Unintended consequences: Car crashes in the UK due to cameras

As we march forward inexorably into our technology Bold New World, we find cracks in all parts of the plan, continuing to reveal the maxim that the path to hell is littered with good intentions.

Consider the following bizarre video, on one side promoting the benefits of “Talivans” in reducing speeding accidents, and on the other, showing two clear examples where Talivans caused accidents (because drivers going high speed slam on the brakes). Here, via TTAC.

There’s more, as TTAC says:

A UK Department for Transport-funded report suggests that the panic braking seen in the Norfolk footage may not be an uncommon response. A study of speed camera usage in 29 highway construction zone projects over 450 miles of road from November 2001 to July 2003 showed that accidents increased by 55 percent in the locations where speed camera vans were used. The DfT unsuccessfully attempted to prevent publication of the report.

Speedcameras.org even has a slightly risque print campaign on the matter. And there’s even a controversy as to whether or not the speed cameras, errr, actually work correctly.

Alex Eckelberry

Social media and privacy

Shelly Palmer blogs about privacy and Twitter, as regards marketing companies mining the data:

But those systems pale in comparison to the kinds of data we’re giving about ourselves on personalized media like social networks and Twitter. Imagine if through some sort of Semantic Web application a company could glean information not only on what info you offered, and tags you’d left, but also the things you were passionate about, what you’d been writing and saying, asking for and complaining about. Imagine if the company could handle the complaint or fuel the delight of that passionate, highly involved (ok, “engaged”) fan — how much might she crow about you, then, an not only increase her loyalty but also help spur others into the fold?

Then a report that aspiring applicants to colleges may be using Facebook to sabatoge in other potential classmates.

And finally a report (in Hungarian, alas) reporting an “exploit” in Twitter. It’s really simple, actually. Apparently subscribing to a feed of a friend of a person who has a “protected status” (meaning, only friends can see what they’re saying) provides a view into the “protected” conversation. A yawn compared to the current top-of-mind exploit, but it’s worth noting, in case you haven’t noticed: There is no privacy.

Alex Eckelberry

No, we’re not at worm stage… (yet)

Correction: There is a worm component. (Yes, the trojan itself isn’t a worm. But that overlooks the behavior of a dll, a dll dropped by Gimmiv, which is a worm. Now, that doesn’t mean we’re at a SQL Slammer type worm stage. This Trojan has to get into a system. But, nevertheless, I stand corrected.)

There’s some misinformation going on out there that there is already a worm targeting MS08–067. We haven’t been able to verify this.

Looking at the particular trojan that blog mentioned, it seems to me to be a trojan related to the MS08–067 attacks that I took a quick look at this morning:

String12388

You can see it targeting antivirus vendors like Bitdefender, Jiangnmin, Kingsoft, Symantec, Microsoft, Rising and Trend.

And in this screen, you can see some pretty ugly stuff. This is not a nice trojan:

String12388a

At any rate, I don’t want to de-emphasize the absolutely vital need to patch systems ASAP.

And, we would make an educated guess that a worm will hit soon (maybe in the next day or so).

Alex Eckelberry

Just some comments on MS08-067

I was stuck in meetings today and didn’t get a chance to write much more than I did earlier.

Just some quick notes on MS08-067.

– We have samples in-house of the trojans in-the-wild that are being used in targeted attacks, taking advantage of this exploit. These are currently only targeted attacks, not being used broadly by malware authors.

– It is not a light thing. The urgency is quite real — unpatched, you’ve got the spectre of another SQL Slammer, Code Red type of scenario if the malware writers create a worm. The other issue with this patch is that it affects a broad number of systems (XP, Windows 2000 and 2003 — the Vista/2008 platform isn’t at the same level of risk).

– It is an extraordinary event that pushes Microsoft to do an out-of-band update. This is a big deal for them — each update is tested on a vast number of machines. It underscores the potential seriousness of this vulnerability.

Patch like hell and let’s hope everything will be ok in the morning.

Alex Eckelbery

Comments: There is no conspiracy

After moving to moderation (because of so much spam) I, well, err, accidently deleted a number of comments. Some are already suspecting a conspiracy. But no, that’s not the case. Just a simple screw-up.

If you’ve posted a comment in the past couple of days and you see it mysteriously gone, feel free to repost. My apologies for the error.

Alex Eckelberry

Analysis of German VOIP attack

VOIP security is an issue, but it is often overhyped (and often, misunderstood). However, “security breaches” in this area should be analyzed carefully to understand the potential issues as VOIP is rapidly rolled-out.

In September, “attacks” against German VOIP users were first reported by Heise in Germany. This attack didn’t get much attention in the US, which is understandable, since almost all of the coverage was in German.

It’s clear that the motive behind these attacks was to check for unsecured gateways. As to why they were checking for unsecured gateways, it seems reasonable to assume that the attackers were looking to make free calls (that conclusion was reached by HoneyNor for a similar series of attacks in Norway). Or, as VOIP expert Klaus Darilion said after analyzing the attack “I only saw the single INVITE request, thus the final PSTN target (Jamaica, Malaysia, …African destination are also often used) was not visible for me. But once the attacker found an “insecure” gateway – that means the gateway forwarded the request, the attacker can use it for making phone calls into the PSTN.”

However, safeguarding against such attacks isn’t that hard. Darilion has provided an excellent writeup on what happened, along with tips on how to protect an organization. I would recommend reading the “Countermeasures” section of his writeup for a fairly simple set of steps to protect your organization. Also, there’s more discussion on this issue at VOIPSEC.

Alex Eckelberry

WinDefender 2008 with a sidebar

Nifty, the Windefender 2008 has a pretty little sidebar to add to the illusion that it’s a normal product (Windefender isn’t itself a new rogue security program, we just thought the sidebar was something interesting).

WinDefender 2008_iSideBar

Along with the usual fake scanning application:

WinDefender 2008_iSecurityCeter

WinDefender 2008_iGUI

Sites Associated:

207.226.179.163 webscanneronline. com
207.226.179.163 internetscannerlive. com
207.226.179.162 win-defender. com
207.226.179.166 update1.win-defender. com
207.226.179.148 registerwindefender. com

Fake 404 page pushing scam:

dns-problem. com/?sid=ar&gid=ma

Online scanner scam

update1.win-defender. com/scanner/scanner.php

Running the free VIPRE trial will remove this threat from a computer.

Alex Eckelberry
(thanks, Patrick Jordan)

New rogue: AntiSpyware XP 2009

AntiSpyware XP 2009 is a clone of XP AntiSpyware 2009 rogue security application. This rogue belongs to WinReanimator family.

AntiSpyware XP 2009

Fake Windows security Center
Windows security Center

AntiSpyware XP 2009 also drops a set of fake files into both windows and system32 folders.

Sites Associated

92.48.201.43 Antispyware-xp2009.com
92.48.201.43 Asxp-2009.com
92.48.201.43 Asxp2009.com
92.48.201.44 Antispywarexp-2009.com
92.48.201.44 As-xp2009.com
92.48.201.46 Antispyware-xp-2009.com
92.48.201.46 As-xp-2009.com
216.195.41.59 Downloadsoftindex.com
216.195.41.60 Downsoftindex.com
216.195.41.61 Downsofthome.com
216.195.41.62 Downloadsofhome.com
216.195.41.63 Updatesofthome.com

Bharath M N

Happy Birthday!

Something on the social side today:

Happy birthday to Alex Eckelberry, Amy Rolak and Melissa Aull!

We’re glad you showed up for work today and on Behalf of Sunbelt Software enjoy your very special day. All the best for you.

PS: Alex, stop complaining, you’re not going to die very soon and according to a office voting you still look young and handsome.

Signing off,
Michael St. Neitzel

Seen in the wild: Skype spam

Richard Stiennon sent this one over to me.

It’s not malware, per se. But it’s completely fraudulent.

[4:40:27 PM] Update Alarm ® says: WINDOWS REQUIRES IMMEDIATE ATTENTION =============================

ATTENTION ! Security Center has detected malware on your computer !

Affected Software:

Microsoft Windows Vista
Microsoft Windows XP
Microsoft Windows 2000
Microsoft Windows NT Server 4.0
Microsoft Windows Win98
Microsoft Windows Server 2003

Impact of Vulnerability: Remote Code Execution / Virus Infection / Unexpected shutdowns

Recommendation: Users running vulnerable version should install a repair utility immediately

Your system IS affected, download the patch from the address below !
Failure to do so may result in severe computer malfunction.

http: //www. registryscan. cc/?q=scan

The page goes to a typical fake scan page.

Registry2134888

However, unlike many rogues, it won’t download anything without payment first.

Registry2134888a

Complete fraud. Server hosted in the state of Washington. Anyone listening?

Alex Eckelberry

People, we need to get along

Cooperation improves phishing takedowns. No surprise.

When we examined our data more carefully we found that we were receiving “feeds” of phishing website URLs from several different sources — and the “take-down” companies that were passing the data to us were not passing the data to each other.

So it often occurs that take-down company A knows about a phishing website targeting a particular bank, but take-down company B is ignorant of its existence. If it is company B that has the contract for removing sites for that bank then, since they don’t know the website exists, they take no action and the site stays up.

Since we were receiving data feeds from both company A and company B, we knew the site existed and we measured its lifetime — which is much extended. In fact, it’s somewhat of a mystery why it is removed at all! Our best guess is that reports made directly to ISPs trigger removal.

Link here.

Alex Eckelberry
(thanks, Jose)

New rogues: Brought to you by Innovagest 2000

Innovagest 2000 group comes up with couple of new rogue security applications.

Spy Protector
Spy Protector

Spy Protector Home page
208.85.178.140 Spyprotector. org
Spy Protector Site

Fake/Scare scan page used by Spy Protector
208.85.178.140 Win-security-scanner.com
Spy Protector Scanner

Security 2009
Security 2009

Security 2009 Home page
208.85.178.140 Security-2009. com
Security 2009 Site

Fake/Scare scan page used by Security 2009
208.85.178.140 Security-center-scanner. com
Security 2009 Scanner

Detection by existing antivirus engines on these rogues is really poor.

Bharath M N

downloadmalware.com reverses

The siteowner of downloadmalware.com read the blog, made a comment and promises to no longer offer the malware download.

The site appears to be suspended right now anyway.

Anyway, to the owner, thank you for listening to the security community and removing this download.

Incidentally, this is not the first time a similar crank has been tried. Didier Stevens did it, but it was strictly as a research experiment, and no malware was ever delivered.

Alex Eckelberry

A sick joke

Downloadmalwar123888

Guess what? A new site, Downloadmalware com, offers free malware.

No. Really. What you get is a Vondu/Virtumonde trojan.

There’s full-disclosure on the site:

Commence Tomfoolery

Everyone knows that it’s no fun getting a virus, and viruses can be obtained by doing basically anything on the internet. That’s why we created Malware, in order to finally put a stop to constant viral infections on yourMalware128812388a personal computer. We have many competitors, and they may be more popular than us, but at some point in this company’s career, we will surpass them. It’s all about persistence and determination, and I would know because I just wrote an essay about that.

Our Approach: As stated on the main page, our methods of preventing viruses are very similar to how the common flu is prevented. We inject your computer with a small ‘virus‘ so that your computer can build up an immunity to all viruses in general. In the past, technology was incapable of developing a program like this, but thanks to new dreamweaver technology by adobe, millions of users around the world are now protected from the most deadly computer viruses.

To, Delve into the Situation Further: Our malware program includes a packaged installer. This packaged installer contains two separate files. One of these files is full of little bits of viruses, and the other package contains the white blood cells of nanotechnology. After the virus is installed, the Wano Cells (White-Nano-Cells) are released into the computer’s data stream. The Wano’s are programmed to seek, analyze, and destroy any form of virus that your computer might have. This super advanced sense of analysis is almost like human instinct, and is the future of virus prevention and removal!

At the bottom of the page, he says:

Warning, this is actually a program that causes popups on your computer… I’m pretty sure it’s harmless but I don’t think you should try and find out. If you download this program you’re dumb! This post is a joke.

Well, it’s not a little piece of malware. Vondu/Virtumonde is anything but.

The author admits to feeling some guilt about putting up a website that openly delivers malware, but feels justified in that he feels anyone stupid enough to actually download the malware kinda deserves it.

This is my attempt at a sort of viral website. It could be seen as a “youfail” sort of site that forum users point to when someone asks a dumb question. I’m not really sure but I’m hoping it works.

I made it blatantly obvious that the file up for download is malware, so anybody who does download and install the program I have uploaded is retarded (nothing against retarded people). The catch is, it’s the affiliate adware from luxecash so I get money every time someone actually does download and install it.

I don’t know whether or not I should deck the site out with ads, or if I should keep it ad free to legitimize the product. I guess I’ll just have to wait and see if there are any people out their who would bite. I’m under the impression that people without a lot of computer knowledge would actually believe it.

It sort of makes me feel like a dick, but since I clearly state that it’s malware… it’s better than uploading it to a torrent site saying it’s msn messenger or something right?

And his own blog post, he has this to say:

…I decided that instead of taking the conventional approach to making money, I would make up my own way. I realized that spending hours uploading files to torrent websites would be just like me actually going to work for a few hours in order to make money. Now, not that I’m against doing a little bit of work for the money, but the only way to make good money requires that you do some illegal things, and work.

So I came up with downloadmalware.com, where people can voluntary download my adware. People like my mother (who will eventually read this post) are really the only people I can expect to download the adware from that site. One would have to be some un-saavy with computers it would be rather disturbing. Not only would you be displaying your lack of computer-vocab, but an extremely huge amount of gullability. For that purpose, I don’t feel so bad knowing that I’m giving someone popups, and I’m also glad what I’m doing isn’t illegal.

I’ll update this with some info on how the site works out for me… but I’ll have to give it some time to saturate in there with the big Goog.

Someone asked in a comment what the malware was, the malware is simply the luxecash affiliate program installer. I’ve never tried installing it on my own computer, but I’m pretty sure it’s just adware… so you get popups every once in a while.

Ok, I have a sense of humor. I get it.

But this is not funny at all.

I hope this enterprising fellow takes this crap down as soon as possible.

Alex Eckelberry

Heads-up: New nasty on the way?

Nano123123123888132

There’s a new site out for a rogue security product, NanoAntivirus. This looks like it will be a potential replacement (or additional rogue version) of the pernicious Antispyware Pro XP.

Binaries are not active (yet). However, a fake scanner page is already up: scan. antispyware-free-scanner. com/100525/8/ (if you don’t add the 100525/8/, you get the Antivirus XP Pro scan, complete with fake “porn” that’s been “found” on your computer).

Alex Eckelberry
(thanks, Bharath)