February 2007 - Posts

 

of the growing number of threats that ride on the rising popularity of digital media and file sharing over the Internet, joining TROJ_ZLOB, among others.

However, TSPY_DENUTARO, like any other persistent threat today, is changing. New variants discovered over the last few days now pretend to be screensaver files. One of these variants is TSPY_DENUTARO.DM. Notably, the file size is reduced considerably (though still much bigger than most threats), and they now use the WinZIP icon.

Nevertheless, once executed on a system, these new variants perform the original family routine: they take a screenshot of the system and, along with the system’s hostname and IP address, upload it to a certain FTP site.

New variants even continue a family tradition: they delete image, video, and archive files, and then, using the file names of deleted files, drop screenshots of Japanese anime with subtitles that seem to attack the illegal use of P2P sites, now matter how ironic that sounds. Images dropped by older variants have said “Are you enjoying committing illegal activities through P2P? If you don’t stop that, I will kill you.” The new variants’ images now say “So, you are still using Winny even after {the creator} lost in his case. I hate you guys.”

This is in reference to the recent conviction of the creator of Winny, the most popular P2P application in Japan, for allegedly conspiring to commit copyright violation (arising from the earlier arrest of two Winny users who allegedly shared copyrighted material). The creator got overwhelming support from the computing community in Japan when he was arrested, calling the arrest wrongful.

Apparently, the authors of TSPY_DENUTARO share the same sentiment. Whether this supports the Winny creator’s plea for innocence or further incriminates him, is not clear.

Source: Movie Files Then, Screensavers Now -  TrendLabs | Anti-Malware Blog - by Trend Micro

 

Skypezov?
Posted by Mikko @ 15:46 GMT


We have two reports of people receiving links to a Warezov-infected file via Skype.

Now, some older Warezov variants have used other Instant Messaging client in a similar fashion, but not Skype.

The messages looked like this:

skypezov

We detect the binary at that download location as Warezov.ly.

Source: F-Secure : News from the Lab - February of 2007

 Now THIS is funny!

Malware writer got infected!

Monday February 26, 2007 at 1:22 pm CST
Posted by Pedro Bueno

Trackback

It is funny to pick on malware writers…I like it… :) This time I would like to recommend that they use anti-virus as well, otherwise they can also be infected ! :)

There is no honor among malware writers and we know that. Today I was looking at a file downloaded by what was looking like a common PWS-Banker.dldr (a downloader for Password Stealer Bankers). While doing some analysis on the file, another virus detection came out: W32/Gael.worm.a. This one is a parasitc virus. This made it a bit more suspicious because it is not common to see a PWS-Banker downloader downloading a parasitics virus (really different skills). So, I attempted to clean it to try to make things a bit more clear. I cleaned the file and BINGO! :) another file came out, detected as PWS-Banker.gen.q ! :) Which means that the malware created/bought by the malware writer was infected or he/she got infected before posting the file on the site to be downloaded… :) . Yeah, my job is tooo funny! :)

Source: Computer Security Research - McAfee Avert Labs Blog

 

New MySpace Nasty
Posted by Mikko @ 15:34 GMT


There's something new spreading on MySpace.

It ends up modifying existing profiles, overlaying the content with a message like this:

MySpace

If you follow the link, you'll end up with a download. This is a Zlob variant.

We haven't finished our analysis on this, but apparently when run it tries to modify your MySpace page to include a code snippet that is responsible for the malicious download link.

Code

Source: F-Secure : News from the Lab - February of 2007

 

Flaw found in Office 2007

By Dawn Kawamoto, CNET News.com
Published on ZDNet News: February 23, 2007, 1:17 PM PT

Researchers have discovered a "highly critical" security flaw in newly released Office 2007, despite Microsoft's efforts to deliver its most secure version yet of the productivity software.

The consumer version of Office 2007, which launched only four weeks ago, is designed to withstand higher scrutiny by malicious code writers, as Microsoft subjected the software to code auditors as part of its security development lifecycle.

But researchers at eEye Digital Security found a file format vulnerability in Microsoft Office Publisher 2007, which could be exploited to let an outsider run code on a compromised PC.

"We were surprised we could find a flaw so quickly (after Office 2007 launched) and one that was part of their core products," said Ross Brown, eEye's chief executive.

An attacker could create a malicious publisher file, he said. Once the recipient opens the file, he or she could find the system infected and susceptible to a remote attack.

Researchers at eEye used a standard process of code auditing in discovering the vulnerabilities, Brown added. He noted that Microsoft either did not do a "good job" with its code auditing, or it may not have had enough people working on such a task.

Microsoft, meanwhile, said it is investigating eEye's report of a possible vulnerability in Publisher 2007 and will provide users with additional guidance if necessary.

Executives at the software giant have recently said they expect security challenges to keep emerging, as an increasing number of devices connect to the Internet.

No public exploits have been reported in circulation for Publisher 2007 and, given Office 2007's recent release, the flaw may hold little attraction for attackers who may wish to concentrate on software that is in greater distribution, eEye said.

Source: Flaw found in Office 2007 | Tech News on ZDNet

 

Firefox 2.0.0.2 released

Published: 2007-02-23,
Last Updated: 2007-02-23 20:13:43 UTC
by Jim Clausing (Version: 2)

The Mozilla folks have released the long-awaited version 2.0.0.2 of Firefox.  The second link below shows that 7 security issues were fixed.  One rate critical.  Bugs fixed appear to include CVE-2007-1004, CVE-2007-0995, CVE-2007-0981, CVE-2007-0800, CVE-2007-0780, CVE-2007-0779, CVE-2007-0778, CVE-2007-0777, CVE-2007-0776, CVE-2007-0775, CVE-2007-0008, and CVE-2007-0009, among others.  This also fixed the issue with the password manager that was exploited late last year, CVE-2006-6077.  The bookmarklet vulnerability CVE-2007-1084 does NOT appear to have been addressed.
Release Notes: http://www.mozilla.com/en-US/firefox/2.0.0.2/releasenotes/
Security Issues: http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.2

Source: SANS Internet Storm Center; Cooperative Network Security Community - Internet Security - isc

********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: February 23, 2007
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS07-010
* MS06-058

Bulletin Information:
=====================

* MS07-010

- http://www.microsoft.com/technet/security/bulletin/ms07-010.mspx
- Reason for Revision: Bulletin updated: "Frequently Asked Questions (FAQ) Related to This Security Update" section in "Executive Summary" for WSUS Windows Defender update process.
- Originally posted: February 13, 2007
- Updated: February 22, 2007
- Bulletin Severity Rating: Critical
- Version: 1.1

* MS06-058

- http://www.microsoft.com/technet/security/bulletin/ms06-058.mspx
- Reason for Revision: Bulletin updated: Further investigation of CVE-2006-3877 as originally revealed that the update was not effective in removing the vulnerability from affected systems.  The Microsoft Security bulletin, MS07-015 has been issued to properly address CVE-2006-3877 and customers should apply the updates in this bulletin immediately.
- Originally posted: October 10, 2006
- Updated: February 21, 2007
- Bulletin Severity Rating: Critical
- Version: 1.1

********************************************************************

 

On the trail of Downloader-AAP

Thursday February 22, 2007 at 9:50 am CST
Posted by Vinoo Thomas

Trackback

Downloader-AAP a.k.a Clagger has been an active family of trojans that has been regularly spammed since May 2005. This trojan downloader provides an excellent case study of how a carefully thought out social engineering approach can deceive users into opening executable attachments in mail.

The Downloader-AAP trojan is usually targeting German computer users who by now must be familiar with receiving spammed mails with executables named “Rechung.pdf.exe or Rakningen.exe or Empfangs.exe”. You would think most organizations would be blocking executables by extension at the email gateway or that people would be careful about running .EXE files. Out of morbid curiosity as to how successful the authors of Downloader-AAP are with their approach, I decided to follow the trojan’s trail back to the author.

Upon infection, the trojan does a WHOIS on the ip address of the infected machine and posts all cached passwords to a webserver hosted in Germany, with folders arranged according to country’s domain name.

WebServer hosting stolen passwords

Apparently business is good!! There were around 95 countries in all starting from .AE (UAE)  to .ZW (Zambia). Pretty decent payback for plain social engineering huh? Looking at the file folder for .DE (Germany), one can see many folders created for infections that occurred around the time the trojan was mass spammed to users.

Stolen German accounts

Each sub folder is created based on a unique hash value generated for every infected machine and contains text files with the stolen passwords. A sample text file with cached auto complete passwords is as follows:

Stolen passwords

Given that there are thousands of folder and files, how do the authors look for interesting information? Apparently the authors are using bash scripts and the favorites searches are for “bofa, citi, chaser, hsbc and nordea”. (No prizes for guessing the $$$Bank$$$ connection.)

The modus operandi of these criminals is to target vulnerable *nix machines on the internet running Apache. Once the server is compromised, they mass spam an undetected version of the trojan to thousands of email address and any stolen passwords from infected users are posted to this server. Once the rogue server has been found out and taken offline, they find a new target and this vicious circle of crime continues.

The good news is we got root access to the server and were able to collect some incriminating evidence to pass on to the authorities. Hope to hear something soon from them.

Source: Computer Security Research - McAfee Avert Labs Blog

 

Credit Card Data Breaches
Posted by Sean @ 13:50 GMT


There's been quite a lot of news regarding TJX Companies and their data breach. The most recent news is that the amount of data stolen was greater than was earlier reported during January.

TJX is the parent company of Marshalls and TJMaxx (TKMaxx in Europe). The breach affects a great many people and their credit card numbers. Click here and here for more details.

Some journalists from Sweden visited for an interview a few weeks ago. As more are more financial transactions are occurring online, Mikko was asked a question along the lines of… What can average consumers do to protect themselves from credit card fraud?

And the answer was in essence – Carefully read and review your billing statement.

Billing Statement

This is true whether you shop online or not. TJX operates "brick and mortar" stores. Yet, your credit card transactions exist on their network. Most business transactions are "online" today in one way or another.

So review and audit your statement each month. If you have access to it electronically then perhaps review it more often. If you see anything that you don't recognize – call your card issuer. We've sought information many times in the past (forgetful after long trips) and the people on the other end of the line were always very willing to assist.

Source: F-Secure : News from the Lab - February of 2007

 

New Web-based Email Worm Found

February 23rd, 2007 by Eric Avena

Trend Micro has received reports of a new worm spreading in the wild. This new worm, detected as WORM_ZHELATIN.CH, propagates via Web-based email messages. Some of the affected email service providers are the following:

  • AOL
  • Bellsouth
  • Care2
  • Comcast
  • EarthLink
  • FastMail
  • Gmail
  • Hotmail
  • Lycos
  • Outblaze
  • Rambler
  • Tiscali
  • Yahoo!

Users of these email service providers are advised to be wary of email messages from unexpected sources.

It is interesting to note that one of the affected email service providers is Rambler, one of the biggest Russian search engines and Web portals.

Trend Micro is conducting an in-depth analysis of this worm. More information will be posted shortly.

Update (02.23.2007):

Upon further analysis, this worm apparently connects to a certain URL in order to retrieve message details (or message templates), which it sends using the abovementioned Web-based email service providers.

It also drops TROJ_AGENT.JWE, a Trojan that is registered as a Layered Service Provider (LSP). This routine allows this worm to intercept and log network traffic before it redirects an affected user to an originally desired Web site. Apart from fully entrenching the dropped Trojan on the system, that is.

The Trend Micro URL Filtering Engine already blocks the malicious links related to this malware. However, user are still advised to avoid clicking on suspicious links even if they come from known and trusted sources.

Source: New Web-based Email Worm Found -  TrendLabs | Anti-Malware Blog - by Trend Micro

 

This new vulnerability is rated as low risk and could be used in phishing or other deceptive schemes by malicious people.
Internet Explorer 7 "onunload" Event Spoofing Vulnerability
http://secunia.com/advisories/23014/
http://msmvps.com/blogs/spywaresucks/archive/2007/02/23/611544.aspx

quote:
Secunia Research has discovered a vulnerability in Internet Explorer 7, which can be exploited by a malicious website to spoof the address bar. The vulnerability is caused due to an error in Internet Explorer 7's handling of "onunload" events, enabling a malicious website to abort the loading of a new website. This can be exploited to spoof the address bar if e.g. the user enters a new website manually in the address bar, which is commonly exercised as best practice.

_____________________________

Harry Waldron - Security News & Best Practices Blog

Source: IE 7 - New address bar spoofing vulnerability

 

'Pharming' attack hits 50 banks

By Jeremy Kirk, IDG News Service

Hackers made an extra effort with this one...

Jeremy Kirk, IDG News Service
22 February 2007

An attack this week that targeted online customers of at least 50 financial institutions in the US, Europe and Asia-Pacific has been shut down, a security expert said Thursday.

The attack was notable for the extra effort put into it by the hackers, who constructed a separate look-alike Web site for each financial institution they targeted, said Henry Gonzalez, senior security researcher for Websense.

To be infected, a user had to be lured to a Web site that hosted malicious code exploiting a critical vulnerability revealed last year in Microsoft software, Websense said.

The vulnerability, for which Microsoft had issued a patch, is particularly dangerous since it requires a user merely to visit a Web site rigged with the malicious code.

Once lured to the Web site, an unpatched computer would download a Trojan horse in a file called "iexplorer.exe," which then downloads five additional files from a server in Russia. The Web sites displayed only an error message and recommended that the user shut off their firewall and antivirus software.

If a user with an infected PC then visited any of the targeted banking sites, they were redirected to a mock-up of the bank's Web site that collected their login credentials and transferred them to the Russian server, Gonzalez said. The user was then passed back to the legitimate site where they were already logged in, making the attack invisible.

The technique is known as a pharming attack. Like phishing attacks, pharming involves the creation of look-alike Web sites that fool people into giving away their personal information. But where phishing attacks encourage victims to click on links in spam messages to lure them to the look-alike site, pharming attacks direct the victim to the look-alike site even if they type the address of the real site into their browser.

"It takes a lot of work but is quite clever," Gonzalez said. "The job is well done."

The Web sites hosting the malicious code, which were located in Germany, Estonia and the UK, had been shut down by ISPs as of Thursday morning, along with the look-alike Web sites, Gonzalez said.

It was unclear how many people may have fallen victim to the attack, which went on for at least three days. Websense did not hear of people losing money from accounts, but "people don't like to make it public if it ever happens," Gonzalez said.

The attack also installed a "bot" on users' PCs, which gave the attacker remote control of the infected machine. Through reverse engineering and other techniques, Websense researchers were able to capture screenshots of the bot controller.

The controller also shows infection statistics. Websense said at least 1,000 machines were being infected per day, mostly in the US and Australia.

Source: Techworld.com - Security News - 'Pharming' attack hits 50 banks

 

Google Desktop Cross-Site Scripting Weakness

Google Desktop is prone to a cross-site scripting weakness because the application fails to properly sanitize user-supplied input.

Successful attacks must exploit this weakness in conjunction with a latent cross-site scripting vulnerability in the 'google.com' domain.

Attackers may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow attackers to access the contents of the Google Desktop search index or potentially to execute arbitrary code.

Source: Google Desktop Cross-Site Scripting Weakness

Hmmm isnt this interesting.... 

Google Apps Premier Edition Takes Aim at the Enterprise

By John Pallatto
February 22, 2007

After months of testing, Google is ready to see whether businesses large and small are ready to pay to use its online suite of basic business applications, including spreadsheets, e-mail, word processing, calendars and instant messaging.

Google, which has steadily transformed itself from a search engine pioneer into a data access, Internet advertising and business application powerhouse, introduced on Feb. 22 its Google Apps Premier Edition at a cost of $50 per account per year.

The Premier Edition adds Google Docs and Spreadsheets; Gmail for mobile devices on BlackBerry; and application-level controls to Google Calendar, Gmail, Google Talk and Start Page applications that the company introduced as a free service starting in August 2006.

While the free applications were initially offered to serve small and midsize companies, the Premier Edition has collaboration and management features that will appeal to companies of all sizes, including large enterprises, said Dave Girouard, vice president and general manager of Google's enterprise group in Mountain View, Calif.

Google Docs and Spreadsheets allow multiple employees to work on the same document simultaneously and the applications keep track of all revisions and edits. The application-level control features allow administrators to set limits on how documents are shared inside and outside an organization.

Click here to read about the launch of Google's private-label apps start pages.

Google is supporting the apps with a 99.9 percent update service-level agreement in which customers will receive credits for downtime. The company is also offering 10GB of storage per user, as well as application programming interfaces to enable data migration, user provisioning and single sign-on, along with mail gateways to allow businesses to customize their e-mail service.

These features are helping to draw interest from large organizations that "have a desire for choice," Girouard said. Google is seeing a "higher level of interest from big company CIOs than we would have expected at the start," he said.

Providing basic business applications, spreadsheets, word processing and e-mail as an online service "is a big opportunity in the market that nobody has taken advantage of yet," he said.

But Girouard denied that the Premier Edition is designed specifically to take market share away from Microsoft Office. Google doesn't believe that enterprise customers will "buy any less Microsoft products" because they decide to use Google Apps. Instead they expect that companies will use Google apps as a supplement to their Microsoft Office applications and to give employees who wouldn't normally have a copy of Microsoft Office on their desktops a chance to use the Google productivity applications online, Girouard said.

Surveys have shown that more than 40 percent of the work force isn't given access to e-mail by their employers, Girouard said. Google Apps could provide an inexpensive way for employers to provide e-mail access to workers in retail or in other industries where people are not normally linked to desktop workstations, he said.

To read Peter Coffee's view on whether Google poses a serious challenge to Microsoft Office, click here.

But analysts said that the Premier Edition poses a long-term challenge to Microsoft, which has garnered huge revenues and profits from selling its Office package for hundreds of dollars a copy plus annual maintenance fees.

"This is the first time there is a compelling, low-cost, service-based alternative to Microsoft Office. And although Google isn't positioning this offering directly against Office, that's where it is headed," said Erica Driver, principal analyst with Forrester Research in Cambridge, Mass.

Next Page: Window of opportunity.

"Microsoft has a couple of years' opportunity to respond to this. But it is certainly an indicator of the direction in which Google is headed. And I fully expect [Google] to add more and more features and capabilities into this suite," Driver said.

In the next few years, said Driver, Google will focus on delivering this service to workers who wouldn't normally have access to Microsoft Office.

"But looking ahead a few years, I see this cutting into Microsoft's revenues and I also see it forcing Microsoft to consider alternative delivery mechanisms for its own products—most noticeably software as a service," she said.

Microsoft is definitely going to have to find a way to respond to the challenge posed by Google Apps over the next five years, said Jim Murphy, research director with AMR Research in Boston.

"It is the beginning of probably the most significant challenge we have seen to Microsoft on the desktop, enterprise or otherwise, in probably 10 years," when it was locked in competition with IBM over the Lotus desktop applications, Murphy said.

What do corporate executives think about Google's chances of cutting into Microsoft's Office and Live business? Find out here.

The introduction of Google Apps is "timely," he said, because enterprises will soon have to decide whether they will upgrade to the latest version of Microsoft Office.

Companies of all sizes will likely experiment with Google Apps before they decide whether to carry out the next Office upgrade. "At least it's going to interest CIOs, and they are going to look at it," Murphy said.

"In five years we'll see a more competitive environment" in the desktop applications market, Murphy said. Microsoft will at least have that much time to decide whether it can use its own experience with the Office Live applications to successfully shift into the software-as-a-service model, he said.

One company that decided to make the shift is Prudential Real Estate Affiliates, a Chicago-area franchise that employees 450 sales agents and support staff. The agency has been using Gmail for nearly a year in place of an outsourced e-mail service that performed so poorly that it had to be replaced, said Camden Daily, the group's technology director.

The agency had already worked with Google on the Google Earth and Maps projects, so it used its Google contacts to join the Gmail beta program. "We went ahead and switched, and basically everybody loved the interface ever since," he said.

Daily said he rarely gets complaints from users saying they can't access the Gmail service or are having trouble learning how to use it.

Using Gmail also saves Daily a lot of time and effort in software installation and maintenance. "We're a pretty big real estate company. But we only have a couple of people in our IT department," he said. Since all software updates and patches will be handled in Google's data center, "if a new a new update comes along, I'm not going to have to walk around and touch 50 machines to install it. I don't have to worry about patches, security problems," Daily said.

There is also a lot of interest among the agency staff in using the Google Calendar, he said. But the agency has been holding off until it finds the right synchronization utility for staffers who want to access the calendar with their BlackBerrys and other smart devices.

Check out eWEEK.com's Enterprise Applications Center for the latest news, reviews and analysis about productivity and business solutions.

Source: Google Apps Premier Edition Takes Aim at the Enterprise

 

Kernel Malware
Posted by Kimmo @ 08:34 GMT


Last December, I blogged about the AVAR 2006 conference where I presented my paper on kernel malware. Finally, we are able to provide the material for our readers. Both the paper and slides are available in PDF format.

The paper – "Kernel Malware: The Attack from Within" – is about kernel malware, explaining what they are, how they work, and what makes their detection and removal challenging. It also looks at two interesting malware cases utilizing kernel-mode techniques to avoid detection and to bypass personal firewalls.

An important part of the paper was a statistical analysis run over a large sample set to investigate how the kernel malware trend has changed over the years. Details for the analysis can be found from the paper but I thought it would be nice also to post the results here. Below, we have two graphs demonstrating the change in kernel malware trends since year 2003 onwards.

Kernel Samples 720

The first graph shows how the number of kernel-mode driver samples has changed over the years. This data includes different variants of the same family. A more interesting graph is shown below, which illustrates the cumulative number of malware families utilizing kernel-mode components.

Kernel Families 720

From these two graphs we can easily see how the trend has changed dramatically at the end of the year 2004. This is mostly explained by the increased number of malware starting to use kernel-mode rootkits to hide their presence on the compromised system.

Today, kernel-mode rootkits are much more common than their user-mode counterparts. There are many reasons for this. Kernel-mode rootkits are more powerful thus they are able to hide better. Documentation with examples and fully working source code is easily available – there are even books available that explain in detail how to write your own kernel-mode rootkit. Implementing a full-flexed user-mode rootkit is a complex task. It seems that for malware authors, it is much easier just to upgrade their user-mode malware with a cut-and-paste kernel-mode rootkit.

Signing Off,
Kimmo

Source: F-Secure : News from the Lab - February of 2007

 

Phish fighters floored by DDoS assault

Botnet hits CastleCops under the belt

By John Leyden

Published Tuesday 20th February 2007 14:57 GMT

Castlecops, the volunteer security community that runs a well-known phishing website investigation service, has been hit by a denial of service attack.

The latest phase in an ongoing botnet powered onslaught that began (http://weblog.infoworld.com/securityadviser/archives/2007/02/castlecops_unde.html) on 13 February rendered the site largely inaccessible on Monday (19 February).

By Tuesday, the website returned albeit without the restoration of all its services. "We're under a DDoS, but we will prevail. Good shall overcome," Castlecops's principal Paul Laudanski said on a posting on the site's website.

Founded five years ago, CastleCops is best known for its Phish Incident Reporting and Termination (PIRT) taskforce. Surfers are able to report fraudulent sites to Castlecops volunteers, who investigate these reports. Castlecops volunteers do the leg work and carry out the sometimes tricky process of having bogus sites removed from the internet. The organisation also assists in educating users about malware risks.

The motives of the attack are unclear, though it's reasonable to assume the phishing fraudsters or malware authors, who have most to gain from the inavailability of Castecop's website, are the likely perpetrators.

Castlecops has become the latest target in a string of attacks targeting organisations looking to frustrate the efforts of phishing fraudsters, spammers, or other internet pond life.

Veteran spam fighter Spamhaus suffered a denial of service attack last September, for example, while an attack by a rogue spammer brought down anti-spam firm Blue Security in April 2006.

According to Blue Security, a renegade Russian language speaking spammer known as PharmaMaster succeeded in bribing a staff member at a top-tier ISP into black-holing Blue Security's former IP address at internet backbone routers. ®

Source: Phish fighters floored by DDoS assault | The Register

********************************************************************
Title: Microsoft Security Bulletin Minor Revisions
Issued: February 21, 2007
********************************************************************

Summary
=======
The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS07-016
* MS07-013
* MS07-012
* MS07-011
* MS06-078

Bulletin Information:
=====================

* MS07-016

- http://www.microsoft.com/technet/security/bulletin/ms07-016.mspx
- Reason for Revision: Bulletin revised to correct installation verification keys for Windows Internet Explorer 7. Removal information for Windows Server 2003 updated with correct folder
- Originally posted: February 13, 2007
- Updated: February 21, 2007
- Bulletin Severity Rating: Critical
- Version: 1.1
* MS07-013

- http://www.microsoft.com/technet/security/bulletin/ms07-013.mspx
- Reason for Revision: Bulletin Updated: additional clarification has been added to the e-mail attack vector. An attacker could also attempt to exploit this vulnerability when a user interacts with a malformed embedded OLE object within a Rich
Text e-mail message
- Originally posted: February 13, 2007
- Updated: February 21, 2007
- Bulletin Severity Rating: Important
- Version: 1.1
* MS07-012

- http://www.microsoft.com/technet/security/bulletin/ms07-012.mspx
- Reason for Revision: Bulletin Updated: additional clarification
has been added to the e-mail attack vector. An attacker could
also attempt to exploit this vulnerability when a user
interacts with a malformed embedded OLE object within a Rich
Text e-mail message
- Originally posted: February 13, 2007
- Updated: February 21, 2007
- Bulletin Severity Rating: Important
- Version: 1.1
* MS07-011

- http://www.microsoft.com/technet/security/bulletin/ms07-011.mspx
- Reason for Revision: BulletinUpdated: additional clarification has been added to the e-mail attack vector. An attacker could also attempt to exploit this vulnerability when a user interacts with a malformed embedded OLE object within a Rich Text e-mail message
- Originally posted: February 13, 2007
- Updated: February 21, 2007
- Bulletin Severity Rating: Important
- Version: 1.1
* MS06-078

- http://www.microsoft.com/technet/security/bulletin/ms06-078.mspx
- Reason for Revision: Bulletin updated to provide additional clarity around known issues customers may experience when
they install this security update: See Microsoft Knowledge Base Article 933065 : Error message when you install the original version of security update 923689 on Korean Windows
2000 and Microsoft Knowledge Base Article 933066 : Error
dialog when you install the security update 923689 on Windows
XP SP2.
- Originally posted: December 12, 2006
- Updated: February 21, 2007
- Bulletin Severity Rating: Critical
- Version: 2.2
********************************************************************

 

Microsoft apologises for serving malware

  • 21st February 2007
  • Dan Warne
  • Windows

Microsoft has apologised for serving malware via its websites and Windows Live Messenger software.

APC reader Jackie Murphy reported the problem:

"With Microsoft launching Vista along with their Defender software to protect users from viruses and spyware, it seems therefore to be an oxymoron that they have started to putting paid changing banner advertisements for malware, on the popular MSN groups servers.

"SystemDoctor2006 has made an appearance over the past few days, coming complete with pop-up windows to trap and then cause horrific damage to the computers of unaware users -- causing them to then rush out to purchase Microsoft Defender?

Murphy supplied screenshots of the scam in action:

SystemDoctor 2006 is described by many websites as being a "rogue antispyware/malware application installed by malware".

A Microsoft Australia spokesperson confirmed the malware vendor had slipped through its ad booking processes.

"We have learned that Microsoft was notified of malware that was being served through ads placed in Windows Live Messenger banners. As a result of this notification Microsoft immediately investigated the reports and removed the offending ads, as this is a violation of Microsoft's ad serving policy. Microsoft can confirm that the ads are no longer being served by any Microsoft system.

"Microsoft apologizes for the inconvenience and is reviewing Microsoft's ad approval process to reduce the chance of an occurrence such as this happening again. To help customers protect their PCs from malware threats, Microsoft recommends customers follow our Protect your PC guidance at www.microsoft.com/protect.

Source: Microsoft apologises for serving malware | APC Magazine

 Hang in there guys!!

We Will Not Be Silenced!
image

CastleCops

We will not be silenced! Here is a current MRTG chart showing about two hours ago we had a 933Mb/s spike DDoS, while a 44Mb/s is now consistent. Someone isn't happy we're up and running.

Source: CastleCops

 

Nuklus Toolkit in Action

This morning we received reports of spammed emails with the following bodies:

John Howard survived a heart attack
Read more: http://wi[REMOVED]news.hk

Prime Minister survived a heard attack
Read more: http://in[REMOVED]help.hk

Once again, it’s the usual attack that tries to lead victims to a Web site that hosts an exploit code. In this case, attackers also added some additional social engineering fun to pursue their criminal purposes. In fact, when someone visits the hostile Web site, it will show a false “502” error and will gently suggest shutting down firewall and antivirus software to avoid the problem. (Of course! What else? Do you want my credit card number? Send money to your bank?).

The hostile site hosts an exploit for the RDS.DataControl component of Internet Explorer, patched by MS06-014 bulletin. The exploit downloads and executes a malicious file (iexplore.exe), always from the mentioned domain.

Spammed mails, social engineering, browser exploits… nothing really new, we get used to this kind of stuff. However, after further analysis, we were able to find the attacker C&C panel, which can manage all the infected hosts and that’s the interesting part of this story!

The interface seems to be a new type of C&C Web panel created by an enigmatic "Nuklus team." It is most likely part of some phishing toolkit sold in the underground market.

The C&C interface can give statistics about the number of infected hosts and the country of origin (based on the IP address). Australia, USA, and the UK are the most targeted by this malware at the moment. The panel also allows the administrator to manage some malicious plugins, and obviously the page already shows a “frame grabber” plugin for IE present on the bot. This plugin is able to intercept typed URLs and information posted on Web pages on-the-fly. The attacker can also redirect the browser if the URL matches with one on a specific list.

The list of “appetizing” URLs for the attacker is configured directly from the C&C interface and naturally includes many bank Web sites. The interface also has its own SQL database to store all the information gathered from the compromised hosts. Using the "SEARCH" tab, the attacker can run queries and search for valuable information in a very easy way. It’s noticeable that this toolkit can also grab users’ certificate stores as shown in the following figure (“CERT SQUEEZING). These types of C&C interfaces are not new in malware, but they are becoming incredibly sophisticated and, unfortunately, easy to use.

Posted by Elia Florio on February 20, 2007 12:45 PM

Source: Symantec Security Response Weblog: Nuklus Toolkit in Action

 

Regional US banks are big targets for phishers

Tuesday February 20, 2007 at 10:04 am CST
Posted by Francois Paget

Trackback

According to the January 2007 RSA Monthly Online Fraud Intelligence Report, the percentage of nationwide US banks targeted by phishing attacks rose from 28% to 31%. Concurrently, the percentage of regional institutions jumped from 37% to 46%. While 2006 saw many US Credit Union attacks, the main target in January 2007 has been smaller financial institutions.

The chart below represents the monthly figures I collected in various Anti-Fraud Command Center reports. It shows that the main targets are US regional institutions. As they are small, it is possible the cybercriminals think they are not as well protected compared to larger institutions, which constantly improve their protections. The focus has turned towards stealthier and more targeted attacks. Smaller institutions are ideal for this.

The full report, with all the January 2007 RSA trend analysis, can be downloaded at the following address : http://www.rp-net.com/online/104/0701_RSA_PIR.pdf

Source: Computer Security Research - McAfee Avert Labs Blog

 

Mozilla delays Firefox update

What a difference a day makes.
Gregg Keizer, Computerworld (US online)
21 February 2007

Mozilla is to delay the next security update for Firefox so it can test a fix for a flaw.

The vulnerability, disclosed by Polish researcher Michal Zalewski on the Full Disclosure security mailing list, could let a malicious site manipulate the authentication cookies for other sites' pages. It is present in the most recent version of the open-source browser, 2.0.0.1.

According to Zalewski, the bug might allow hackers to "tamper with the way these [third-party] sites are displayed or how they work."

Mozilla developers jumped on the bug and produced a fix by the next day. However, adding the patch to the Firefox 2.0.0.2 and 1.5.0.10 updates, which are still under development, will require more work. "We had to respin for [the patch] and now have Firefox 2.0.0.2 rc4 and 1.5.0.10 rc2 builds," wrote Firefox developer Jay Patel on the Mozilla.dev.planning forum. "We are [now] shooting for a target ship date of Thursday 2/22." Mozilla had earlier pencilled in 21 Febraury as its target release date.

The vulnerability was rated as "moderately critical" by Danish bug tracker Secunia. Symantec's DeepSight threat network rated it 7.1 out of a possible 10. For his part, Zalewski posted a demonstration of the flaw online.

On Monday, Zalewski made note of a new Firefox bug that could give cybercriminals a leg up when running phishing attacks. Firefox can be forced to spawn a window with blank address bar with the Reload button disabled, Zalewski said. "This can be used to evoke a false sense of security or authority in casual users," he wrote in his warning. Hackers would have to dupe users into visiting a malicious site to pull this off this kind of attack, however.

Mozilla, security vendors and even Zalewski ranked this more recent flaw as minor; Mozilla has not yet patched the problem, and it's unclear whether it will be fixed in the 1.5.0.10 and 2.0.0.2 updates.

Mozilla also said that the week's Firefox updates would include Windows Vista-related changes, including one that allows Vista users to update the browser without having to download and reinstall the entire browser.

Source: Techworld.com - Security News - Mozilla delays Firefox update

 

February 16, 2007

  Data Breach Alert:   Multiple Organization Data Breaches

Websense® Security LabsTM has received reports of three new data security breaches.

Department of Education, Des Moines, Iowa.

Personal information, including Social Security numbers, names, addresses, and dates of birth, leaked from an unprotected file located on the department's website. The file contained nearly 160,000 records of individuals who obtained a General Educational Development certificate from Iowa between 1965 and 2002.

The protocol was HTTP, and the data was NPI (customer data).

City College of San Francisco, San Francisco, California.

Private information, including names, grades, and Social Security numbers of 11,000 past and possibly current students at City College of San Francisco, leaked from a file posted to the internet for several years. Due to an incorrect business process, students' details were posted online, allowing a contractor to prepare transcripts.

The protocol was HTTP, and the data was NPI (customer data).

Metropolitan Police Department, Washington, D.C.

Personal information, including Social Security numbers of nearly 2,000 members of the Metropolitan Police Department, has been accidentally released to two Advisory Neighborhood Commission officials who requested information about police overtime.

The protocol was network printer, and the data was NPI (customer data).

Websense Content Protection Suite can prevent such leaks by blocking internal and external communications, such as emails and web posts, that include data that should be protected. Content Protection Suite also protects against leaks from outside the organization by using a reverse proxy mode. This mode prevents unauthorized access to web pages that contain this type of information.

By using the suite's Content Auditor module for monitoring and discovering data at rest, and data in use, at the endpoint, an organization can identify and locate where confidential and private information is found, and determine if that data is being used inappropriately.

For additional information on how to discover your sensitive data, monitor its movement throughout your network, and protect it against breaches, visit:

http://www.websense.com/global/en/ProductsServices/CPS/

Source: Websense® - Security Labs Alert: Multiple Organization Data Breaches

 

Movie Review: Ghost Rider

Posted by Chris Mosby on February 19th, 2007

The Wife and I went to see Ghost Rider last weekend, so I thought I would write up a review while the movie was still fresh in my mind. Warning, spoilers may follow.

One of the first things I always look for in a movie based on comic books, is how true they are to the original concept of the character. It has been a while since I have read any Ghost Rider stuff, so I had to brush up on my Ghost Rider lore over on Wikipedia. From what I have read there, it looks like they combined elements of Johnny Blaze and the Danny Ketch (the one that I am most familiar with) origins and powers for this movie. In my opinion, they seemed to be pretty true to the Ghost Rider character in this film. To me that is pretty important in a movie like this, as the movies that stray too far away from the comic book roots do not do very well in the box office in the last few years. A great example of a success would be the Spider-Man movies. The first one especially was very close to the original character, almost exactly in fact, to what Stan Lee wrote all those years ago. We all know how well that movie did. Then you take the movie Catwoman, which failed horribly. Now I never watched this movie, but I read and saw enough trailers to know that the only thing similar to the character in that movie to the one in the comics was the name. If you look at other movies based on comic book characters, you can really see the pattern. These characters have been around for decades for a reason, you really don’t need to radically change them for a comic book movie to be successful. I just wish the movie studios would just realize that.

With that said, on to the review.

The movie started out great in the beginning. I liked how much time they spent showing the young Johnny Blaze and how he ended up selling his soul to Mephistopheles. Adding that much detail in the backstory went a long way to get you emotionally involved with Blaze. Setting up the prerequisite love interest here was good too. I am not sure that would have worked in the plot any other way, and I thought it was a nice touch. Everything went along smoothly in this movie for me until Eva Mendes showed up as Blaze’s long lost love, then things started to go downhill.

The first scene I saw Mendes in was almost funny. I think she fell into that trap that most actors/actresses fall into when they are in a movie based on a comic book. They get the mind set “comics are for kids, so I don’t need to be serious”. The only other movie that I remember Mendes being in was Hitch, so I don’t know if she was trying to act so silly on purpose, or if this is what the director wanted for this role. If she was acting like that on purpose, then she seriously overacted in very seen she was in. It was almost painful. If not, then she is either not a very good actress, or the director is an idiot. Of course it is possible that they only hired her for her looks, which would explain why they overdid her cleavage every chance they got. Now don’t get me wrong, I LIKE cleavage and Mendes is pretty damn nice on the eyes. It was just getting a little bit silly in my opinion.

Nicholas Cage did a great job in this role when he was not in a scene with Mendes, it was like her overacting sucked the talent out of every scene she was in and made the other actors silly too.

Mendes’s acting aside; I thought Cage was pretty good in this film. He portrayed the Ghost Rider transformation well enough that I believed he really was in a lot of pain. I did have a problem with his hair however, it didn’t look real enough to me and he looked like he was using one of William Shatner’s old tupes from the ‘60’s. Was it just me, or did they CGI a ripped body on Cage during that scene that he was looking through the mirror? I sure looked fake to me.

Overall, I liked this movie, despite the problems I had with it. They stayed true to the Ghost Rider character but changed it just enough that the movie was entertaining.

Source: Tales from the Longbox » Blog Archive » Movie Review: Ghost Rider

 

February 18, 2007

  Data Breach Alert:   Department of Administrative Services. Hartford, Connecticut

Personal information including names and Social Security numbers of 1,753 state employees leaked after it was posted to the Department of Administrative Services website. The personal information was included in a spreadsheet of vendors used by the state that was accessible to the public on the state web site. Officials believe the information was on the website since October 2003. After the leak was detected, the file was scrubbed. This leak was disclosed due to Connecticut's S.B.650 which requires breach notification.

State officials claimed that the leak was not too serious because the Social Security numbers were displayed without hyphens and each had a numerical suffix attached, making them not easily recognizable.

The protocol was HTTP and the type data was NPI (e.g. customer data).

Websense Content Protection Suite can easily prevent such leaks by preemptively blocking internal and external communications such as emails and web posts that include confidential information. Being format agnostic, Websense Content Protection Suite can protect against leaks even if Social Security Numbers are displayed in different methods.

Content Protection Suite can also protect organizations against leaks from the outside when used in reverse proxy mode to prevent unauthorized access to web pages that contain such information.

Using Content Protection Suite’s Content Auditor module for monitoring and discovery of data at rest and data in use at the endpoint, organizations could identify confidential and private information and determine how it is being used.

For additional information on how to discover your sensitive data, monitor its movement throughout your network, and protect it against breaches, visit:

http://www.websense.com/global/en/ProductsServices/CPS/

Source: Websense® - Security Labs Alert: Department of Administrative Services. Hartford, Connecticut

 

An Example of Why UAC Prompts in Vista Can’t Always Be Trusted

People who have been following the not unexpected initial wave of security research with regards to Windows Vista will have seen three informative blog posts recently. The first, by Joanna Rustkowska is titled "Vista Security Model – A Big Joke?" This, I believe in part, resulted in Mark Russinovich writing his blog entry "PsExec, User Account Control and Security Boundaries." The post by Mark (and some Slashdot.org coverage) was then followed by another posting by Joanna titled "Confiusion (sic) About The 'Joke Post.'"

Joanna hit upon a something in this last blog stating, "Mark Russinovich - declared that all implementation bugs in UAC are not to be considered as security bugs." I recently had the pleasure of working with Microsoft Security Response on an issue I thought was detrimental to the trust placed upon UAC prompts. In Microsoft’s Technet document "Understanding and Configuring User Account Control in Windows Vista" they provide the following graphic:

UACdecision.jpg

Figure 1: The UAC decision flow chart
This shows the different types and colors of dialog boxes one can expect to see when using UAC. One assumes they made these different colors to encourage the user to make a more informed judgment when