Chris Mosby at myITforum.com

Really Legal Stuff
Posted by Sean @ 16:16 GMT | Comments

WinDefender 2008 is a rogue application. Rogues are also sometimes known as scareware.

Looks sort of familiar, doesn't it? Do you recognize the shape of the box?
The website creators appear to have "borrowed" a few things.
Let's check out the legal disclaimer.

Hey — Really Legal Stuff — That's impressive. From where else we can find really legal stuff?

Oh, Antivirus XP 2008. That particular rogue is a huge pain in the… neck.
The guys that produce this stuff are crooks and swindlers.

Here's a tip: If they claim to be REALiable — they're probably FAKE.
P.S. Performing a search for "really legal stuff" produces some very interesting but definitely NOT safe for work results.
Avoid following the links.

Sep29

Warning: Spam With Trend Micro Logo Delivers Trojan

by Eduardo Godinho (Threats Analyst)

While not as massive as earlier Web attacks that have used similar social engineering techniques, a new spamming operation has malware criminals using the logo of Trend Micro to lure unsuspecting Web users to “Trojanize” themselves.

Here’s a screenshot of a bogus email message that potential victims in Brazil have been receiving in the past several days:

Figure 1. Portuguese spam using the Trend Micro, Inc. logo

These messages, written in Portugese, inform the recipient that they contain pictures supposedly requested by those who received the mails themselves. The bogus “picture” purportedly available via download from a link found in the email body.

The message also carries the Trend Micro logo as a sort of “guarantee” to users that the file they are about to download is legitimate.

The link, when accessed, does not lead to any image file but installs a Trojan Horse program instead.

Users are perpetually reminded to be careful in handling links in the messages they receive. Just the mere mention of an online security company or the appearance of its logo does not guarantee that the message and its contents are legitimate and not harmful to systems. Logos after all are easy to copy or fake.

Trend Micro Smart Protection Network already blocks the spammed email messages involved in this threat. It also protects users from TROJ_GENERIC by detecting the Trojan at the desktop level and by providing solutions for its removal.

Sep29

In The Virtual Crime World, Merrill Lynch Follows Wachovia’s Fate

by Reuben Mercado (Technical Communications)

Financial crisis or no financial crisis, banks have emerged as social engineering standards. However, as floundering financial institutions take centerstage in the public’s consciousness, users may become more susceptible to banking-related ploys.

Less than a week ago, TrendLabs reported on a scheme targeting Wachovia, the fourth largest banking chain in the US. This time, an almost identical plot has been set using Merrill Lynch as bait. The storied firm has received a sizable amount of media attention lately due to its high-profile bailout by the Bank of America.

The spam email message may appear as such:

Figure 1. Fake Merrill Lynch spam

While those on social engineering watch may expect a frenzied appeal to buck up security in the face of the financial crisis, this scheme actually comes off cool and collected.

Trend Micro Advanced Threats Researcher Ivan Macalintal notes the use of very long, legitimate-looking URLs contained in hyperlinks on the spammed email messages. “[We] haven’t seen this for quite some time. [It] looks legit in a way but [then], you have to dig deeper,” Ivan says.

Clicking on the links will result in the download of malware detected as BKDR_AGENT.AWAF. It compromises system security, possibly allowing a remote user to issue commands on the affected system. It also drops TROJ_ROOTKIT.FX which has rootkit capabilities, used to hide malicious files and processes to ensure memory residency. One may remember TROJ_ROOTKIT.FX as the same malware found in the recent Wachovia spam, denoting that this is possibly the working of the same malware author.

Now here's something we don't see every day.

It's an interesting twist on an old tactic — a worm that uses a local elevation of privilege vulnerability to access the kernel and execute code.

Most malware with rootkit functionality will tamper with the Windows kernel and attempt to execute code in kernel mode. Typically, a special driver is used to do this.

Worm.Win32.AutoRun.nox has a payload that restores the original function pointers back to the kernel's System Service Table (SST). The usual motivation for malware to do this is to remove any SST hooks installed by security software or other malware that might affect its successful operation.

As noted, normally a special driver or the physical memory device is used to get access to kernel-mode memory to restore the pointers. AutoRun.nox is different — it uses "GDI Local Elevation of Privilege Vulnerability (CVE-2006-5758)" to do the job. For malware, its rather unique to see such a technique being used.

This vulnerability is due to an error in handling a shared memory structure, which allows the structure to be remapped from read-only to writable. April 2007's update patched the vulnerability.



After remapping the memory, the malware will initialize a CPalette object. It will then search for the palette object in the shared kernel memory structure. Since the memory is now writable, it can be altered to include a pointer to a special function that will remove any existing SST hooks. Finally, a call to GetNearestPaletteIndex will indirectly cause the function to be executed. Afterwards, the palette object is restored leaving no trace of the attack.

If attacking this vulnerability fails, the worm goes back to the tried-and-true "special driver" method. The driver is detected by us as Rootkit:W32/Agent.UG.

Either way, if the attack is successful, the machine is compromised as the attacker can access the kernel and execute code, or cause a denial of service.

This attack will only work on unpatched machines running without the latest updates. Microsoft ranks this vulnerability as Important and recommends that users apply the update immediately.

Foresight? From: http://technet.microsoft.com/en-us/library/cc750820.aspx

"With this new release, the Window Manager, GDI, and related graphics device drivers have been moved to the Windows NT Executive running in kernel mode."

Response team post by — Lordian, Kimmo, Antti ...and Mika

Firefox v2.0.0.17 and Thunderbird v2.0.0.17 release fixes vulnerabilities

Published: 2008-09-26,
Last Updated: 2008-09-26 20:01:11 UTC
by Patrick Nolan (Version: 1)

0 comment(s)

Firefox 2 v2.0.0.17 is available for download and corrects the vulnerabilities listed at "Security Advisories for Firefox 2.0 - Fixed in Firefox 2.0.0.17". "Firefox 2.0.0.x will be maintained with security and stability updates until mid-December, 2008. All users are strongly encouraged to upgrade to Firefox 3".

Thunderbird 2 v2.0.0.17 is available for download and  corrects the vulnerabilities at "Security Advisories for Thunderbird 2.0 - Fixed in Thunderbird 2.0.0.17".

Thanks Raul!

From the SANS NewsBites newsletter today:

--Researchers Find Users Often Click Through Dialog Windows Without Reading (September 23 & 25, 2008) An experiment conducted by psychologists at North Carolina State University found that computer users often fail to distinguish fake Windows dialog boxes from legitimate ones. Sixty-three percent of the

42 students participating in the experiment clicked OK whenever a pop-up window appeared, ignoring anomalies that should have clued them in to the potential for malicious activity. The subjects appeared to view pop-up windows as hindering their intended activity; clicking the OK button is the virtual equivalent of brushing away flies.

http://www.networkworld.com/news/2008/092508-computer-users-overeager-to-click.html?hpg1=bn

http://arstechnica.com/news.ars/post/20080923-study-confirms-users-are-idiots.html

[Editor's Note (Schultz): This research confirms the obvious, but it nevertheless significant in that it provides controlled, experimental data that shed some light on the magnitude of the problem of users clicking OK just to get rid of security related dialog boxes that pop up.]