Tag: security

Categories
Uncategorized

“Thank you for your visit” could mean you’re curious or just gullible

Lisa Vaas of eWeek has an article today on how nearly 500 people took the bait to ‘Click Here to Get Infected.’ It was as simple as setting up an innocent looking domain name (drive-by-download.info), one with an ‘.info’ suffix that is reportedly popular with malware providers, as noted in the article. If you managed to find the ad and click through, you received a “Thank you for your visit” message. Sounds innocent enough. 



“That was evidenced by the 409 people who clicked on an ad that offers infection for those with virus-free PCs. The ad, run by a person who identifies himself as security professional Didier Stevens, reads like this:


Drive-By Download
Is your PC virus-free?
Get it infected here!
drive-by-download.info


“Stevens, who says he works for Contraste Europe, a branch of the IT consultancy The Contraste Group, has been running his Google Adwords campaign for six months now and has received 409 hits. Stevens has done similar research in the past, such as finding out how easy it is to land on a drive-by download site when doing a Google search.”


In other words, be careful what you click on.


Although the site owner and the mock-site owner claims that no PCs were harmed, it goes to show that a significant number of people will click on ads or other interesting tidbits that have the potential harbour potential malware or malicious code. (In a related post, see “ani exploit via e-mail: you’d think hackers would know how to spell ‘Britney Spears’.)


You can read more about this on the site owner’s blog at http://didierstevens.wordpress.com/tag/malware/.


For more, see my past note on how there’s no immunity from security vulnerabilities.



Tags: , , , , , .

Categories
Uncategorized

.ani exploit via e-mail: you’d think hackers would know how to spell ‘Britney Spears’

As I noted yesterday in my blog, there is a new patch that addresses the animated cursor vulnerability as noted in Security Bulletin MS07-017. This patch is prevents remote code execution (so an attacker can not take over your PC remotely) delivered via a malicious Web site or viewed via a bogus e-mail.


I was asked today, how will people try to take advantage of this vulnerability? I have an answer via eWeek in their article on how malevolent  hackers may try to hook users via email promising “hot pictures of britiney Speers.” 


<Ahem> that’s Britney Spears, thank you. (Not that I’m a fan.)



“…Spam promising “Hot Pictures of Britiney Speers [sic]” is linking to sites hosting the Windows ANI exploit, Websense discovered today. The e-mail, coming from “Nude BritineySpeers.com,” is written in HTML and contains text that allows it to skirt anti-spam rules in the HTML comments.


“The come-on is from a server hosted in Russia that Websense says is the same one used previously by groups to install rootkits, password-stealing Trojans and other malware. Users who fall for the Britney bait and click on links in the spam are redirected to one of several sites containing hidden JavaScript. The JavaScript sends users to a site hosting Windows animated cursor exploit code.


“Without user interaction, a file is then downloaded and installed. The file, called 200.exe, looks like a new variant of a file infector with operating system hooks and spamming capabilities, Websense said in an alert.


So, what to do if you get an email offering such photos of public figures?


Delete it.


And if you haven’t, ensure that you’ve turned on Automatic Updates. For more, see my past note on how there’s no immunity from security vulnerabilities.


More info:



Tags: , , , , , .

Categories
Uncategorized

Quick note for consumers on security: turn on Automatic Updates

What’s all this talk about animated cursors and exploits on Windows?


Some times, email attachments and web sites aren’t what they appear to be on face value.


You might’ve seen a security announcement or press coverage on a new security patch that addresses a vulnerability associated with .ani files, which are associated with web site and animation attachments. (See the full technical bulletin here.) 


Christopher Budd’s post and Mike Reavey’s (both from the MSRC team) post more info on MS07-017 on the MSRC Technet blog.


In short, if you’re a consumer or small business and you manage your updates via Microsoft Automatic Updates (aka “AU”) the update will be automatically installed. And if you’re a sysadmin or IT Professional, we encourage you to test and deploy this update via WSUS and SMS.


Visit the Microsoft Security at Home web site for more on protecting your computer.

Categories
Uncategorized

Lifehacker’s Thanksgiving download: a dozen PC fix-it tools

Of interest is this item on Lifehacker.com, just in time for the holidays, “Geek to Live: A meaty Thanksgiving download.” In a 17MB download, it promises that they will “save you the trouble of chasing down half a dozen PC fix-it tools in the midst of your post-turkey coma. Instead we’ve put together everything you’ll need to right your famliy’s borked computer into one meaty Thanksgiving download…”



Lifehacker’s Thanksgiving PC Rescue Kit – (zip file, 17MB)


“This zip file contains half a dozen free tools we recommend to scan and clean and protect a malware-laden PC. Either download right now and save to your thumb drive, or bookmark this page for next week’s tech support session. The entire file is less than 17 megabytes, which will leave room on your USB drive for those Neil Diamond tracks Mom asked you to download for her.”


Additional resources:



Also check out my past posts on computer security, here on protecting your pc and here on screen scraping, trojan horses and stronger passwords.


Tags: , , .

Categories
Uncategorized

Article: Recovering files by reinstalling Windows, Mac virus protection

Thsi week in Patrick Marshall’s Q&A column on technology, there are two items that struck home for me:


Reinstalling Windows to recover lost files: The first was Mr. Marchall’s advice on “reinstalling Windows may help retrieve photos.” A reader asked what they should do when their “daughter’s computer wouldn’t boot and displayed a message stating that Windows System 32 was missing. All I wanted was to get her pictures off her hard drive.”


Mr. Marshall suggests reinstalling Windows. The error message you’re getting implies that important system files have been corrupted, whether by a problem with the drive or by a virus. That being the case, you’ll need to boot from your Windows disk and reinstall Windows. Assuming you’re able to reinstall, choose to install over the current version. Above all, do not choose the option to reformat the drive prior to installing.


More info on how to do this is detailed on Nick Peers’ good tutorial on reinstalling Windows, and mentioned in this PC World article.


I also agree with Marshall’s suggestion to use a reputable hard-drive data-retrieval service if the drive is damaged and you’re not able to reinstall Windows.


One more thing: back up your files regularly. If you don’t have a writable CD or DVD drive (or even if you do) a handy and ever more affordable way to back up your files is to a USB 2.0 Flash Drive. I found several brands of flash drives (which I refer to as memory fobs, sometimes getting a blank stare at the office) for less than $20 for 1 GB. I use these at home for archiving our photos and important documents, and keep a small spare flash drive in our emergency kit with copies of important family documents and information.


Note on Mac OS X anti-virus: Also of interest in this week’s column was this on Mac AV:



“I wrote that even users of Apple computers should employ anti-virus software, explaining that while there are fewer viruses reported for Apple computers, especially for those using the newest Mac OS X operating system, there are still viruses.


“I was inundated with responses from Mac users, many of whom claimed there are no viruses that target the Mac OS X. While it is interesting to find that so many users feel so passionately about their choice of operating system, it is dangerous to operate under the assumption that your computer does not need anti-virus software.


“Indeed, there is no operating system in the world that is not vulnerable to viruses.


“There were, in fact, so many e-mails that I cannot respond to them individually. Accordingly, I want to again urge readers with more questions to visit the Web site I mentioned in the article: www.securemac.com. You will find extensive coverage there of existing vulnerabilities and viruses affecting Mac OS X and other Apple operating systems.”


I have a Mac at home (actually, more than one… it’s a long story.) and I wouldn’t think to have them on the Internet or our network without AV. I received a number of mails from Mac users to my blog post on “Mac or PC Security, it doesn’t matter: be prepared” and why I noted that being prepared in this example costs me nothing. I have a choice to purchase additional security if I choose. And that’s what I have done for both my Macs (with Norton AV, but I am considering switching to Intego) and my PCs (OneCare with Etrust).


Tags: , , , .