Category: Uncategorized

I would love to see a copy of that hard drive…

David Farr was once employed as a respiratory therapist at St. Francis Hospital in Indianapolis, Ind. He started there in October 2000 and was the only male respiratory therapist.

All of the seven respiratory therapists share a small office divided into individual cubicles with one computer in the center of the room. Each therapist is assigned a password, though it’s unclear whether logs are kept of each user’s individual activities.

In July 2005, Farr’s supervisor informed him he was suspended from work because pornographic entries were found in his “Favorites” file, apparently a reference to Web sites bookmarked. Farr denied being responsible and said he was rebuffed when he asked for details about the allegations.

Farr was fired in August 2005. An e-mail message from the hospital’s lawyer at the time claims to “have evidence that provides us with reasonable belief that he was accessing pornographic Web sites on his work computer.”

After losing his job, Farr went through the formal grievance process listed in the hospital handbook and met with no success. He filed a lawsuit after the grievance committee upheld his termination in December 2005.

What makes this case relevant to Police Blotter is that Farr claims that “St. Francis failed to install and update effective antivirus protection on its computers” and that any pornographic bookmarks were inserted by malware. He also claims that antivirus software was required by Health Insurance Portability and Accountability Act.

Farr even retained a computer forensics specialist who concluded: “No one had intentionally loaded the list of Web sites on the computer. Rather, the list was placed on the respiratory therapists’ computer by a common and well-known Internet virus that promotes fee-generating pornographic sites.”

That is plausible. One of the malware programs known to inject porn bookmarks is CoolWebSearch, also called CWS or CoolWWWSearch, and it’s been around since 2003. Some reports have estimated that 5 million sites are infected with it and that more than 60 strains of it exist.

More here.

Alex Eckelberry
(Thanks Francesco)

Last week, we received a sample of personalized spam. The name of the recipient has been redacted — however, it is an accurate spelling of that person’s name.

It goes without saying that the recipient of the spam has no idea who “Tony” is.

So how did this happen? While the first thought might be spammers scraping names from Facebook or LinkedIn, this may very well have occurred by by scraping publicly-available alumni lists. There are a lot of open alumni lists out there, as this Google search shows. And, of course, Augstana college is one of those sites with an open alumni list.

We’ve seen more and more personalized spam attacks over the last several months, and it is a troubling trend. For obvious reasons, a finely targeted spam has a higher chance of being read and acted upon. And that’s one more reason for the urgent need for broad user education and ongoing improvements in security products. And when I say user education — I mean blast it out on mass media through Ad Council methods or what have you.

Alex Eckelberry

Andreas Marx gave a presentation at the Virus Bulletin conference in Vienna, and I’m posting it here for reference.

Paper here.

Presentation (PPT and PDF)*.

From Andreas:

During the Virus Bulletin 2007 Conference I gave a presentation on the topic “The WildList is dead, long live the WildList!”.

It actually confirms that some AV product tests are very problematic, especially, if they are only based on the WildList as reference. I’ve created some interesting statistics to show that the WildList cannot be used anymore (in it’s current state) to show how good or worse products are…

The feedback from the industry was quite interesting… for example, Panda has blogged that they strongly agree on my comments while Sophos disagrees that the WildList is not useful for testing purposes anymore:

Back from Virus Bulletin 2007 (Panda Research Blog)

Is the Wildlist still relevant? (Sophos Blog). I also saw a comment from an other AV tester here. And Authentium’s Eric Kumar has a blog up as well on the subject.

Alas, Andreas caught me on camera swigging some substance at the Virus Bulletin dinner. You can see one of the frightful pictures here.

Alex Eckelberry
* (Copyright is held by Virus Bulletin Ltd, but is made available on this site for personal use free of charge by permission of Virus Bulletin.)

I’m a little late on this one but wanted to get something up.

Yesterday, a botmaster was busted. But this one is close to home: He was allegedly behind the DDoS attack on CastleCops earlier this year.

(Photograph taken from a Yahoo Member Directory, which appears to match the description in the DOJ press release below.)

United States Attorney McGregor W. Scott announced today the arrest of GREG KING, 21, of Fairfield, California, and the unsealing of an Indictment returned on September 27, 2007, charging KING with four counts of electronic transmission of codes to cause damage to protected computers.

This case is the product of an extensive investigation by the Federal Bureau of Investigation.

According to Assistant United States Attorney Matthew D. Segal, a prosecutor with the Computer Hacking and Intellectual Property section of the U.S. Attorney’s Office who is handling the case, the Indictment alleges that KING used a “botnet” to attack computer servers. A botnet is a network of infected computers that, unbeknownst to their owners, are compromised by a hacker and programmed to respond to a hacker’s commands. The infected computers are referred to as “bots,” “zombies,” or “drones.” According to documents filed with the court, KING allegedly controlled over seven thousand such “bots” and used them to conduct multiple distributed denial of service attacks against websites of two businesses. In a distributed denial of service attack, a hacker directs a large number of infected computers (“bots”) to flood a victim computer with information and thereby disable the target computer. On the Internet, KING was also known as “Silenz, Silenz420, sZ, GregK, and Gregk707.”

Press release here, indictiment here.

Alex Eckelberry
(Hat tip to Dre)

This man is clearly in need of a clue-by-four:

European Union interior ministers debated Monday proposals to sanction or shut down Internet sites spreading “terrorist propaganda” and bomb-making instructions.

EU Justice Commissioner Franco Frattini told reporters that he had urged the ministers, during informal talks in Lisbon, Portugal, “to make punishable activities of misuse of the Internet.”

“My intention of course is not to limit freedom of expression,” he said.

“My intention is … to introduce sanctions against those who disseminate terrorist propaganda or instruct on websites how to make a bomb. This has nothing to do with freedom of expression.

“If a given website is found instructing people to make a bomb, the only possible result is to disconnect, or to close such a website,” he said.

First, let’s look at a simple Google search, “how to make a bomb”. Over 17 million hits. Ok, so there’s the practical aspect.

But the bigger question is: Where does it start, and where does it stop?

What, are we now going to ban certain “potentially dangerous” books in libraries?

Or do we ultimately go down the path of Thailand, which outright banned YouTube in their country? And let’s not even talk about China.

The Internet is a big fat load of tubes and happiness that shovels out all kinds of useless and useful information. And I know that some people are irresponsible with what information they disseminate.

However, it’s one thing to crack down on terrorist cells that use the net for criminal purposes (which can be done through standard surveillance practices). But it’s another to start coming out with useless restrictions which ultimately will lead to a censored society.

Alex Eckelberry
(Thanks, Richard)

We found something interesting recently — a variant of the Zlob fake codec which checks to see if you’ve visited a number of sites. Now, this isn’t unusual, but one thing we did see was the addition of the SunbeltBlog.

What does this mean? If the Trojan sees that Sunbeltblog has been visited, it won’t pull down extra malware.

The Trojan contains two exportable functions:

1. GetVerID
Returns the version of the Trojan installer to the Trojan installer script by reading it from the installer executable file.

2. CheckIEHistory
Calls the function which lists URLs from the ‘visited’ browser cache.

It checks for a number of addresses, such as ?ozyfrog(dot)com, adultchamber(dot)com, askdamagex(dot)com… and sunbeltblog.com.

If none of these addresses are found in the browser cache, it will search for them in the following registry key:
[HKCUSoftwareMicrosoftInternet ExplorerTypedURLs]

If any of the addresses are found, then the installer script will return “1” as the string variable. If none of the addresses are found, then “0” will be returned”. If 0 is returned, then the Trojan makes an http get request to download the additional malware components.

One can speculate that the Trojan looks for the other sites to possibly protect certain affiliates (who don’t want to have the extra malware coming down to their users). But the addition of the Sunbeltblog is interesting, as this blog has historically been quite vocal on the subject of fake codecs. Perhaps they don’t want readers of the blog (many of whom are in the security space) to get the “additional” features…

If you read the blog / you won’t get zlob.

Alex Eckelberry

Vista Downgrade Followup
Last week, we reported that Microsoft is allowing PC makers to provide an XP downgrade to users who want them for new computers that have certain versions of Vista installed. Now we have a few more specifics. Here’s how it works: if you buy a computer from Dell, HP or Lenovo that comes with Vista Business or Ultimate edition, you can request that an XP recovery disk be included with the purchase. You may have to pay $15-20 for the recovery disk (although if you complain enough, you might even get it for free). More here.

First Looks at Vista SP1
Some brave souls have already installed Service Pack 1 and not all of them had the same bad experience as Chris Pirillo (shown in the link at the end of this week’s Followup segment). According to several reports, SP1 improves performance on Vista machines; that will be a welcome change. We recommend that the average user wait until the service pack is in final release, but if you’d like to get a look at some screenshots showing minor interface changes made by the beta, click here.

How to get around the new sig line restrictions in Outlook 2007
A recent article in the Network World Security Strategy newsletter discusses one of the changes in Outlook 2007 that has some users unhappy. In past versions, you could use the signature feature to create a lot more than just sigs. You could construct boilerplate messages, for instance, and then just select them from the signatures list to insert them into messages. You might want to insert several such boilerplates into a single message (as well as your real sig line).

This doesn’t work in Outlook 2007, because suddenly you’re only allowed one sig per message. If you insert a signature, then select and insert a different one, the second one replaces the first. I actually like this feature because it prevents having to then highlight and delete the first one – but I only use signatures as signatures, not as boilerplate. I think Microsoft should have made it user configurable so you could choose whether to replace or add.

Meanwhile, you can still use boilerplate (and in my opinion, more effectively) by using Outlook 2007’s “Quick Parts” feature. Here’s how:

1. Open a new message window and click the Insert tab.
2. Type the text you want to set as a boilerplate in the message body and highlight it.
3. Click Quick Parts in the Text section of the ribbon, and then select Save Selection to Quick Parts Gallery. Give it a name to identify it.
4. Now whenever you want to insert that same block of text in any message, just click Quick Parts and choose the name you gave it. It will be inserted into your new message.

Photo Email wizard closes when you try to send a picture
You can send photos directly from Windows Live Photo Gallery via email in XP or Vista, but if you attempt to do so and the windows closes instead of sending the pictures, it may be because you haven’t set a default email program. To find out how to do so, see KB article 939812.

Slow performance when viewing certain files in Windows Live Photo Gallery
If you try to view multipage .tiff files in the Windows Live Photo Gallery with XP or Vista, you may find that system performance slows down and memory usage goes way up. What’s up with that? It has to do with the precaching feature, and to fix the problem, you may need to disable precaching. You can find out how in KB article 939815.

Deb Shinder

XP Downgrade Option May be Available from Some PC Makers
Want to buy a new computer but don’t want to go to Vista yet? One solution is to buy the Vista machine, format the hard disk and install XP yourself; most any computer powerful enough to run Vista will run XP with no problems. However, some folks aren’t comfortable with doing that, or don’t want to pay for a copy of XP when they’ve already paid for Vista as part of the price of the new computer. Word’s out this week that Microsoft has agreed to allow PC manufacturers to offer a “downgrade” option to customers who buy Vista Business or Ultimate machines. Read more here.

Take Total Control over Windows XP with TweakAll 3.0
Those of you who are real Windows XP tweakers and tuners are always looking for something to help you take total control over your computer. If you’ve tried programs like TweakUI then you’re ready to move up to the next level. Try out TweakAll if you want to control hundreds of settings that would otherwise require you to enter the Registry and suffer the risk of making a typo! I’ve been playing with it on my Windows XP Pro computer and it’s the good stuff. Download it free here. Link to the classic PowerToys and TweakUI here.

Save Desktop Settings Before a Crash
If you spend a lot of time arranging the files and folders on your desktop you’ll really appreciate this tip. You might have noticed that if you set up your desktop in a certain way, it stays that way after you reboot. But if you’re forced to reboot by a system crash, all the changes you made to your desktop are lost. Not good! Save those desktop settings before a crash loses them by right clicking on the desktop and clicking the Refresh command. Now your desktop settings will remain intact even if you crash later.

Getting XP Back to a Working Configuration
Every week we get a few questions from people who’ve noticed that something isn’t working the way it used to. If you notice that something in your Windows XP setup isn’t working right anymore, maybe what you need to do is “roll back” to a time when things did work. You can do this with the System Restore Tool. System Restore won’t overwrite your data (as long as you keep it in the My Documents folder) and can bring your machine back to where it was when things worked. Try this:

1. Click Start and point to All Programs. Point to Accessories and then point to System Tools. Click System Restore.
2. The first page is the Welcome to System Restore page. Read the info on this page. Make sure the Restore my computer to an earlier time option is selected and click Next.
3. On the Select a Restore Point page, pick the most recent date where things worked. This might take some guessing, but if you’re wrong, you can always pick another date or even return to where you are. Click on a date and click Next.
4. On the Confirm Restore Point Selection page, read the dire warnings and description of what’s going to happen. When you’re ready, click Next.

The computer configuration is restored. You might have to restart the computer. If you guess right about the date when things worked, then everything should work again. Note that if you installed any programs after the date of the restore point you used, you’ll have to reinstall those programs.

Windows Live Search 2.0 is right around the corner
The next version of Windows Live Search is to be officially unveiled later this week at the “Searchification” event sponsored by Microsoft in California, but some early screenshots have already been leaked to the Web and it looks as if we can expect some major improvements in search results. Get a sneak preview here.

And the Bott goes on: Ed continues to debunk the Vista DRM myths
We’ve reported before on the ongoing discussion some of our friends over at ZDNet have been having regarding a widely distributed paper by Peter Gutmann that many have taken as the gospel condemning Vista’s Digital Rights Management technology. For the most comprehensive counter arguments to Gutmann’s position, see Ed Bott’s three-part article titled “Everything You’ve Read about Vista DRM is Wrong.” Start here with Part One.

Windows Vista Hardware Assessment 2.1
The Windows Vista Hardware Assessment Solution Accelerator is an inventory, assessment, and reporting tool that will find computers on a network and determine if they are ready to run the Windows Vista(tm) operating system or the 2007 Microsoft Office System. This is an especially handy tool for network administrators who need to find out how many new PCs they’ll need to buy to run Windows Vista.

Windows Fax and Scan makes things easy
Windows Fax and Scan, available in the Business, Ultimate, and Enterprise editions of Windows Vista, makes it very easy to send and receive faxes, scan documents and images, and share those items with others-right from your computer. Whether you are a home user or a business professional in a small or medium-size business, the new enhancements in Windows Fax and Scan can help you send information, handle documents, and save time. I think you’ll love Vista Fax and Scan if you’ve ever had to fight with your integrated fax and scanner to get it to work with Windows – it’s truly plug and play!

How to publish photos to the Web from XP
You can publish pictures to the web directly from a scanner or digital camera with Windows XP. Here’s how:

1. Click Start, then click My Pictures.
2. In the left pane, click Get picture from camera or scanner.
3. Click Next on the Welcome to the Scanner and Camera Wizard page.
4. Go through the wizard until you get to the Select a Picture Name and Destination page. Type the picture name and set your preferences.
5. On the Other Options page, click Publish these pictures to a Web site.
6. Click Next. On the Change your file selection page, then click the files you want to publish.
7. Click Next and on the Where Do You Want To Publish These Files page, choose your preferred Internet Service Provider (you might need to create an account at this point).
8. After the transfer is complete, you will see the Completing the Scanner and Camera Wizard page. At the bottom of the window is a link showing the location from which the pictures were uploaded. Note the location and then click Finish.

Critical Security Flaw in Acrobat Reader affects Windows, Linux and Mac
A security flaw has been discovered in Adobe’s Acrobat Reader, which is installed on a huge number of PCs. The vulnerability allows attackers to compromise Windows computers, including XP SP2 and Vista, as well as Linux and OS X systems. This problems affects Acrobat Reader versions 7, 8.0 and 8.1. An attacker can use the exploit to automatically run an executable program on your computer if you open a PDF file that’s been crafted to do so. Read more here.

Can I make the Vista Start Menu look like XP’s?
QUESTION: I know that Vista is the cat’s meow and is tons more secure than Windows XP or any other operating system, but I’ve been using Windows 2000 and Windows XP for years and I don’t really like changing the way I do things. Last week you told us how to make Windows Explorer look more like XP’s. Well, the Vista Start Menu looks really cool, but I like the old Start menu a lot better. Is it possible to get my tried and true Start Menu back again? Thanks! — John Q. Luddite

ANSWER: Yes! Of course you can have your old Start Menu back. Right click the task bar and click Properties. In the Taskbar and Start Menu Properties dialog box, click the Start Menu tab and select the Classic Start Menu option. You can then click the Customize button to get it working the way you had it with your Windows XP computer.

You cannot uninstall Windows Vista by using the “Uninstall a program” option of the Programs and Features Control Panel tool
You upgrade Microsoft Windows XP to Windows Vista. After you upgrade, you cannot uninstall Windows Vista by using the Uninstall a program option of the Programs and Features Control Panel tool. This problem occurs because Windows Vista does not provide the Uninstall Windows Vista option in the Uninstall a program option of the Programs and Features Control Panel tool. To resolve this problem, check out KB 925809.

You cannot connect to a Cisco ASA Series VPN server by using an L2TP/IPsec-based VPN connection in Windows Vista
You cannot connect a computer that is running Windows Vista to a Cisco ASA Series VPN server by using a virtual private network (VPN) connection that is based on the “Layer 2 Tunneling Protocol with IPsec” (L2TP/IPsec) protocol. This problem occurs if another Windows Vista-based computer is already connecting to the VPN server through a L2TP/IPsec-based VPN connection. You cannot connect to the VPN server until the other computer disconnects from the VPN server. This behavior does not occur on a computer that is running Windows XP or Windows Server 2003. This KB article explains the problem, here.

Windows Vista displays the incorrect dedicated video memory size for certain display adapters
Windows Vista displays the incorrect dedicated video memory size for certain display adapters. The incorrect dedicated video memory size appears in the system display settings and in the Windows System Assessment tool. This problem occurs if the dedicated video memory size is not a power of 2. For example, if a display adapter has 320 megabytes (MB) of dedicated video memory, Windows Vista shows that only 256 MB of dedicated video memory is available for the display adapter. Get the hotfix here.

Cumulative time zone update for Microsoft Windows operating systems
Starting in the spring of 2007, daylight saving time (DST) start and end dates for the United States will transition to comply with the Energy Policy Act of 2005. DST dates in the United States will start three weeks earlier, at 2:00 A.M. on the second Sunday in March. DST will end one week later, at 2:00 A.M. on the first Sunday in November. This is a cumulative update that all DST and other time zone changes since the last release of the DST update. Even if you previously installed a time zone update, you should get this latest update.

Windows Easy Transfer Companion
Windows Easy Transfer Companion transfers your programs from your Windows XP- based PC to your new Windows Vista based-PC. Easy Transfer Companion is designed to be used in addition to Windows Easy Transfer, and can transfer the programs with either an Easy Transfer Cable or a network. Easy Transfer Companion is currently available in Beta version for the U.S. English market. Download the beta version of Windows Easy Transfer Companion here.

Vista Windows Explorer is Driving Me to Drink!
QUESTION: The Windows Vista Explorer is driving me to drink! It’s bad enough that they took away the lines that connected the folders to each other, but something that’s really sending me over the edge is that absent menu bar! I’ve had menu bars ever since DOS 5.0. I need them! Please tell me that there’s hope for me. Thanks! – Jim from Peoria.

ANSWER: I have good news for you Jim, there is hope! Open Windows Explorer and click the Organize button. Hover over the Layout command and click on Menu bar. Voila! Now you have menus again.

Enabling Vista Search for Compressed Archives
QUESTION: I keep a lot of information in zip files on my Vista computer. The problem is that when I’m doing a search for information on my computer, the search doesn’t look into the .zip files. Is there anything I can do to make Vista search inside zip files? Thanks! -Larry from Sonoma.

ANSWER: Yes! You can configure Vista to search inside .zip files. Open Windows Explorer and click the Tools menu and then click Folder Options. Click the Search tab in the Folder Options dialog box. On the Search tab, put a checkmark in the Include compressed files (ZIP, CAB, …) checkbox in the When searching non- indexed locations section. Click OK. Now Vista search will check the contents of your zip files when doing a search.

Availability of the Windows Vista Secure Digital (SD) rollup package
Secure Digital (SD) cards are getting increasingly popular. You can use them to store information and share that information across a wide variety of devices. Here’s an update that will allow you to use larger SD cards, and also allow you to use a new type of SD card, called SDIO cards. Get the update here.

A Windows Vista-based computer stops responding when you resume the computer from hibernation
A Windows Vista-based computer stops responding when you resume the computer from hibernation. Note that this problem may occur if a system device configuration changes when the computer is in hibernation. This problem occurs because the Peripheral Component Interconnect (PCI) device driver does not correctly update the device settings to reflect the new configuration. If you’re having this problem, download the hotfix here.

Windows Vista cannot obtain an IP address from certain routers or from certain non-Microsoft DHCP servers
This issue occurs because of a difference in design between Windows Vista and Microsoft Windows XP Service Pack 2 (SP2). Specifically, in Windows XP SP2, the BROADCAST flag in DHCP discovery packets is set to 0 (disabled). In Windows Vista, the BROADCAST flag in DHCP discovery packets is not disabled. Therefore, some routers and some non-Microsoft DHCP servers cannot process the DHCP discovery packets. To fix the problem, follow the steps here.

A USB telephony device that is installed on a Windows Vista-based computer is unexpectedly set as the default audio device
After you install a universal serial bus (USB) telephony device on a Windows Vista-based computer, this device is unexpectedly set as the default audio device. The USB telephony device can be a USB telephone, a USB handset, or a USB headset. This behavior occurs even though other audio devices are already installed on the computer. In this situation, the computer cannot correctly play media or record media. If you’re having this problem (we have), then go this link to download a fix.

Deb Shinder

Long arm of the law nabs Media Motor adware scammers:

Operators who infected more than 15 million computers with destructive, intrusive spyware will give up $330,000 in ill-gotten gains from their venture to settle FTC charges that their scam violated federal law. The settlement will bar the defendants from downloading software onto consumers’ computers without disclosing its function and obtaining consumers’ consent prior to installation, bars them from downloading software that interferes with consumers’ computer use, and bars false or misleading claims.

In November 2006, the FTC charged ERG Ventures, LLC and its principals with tricking consumers into downloading malevolent software by hiding the Media Motor program within seemingly innocuous free software, including screensavers and video files. Once downloaded, the Media Motor program silently activated itself and downloaded “malware” that was intrusive, disruptive, and made it difficult for consumers to use their computers. The software changed consumers’ home pages, tracked their Internet activity, altered browser settings, degraded computer performance, and disabled anti-spyware and anti-virus software. Many of the malware programs installed by the Media Motor program were extremely difficult or impossible for consumers to remove from their computers.

The FTC charged that ERG Ventures and its principals violated the FTC Act, which bars unfair and deceptive practices. Specifically, the FTC alleged that the defendants failed to disclose to consumers that the free software they offered was bundled with malware. The agency also charged the defendants with using a deceptive End User License Agreement, which gave consumers the option to halt the installation of all software from ERG Ventures, but secretly installed malware whether consumers accepted or rejected the terms of the agreement. The agency also charged the defendants with unfairly downloading software that causes substantial harm to consumers. At the request of the FTC, the U.S. District Court for the District of Nevada froze the defendants’ assets and ordered a halt to their spyware operation pending trial.

The stipulated final order announced today ends that litigation with these defendants.

The order will permanently bar the defendants from distributing software that interferes with consumers’ computers, including software that tracks consumers’ Internet activity or collects other personal information; generates disruptive pop-up advertising; tampers with or disables other installed programs; or installs other advertising software onto consumers’ computers. The defendants will also be required to fully disclose the name and function of all software they install on consumers’ computers in the future, and to provide consumers with the option to cancel the installation after viewing the disclosure. The defendants will give up $330,000 in ill-gotten gains. Should the court find that the defendants misrepresented their financial status, $3,595,925 – the total revenues from their scam – will be due.

The order names ERG Ventures, LLC, as well as Elliott S. Cameron, Robert A. Davidson II, and Garry E. Hill d/b/a Media Motor, Joysticksavers.com and PrivateinPublic.com.

More here.

Alex Eckelberry

This is a really nice upgrade, with slick new dashboard widget-thingies, improved reporting and faster console performance.

The console performance improvements are pretty dramatic, as one new user pointed out on our forum.

Some pics:

Company propaganda here, product website here.

Alex Eckelberry

We are releasing our next big release of CounterSpy Enterprise, version 3.0.

Greg Kras and I will be doing an overview over the web. It’s a really nice upgrade.

Fluff from our marketing department:

Join Sunbelt Software for an overview of the new features in CounterSpy Enterprise version 3.0. This new version continues to provide robust protection against complex malware threats for corporate environments while delivering several new features, including new management dashboards, reporting improvements, and console usability enhancements.

The web demo will be hosted by Alex Eckelberry, President and Greg Kras, VP of Product Management for Sunbelt Software on Wednesday, October 3rd at 2:00pm EDT.

Learn about the new features of this robust enterprise antimalware product including:

– New configurable management dashboards that allow administrators to easily create a customized “malware command center” that gives instant access to their most used reports and policy controls

– Reporting improvements that make it easier to schedule and customize the library of reports, and includes a new report scheduler and custom report editor

– Console usability enhancements that offer easier-to-understand alerts and customizable views

When: Wednesday, October 3, 2007 2:00 PM (EDT)

To register for this event please visit:

http://www.sunbelt-software.com/rd/?id=070928IB-CSE3-Web-Demo

Alex Eckelberry

Wow, we’ve talked about securing metadata in the past, but this one takes the cake.

Notes from a meeting of the World Motor Sports Council were released recently by the FIA. The document was redacted, as you can see from the example below:

However, as F1Fanatic found out, simply copying and pasting the text into another document reveals the redacted text. In this case, I simply copied the text into Word:

Nigel TOZZI

He was paid around 300 000 to 400 000 pounds per annum. Is that correct?

Apparently, the person responsible for redacting the document simply drew a black box around the sensitive text, not realizing that the underlying text was still available. I feel a bit sorry for the poor sod who did this. Simply copy-protecting the PDF would have prevented this type of thing from occurring.

The PDF (at the time of this posting) is still up, here. I’ve also archived a copy here.

Alex Eckelberry
(Thanks Francesco)

Thursday, we blogged that the ancient Stoned.Angelina virus had been found on some German notebooks made by Medion.  SecuriTeam has a round-up. 

It’s worth noting that a) virtually no PCs ship with floppies these days, making infection of other PCs highly unlikely and b) the fact that an antivirus program can’t remove an ancient boot sector virus such as this one is open to debate. 

The virus itself isn’t destructive.  And in Windows XP and Vista, you would have to have a floppy in the drive while the system is booting in order to get infected.  In a way, it’s more of a novelty to see such an old virus (which is no longer even on the Wildlist).  

However, the point is that if you’re infected, you would want to clean it, and a number of notebooks shipped from Medion with this virus.  BullGuard, the antivirus product included with the notebook, was initially unable to remove it, although the company has an update on its website which should do the job.

Here is more from Andreas Marx:

Introduction: Medion shipped some notebooks together with a boot virus from 1994 (!)… and it looks like quite some AV tools had problems with the detection and/or removal of this critter. For example, the AV software installed on the system reported this virus on every reboot, but was unable to remove it. 

To my surprise, Stoned.Angelina is working very well with Windows Vista (x86) — the system gets infected and it is still bootable.
Windows Vista won’t display any message or other kind of warning regarding the boot sector change (unlike Windows 98, for example.).

The virus is only able to spread to further disks when Windows [itself] is not yet started,…the virus can infect further disks at boot time, but not after Windows has been started.

Testing: First, we infected a PC with an installed Windows XP SP2 or Windows Vista with “Stoned.Angelina”, which is quite easy to perform — you only need to “forget” an infected floppy disk in the A: drive and try to boot from it. The virus will instantly infect the system area of the hard disk. However, unlike some other boot viruses, Windows is still able to boot up and it won’t display a warning messages. The virus can infect further floppy disks as soon as it’s activated (on every reboot) and under DOS. As soon as Windows 2000, XP or Vista (or Linux or any other protected mode OS) is started, the virus code won’t be called anymore — the system is still infected, but the virus itself cannot spread further until the next reboot.

For our testing, we used the German versions of Windows and the currently available “2007” or “2008” consumer versions of some anti-virus software or security suites (in German language, using updates as of yesterday or today, 2007-09-14). We have tested a total of 10 products (on two OS): Avira AntiVir Personal Premium (v7), G Data (AVK) Total Care 2008, BitDefender Internet Security 2008 (v10), BullGuard Internet Security 7.0, Kaspersky Internet Security 7.0, McAfee Internet Security 2007 (the 2008 version is not yet released), Symantec Norton 360, Microsoft OneCare 1.6, Panda Internet Security 2008 (v12), Trend Micro PC-cillin Internet Security 2007 (the 2008 version is not yet released).

The following scanners were able to detect and successfully remove the “Stoned.Angelina” critter on Windows XP and Vista:

• G Data (AVK) Total Care 2008
• BitDefender Internet Security 2008 (v10)
• Kaspersky Internet Security 7.0

The following tools were able to detect and report the infection, but unable to handle it:

• BullGuard Internet Security 7.0 (updated information from BullGuard, here). 
• McAfee Internet Security 2007
• Trend Micro PC-cillin Internet Security 2007
• Avira AntiVir Personal Premium (v7) — BUT the scan of the system areas (master boot record) is disabled by default, so it has to be enabled or AntiVir wouldn’t report anything, as it’s not scanning this sector.

Two of the tools were able to successfully report and clean the virus on Windows XP, but they shred the system area on disinfecting a Windows Vista based system after the infection was found — this means that Vista wouldn’t start anymore after a “successful” cleaning and it has to be repaired (e.g. by booting from the installation DVD and selecting the option to repair the system, see the Bullguard website link above for details):

• Symantec Norton 360
• Panda Internet Security 2008 (v12) — BUT you need to start the tool with administrator rights or disable User Account Control (UAC) or Panda wouldn’t be able to scan for the virus on disk and report the system is clean, even if it’s indeed infected.

This leaves one tool — Microsoft OneCare 1.6 — which is completely unable to scan for boot viruses on disk (tested on Windows XP and Vista), so the user wouldn’t get a notification that his system is infected. As nothing is found, nothing can be removed, of course.

More links:

How to remove Stoned.Angelina
Aldi-Notebook mit Virus an Bord.
Viren-Alarm in Daenemark – auch in Deutschland Schaedling gesichtet. 
Virus auf Aldi-Notebooks: Ein Plagegeist aus alten Tagen. 

Alex Eckelberry

Latest Storm variant.

Virus Bulletin Conference: This week, the blog will be silent as I’m going with a bunch of other Sunbelters to the Virus Bulletin Conference in Vienna. If you happen to be there, drop by our booth and say hello.

One of our senior researchers, Casey Sheehan, will have a very interesting presentation, entitled “Pimp my PE: taming malicious and malformed executables” (PE is the file format used for programs, DLLs, etc. in Windows).

From the abstract:

A foundational requirement in the security world is the ability to robustly parse and analyse Windows Portable Executable files. Many malicious PEs currently found in the wild are actually quite difficult to analyse, due to packing and purposely malformed header structures…

This fast-paced, highly technical presentation will survey and attempt to classify some common and interesting malformations we have examined in our work at Sunbelt Software. We will analyse PE structural information and demonstrate how tolerant the Windows loader is to fuzzing this data. We will discuss the PE specification and highlight specific hurdles we have overcome in the course of developing a parsing framework capable of dealing reliably with modern malware…

Casey is one of our most senior developers and is responsible for the development of our VIPRE engine, and his insights are quite interesting for those involved in reverse engineering malware.

Incidentally, Alex Shipp, who was part of the team that helped me on the Julie Amero case, will also be presenting some of his thoughts on the case.

AVAR (Association of anti Virus Asia Researchers): We will also have a presence at AVAR 2007, where Chandra Prakash (who is in the process of finishing up our next-generation anti-rootkit technology for release this fall), will be presenting a paper on “Design of X86 Emulator for Generic Unpacking” (faithful readers will recall that Chandra presented a paper at AVAR last year as well).

While the title of the paper sounds rather dry, the subject of generic unpacking is a fairly interesting one to antivirus researchers. To oversimplify, here’s why: Since the vast majority of malware is “packed” (compressed) using tools such as FSG or UPX, antivirus engines need to unpack them to see if what’s inside is bad. Many antivirus engines perform “static” unpacking, where an antivirus researcher writes a separate signature for each piece of malware that’s packed. This is obviously time consuming and has disadvantages in detecting new variants (it’s easy to fool a static unpacker). The solution that’s come about is to implement generic unpacking, which runs the malware inside of an emulator, thus allowing easier detection by the engine.

At any rate, if you’re at either conference, feel free to say hello. It’s easy to spot us: we’re the ones causing all kinds of trouble.

Alex Eckelberry

I culled them down to the best, but there are still so many good (and funny) answers, I couldn’t decide which was best for the Lamer bus.  So vote for your favorite.   

Alex Eckelberry

Greeting card scams are all the rage. It’s a big part of how the Storm worm got so many happy participants.

In response to scams using American Greetings’ style emails, the company has changed their format.

Now, I’m glad to see something’s happening here, and it’s a start. But here are some points to consider.

Sender’s personal information is in the subject line
Ex. “John Smith has sent you an ecard from AmericanGreetings.com”

Ok. But since these spams are coming from infected machines, well, that’s easy to spoof.

“ecards@americangreetings.com” is the actual “from” email address with “Ecard from AmericanGreetings.com”as the “from” display name.

Please. That’s so trivial to spoof, it’s a joke. That’s not even a security recommendation. That’s just a dangerous piece of advice.

Sender’s name and email address are included in the body of the email

Right, but again, these are sent from infected machines and can simply use the address book of the infected user. (It’s true that this would only apply to the names that the sender had in their address book, not in other email addresses the infected system/spam zombie might be ordered to send to. But nevertheless, people seem to click on “a friend sent you a greeting card” anyway, regardless if it’s from someone they know or not: Just witness the Storm worm’s ubiquity.)

American Greetings’ changes will help a wee bit, and I am glad they’re doing at least this. But it’s going to take a lot more to fix this problem.

Alex Eckelberry

Computer maker Medion has shipped notebooks with a rather ancient boot sector virus that you don’t see much of — Stoned.Angelina.

Link here (alas, in German).

Alex Eckelberry
(Thanks to Andreas Marx for the heads-up).

Free copy of CounterSpy to the person who comes up with the best caption for this picture.  

Alex Eckelberry
(Credit to Michael Hale Ligh for letting me use this picture.)