Month: December 2006

Websense has a writeup on a skype trojan that a number of security researchers have been discussing over the past couple of days.  It was originally thought to be a worm.

Yesterday Websense Security Labs reported on our blog that there was a potential Worm propagating via Skype (see: http://www.websense.com/securitylabs/blog/blog.php?BlogID=101). After investigation we have discovered that this is not a self propagating worm and is actually a Trojan Horse.

After discussions with the very helpful Skype security team, the behavior of this Trojan using the Skype API is as per the specifications of the API. The end-user who is running Skype does get notified that a program is attempting to access it and must acknowledge it.

*there is no vulnerability in Skype at this time that has been uncovered*

Link here.

 

We got a bunch of these today.  Typical Mydoom crap, attempts to infect users with a virus, through a fake “abuse” email from your own domain.  In this case, it uses a spoofed link, which redirects to mailsecuritycenter(dot)org/Confirmation_Sheet.pif.

 Detection is fairly low among AV products.  

 Alex Eckelberry

How to use the Networking Tab in Task Manager
You can use the Networking tab in Windows XP Task Manager to get a visual representation of the traffic occurring on your local network connection. To access it, do the following:

1. Right click the taskbar and select Task Manager.
2. Click the Networking tab.

You’ll see a graph that indicates network utilization. Underneath it, columns show the network adapter name(s), percentage of network utilization in real time, the link speed for each adapter, and its state (whether it is currently operational). By default, total bytes sent and received are shown in the graph, but you can have it show bytes sent and bytes received separately, by clicking the View menu and selecting Network Adapter History.

You can also select many more columns to display. Click View and select Display Columns. For example, you can show the total bytes and/or bytes sent and bytes received so that you have the total numbers in addition to the graphic representation and percentage utilization.

The Networking tab is handy for diagnosing connectivity problems that may be related to network congestion. For more information about what each column represents, click here. 

Store your Favorites online with Windows Live
There are so many Windows Live services that you may not be aware of some of them. Did you know that you can store your favorites online so they’ll be accessible anywhere, no matter what computer you’re using? If you have a Windows Live ID, just go to http://favorites.live.com and sign in. You’ll need to accept the terms of use agreement, Then you can import your existing favorites on your local computer to your Windows Live account. Just click the Import option in the Add menu at the top of the page. Adding new favorites is simple, too.

Parental controls in Vista put you in charge
In homes with young children, allowing the kids to benefit from the educational value of the Internet without exposing them to its dangers is a big concern. Vista lets you set parental controls on your kids’ user accounts (this works only for local computer accounts, not domain accounts). This is done via the Set Up Parental Controls option in Control Panel. On a per-user basis, you can configure settings to specify which Web sites are allowed, as well as allowed types of content. You can set time limits for when the computer can be used, what games can be played (based on their rating, content or title) and block programs by name. You can also have activity reports recorded that you can review. For more information, click here. 

Patch fixes vulnerability in wireless networking cards
A while back, there was a big uproar over the fact that some wireless networking adapters built into laptop computers had a vulnerability due to the fact that they start scanning automatically for wireless networks when you reboot the computer or when it wakes up from hibernation. Microsoft has released a patch for XP SP2 machines to fix the problem, but it wasn’t included with the Patch Tuesday updates. You have to manually download and install it, at least at this time. If you’re using a laptop with embedded wireless, it’s a good idea to do so. You can get it here.

Can I remove my user information from Windows Messenger?
You may find that after using Windows Messenger, your user name is displayed in the list of Windows Messenger users. If you want this want this information private, you can delete your user name from the list that Windows Messenger saves. How to do it depends on whether the computer is a member of a workgroup or a domain. Here’s how:

1. Click Start | Control Panel.
2. Click User Accounts.
3. On a workgroup computer, click your user account in the list. Under Related Tasks, click Manage my Network Passwords. Select the user account in the Stored User Names and Passwords box and click Remove.
4. On a domain computer, click the Advanced tab, click Manage Passwords, and in Stored Users and Passwords, select the user account and click Remove.
5. Click OK.
6. Click Close.

Now your user name shouldn’t appear in the list in Windows Messenger.

Can’t synch offline files as you expect in XP
If you try to synchronize your offline files on your Windows XP computer and get an error message that says “More data is available” or “The system cannot find the file specified,” it may be that a cache has become corrupted. There is a hotfix available that addresses this problem, as long as you have SP1 or SP2 installed. To find out how to get the hotfix, see KB article 903891.

How to copy data from a corrupted profile to a new one
If your user profile becomes corrupted, you can copy the files and settings from the old profile to a new one. This doesn’t apply to Outlook Express email messages and addresses. For instructions on how to create the new profile and then copy the relevant files to it, see KB article 811151.

XP stops responding at the Welcome Screen
If your computer stops responding (hangs up) when the Welcome screen is displayed after a reboot, and the keyboard and mouse stop working, you might receive the following message after you restart again: “System restart has been paused. Continue with system restart. Delete restoration data and proceed to system boot menu.” This happens because the computer goes into hibernation and accesses a corrupted memory snapshot. For instructions on how to fix it, see KB article 294427.

Internet enabled surveillance cameras can catch burglars in the act
If you’ve installed Internet enabled surveillance cameras that can be accessed via the web at your home or business, you probably already know that they can keep you apprised of what’s going on when you’re gone. A Brazilian businessman recently saw a criminal burglarizing his house, watching on his laptop while he was traveling in Germany, and police were able to get there in time to catch the bad guy. Link here.

Gartner predicts Vista will be the end of Windows
A report released by the Gartner research firm earlier this month predicts that Vista will be Microsoft’s last big operating system release. Many in the IT industry are, to put it mildly, a bit skeptical. Gartner’s rationale is that operating systems will become more modular, with “more flexible updates.” Of course, Microsoft has been releasing incremental updates for years (hey, Gartner guys, that’s what service packs are all about). Of course, crystal balls are notorious for being a bit inaccurate.

Vista update fights product activation crack
Last week, we told you about a reported crack for the Vista anti-piracy mechanism. There are already several cracks out there that attempt to bypass product activation. This week Microsoft released an update to Vista that’s supposed to combat the “Frankenbuild” product activation workaround. Read more here.

Hackers selling Vista exploits for big bucks
Once upon a time, hackers did their dirty work just for the fun of it. Now they’ve gone commercial. It’s been reported by Trend Micro that members of the hacking underground are trying to sell exploits for Windows Vista. The price tag: up to $50,000. Bad guys can also buy stolen personal data from the same sources; that’s where much of the information stolen in phishing attacks ends up. Read more here.

This is the time of the year when many of us seem to accumulate a lot more “stuff” to add to our collections. Holiday gifts that we may or may not really want, end of year sales that we just can’t resist, those little “pick me up” presents to ourselves to counter the winter doldrums, whatever the reason, it’s likely that come spring cleaning time, you’ll find yourself with closets and shelves that are more crowded than they were a few months ago.

Some self-disciplined folks have no problem keeping their lives clutter free. Those lucky souls are the ones who can ruthlessly root out all the unnecessary possessions that are taking up too much space and consign them to the trash bin or the Salvation Army sack without even a twinge of remorse. For others, it’s not quite as easy.

I’m one of those people who’s not comfortable unless my surrounding are nice and organized. I like a place for everything and everything in its place. But it’s hard to reconcile that compulsion with another I have: to never throw away anything that might still have value or be useful to me or someone else in the future. Thus my closets, drawers, garage and attic are overflowing with nicely organized things that I’ll probably never use again.

I admit it: I’m something of a packrat – although not as bad as some people I’ve known, who save things that couldn’t possibly ever be of use to them again. For example, when my mom passed away and I had to go through all her belongings in preparation for selling the house, I found boxes and boxes of old receipts that had long outlived their tax or other recordkeeping purposes (I’m talking about things like grocery store receipts and utility bill stubs from thirty years before). Hmmm … maybe you’re beginning to see where my own packrat tendencies came from.

In this electronic age, those of us who like to keep things have the perfect venue: our computers. We can collect digital photos or songs or other files in the same way we collect coins or stamps or guns or dolls in the “real world.” And with hard disk space getting cheaper all the time (a Maxtor 500 GB SATA drive can be had for $149 – that’s about 29 cents per gig), it’s tempting to keep everything. And with digital data, you can keep several copies of everything. Just to be on the safe side.

Consequently, we electronic packrats find our gargantuan disks filling up quickly, with music, video, pictures, documents, archived email and so forth. It’s fun to amaze my friends by going back and reproducing a message I received ten years ago. But what if you were required by the government to keep copies of all your electronic data? That’s exactly the situation that businesses – and maybe even individuals – are likely to eventually find themselves in.

Data retention laws are gaining ground fast. At the beginning of this month, new federal rules went into effect that prohibit companies from deleting data that could be relevant in a lawsuit. In other words, deleting the wrong file could subject individuals and businesses to the same penalties as shredding paper documents that might be later asked for by the court. The good news is that this law contains a “safe harbor” provision that says that absent exceptional circumstances, a court can’t impose sanctions on a party for failing to provide electronically stored information that was lost as a result of routine, good-faith operation.” Many breathed a sigh of relief at that. The “gotcha” is that the law requires you to retain data not just after a lawsuit is filed, but if litigation is “reasonably anticipated.” You can read more about the new rules here.

Of course, ISPs are already required to retain a good deal of information. And the European Union is way ahead of us when it comes to data retention; their parliament approved a requirement a year ago requiring ISPs, phone companies and VoIP providers to maintain information about all electronic messages sent and phone calls made, for up to two years.

Keeping electronic information around forever is a two-edged sword. Certainly we’ve all encountered frustration when dealing with some business that claimed to no longer have our records, but having all that data out there – especially personal and financial data – also puts us all at risk that it will eventually be accessed by the wrong person. Privacy of any kind is quickly becoming a thing of the past.

Of course, there are a lot of persuasive arguments in favor of data retention requirements. It will help us detect and prosecute terrorists, it will help us protect consumers, we need to do it “for the children” to catch pedophiles. And masses of information that contain everyones’ email messages, phone calls, credit card purchase record, travel history, etc. will indeed help with all those pursuits. But at what price to society and individual liberties? That’s what remains to be seen.

What do you think? Are you an electronic packrat? If so, has long term saving of data saved your skin on at least one occasion?

Or does all that info just sit there taking up space?

Should the government be allowed to be an electronic packrat too, creating huge databases that detail every aspect of our lives? Are the benefits worth the risks?

Should private businesses be required to keep data such as all its employees’ emails and records of their phone calls, even when no litigation proceedings have been initiated? 

Deb Shinder, MVP

I’m sorry, we didn’t plan on having so many new rogue antispyware apps up today. But things just happen like that sometimes.

There is a new variant of Spyaxe (related to the Virusburst folks), called Malwarewiped.

IP: 85.255.120.18   
malwarewiped(dot)com

Application screen:

Obviously, stay clear of these rogue applications. If you are infected, the latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry
(With a hat tip to PIRT handler Nosirrah.)

Two more fake codec sites:

IP: 85.255.117.197 
apassmanager(dot)com       

IP: 85.255.117.197 
imageactivex(dot)com         

 

Obviously, do not download these fake codecs as they are malware. If you are infected, the latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry

 

The Open Relay Database is shutting down, as “Our volunteer staff has been pre-occupied with other aspects of their lives. In addition, the general consensus within the team is that open relay RBLs are no longer the most effective way of preventing spam from entering your network as spammers have changed tactics in recent years, as have the anti-spam community.”

My only comment?  Good.  Open relay RBLs had their use years ago, but even then generated false positives.   They’re useless now.

Alex Eckelberry
(Hat tip to Donna)

There has been some discussion on the net of a recent article written by Jürgen Schmidt about how Skype gets around firewalls.

From the article:

Naturally every firewall must also let packets through into the local network – after all the user wants to view websites, read e-mails, etc. The firewall must therefore forward the relevant data packets from outside, to the workstation computer on the LAN. However it only does so, when it is convinced that a packet represents the response to an outgoing data packet. A NAT router therefore keeps tables of which internal computer has communicated with which external computer and which ports the two have used.

Schmidt hits the point and a basic tenet of firewalls.  A response to an outgoing connection is trusted by the firewall.  

A variant of this same theory is used by web-based conferencing and remote control systems like Go2MyPC, as well as some games:  They broadcast a message out, and the response coming back in is trusted.  It’s one reason why programs such as Go2MyPC are generally looked on askance by IT managers.   It just sits there, chirping happily away, looking for a friend to talk to.  (Note that Go2MyPC and Skype are quite different in their methods, but the basic theory remains the same).

Does this mean Go2MyPC or Skype will bring down your system through attack?  Not necessarily. This is not something worthy of getting into any deep paranoia, but really just an observation: Just because you have all the ports locked down on your firewall does not mean it can’t be accessed remotely.  All that’s needed is a client installed on a user’s PC to establish an outbound connection, and then “bring in” another connection. If you’re truly worried, you can get a free desktop firewall (like mine or Zone’s) which will note what’s going out and provide you with the ability to block it.

Alex Eckelberry

A new Spysheriff clone is on the loose — MrAntiSpy.

Creatively, they ripped off the Mr. Clean logo.  Anyone with contacts at Procter and Gamble?

We can see in their satisfaction guarantee their relationship to Spysheriff:

One interesting aspect about this rogue is the owner in the whois records — the same one as procounter(dot)biz, which has been running malware files via vxgame-related sites last year and part of the Cool.WebSearch world since 2002. Nice bunch of folks, eh?

Stay away from these.  The latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry
(Credit to PIRT handler Nosirrah for the tip).

Another new rogue antispyware product, designed to rip you off:  SpyMarshal.

A SpySheriff clone, related to BraveSentry and KillAndClean through the same company, Stratex International, (which also markets ScanAndClean and UnspyPC). Dizzy? You should be, it’s not all simple out there.

 

Identical license agreements show the relationship of “Stratex International.”

Note that KillAndClean and ScanAndClean are all marketed through Digital River’s subsidiary, Regsoft.  Anyone with any contacts there?

 

One can see that the installations are identical to BraveSentry.  This is a BraveSentry clone.

Stay away from these.  The latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry 

Gromozon, just about the nastiest piece of malware/spyware we’ve ever seen, dropped off the radar recently (I had described it in an interview with Search Security as a piece of malware that “drips blood”).

However, it’s techniques have evolved. The same people behind it are now using a variant of the Rustock trojan, Rustock.b (Rustock.a has been around since around June).  

Now, we’ve only seen Gromozon in Italy (researchers — you need an Italian IP to get the malware).  Why Italy, you ask? I would guess poor legislation and enforcement, and a plethora of vulnerable machines.

Symantec actually had a pretty good writeup on this trojan. 

– Rootkit detectors can detect hidden processes, but Rustock.A has no process. The malicious code runs inside the driver and in kernel threads.
– Rootkit detectors find hidden files, so Rustock.A uses NTFS Alternate Data Stream
to hide its driver into the “System32:18467” ADS. In addition, this ADS can’t be enumerated by ADS-aware tools since it is protected by the rootkit.
– Some detectors check for the presence of system hooks by analyzing native API
and scanning for hooked functions, however Rustock.A does not hook directly any native API.
– Rootkit detectors also check for the integrity of some kernel structures like the Service Descriptor Table, but Rustock.A controls kernel functions by hooking MSR_SYSENTER and other special IRP functions. [2]
– Rootkit detectors try to detect hidden drivers, but Rustock.A removes its entries from many kernel structures including the Services Control Manager, Object manager, and the loaded module list so that this enumeration fails.
– Last, but perhaps not least, the SYS driver is polymorphic and changes its code from sample to sample.
Moreover, the malware contains aggressive rootkit technologies because it scans for the following strings in loaded programs, and then changes its behavior to avoid any detection:
– BlackLight
– Rootkitrevealer
– Rkdetector

Note the statement “Rustock.A has no process. The malicious code runs inside the driver and in kernel threads,”  and then the statement that it changes its behavior to avoid detection by the popular rootkit detection programs BlackLight, Rootkitrevealer and Rkdetector. And, “It even seems able to achieve all of its stealth functionality without any problems on a beta version of Microsoft Windows Vista.”(Note that despite vehement opinions otherwise, this is one more reason why Microsoft needs to release the 64 bit Patchguard APIs earlier than 2008.  We cannot even imagine what future threats might look like.) 

So you get the picture?  This is one really nasty little bastard.   I feel sorry for Italians!

Alex Eckelberry

I am a bit of a military and political buff and recently saw something rather interesting, just published by the US Army.  Entitled “Counterinsurgency”, it’s a detailed look (281 pages) at practically all aspects of counterinsurgency.

1-5. Governments can be overthrown in a number of ways. An unplanned, spontaneous explosion of popular will, for example, might result in a revolution like that in France in 1789. At another extreme is the coup d’etat, where a small group of plotters replace state leaders with little support from the people at large. Insurgencies generally fall between these two extremes. They normally seek to achieve one of two goals: to overthrow the existing social order and reallocate power within a single state, or to break away from state control and form an autonomous entity or ungoverned space that they can control. Insurgency is typically a form of internal war, one that occurs primarily within a state, not between states, and one that contains at least some elements of civil war.

Interesting to me were the short case studies (in grey boxes) providing historical perspectives on past insurgencies.  Makes you wonder if anyone at the top levels of our government ever took a history class. What we’re going through in Iraq has happened so many times in the past it’s almost a joke.

For example, under a case study entitled: “Lose Moral Legitimacy, Lose the War”, we see this example:

During the Algerian war of independence between 1954 and 1962, French leaders decided to permit torture against suspected insurgents. Though they were aware that it was against the law and morality of war, they argued that—
• This was a new form of war and these rules did not apply.
• The threat the enemy represented, communism, was a great evil that justified extraordinary means.
• The application of torture against insurgents was measured and nongratuitous.

This official condoning of torture on the part of French Army leadership had several negative consequences. It empowered the moral legitimacy of the opposition, undermined the French moral legitimacy, and caused internal fragmentation among serving officers that led to an unsuccessful coup attempt in 1962. In the end, failure to comply with moral and legal restrictions against torture severely undermined French efforts and contributed to their loss despite several significant military victories. Illegal and immoral activities made the counterinsurgents extremely vulnerable to enemy propaganda inside Algeria among the Muslim population, as well as in the United Nations and the French media. These actions also degraded the ethical climate throughout the French Army. France eventually recognized Algerian independence in July 1963.

Or this example, under “Campaign Assessment and Reassessment”:

During Napoleon’s occupation of Spain in 1808, it seems little thought was given to the potential challenges of subduing the Spanish populace. Conditioned by the decisive victories at Austerlitz and Jena, Napoleon believed the conquest of Spain would be little more than a “military promenade.” Napoleon’s campaign included a rapid conventional military victory but ignored the immediate requirement to provide a stable environment for the populace. The French failed to analyze the Spanish people, their history, culture, motivations, and potential to support or hinder the achievement of French political objectives. The Spanish people were accustomed to hardship, suspicious of foreigners and constantly involved in skirmishes with security forces. Napoleon’s cultural miscalculation resulted in a protracted occupation struggle that lasted nearly six years and ultimately required approximately three-fifths of the Empire’s total armed strength, almost four times the force of 80,000 Napoleon originally designated.The Spanish resistance drained the resources of the French Empire. It was the beginning of the end for Napoleon. At the theater level, a complete understanding of the problem and a campaign design that allowed the counterinsurgency force to learn and adapt was lacking.

So if you really want to understand counterinsurgency, this detailed tome will be your answer:   Link here (via beSpacific). 

That is, if you can get through it without collapsing from the overwhelming amount of detail.

Alex Eckelberry

We caught this post by an apparent (and decidedly foreign) troll on a newsgroup earlier today about a mail security product:

“I am using GFI Antispam and it is very delicious. If you make your
configuration good, it works very very fine. I tried different types of
antispam included Symantec mail security but GFI better. If you want any
information , do not hesitate to contact me.”

Antispam software delicious?  Love it!

To match the spirit, Greg here came up with our own yummy delicious logo for our own product!

Interesting video by Enigma Software on the Mirar Toolbar (the video is not related to Sunbelt).

Perhaps Mirar sent the authors a similar notice?

Alex Eckelberry

Today, we received a cease and desist letter from NetNucleus, makers of Mirar. 

The letter has been referred to our high-priced lawyers and we will be filing a response in due course.

It should be interesting preparing our response, considering that even just recently, Mirar Toolbar was observed in a mass installation from fastmp3search.com. 

You can read their C&D here.

Alex Eckelberry

Wow, this is such a cool new service.  Just found my brother’s microbubble patent. And Sunbelt’s Joe Wells has some listed as well. 

Google patent search can be found at http://www.google.com/patents.

Have fun, it’s a great service. Now we just have to clean up the patent system in this country and all will be well.

Alex Eckelberry

 

Bill Brenner over at Search Security interviewed me for a piece on malware, patchguard and other things. 

Symantec and McAfee were particularly critical of Microsoft over PatchGuard, and they were called crybabies by some in the media…
Eckelberry: I think the stand they took was absolutely warranted, and I don’t think it hurt the overall cause. There is often a general knee-jerk reaction when Symantec and McAfee complain about something Microsoft does, because people will inevitably think they’re just whining. However, what Microsoft has been doing with PatchGuard absolutely made their reaction justified. Symantec has a whole team that deals with Microsoft. You can bet their discussions broke down and went from a very diplomatic issue to turning into a press spat.

You can read the Q&A here.

Alex Eckelberry

We’ve blogged before about the weird occasional delays in IE 7.

This may be due to a bug in the phishing filter.  Microsoft has released a patch, here, via Sandi.

Here’s hoping it will make a difference. 

Alex Eckelberry

 

A major part of the new CounterSpy 2.0 is the inclusion of a number of antivirus technologies to combat the increasingly complex forms of malware out there.  For example, since over 90% of all malware is packed using UPX or other similar packers, we built our own generic unpacker. 

One thing we needed to do was to build our own x86 emulator that will run inside a future version of CounterSpy Anti-malware Engine.  As part of that, we built our own emulator/debugger for analyzing malware and automatically creating signatures.  I was playing with it over the weekend and it’s pretty cool (don’t worry, I only play a programmer on TV).  The malware executes inside the emulator and you can unpack it for analysis, similarly to how you might debug or analyze code in OllyDbg or the like.

I’ll be writing more about our new technology in the coming weeks.  Lots more to talk about.

Alex Eckelberry

As many of you know, one of the great computer industry pioneers died yesterday.  While I used to work down the street from 1 Disk Drive (the Seagate headquarters), I never got to meet Al.   I wish I had.

A great way to get an idea of what kind of person he was is from an interview he did years ago with Jill Wolfson at the San Jose Mercury News and Bruce Phebus for the Tech Museum of Innovation.

There’s some Shugart great quotes in there, like:

On education: “[Kids are] learning all kinds of junk stuff. They gotta learn how to read and write, learn how to communicate, and learn how to be computer literate. Beyond that, they ought to do what they like to do.”

On common sense: “There’s not enough logic any more. Common sense is dead.”

On the web: “If you find somebody who spends four hours a day surfing the web, they’re really not a very balanced person.”

On politics: “We’ve got to get rid of the Republicans and the Democrats and the lawyers and elect only independents.”

Interview link here.

He was a great man and he will be missed. 

Alex Eckelberry