Internet in the hope that it downloads the patches faster than it gets exploited are odds that you wouldn’t bet on in Vegas. Using a NAT router and a correctly configured personal firewall is the way to go - both these measures help a lot to improve the odds in favor or your PC.
Be careful out there.
Ken is a Systems Engineer at Connective Computing, Inc. specializing in network and desktop security for small and medium businesses. Ken helps others through his Ask the Geek blog, is a regular contributor to Dave’s Computer Tips newsletter, and is currently working on his first consumer-oriented book on computer security.
