Tag: security

Categories
Uncategorized

The new year rings in another bonus: a rise in bogus electronic greeting cards

It’s that time of year again when fake online greeting cards increase in the daily Outlook mailbox and in web based mail as well).

A common give away? The sender is often listed only by first name – no last name – and includes links to various e-card sites: this was from Michelle offering "Happy Wishes!"

Michelle has created the ecard.

Here’s your greeting card: [this one from included a URL from greetingcardcalendar.com]

Thank you, greeting-cards.com team.

As I noted in a post last year on the subject, Brian Krebs of the Washington Post highlighted this problem in his post on Not-So-Friendly Greeting Cards.  Krebs noted that the rise of fake online greeting cards that can install keystroke loggers on to your computer, rather than delivering what you thought to be an innocent e-card from a long lost aunt.

"You might want to think twice before opening that e-greeting card sent to you via e-mail. Cyber crooks have recently been blasting out millions of fake online greeting cards in the hope that recipients will click on the included links and infect their computers with password-stealing viruses.

"Previous e-greeting card scams harbored their viral payload in an infected e-mail attachment, but fraudsters now are simply embedding links in the fake card messages. Anyone who clicks on such a link without the benefit of the most recent security updates for their Web browser is likely to have their PC silently whacked with an invasive keystroke-logging program.

"… It is sad that the state of e-mail security has come to this, but Microsoft Windows users would be well-advised to simply delete any e-greeting cards that land in their inboxes."

For more info, see the Wiki link on the Storm Worm, and here on Symantec’s site.

Also, here’s the link if the embedded links above don’t work: http://blog.washingtonpost.com/securityfix/2007/07/notsofriendly_greeting_cards_1.html

And see my past note on how there’s no immunity from security vulnerabilities.

More info:

Tags: Microsoft, security, antivirus, antispyware, Windows Defender.

Bookmark and Share

http://tinyurl.com/bogusecards

Categories
Uncategorized

PC Magazine: “It’s all another reason why you’re better off with Vista.”

Going though customer and partner feedback today, I was interested to see this appear in my mailbox (thanks to the several people who forwarded this today), an excerpt from an article by Larry Seltzer on PC Magazine’s blog, Why Vista Looks Good After The MS08-067 RPC Bug – Security Watch…

One of the lessons of the recent Windows RPC bug, the one that was fixed “out of band” a few weeks ago, didn’t get enough attention. It’s that Vista is so much more resilient than XP to the attack, and why. I believe that, on Vista, this vulnerability is almost impossible to exploit and nobody will try.

“When MS08-067 was released it was a shocker, the kind of vulnerability that, in the past, has led to widespread attacks. This hasn’t happened so far for a number of reasons. But I’ll wager that very few Vista systems anywhere in the world will be successfully attacked through this vulnerability, except maybe in hacker testing. It’s all another reason why you’re better off with Vista.”

Tags: articles, what I read, Microsoft, blogs, security, antivirus.

Bookmark and Share

http://tinyurl.com/55zhkz

Categories
Uncategorized

Get an ecard today? Watch out for malware, viruses and poor spelling

Be alert as you read your mail today: fake ecards with loaded exe’s are once again making the rounds…

Oooh, look at the mail that’s piling up:

“You’ve received a greeting ecard”

How exciting. Not.

Today, several mails on my email accounts at home reportedly from greetingcard.org (which Outlook displayed as from alien@got.net).

Good day.
You have received an eCard

To pick up your eCard, choose from any of the following options:
Click on the following link (or copy & paste it into your web browser):

http://somerandomurl.com/e-card.exe

Your card will be aviailable for pick-up beginning for the next 30 days.
Please be sure to view your eCard before the days are up!

We hope you enjoy you eCard.

Thank You!

http://www.greetingcard.org

Nope, not gonna do it.

First of all, I’m sure that legitimate ecard companies are better at spelling (‘aviailable’ as you know is spelled available).

Last year, In his post on Not-So-Friendly Greeting Cards, Brian Krebs of the Washington Post calls out the rise of fake online greeting cards that can install keystroke loggers on to your computer, rather than delivering what you thought to be an innocent e-card from a long lost aunt.

Here’s a couple of things to watch for:

  • If a link drives you to an exe file (an executable or application) then think twice. 
  • If the link isn’t from someone you know, think again. 
  • you've been had!If it looks like the mail comes from and directs you to a legitimate ecard site — such as American Greetings.com — be sure that it’s really http://www.americangreetings.com/ by hovering over the URL and verifying the link (see the lower left corner of your browser windows)
  • And when in doubt, copy and paste the URL directly into your browser.

For more about what to do when you see these types of emails, see my post on More greeting ecard spam and what to do about it.  And see my past note on how there’s no immunity from security vulnerabilities.

(Also, here’s the link if the embedded links above don’t work: http://blog.washingtonpost.com/securityfix/2007/07/notsofriendly_greeting_cards_1.html).  You can copy the link as text and paste it into your browser to ensure that I haven’t duped you with a loaded exe. 😉

More info:

Tags: Microsoft, security, antivirus, antispyware, Windows Defender.

Bookmark and Share 

http://tinyurl.com/55hjma

Categories
Uncategorized

Of interest: Windows Live OneCare security suite to be included with many new PCs

Of interest… OneCare to be preinstalled in new PCs from several PC manufacturers…

To address the growing security and management needs of today’s new PC user, Microsoft Corp. is working with 11 original equipment manufacturers (OEMs), including Sony Corporation of America and Toshiba Asia Pacific to preinstall trial subscriptions of Windows Live OneCare on select new PCs across North America, Europe and Asia. Windows Live OneCare provides all-in-one security and anti-malware protection for consumers and small businesses along with tools that automate and simplify PC management and performance.

New Alliances Continue Momentum for Windows Live OneCare: Manufacturers choose Microsoft’s all-in-one security suite to help protect and maintain their customers’ PCs.

Categories
Uncategorized

Microsoft Security Advisory (956187): Increased threat for DNS spoofing vulnerability, and what you should do

As noted in this security advisory on TechNet…

Microsoft released Microsoft Security Bulletin MS08-037 on July 8, 2008, offering security updates to protect customers against Windows Domain Name System (DNS) spoofing attacks.

Microsoft is not currently aware of active attacks utilizing this exploit code or of customer impact at this time. However, attacks are likely imminent due to the publicly posted proof of concept and Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary.

Microsoft’s investigation of this exploit code has verified that it does not affect Microsoft customers who have installed the updates detailed in Microsoft Security Bulletin MS08-037. Microsoft continues to recommend that customers apply the updates to the affected products by enabling the Automatic Updates feature in Windows.

As noted in this article over at Redmond Developer News, this “advisory comes almost immediately after H.D. Moore, a hacker and researcher who created the Metasploit vulnerability testing framework, published the attack code in two parts on Wednesday and late Thursday. The code was posted at several security mailing lists and at the Computer Academic Underground Web site.”

As Gregg Keizer of Computerworld pointed out in his article today…

“You know a bug is big news when it makes National Public Radio‘s All Things Considered, the network’s afternoon drive-time show. That’s what happened on Friday, when Dan Kaminsky, the security researcher who uncovered a critical flaw in the Domain Name System (DNS) software used to direct traffic on the Internet, gave a synopsis of the problem and what has been done to fix it.

“What’s all the fuss? A basic flaw in the Domain Name System makes it much easier than originally thought to insert bogus information into the Internet’s routing infrastructure. Here’s how Kaminsky put it: “A bad guy has a 1-in-65,000 chance of stealing your Internet connection, and he can try a couple thousand times a second.

“By the way, this explanation by Kaminsky is among the few around we think is understandable to the DNS layman. Recommended reading.”

Yes, I agree. 

As Kaminsky explains, this threat is to the system that maps your common domain name (such as www.myinternetprovider.com) to a specific IP address, the numbers you often see associated with a web site (for example, 1.160.10.240).  With this exploit, “malicious people [could] impersonate almost any website on the Internet.”

imageI like the way that Gregg describes the issue and provides suggested actions. 

So what should you do?  For the most part for consumers and general users, the fixes are handled by your ISP.  Gregg provides a list of several tools you can access via the Internet to test that your DNS server has been updated. The simplest way is to visit Kaminsky’s blog and click on the “Check My DNS” button under the “DNS Checker” column, as noted at right.

Turns out my “name server appears to be safe…”

That’s a relief. 😉

As noted…

“If the testing tools show that you’re vulnerable, you should contact your ISP or network administrator to ask what is being done to plug the hole.

As Kaminsky notes, based on the data collected at his website…

“From July 8th to July 9th, 4242 of 5000 tests actively run by users behind unique name servers showed that server to be vulnerable. That’s about 85%. Today, July 25th, the last 5000 tests (about the last six hours) from unique name servers show only 2503 of 5000 vulnerable — just above 50%. Now, I’m not going to deny. There’s selection bias. It’s a limited sample. There are tons and tons of unpatched ISPs. This is all true.

“You know what? A lot of people did a lot of work to make that number drop. More needs to be done, but 13 days made a difference, and it’s awesome to see it.”

But it appears that there is still some work to do…

“Apple Inc. has not yet patched Mac OS X, a fact that hasn’t escaped security researchers such as Andrew Storms of nCircle Network Security Inc. and security consultants such as Rich Mogull.

“Fortunately, noted Mogull, attacks are much more likely against Mac servers than individual Macs, so though the later are technically vulnerable, “there’s no need to panic.”

Whoops…

Microsoft Security Advisory (956187): Increased Threat for DNS Spoofing Vulnerability