February 2005 - Posts

On-demand scan comparative


http://www.av-comparatives.org

Av-Comparatives.org published their February 2005
On-demand scan comparative with Kaspersky stealing the show.
Posted by Anonymous | with no comments
Filed under:

New SDBOT virus loads in "SAFE MODE"

I found it interesting that this virus creates registry entries so that it loads in safe mode.


Virus Name Risk Assessment
W32/Sdbot.worm.32768
Corporate User : Low
Home User : Low

Virus Information
Discovery Date: 02/23/2005
Origin: Unknown
Length: 32,768 bytes
Type: Virus
SubType: Internet Worm
Minimum DAT: 4432 (02/23/2005)
Updated DAT: 4432 (02/23/2005)
Minimum Engine: 4.3.20
Description Added: 02/28/2005
Description Modified: 02/28/2005 5:00 AM (PT)

Virus Characteristics:

This variant is double packed, firstly with Morphine packer and then UPX packer.

When run, it copies itself to the WINDOWS SYSTEM (%sysDir%) directory as WZDSVC.EXE.

It creates and starts the following service:

  • Wireless Zero Daemon

The following registry keys are created:

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WZDSVC   DisplayName = "Wireless Zero Daemon"
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WZDSVC   ObjectName = "LocalSystem"
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WZDSVC   Description = "Provides automatic configuration for the 802.11 adapters"

It also creates the following registry keys so its service starts in Safe Mode :

  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\WZDSVC
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WZDSVC

It exploits the following Windows vulnerabilities to propagate across networks:

  • Windows NetDDE Remote Buffer Overflow Exploit - MS04-031
  • Remote Procedure Call (RPC) Distributed Component Object Model (DCOM) vulnerability - MS03-026
  • Buffer Overflow in SQL Server 2000 vulnerability - MS02-061
  • IIS5/WEBDAV Bbuffer Overrun vulnerability - MS03-007
  • LSASS vulnerability - MS04-011

Are you keeping up with the iDownload/iSearch spyware controversy?


If you haven’t been keeping up with the iDownload/iSearch saga, you might be interested in taking the time to do so. You can check out the Spyware Warrior aspect of the story and this is the link for the Castle Cops side of the story. This is a pretty interesting story and is creating a buzz in several forums. There is the question of whether iDownload/iSearch is spyware or not. There is also controversy in whether iDownload/iSearch is preparing for a SLAPP.

Suzi at spyware warrior claims to have searched her site, and found only references to Ad-Aware updates and Spyware Blaster updates. Does this mean that if I place a list of updates in a myITforum blog, that we may receive a letter that makes a threat of legal action? Could such legal action succeed? What about opinions posted by forum members? I don’t think that the legal attempts of iDownload/iSearch will be successful, but it does provoke thought on the matter.

According to thefirstamendment.org :

Most SLAPPs are ultimately legally unsuccessful. While most SLAPPs lose in court, they "succeed" in the public arena. This is because defending a SLAPP, even when the legal defense is strong, requires a substantial investment of money, time, and resources. The resulting effect is a "chill" on public participation in, and open debate on, important public issues. This "chilling" effect is not limited to the SLAPP target(s): fearful of being the target of future litigation, others refrain from speaking on, or participating in, issues of public concern.

I found it pretty interesting that in the Cease & Desist letter sent to Spyware Warrior, iDownload/iSearch says :

“iSearch does not qualify as Malware. iSearch is a toolbar that in no way attempts to remain hidden or evade detection, Continuing, unlike Malware, iSearch does not gather any personally identifiable information about end users, does not collect data about the user’s web usage, does not collect any information entered into web forms, does not share information with third parties, does not send or cause to be sent unsolicited e-mail, and does not install items such as dialers on the end user’s computer.”

This paragraph is from  ISEARCH INTERNET END USER LICENSE AGREEMENT and states :

 iSearch and/or it's partners may also collect and may use certain other types of non-personally identifiable information, including: certain of the web pages that you view, the amount of time that you spend on certain websites, your responses to ads served by iSearch and/or it's partners, certain software installed to your computer and software characteristics and preferences, non-personally identifiable information on web pages and forms, software usage characteristics and preferences, and your ZIP code. iSearch and/or it's partners may associate this information with a randomly-generated anonymous identifier for your computer and may use this information to enable the functionality of the Software, to periodically update the Software, to deliver and display ads served by iSearch and/or it's partners of advertisers who pay a fee to iSearch and/or it's partners, provide you with or redirect you to content or websites of such advertisers or other parties and offer you the opportunity to download software from third party vendors.”

In my non-legal opinion, they seem to be contradicting when talking about collecting data from web forms. Also, the first paragraph states that they do not collect any data about the users web usage, but the second paragraph from the EULA states that they can collect web pages you view, the amount of time on a page, information in forms, and your zip code. If they are collecting data on where you go and how long your there, that sounds like a users web usage to me. Anyway this is an interesting story to follow and does stir up some debate.

In an effort to determine what the public opinion is on the controversy, I created a poll at VirusIntel.com.


Posted by Anonymous | with no comments
Filed under:

Recognizing and Avoiding Spyware

 http://www.us-cert.gov/cas/tips/ST04-016.html

Recognizing and Avoiding Spyware

Because of its popularity, the internet has become an ideal target for advertising. As a result, spyware, or adware, has become increasingly prevalent. When troubleshooting problems with your computer, you may discover that the source of the problem is spyware software that has been installed on their machine without their knowledge.

What is spyware?

Despite its name, the term "spyware" doesn't refer to something used by undercover operatives, but rather by the advertising industry. In fact, spyware is also known as "adware." It refers to a category of software that, when installed on your computer, may send you pop-up ads, redirect your browser to certain web sites, or monitor the web sites that you visit. Some extreme, invasive versions of spyware may track exactly what keys you type.

Because of the extra processing, spyware may cause your computer to become slow or sluggish. There are also privacy implications:

  • What information is being gathered?
  • Who is receiving it?
  • How is it being used?

How do you know if there is spyware on your computer?

The following symptoms may indicate that spyware is installed on your computer:
  • you are subject to endless pop-up windows
  • you are redirected to web sites other than the one you typed into your browser
  • new, unexpected toolbars appear in your web browser
  • new, unexpected icons appear in the task tray at the bottom of your screen
  • your browser's home page suddenly changed
  • the search engine your browser opens when you click "search" has been changed
  • certain keys fail to work in your browser (e.g., the tab key doesn't work when you are moving to the next field within a form)
  • random Windows error messages begin to appear
  • your computer suddenly seems very slow when opening programs or processing tasks (saving files, etc.)

How can you prevent spyware from installing on your computer?

To avoid unintentionally installing it yourself, follow these good security practices:
  • Don't click on links within pop-up windows - Because pop-up windows are often a product of spyware, clicking on the window may install spyware software on your computer. To close the pop-up window, click on the "X" icon in the titlebar instead of a "close" link within the window.

  • Choose "no" when asked unexpected questions - Be wary of unexpected dialog boxes asking whether you want to run a particular program or perform another type of task. Always select "no" or "cancel," or close the dialog box by clicking the "X" icon in the titlebar.

  • Be wary of free downloadable software - There are many sites that offer customized toolbars or other features that appeal to users. Don't download programs from sites you don't trust, and realize that you may be exposing your computer to spyware by downloading some of these programs.

  • Don't follow email links claiming to offer anti-spyware software - Like email viruses, the links may serve the opposite purpose and actually install the spyware it claims to be eliminating.
As an additional good security practice, especially if you are concerned that you might have spyware on your machine and want to minimize the impact, consider taking the following action:

  • Adjust your browser preferences to limit pop-up windows and cookies - Pop-up windows are often generated by some kind of scripting or active content. Adjusting the settings within your browser to reduce or prevent scripting or active content may reduce the number of pop-up windows that appear. Some browsers offer a specific option to block or limit pop-up windows. Certain types of cookies are sometimes considered spyware because they reveal what web pages you have visited. You can adjust your privacy settings to only allow cookies for the web site you are visiting (see Browsing Safely: Understanding Active Content and Cookies for more information).

How do you remove spyware?

  • Run a full scan on your computer with your anti-virus software - Some anti-virus software will find and remove spyware, but it may not find the spyware when it is monitoring your computer in real time. Set your anti-virus software to prompt you to run a full scan periodically (see Understanding Anti-Virus Software for more information).

  • Run a legitimate product specifically designed to remove spyware - Many vendors offer products that will scan your computer for spyware and remove any spyware software. Popular products include Lavasoft's Ad-Aware, Webroot's SpySweeper, PestPatrol, and Spybot Search and Destroy.

Authors: Mindi McDowell, Matt Lytle
Copyright 2004 Carnegie Mellon University. Terms of use

If you are a FireFox user, Its time to update

FireFox 1.0.1 has been released and fixes several security issues. For more information, read the Known Vulnerabilties page and the release notes page.

eWeek has a good article explaining the issues and fixes.

Posted by Anonymous | with no comments

UK launches IT Security Awareness site for everyone

http://www.itsafe.gov.uk/about/index.html


About ITsafe

ITsafe is a government service, launched on 23 February 2005, to provide both home users and small businesses with proven, plain English advice to help protect computers, mobile phones and other devices from malicious attack.    ITsafe provides:

  1. A website that gives advice on keeping your computer safe, including a glossary in plain English to help you understand the technical terms used.
  2. An Alerting Service to warn you of serious threats that might affect you when you use your computer.

If you're interested in learning more about ITsafe, including ways in which your organisation could assist us to get the ITsafe message across to your customers or to your community, please visit the additional information page.


Posted by Anonymous | with no comments

Iran jails blogger for 14 years

http://newsvote.bbc.co.uk/mpapps/pagetools/print/news.bbc.co.uk/1/hi/technology/4292399.stm


“Arash Sigarchi was arrested last month after using his blog to criticise the arrest of other online journalists.

Mr Sigarchi, who also edits a newspaper in northern Iran, was sentenced by a revolutionary court in the Gilan area.

His sentence, criticised by human rights watchdog Reporters Without Borders, comes a day after an online 'day of action' to secure his release.

Iranian authorities have recently clamped down on the growing popularity of weblogs, restricting access to major blogging sites from within Iran.“


 

Posted by Anonymous | with no comments
Filed under:

Virus Notifications and Form Response Templates

There was a good question posted in one of the security forums at myITforum in reguards to a virus advisory template. This is the question: “Does anybody have a word doc or similar which I can send end users on latest viruses i.e A Virus Advisory.“

The responses from both Roger McClinton and Harry Waldron were both excellent. I also shared a document that I had found some time ago. This thread is an excellent thread and provides information that can be implemented into your virus incident response plan with some custom modifications for your environment. I have also found some other templates that you may also want to implement into your organizations virus response plan. I would be interested in what templates that you have implemented into your virus response plan, or if you have some good information to add to the thread. If so, the thread is located at http://www.myitforum.com/forums/fb.asp?m=96863


Announcement Template

From “An Incident Response Preparation Policy for Virus Outbreaks“

By Thomas Kline

http://www.giac.org/practical/tom_kline_gsec.doc

 

This is the template and example I use based off of Thomas Kline's document.

Critical Virus Alert

ACME is experiencing a virus outbreak. This virus is spreading through (Internet email, internal email, web access, workstation software, server software, specific application, Instant Messaging).

In effort to insure the security of the company’s network, < avenue of infection> is shutdown. To help stop the spread of this virus, please (log off email, save your work, don’t shutdown workstation, shutdown workstation, log off network). If you suspect that your system may already be infected, please disconnect your network cable and call the helpdesk at (555)555-HELP. You may also fill out the Virus Incident Report located at http://ACME_Intranet.com or be sending an e-mail to virusincident@ACME.com from a non-infected computer. Estimated time to normal work is


  E-mail response Template for the sender of a chain letter or hoax.

  

This was constructed based on information from the book “Viruses Revealed” ISBN 0-07-213090-3       

 

        It has been brought to our attention that you have participated in a chain-mail or virus hoax. While this may have been done in good faith, this type of activity has caused problems for ACME. Here at ACME we have employees that are responsible for actively monitoring viruses and threats. We receive alerts immediately and directly form verified sources. If you feel that you have received a warning that we are not aware of, you are only authorized to forward the message to the following locations:  VirusIncidents@ACME.com, or fill out the Virus Incident report at http://ACME_Intranet.com.  You may also contact the client support helpdesk at (555)555-HELP.

 

Virus Hoaxes and chain letters may not appear to cause any problems, but the reality is much different. Here are a few of the problems they cause:

 

- They result in a large number of e-mails being generated, which wastes network bandwidth, hard drive space, and sometimes cause server crashes.

 

- They waste employee time and spread false information.

 

- They sometimes tell people to delete good system files in "The cleaning process".

 

Again, please do not participate in chain mails and virus hoaxes. We would be grateful if you could point out to anyone in doubt that warnings from any individual within our organization who is not authorized to forward them should not be assumed to be accurate, and should still be checked with the Helpdesk or the Anti-Virus administrator. This applies irrespective of:

 

- The status of the sender.

 

- Apparent endorsement of the warning by authoritative individuals or organizations, including anti-virus and other security companies or agencies.

 

- Your belief in the good intentions and technical competence of the source of the warnings.


E-mail response template for fowarding virus alerts and/or hoaxes.

 

This was constructed based on information from the book “Viruses Revealed” ISBN 0-07-213090-3  

 

Thank you for the message concerning the . We at ACME appreciate notification of such things, and even more we appreciate it if people check with us rather than forward them on. Indeed, we ask that all virus warnings be forwarded to VirusIncidents@ACME.com or to the Helpdesk and that the Virus Incident Report be filled out at http://ACME_Intranet.com.

 

            The Anti-Virus Administrator is always pleased to determine and provide advice on whether the warning is authentic or accurate, whether it's advisable or appropriate to forward to anyone, and whether any further response to the apparent source of the warning is indicated.

 

This Alert: :

 

Is a known hoax

 

Is probably or possibly a hoax

 

Contains some element of truth, but is not very/completely accurate

 

Is correct, but we wouldn't regard it as particularly useful to forward it indiscriminately.

 

Raises an important issue and we take it seriously. A statement will be/has been issued accordingly.

 

 

 

 

            We would be grateful if you could point out to anyone in doubt that warnings from any individual within our organization who is not authorized to forward them should not be assumed to be accurate, and should still be checked with the Helpdesk or the Anti-Virus administrator. This applies irrespective of:

 

- The status of the sender.

 

- Apparent endorsement of the warning by authoritative individuals or organizations, including anti-virus and other security companies or agencies.

 

- Your belief in the good intentions and technical competence of the source of the warnings.


A company is the victim of identity fraud

http://www.theregister.co.uk/2005/02/17/scary_web_scam/

It appears that fraudsters have taken identity theft and phishing to a new level. I have not seen a case where the website was registered in the name of a director in the company. Even if a savy user did a domain whois lookup, they may still be fooled into thinking it is a legitimate website.


“In effect, they've assumed the identity of a legitimate business with a very professional-looking site. Contact and company details were lifted from Laptop Bits Ltd and even the domain was registered in the name of a director at the company. The site was so complete and professional-looking it would be very hard to spot that it is bogus.”


Posted by Anonymous | with no comments

Not your ordinary phish pun headline.....

Is it just me or are you sick of hearing bad phishing puns for story headlines?

Microsoft and VISA form Anti-phising Network, Again. Below is a link for the newly formed network, followed by a link for Anti-Phishing Workgroup, which both organizations were already members of.


http://www.phishreport.net/index.html

The Phish Report Network (PRN) was established to address the growing problem of phishing. As the industry's first anti-phishing aggregation service, PRN enables companies to better protect consumers against online fraud.


http://www.antiphishing.org/index.html

Anti-Phishing Working Group
The Anti-Phishing Working Group (APWG) is the global pan-industrial and law enforcement association focused on eliminating the fraud and identity theft that result from phishing, pharming and email spoofing of all types.


The following information is from http://www.antiphishing.org/consumer_recs.html

Consumer Advice: How to Avoid Phishing Scams

The number and sophistication of phishing scams sent out to consumers is continuing to increase dramatically. While online banking and e-commerce is very safe, as a general rule you should be careful about giving out your personal financial information over the Internet. The Anti-Phishing Working Group has compiled a list of recommendations below that you can use to avoid becoming a victim of these scams.
  • Be suspicious of any email with urgent requests for personal financial information
    • unless the email is digitally signed, you can't be sure it wasn't forged or 'spoofed'
    • phishers typically include upsetting or exciting (but false) statements in their emails to get people to react immediately
    • they typically ask for information such as usernames, passwords, credit card numbers, social security numbers, etc.
    • phisher emails are typically NOT personalized, while valid messages from your bank or e-commerce company generally are
  • Don't use the links in an email to get to any web page, if you suspect the message might not be authentic
    • instead, call the company on the telephone, or log onto the website directly by typing in the Web adress in your browser
  • Avoid filling out forms in email messages that ask for personal financial information
    • you should only communicate information such as credit card numbers or account information via a secure website or the telephone
  • Always ensure that you're using a secure website when submitting credit card or other sensitive information via your Web browser
    • to make sure you're on a secure Web server, check the beginning of the Web address in your browsers address bar - it should be "https://" rather than just "http://"
  • Consider installing a Web browser tool bar to help protect you from known phishing fraud websites
    • EarthLink ScamBlocker is part of a free browser toolbar that alerts you before you visit a page that's on Earthlink's list of known fraudulent phisher Web sites.
    • Its free to all Internet users - download at http://www.earthlink.net/earthlinktoolbar
  • Regularly log into your online accounts
    • don't leave it for as long as a month before you check each account
  • Regularly check your bank, credit and debit card satements to ensure that all transactions are legitimate
    • if anything is suspicious, contact your bank and all card issuers
  • Ensure that your browser is up to date and security patches applied
    • in particular, people who use the Microsoft Internet Explorer browser should immediately go to the Microsoft Security home page -- http://www.microsoft.com/security/ -- to download a special patch relating to certain phishing schemes
  • Always report "phishing" or “spoofed” e-mails to the following groups:
    • forward the email to reportphishing@antiphishing.com
    • forward the email to the Federal Trade Commission at spam@uce.gov
    • forward the email to the "abuse" email address at the company that is being spoofed (e.g. "spoof@ebay.com")
    • when forwarding spoofed messages, always include the entire original email with its original header information intact
    • notify the Internet Fraud Complaint Center of the FBI by filing a complaint on their website: www.ifccfbi.gov/
Posted by Anonymous | with no comments

Submit a malware sample

If you were wondering how you can help in the fight against malware, this is one way you can help.  If you suspect a file is malicious, then you should submit a sample to the major antivirus vendor's.  Antivirus vendors do their best to find threats, but they can always use your help.  Many antivirus vendors are including detection and removal for spyware as well as viruses, so you can even go as far as submitting spyware programs.  This will allow the vendors to create definitions based on your submission, which in return, will protect others.

Here is a list of sites that you can submit your malware samples to.

Virustotal

AVERT WebImmune

Trend Micro

Symantec Security Response

Kaspersky

 

 

 

Using Group Policy to proactively defend against malware threats

I received Microsoft's Security Newsletter this morning, and it contained two excellent articles. I have always been an advocate of taking proactive measures in malware defense by using all available tools and policies. One of my favorite tools is group policy. In these articles, the use of group policy to prevent malware threats is demonstrated.


 

Browsing the Web and Reading E-Mail Safely as an Administrator

If you look at the major threats to computers, they are from user interaction with the Web through tools like browsers, instant messaging, and e-mail clients. Michael Howard discusses how you can run as an administrator and access Internet data safely by dropping unnecessary administrative privileges when using any tool to access the Internet.

 

 

Browsing the Web and Reading E-Mail Safely as an Administrator, Part 2

Michael Howard builds upon his previous article by showing you how to use SAFER with local or enterprise policy to reduce potential threats when running as an administrator.


F-Secure AntiVirus Library Heap Overflow

http://xforce.iss.net/xforce/alerts/id/188


ISS has shipped protection for a flaw X-Force has discovered in F-Secure
AntiVirus Library. The F-Secure AntiVirus Library is widely relied upon
to provide antivirus capabilities to desktop, server, and gateway systems.
Also, several large vendors and ISP's implement F-Secure's AntiVirus
Library in their products. By crafting a archive file, an attacker is able
to trigger a heap overflow within the process importing the F-Secure
AntiVirus Library.

Follow UP: F-Secure issued a bulletin with patch information

 http://www.f-secure.com/security/fsc-2005-1.shtml

Posted by Anonymous | with no comments

Symantec Multiple Products UPX Parsing Engine Buffer Overflow

http://secunia.com/advisories/14179/




Description:
ISS X-Force has reported a vulnerability in multiple Symantec products, which can be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the DEC2EXE parsing engine used by the antivirus scanning functionality when processing UPX compressed files. This can be exploited to cause a heap-based buffer overflow via a specially crafted UPX file.

Successful exploitation allows execution of arbitrary code.

More Posts Next page »