F-Secure on how to "un-Google" yourself. Privacy tips for the paranoid!

A personalized web-experience comes at a price to your privacy.  We all (to some degree) probably appreciate personalized content, relevant ads (since we have to look at them anyway) and the ability to easily share with others the timely nuggets we find about the web.

Check out this article from the Safe and Savvy  blog about how to limit what information Google can use when you are on their services/sites.

Facebook Data Harvested to Build List of Likely Logins

A researcher published a torrent file containing the name of every Facebook user that hasn't specifically opted out. The list was obtained by harvesting a public directory that Facebook maintains.

This list was then used to determine the likely variations of "first initial last name", "first name last initial" and so on, which could be helpful at increasing the success of users attempting to log in to systems using brute-force tactics.

The details of how this was done are available at: http://www.skullsecurity.org/blog/?p=887

Security Secrets the Bad Guys Don't Want You to Know

PC World has a nice easy read on safer Internet browsing.

From the article:

"You already know the basics of internet security, right?

You know to keep your antivirus program and patches up to date, to be careful where you go on the Internet, and to exercise online street-smarts to resist being tricked into visiting a phishing site or downloading a Trojan horse.

But when you've got the basics covered, but you still don't feel secure, what can you do? Here are a few advanced security tips to help you thwart some of today's most common attacks.

Remember, however, that security is all about trade-offs. With most of these tips, what you gain in security, you lose in convenience. But hey, it's your computer. Be as paranoid as you want to be."

http://www.pcworld.com/article/201309/security_secrets_the_bad_guys_dont_want_you_to_know.html?tk=hp_new

Scareware/Rougeware Propogation Tactics

If this article doesn't make you uncomfortable, you may need to re-read it.

The infection routines being used by some scareware and rogue AV gangs are much more comprehensive and far-reaching than many current analysis have shown

Quote from SANS -
""Once the site has been compromised, the attackers install their script in any directory, preferably in a directory that is not accessible directly from the web since they will not need to access it directly. The next step the attackers do is to infect all (and I mean all!) PHP files on the compromised web site. If it's a shared web site, and the permissions are not setup correctly, they will actually infect absolutely every web site hosted on that machine," 

Read the full article and Threatpost

The Asprox Spambot Resurrects (apparently with some new tricks)

Been awhile since we've heard anything about this particular Botnet, but seems it's sparked back to life -

"With the help of Pushdo and Bredolab downloader, it seems Asprox has risen from the dead to build another spamming bot network. The above analysis also highlights the intricate relationships between individual malware components, and hint at a common gang behind it all."

Stable release of Firefox 3.6.4 delayed

Mozilla has confirmed that it is delaying the the release of [Firefox] version 3.6.4.  Launch date TBD

The development of browsers that "sandbox" or isolate historically problematic plugins and processes is encouraging. Look forward to seeing how this changes development of other apps that are reliant on external programs.

RC for this release can be found here

NetMarketshare's OS report

Graph showing OS market share over the past year (my apologies, but you have to click on the images to look at them.. too much info for a small graph).



Here is the current month -


One of the things that stood out to me was the number of mobile devices/OSes captured from last years reports in June (e.g. iPhone from .20 to .60%).

McAfee - Interesting look at common "exploit packs" and target vulnerabilitites

Affordable and readily available tools for miscreants who want to use your computer for bad things...

Very interesting look at the kits and what well-known exploits they go after -

Check out McAffee's blog post for other images from these kits and their very informative write-up (including prices) on this.

Mac users get own their version of a Windows Spyware variant

.."some [free Mac downloads] include a new piece of invasive spyware"


List of applications known to contain this malicious code -

• Secret Land ScreenSaver v.2.8
• Color Therapy Clock ScreenSaver v.2.8
• 7art Foliage Clock ScreenSaver v.2.8
• Nature Harmony Clock ScreenSaver v.2.8
• Fiesta Clock ScreenSaver v.2.8
• Fractal Sun Clock ScreenSaver v.2.8
• Full Moon Clock ScreenSaver v.2.8
• Sky Flight Clock ScreenSaverv.2.8
• Sunny Bubbles Clock ScreenSaver v.2.9
• Everlasting Flowering Clock ScreenSaver v.2.8
• Magic Forest Clock ScreenSaver v.2.8
• Freezelight Clock ScreenSaver v.2.9
• Precious Stone Clock ScreenSaver v.2.8
• Silver Snow Clock ScreenSaver v.2.8
• Water Color Clock ScreenSaver v.2.8
• Love Dance Clock ScreenSaver v.2.8
• Galaxy Rhythm Clock ScreenSaver v.2.8
• 7art Eternal Love Clock ScreenSaver v.2.8
• Fire Element Clock ScreenSaver v.2.8
• Water Element Clock ScreenSaver v.2.8
• Emerald Clock ScreenSaver v.2.8
• Radiating Clock ScreenSaver v.2.8
• Rocket Clock ScreenSaver v.2.8
• Serenity Clock ScreenSaver v.2.8
• Gravity Free Clock ScreenSaver v.2.8
• Crystal Clock ScreenSaver v.2.6
• One World Clock ScreenSaver v.2.8
• Sky Watch ScreenSaver v.2.8
• Lighthouse Clock ScreenSaver v.2.8

Microsoft continues uphill battle against the Alureon rootkit

"According to the Microsoft Malware Prevention Center (MMPC), this month's Malicious Software Removal Tool (MSRT) has scrubbed the Alureon rootkit from over 360,000 Windows PCs since its May 11 release. That represented 18.2% of all MSRT detections for the month, more than double the 8.3% the rootkit accounted for in Apr"


"Almost two-thirds (65%) of the PCs infected with Alureon this month were running Windows XP Service Pack 3 (SP3), with the No. 2 spot taken by Windows XP SP2 (14%). Only 3.5% of the rootkit-infected PCs were running Windows 7, said Microsoft."


Have to give Microsoft credit for not giving up on this.  The longer this problem persists, the longer these machines stay vulnerable.  They are aiming at an unpredictable, moving target though.

Devious New Phishing Tactic Targets Browser Tabs

The essence of phishing is taking advantage of user trust. This attack exemplifies that in every form. Even advanced users may be caught off guard by this scheme. Make sure you check your address bar!

Some good news is that users running NoScript, Safari or Chrome don't seem to be affected by these iterations of the attack.

Example of concept is here

Present Day History of Conficker

This entertaining write-up on the history of Conficker reveals some of the complexity behind the worm. The story also explains the back and forth escalation between the highly proficient authors of the worm and the Conficker Cabal including some interesting details like Confickers implementation of bleeding-edge encryption.

Link: The Atlantic

New Rogueware links identified in many popular entertainment related search queries

MySecurityEngine is a FakeAV (Rougeware) application that seemed to surface towards the end of April. This strain of Rogueware is seeing heavy propagation due to what appears to be a very effective employment of Malicious Search Engine Optimization.

The distributors have been observed achieving very high search rankings for queries on the following topics:

Lost episodes
Friday Night Lights
The Boondocks
The Hills
Family Guy
Iron Man 2
Misc. Popular Musicians
Death of Ronnie James Dio
.. and others

Panda Labs describes the software as:
"MySecurityEngine is an adware program that deceives users warning them of unexisting threats in their computers so that they purchase a certain program that removes them from the computer.

Additionally, it prevents users from accessing certain search engines and from running certain security programs, like antivirus solutions, firewalls, or even fils belonging to fake antivirus programs. It also modifies the searcher that is displayed in the Search option of the Internet Explorer browser.

MySecurityEngine can reach the computer in spam messages containing a link or an attached file, or through malicious websites that have obtained googd positions in the search engines by using BlackHat Seo techniques"

File-sharing can be risky business!

There are many free or inexpensive ways to consume high-quality media online such as Centurylink Video Store, CenturyLink Unlimited Music (and videos), Netflix, iTunes, Hulu and others.

Using reputable services like these can provide great content and save a lot of frustration.

New and improved Zueskit payload from spam messages

Be very careful of this one. It appears that there is limited detection for these variants.

"for instructions and an executable that is meant to be the patch to apply. The executable file named adbp932b.exe (SHA1 0632f562c6c89903b56da235af237dc4b72efeb3) has minimal coverage of about 7%."

Facebook Privacy Check - From the F-Secure Blog

Often, the lines between online privacy and online security merge. Such is the case with many of the changes made on Facebook recently. Many folks don't think about the impacts of data they share online. How is it used, is it shared, and what is the impact to your "friends".

Try this interesting app to see what the privacy and security footprint of your Facebook profile really looks like. It may surprise you!

We'll try to add some discussion about social networking (from both sides of the field) and specifically the recent changes to Facebook in our next webcast.

Phishlabs baits a phisher (and reports some great insight)

Another great article from Brian Krebs. This one shows some really detailed info about what goes on behind the scenes in a "phishing racket".

The fact that this type of activity is now being made available to mainstream opportunists is a double-edged sword. While the prevalence is increasing, it allows allows researchers more opportunities to capitalize on amateurs making mistakes. This was just one such case.

This SC based research organization found this phisher's "back door" and watched it.

AS50896 - (PROXIEZ) Gets Taken Offline

This network was harboring some really bad stuff. While I'm sure these miscreants will find a new home for their garbage, it's always encouraging to see this. If law enforcement keeps up the tempo on arrests and take-downs, it increases the risk and potential loss associated with this type of activity.

Increased risk (and potentially higher operating costs) drastically changes the equation for online fraudsters and provide deterrent that has been lacking in the past.

As a "double whammy" today, I'm including a video of yet another Romanian Law Enforcement agency taking a group of scammers into custody.

"Sexiest Video Ever" on Facebook is a front for Malware

Websense article about this very successful campaign currently running on Facebook.

Adding this to your profile puts you and your friends in jeopardy. Please don't follow these links!

"When clicking on the "video" you are taken to an application installation screen asking you to allow it to access your profile, wall etc. Once approved it claims you have to download an updated FLV Player to view the video and promptly sends an EXE your way...

This is the Hotbar Adware which displays ads in your browser based on your browsing habits etc. In addition, the Facebook application just installed will post messages on your friends wall on your behalf with the same "sexiest video ever" message."

Attack Method Bypasses Anti-Virus

Researchers have revealed a method for bypassing just about any anti-virus software by swapping "safe" code for "malicious" code after it has been scanned, but before it has been executed.

Links:

Article

Research Paper

Updates 5/11/2010 --

Responses from AV Vendors:

F-Secure

Sophos

US Treasury Websites Serving Malware

The Register reports that the US Treasure Department website has been compromised and was serving up malware to visitors as recently as Monday.

Full details at The Register:

http://www.theregister.co.uk/2010/05/03/treasury_websites_attack/