Good article on rootkits

Joern Wettern at Redmondmag has a good overview of the situation.

As if there weren’t enough threats coming at you via the Internet, now you have to secure your systems against rootkits, as well. Rootkits are similar to spyware, viruses and worms in that they’re designed to run on your computer without your knowledge. Once on your system, they often perform a malicious task, like creating a backdoor to enable unauthorized access to your system.

What makes rootkits unique is that they’re designed to avoid detection by standard scanning methods and tools. If a rootkit has installed itself on your computer, you won’t find it using Windows Explorer or see it in the list of services that are currently running. Most virus scanners can’t even find a typical rootkit. To protect yourself against this type of threat, you need to know how they work and how to remove them from your systems.

Link here.

 

Alex Eckelberry
(Thanks Dan)

Consumer Affairs article on RFID

Martin Bosworth at ConsumerAffairs.com has an excellent article on RFID.  Definite must read if you’re interested in privacy issues.

From an RFID advocate:

“Today everybody knows what an iPod is,” said Thompson, “and the same thing as with a chip in your arm that is placed there instantaneously, and is going to be able to help you secure your medical records which will be able to allow you to…be able to get immediate care.”

Link here.

 

Alex Eckelberry

Is the Pentagon spying on you?

Pretty interesting blog at the WashingtonPost today by national security expert William Arkin.

An NBC Nightly News piece yesterday on domestic spying by the military featured yours truly discussing an intelligence database of 1,519 “suspicious incidents” that covers the period July 2004-May 2005. 

The database — which I obtained from a military source — is a rare look inside the actual work of the Defense Department conducting counter-terrorism and “force protection” missions inside the United States.  Building on the NBC story, what does the database actually show?

Now check out some of these hardcore terrorist threats:

In last night’s report, NBC focused on one such report, the monitoring of an anti-war Quaker meeting in Lake Worth, Florida by the Army’s 902nd Military Intelligence Group (that, according to the database). The database categorizes the meeting, which was to plan a protest at a military recruitment station, as a “threat.”

Or

August 2004, Atlanta, Georgia, a Navy enlisted man is arrested for driving under the influence by the Cobb County Police Department “and upon search of vehicle, discovered a picture of Usama bin Laden displayed as a screensaver on E-4’s cellular telephone.”

Link here.

The fear of real or perceived outside threats has historically been the justification for the biggest assaults on civil liberties.

Be vigilant.

Alex Eckelberry

Another fake security site.

Here’s yet another fake security site, with a blatant rip-off of the Microsoft security logo, pushing the WinFixer scam.

Anotherfakesecuritysite

For your block lists:

amaena.com

 

Alex Eckelberry
(Thanks Patrick)

Update:  Suzi posted this comment — thanks Suzi:

Gravatar Whois info for the domain:

http://www.whois.sc/amaena.com

IP: http://www.whois.sc/66.244.254.177

Most of the other domains on this IP are porn sites along with some other fake security sites thrown in, too.

And these:
Win-anti-virus-pro.com
Win-antivirus.com
Win-virus-pro.com
Winantivirus2005.com
Winvirus2005.com

 

Beware Vcodec

Wondering how people get to these bogus security sites and download junk like SpyAxe?

Patrick Jordan and Adam Thomas on our spyware research team have been investigating Vcodec.com.  This is a site that has a program called “VCodec v3.05b is new generation multimedia compressor/decompressor which registers into the Windows collection of multimedia drivers…”

Vcodecasdfasdfawe4r234234234qwdfasdf

This is bogus video utility. The file, VideoCodec3_05b, is a trojan which then starts the scam about “Your computer is infected!”.

Videocodecpostinfect

I ran this through VirustTotal and here are the results (“No virus found” means the scanner did not detect the file as a trojan):

—————————————————————————————————

This is a report processed by VirusTotal on 12/14/2005 at 23:23:24 (CET) after scanning the file “VideoCodec3_05b.exe” file.

Antivirus Version Update Result
Kaspersky 4.0.2.24 12.14.2005 Trojan-Downloader.Win32.Zlob.cu
NOD32v2 1.1322 12.14.2005 probably a variant of Win32/TrojanDropper.Small.NCU
CAT-QuickHeal 8 12.13.2005 (Suspicious) – DNAScan
AntiVir 6.33.0.61 12.14.2005 no virus found
Avast 4.6.695.0 12.14.2005 no virus found
AVG 718 12.14.2005 no virus found
Avira 6.33.0.61 12.14.2005 no virus found
BitDefender 7.2 12.14.2005 no virus found
ClamAV devel-20051108 12.12.2005 no virus found
DrWeb 4.33 12.14.2005 no virus found
eTrust-Iris 7.1.194.0 12.14.2005 no virus found
eTrust-Vet 12.3.3.0 12.14.2005 no virus found
Fortinet 2.54.0.0 12.14.2005 no virus found
F-Prot 3.16c 12.13.2005 no virus found
Ikarus 0.2.59.0 12.14.2005 no virus found
McAfee 4650 12.14.2005 no virus found
Norman 5.70.10 12.14.2005 no virus found
Panda 8.02.00 12.14.2005 no virus found
Sophos 4.00.0 12.14.2005 no virus found
Symantec 8 12.14.2005 no virus found
TheHacker 5.9.1.055 12.14.2005 no virus found
VBA32 3.10.5 12.14.2005 no virus found

—————————————————————————————————

So,only Kaspersky (no surprise), NOD32 and CAT-QuickHeal are catching it. 

Put this one on your blocklist.  Hopefully AV vendors will get signatures out very soon.

Alex

New IRS phishing scam

Looks like this:

From: supp…@irs.gov <supp…@irs.gov
Date: 14 Dec 2005 18:41:23 -0000
Local: Wed, Dec 14 2005 1:41 pm 
Subject: Refund notice

You filed your tax return and you’re expecting a refund. You have just one question and you want the answer now – Where’s My Refund?

Access this secure Web site to find out if the IRS received your return and whether your refund was processed and sent to you.

New program enhancements allow you to begin a refund trace online if you have not received your check within 28 days from the original IRS mailing date.  Some of you will also be able to correct or change your mailing address within this application if your check was returned to us as undelivered by the U.S. Postal Service.  “Where’s My Refund?” will prompt you when these features are available for your situation.

To get to your refund status, you’ll need to provide the following information as shown on your return:

  • Your first and last name
  • Your Social Security Number (or IRS Individual Taxpayer Identification Number)
  • Your Credit Card Information (for the successful complete of the process)
     

Okay now, Where’s My Refund?  (Link points to a bogus site, http://www[dot]collionline[dot]it/img/[dot]www4[dot]irs[dot]gov/index[dot]html

Note: If you have trouble while using this application, please check the Requirements to make sure you have the correct browser software for this application to function properly and check to make sure our system is available.

The link leads to a bogus phishing site that is highly believable as an IRS page:

Irsfakephish

Two links which provide more here and here.   Reported by n3td3v on Full Disclosure.

 

Alex Eckelberry
(Thanks Eric)

FTC settlement with DirecTV

The FTC settles with DirecTV over alleged violations of the Do Not Call registry.

But what’s interesting in this article is the following:

The FTC’s action “demonstrates that the registry is a program consumers can continue to believe in,” said FTC Chairwoman Deborah Platt Majoras at a press conference held Tuesday morning. “Sellers are on the hook for calls placed on their behalf and for their benefit,” she added. “It is not named the Do Not Call Registry for nothing.” [my emphasis in bold]

Link here.

Hmm… would that imply that companies advertising through spyware applications might have a liability?  Remember that Can Spam has this type of provision:

    (a) IN GENERAL- It is unlawful for a person to promote, or allow the promotion of, that person’s trade or business, or goods, products, property, or services sold, offered for sale, leased or offered for lease, or otherwise made available through that trade or business, in a commercial electronic mail message the transmission of which is in violation of section 5(a)(1) if that person–
      (1) knows, or should have known in the ordinary course of that person’s trade or business, that the goods, products, property, or services sold, offered for sale, leased or offered for lease, or otherwise made available through that trade or business were being promoted in such a message;
      (2) received or expected to receive an economic benefit from such promotion; and
      (3) took no reasonable action–
        (A) to prevent the transmission; or
        (B) to detect the transmission and report it to the Commission.

Alex Eckelberry

RFID = Big Bucks

Gartner estimates:

Worldwide spending on the emerging wireless tracking technology is set to reach $504 million this year, up more than one-third from 2004, market researcher Gartner said Tuesday. Adoption will accelerate by 2007, with spending pegged to hit $3 billion by the end of the decade.

It’s also been denounced as a harbinger of a Big Brother society in which personal privacy disappears, either because of voluminous record-keeping on people’s shopping habits and travel patterns, or even because the chips could even end up under the skin.

Link here.

 

Alex Eckelberry

Running IE 7 alongside IE 6

For those who are testing IE 7, pretty good data.

Sure, you knew IE7 Beta 1 was up on MDSN, but you don’t have a free machine to test it on. Can’t install it on your main work machine, because you can’t afford to mess it up… plus, you need to be testing your work against IE 6, right?

You thought about setting up a Virtual PC image, but it seemed like too much trouble for a Beta 1. Still, it would be nice to click around in it for a few minutes here and there…

Fret no more! IE has a secret standalone mode which lets you run multiple versions side by side (thanks to Joe Maddalone for figuring this out).

More here.

 

Alex Eckelberry
(Hat tip to Deb)

Cell phone tracking

Mobile phones get more and more sophisticated all the time. More and more people are getting rid of their landline service altogether and using mobiles as their primary means of telephone communications. As this trend started to develop several years ago, one problem that emerged was the inability to pinpoint the location of users who called 9-1-1 in an emergency, as has long been possible with landlines.

The solution was a technological one: build Global Positioning Satellite (GPS) receivers into the cell phone handsets. Many of us already have GPS units in our cars or use standalone handheld units or GPS software on our Pocket PCs to provide driving (or walking) directions to our destinations. The receiver uses a technique called trilateration to calculate the distance to each of four earth-orbiting satellites by timing how long it takes for each satellite’s signal to reach it, and from that it can deduce its location. For a detailed explanation of how this works, click here

The Federal Communications Commission (FCC) mandated that all cell phone providers have the technology in place to provide Enhanced 911 (E911) service, giving emergency operators the caller’s physical location, by 2004, and 95% of phones are required to be GPS-enabled by the end of 2005. All cell phones being sold now by major providers contain the GPS technology. If you have an older phone that doesn’t support GPS, it won’t be turned off, but when you go to replace it, you’ll get a GPS-capable phone.

E911 has been credited with saving lives when callers get cut off or otherwise are unable to give their locations, or don’t know where they are. But what else can this technology be used for?

Some privacy advocates are afraid it can be used by the government or private concerns to track everyone’s location without their permission. More and more of us carry mobile phones almost everywhere we go, and most of us keep the phones turned on all the time in order to receive calls. This can make it a handy electronic tracking device. And in fact, law enforcement agencies have used the technology to monitor the movements of criminal suspects for the past several years. However, under the 4th amendment to the Constitution, they’ve had to get a warrant issued by a court to conduct this type of surveillance.

Federal judges in several states, including New York and Texas, have recently denied warrants because of a lack of probable cause – the standard of proof showing that a crime has been committed and evidence tying the suspect to that crime. Some prosecutors have argued that the USA Patriot Act expands their powers to allow them to use cell phone tracking without meeting that high standard of proof. For more on this conflict, click here.

Of course, government surveillance isn’t the only potential use for this technology. Some consumer advocates worry that cellular companies will sell customers’ location information to advertisers, who could then display ads on your phone screen for retailers, restaurants, etc. that are close by, effectively turning your phone’s display into a miniature electronic billboard.

There are more consumer-friendly uses for GPS phones. In 2004, Nextel offered a GPS navigation service that could be used with some of their phones. Rather than having to buy a separate GPS device or handheld computer and software, you could just use your cell phone to receive driving directions through the TeleNav or ViaMoto services. Click here.

Sprint also offers the TeleNav service. And just last week, Verizon announced their VZ Navigator service that does the same thing, for a $10 monthly fee. Unfortunately, the services are limited to only a few models of phones at this time. Read more about Verizon’s service here.

Or how about if you’re a parent, using the technology to keep up with where your kids are? There are several services, including MyChildTracker (http://www.trackwell.com/products/mct.html) and FindYourChild (http://www.findyourchild.net), that make it possible for you to locate your child’s cell phone through the Web or through your own mobile phone. You can also designate who else is allowed to get location information about your child, if you want to delegate that ability to a grandparent or babysitter.

Trackwell also offers MyBuddyTracker for teenagers to locate their friends, MobileDate to “bring people with similar interests together” anonymously, and business-oriented GPS services suchas TracScape for fleet management and TrackWell Vessel Monitoring System for fisheries to keep up with their boats.

There’s another service, AccuTracking (www.accutracking.com) for Web-based cell phone tracking (if you have the right model phone and cellular provider). The good thing about this one is that it’s free for personal non-commercial use.

It’s important to note that all of these services that allow tracking by private parties require the person whose phone is being tracked to explicitly give permission. Usually client software has to be installed on the phone, so it’s not as if just anyone can go to the Web and find you via your cell phone? Or can they?

There’s already a company called PangoNetworks that sets up sensors in shopping malls to detect phones and PDAs and send ads to them. And courts have held that employers can use GPS services to track their employees’ locations during working hours if they pay for your phone (or provide you with a GPS-equipped vehicle).

More troubling, some hacker sites suggest that it might be possible to write a program that could be sent via an SMS message to query a phone’s GPS function and get its location. They would need to know the phone number to do so. Of course, most GPS-enabled phones allow you to turn the GPS receiver on or off, and some let you set the E911 GPS separately from the location service. If you’re particularly paranoid, though, you may wonder if turning off these options would really keep the provider from tracking you. Some security experts say the only way to be sure you’re not being tracked is to turn the phone off completely, and a few go so far as to recommend removing the battery. Maybe you’re better off just leaving the phone at home if you’re going someplace you don’t want anyone to know about.

How accurate is GPS-based cell phone tracking? Although the FCC’s E911 rule requires that carriers be able to locate phones within 100 meters, the technology can usually pinpoint your location to within a few feet. And what else can your cell phone tell about you besides your current location? MIT media lab conducted a research project in which they were able to create detailed profiles of people’s lives from the information that tracking their phones provided. Click here.

What do you think about all this? Does it have you ready to dump your cell phone, or are you excited about the possibilities the technology offers? Do the public safety benefits of E911 outweigh the privacy implications? Would you like to see more cell phone companies offer navigation services and private Web-based location tracking? Should unsolicited location-based advertising (phone spam) be banned? Comment away.

Deb Shinder
Editor, Sunbelt WXPnews.

My New Best Friend is the Bestest Friend Ever!

You read an article, and it starts like this:

Imagine your best friend, a skilled reference librarian, watching you surf the web and — by noting what you stop to read and what you bypass — continually offering you lots of additional, in-depth content you might not easily find on your own.

Relax… all is good.  Your New Best Friend is helping you.

Except you wake up and realize your New Best Friend is:

Gator. Claria.

The company is releasing PersonalWeb in January. It’s a software download that watches “profiles” the sites you visit and the content you read, continually updating a personal home page.

More:

As with Google Sidebar, PW will be a software download that will profile the sites you visit and the content you select. It will determine your news and information interests in much the same way behavioral targeters already infer and anticipate your advertising interests. Using both algorithms and your personal choices, the PW system will bring you more and better content within the topics you’re already reviewing, and will also “audition” other content you might find of interest.

The analogy to Google Sidebar is misleading.  As far as I know (and correct me if I’m wrong), Google Sidebar primarily collects information on the types of news that you read—not profiling the sites I visit and the content I select.

I will be very curious to look at this program when it releases.

Link to the article by Robert Moskowitz here.

 

Alex Eckelberry
(Thanks Amanda)

It’s a security scam party, and this is one party you don’t want to crash

Patrick and Adam found a bunch more of these “security scam” sites.  

IPs below, feel free to put these in your block lists.

Newly found sites

Mattie Muirhead
Florence, AL US
wm @ needupdate.com
85.255.115.174  dns404.net
85.255.115.130  needupdate.com
85.255.115.173  yoursystemupdate.com
85.255.115.172  systemwarning.com

Mag Dicacik     
Praha,  CZ       
mag @ sexpicporn.com 
85.255.115.172  securitywarnings.net

Sites already known

Henn Preson    
Stockholm,  SE 
henn @ teeeen.com

85.255.115.130  Warningmessage.com   
85.255.115.131  syserrors.com

Mag Dicacik     
Praha, CZ       
mag @ sexpicporn[dot]com

85.255.115.131  notfound404.com
85.255.115.132  Updateyoursystem.com
85.255.115.170  securityerrors.com
85.255.115.179  hdnsservidce.com
85.255.115.180  downldboost.com

And now for a picture party:

1asdfa324234

201231231233123

398098lijkjf

5234asdfacvwdr23ra

6asdfasdf234sd

70909090909

829asdkfjasldfjkadf

9oiuoiuljh

105468789764534415

1109090909090adf

 

Alex Eckelberry

Latest firefox “vulnerability”

Reported by one newsletter as “Firefox Subject to DoS Attack”, it’s really not that big of a deal (at least at this juncture, but one is never complacent in the security business).

Firefox has a vulnerability with hugely long URLs (and I do mean huge) where it slows down.  Part of the problem is that the slowdown continues as long as you have the mega URL in Firefox’s history.

The Mozilla folks have investigated it and they believe there’s no evidence that a DoS scenario using this long URL vulnerability could result in a security issue.

Web pages with extremely long titles (the posted proof of concept used 2.5 million characters) can cause Mozilla Firefox and the Mozilla Suite to appear to “hang” on startup when reading the browsing history data. The browser will eventually continue normally although this can take up to several minutes on a slower computer. The unresponsive starts will continue until the item with the long title is removed from the history file or eventually expires.

We have investigated this issue and can find no basis for claims that variants of this denial-of-service attack can cause an exploitable crash, and no evidence for this claim has been offered. There does not appear to be any risk to users or their computers beyond the temporary unresponsiveness at startup.

Should the user encounter this problem the slow starts can be fixed by deleting the item from history.

Link here.

 

Alex Eckelberry

 

Seen in the wild: Trojan masquerading as Microsoft Update

Reported in Codefish.  We checked out this Trojan and it’s not very friendly. 

Here is what the email looks like::

Microsoft Security Bulletin MS05-039

Vulnerability in Plug and Play Could Allow Remote Code Execution and Elevation of Privilege (899588)

Summary:

Who should receive this document: Customers who use Microsoft Windows
Impact of Vulnerability: Remote Code Execution and Local Elevation of Privilege
Maximum Severity Rating: CRITICAL
Recommendation: Customers should apply the update immediately.
Security Update Replacement: None
Caveats: None
Tested Software and Security Update Download Locations:

Affected Software:

Microsoft Windows 2000 Service Pack 4 – Download the update

Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service Pack 2 – Download the update

Microsoft Windows XP Professional x64 Edition – Download the update

Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service Pack 1 – Download the update

Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft Windows Server 2003 with SP1 for Itanium-based Systems – Download the update

Microsoft Windows Server 2003 x64 Edition – Download the update

Non-Affected Software:

Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME)

Executive Summary:

This update resolves a newly-discovered, privately-reported vulnerability. A remote code execution vulnerability exists in Plug and Play (PnP) that could allow an attacker who successfully exploited this vulnerability to take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Conclusion: We recommend that customers apply the update immediately.

© 2005 Microsoft Corporation. All rights reserved.  Terms of Use | Trademarks | Privacy Statement

 

Loading the trojan, here’s what it looks like:

1trojan13

 

2trojanadf2134

3traojoani34adf

I checked the file at Virustotal.com and here are the results are as follows
(“No virus found” means that the virus scanner did not detect it):

This is a report processed by VirusTotal on 12/12/2005 at 18:59:39 (CET) after scanning the file “Windows-KB899588-x86-ENU.exe” file.

Antivirus Version Update Result
Avast 4.6.695.0 12.10.2005 No virus found
AVG 718 12.08.2005 No virus found
McAfee 4648 12.12.2005 No virus found
NOD32v2 1.1319 12.12.2005 No virus found
Norman 5.70.10 12.12.2005 No virus found
TheHacker 5.9.1.053 12.12.2005 No virus found
F-Prot 3.16c 12.09.2005 security risk or a “backdoor” program
AntiVir 6.33.0.61 12.12.2005 TR/Luhn
Avira 6.33.0.61 12.12.2005 TR/Luhn
Panda 8.02.00 12.12.2005 Trj/Spy.Luhn
Sophos 4.00.0 12.12.2005 Troj/Dropper-BV
Symantec 8 12.12.2005 Trojan.Dropper
DrWeb 4.33 12.12.2005 Trojan.Sklog
BitDefender 7.2 12.12.2005 Trojan.Spy.Luhn.A
ClamAV devel-20051108 12.12.2005 Trojan.Spy.W32.Luhn
CAT-QuickHeal 8 12.12.2005 TrojanSpy.Luhn.a
Kaspersky 4.0.2.24 12.12.2005 Trojan-Spy.Win32.Luhn.a
VBA32 3.10.5 12.12.2005 Trojan-Spy.Win32.Luhn.a
Fortinet 2.54.0.0 12.11.2005 W32/SpyLuhn.A-dr
eTrust-Iris 7.1.194.0 12.11.2005 Win32/Luhn!Spy!Dropper
eTrust-Vet 12.3.3.0 12.12.2005 Win32/Luhn.A

 

Alex Eckelberry
(Hat tip to Sunbelt researchers Eric Sites, Eric Howes and Patrick Jordan)

Maybe now del.icio.us will be something you can spell

del.icio.us gets bought by Yahoo.  

We’re proud to announce that del.icio.us has joined the Yahoo! family.  Together we’ll continue to improve how people discover, remember and share on the Internet, with a big emphasis on the power of community.  We’re excited to be working with the Yahoo! Search team – they definitely get social systems and their potential to change the web. (We’re also excited to be joining our fraternal twin Flickr!)

Link here via loose wire.

Alex Eckelberry

Using Gmail as a bookmarking tool?

A novel use of Gmail.  Not something I bother with, but nifty.  Here it is in case you’re inclined:

Whether you’re knee-deep in del.icio.us or not, it’s easy to understand the benefits of a good online bookmarking system. Wherever you go, whatever you’re doing, your bookmarks will be there with you.

For a while now, I’ve been tweaking my own personal bookmarking system with Gmail. If you’re a Gmail lover like I am, setting up filters and labels to tag and handle your bookmarks with Gmail is a nice and simple solution that brings bookmarking to the email client that you already know and love.

Link here.

 

Alex Eckelberry