The Legacy Sunbelt Software Blog

ArsTechnica is reporting that U.S. Federal Judge Kimba Wood of the United States District Court for the Southern District of New York has granted summary judgment against LimeWire in an action by brought by Recording Industry Association of America (RIAA), which claimed the peer-to-peer file-sharing service was facilitating copyright infringement.

Penalties against LimeWire and its CEO Mark Gorton will be set after a status conference on June 1.

During the legal proceedings, an expert witness called by the RIAA testified that in a sample of 1,800 LimeWire files he examined, 93 percent were copyrighted.

In other testimony it was revealed that LimeWire had opened a digital music store and used filtering to prevent users from sharing digital recordings purchased from it, but didn’t filter to prevent them from sharing anything else.

“In Wood’s view, this all adds up to a business model knowingly built on copyright infringement, and it continued with no attempt to address the massive problem,” according to the article in ArsTechnica (“LimeWire sliced by RIAA, guilty of massive infringement”)

More coverage here in Wall Street Journal: “CopyWrong! Kimba Wood Squeezes the Juice Out of Limewire”

This is big news for LimeWire users who never knew you were supposed to pay for music and the artists and recording companies who would like them to learn.

Tom Kelchner

The Washington Post is carrying a story and video of Pam Horan, president of the Online Publishers Association, discussing the draft privacy bill that Rep. Rick Boucher (D-Va.) and Rep. Cliff Sterns (R-Fla.) introduced last week. (See Sunbelt Blog pieces here, and here.) Cecilia Kang on her Post Tech blog asked Horan to post one question to Boucher about the bill.

Horan said the Online Advertisers biggest concern is how the ultimate wording of the bill will define “precise geolocation information”

Information about a person’s location falls is in the category of “sensitive information” in the bill and advertisers would not be allowed to collect that data unless users opted in.

Horan said with users buying more portable devices such as the iPad, advertisers would like to be able to deliver coupons and ads for businesses near them using global positioning technology.

“This can all be done in a way that is non-identifiable and is a huge opportunity for us,” Horan said.

Story and video here: “Online publishers question Boucher privacy bill”

According to Hillicon, the technology blog of The Hill web site, Boucher said today that the bill is not an attempt to inhibit responsible targeted advertising.

At this point the draft bill requires companies to disclose the fact that they collect information from consumers and port the information into Web ads. Those that fail to make proper disclosure could face penalties from the Federal Trade Commission.

The next draft of the bill could be complete by the middle of next month.

The Information Law Group posted a great analysis of the draft bill today here: “Breaking Down the Boucher Bill”

Tom Kelchner

The Washington Post is carrying a story and video of Pam Horan, president of the Online Publishers Association, discussing the draft privacy bill that Rep. Rick Boucher (D-Va.) and Rep. Cliff Sterns (R-Fla.) introduced last week. (See Sunbelt Blog pieces here, and here.) Cecilia Kang on her Post Tech blog asked Horan to post one question to Boucher about the bill.

Horan said the Online Advertisers biggest concern is how the ultimate wording of the bill will define “precise geolocation information”

Information about a person’s location falls is in the category of “sensitive information” in the bill and advertisers would not be allowed to collect that data unless users opted in.

Horan said with users buying more portable devices such as the iPad, advertisers would like to be able to deliver coupons and ads for businesses near them using global positioning technology.

“This can all be done in a way that is non-identifiable and is a huge opportunity for us,” Horan said.

Story and video here: “Online publishers question Boucher privacy bill”

According to Hillicon, the technology blog of The Hill web site, Boucher said today that the bill is not an attempt to inhibit responsible targeted advertising.

At this point the draft bill requires companies to disclose the fact that they collect information from consumers and port the information into Web ads. Those that fail to make proper disclosure could face penalties from the Federal Trade Commission.

The next draft of the bill could be complete by the middle of next month.

The Information Law Group posted a great analysis of the draft bill today here: “Breaking Down the Boucher Bill”

Tom Kelchner

At the tail end of last year, Botnets controlled by Twitter accounts started to make the news. They’ve kind of faded from view a little since then, but one enterprising coder is hoping they’ll make a comeback with a tool designed to make botting simple for script kiddies the world over.

This is the builder we’ll be looking at today:

Firing the program up gives the most basic of interfaces – all you can do is enter a Twitter Username and hit the “Build” button:

Once done, an executable file is created that will keep an eye on the named Twitter account for a series of commands used to infect, download, attack with DDoS and even kill the connection between Bot and Command channel. This is the file that’s created:

Of course, the attacker will change the name and the icon before attempting to send it to a victim. Should an end-user infect themselves, the attacker simply posts one of the following commands to their Twitter feed and the Bot will happily oblige:

.VISIT*link.com* (The attacker can add a 0 at the end to repeatedly open a weblink in an “invisible” manner, or a 1 if they want to pop open a website for giggles on the infected PC. Above, you can see a Twitter account telling all bots to open up Google.com in a visible web browser).

.DDOS*IP*PORT (This is a UDP attack).

.SAY* (This one takes advantage of the text to speech feature on a Windows machine, babbling a phrase of choice at the confused victim).

.DOWNLOAD*link.com/file.exe* (The attacker can add a 0 at the end to download, or a 1 if they want to download and execute a file).

.STOP (This will tell the Bots to cease their activities, regardless of whether that’s a DDoS attack or a world record attempt for the amount of times they can open up a Rickroll).

.REMOVEALL (This cuts the connection between bot and Twitter account).

Here’s a screenshot of Youtube popped open on an infected PC courtesy of a .VISIT command – note the shot of the Wireshark traffic indicating the bot / Twitter connection just before the browser opens:

All in all, a very slick tool and no doubt script kiddies everywhere are salivating over the prospect of hitting a website with a DDoS from their mobile phones. However, something to keep in mind: anyone using this as an attack method is horribly exposed.

For one thing, this doesn’t work if the person controlling the bots attempts to hide their commands with a private Twitter page; the bots will just flail aimlessly as they wonder where their master has gone. There are two side effects of “being public” as a result:

1) In theory it should be easy for Twitter to track / filter / block anyone issuing these commands – and security researchers on Twitter who go hunting for these things will probably ensure offending accounts are reported and banned.

2) It only takes a quick Twitter Search to reveal who is using this Bot method at the moment:

Even better, things get extremely complicated if you’re apparently posting Bot commands from a Twitter feed that contains your full name, your geographic location and a link to your homepage that gives up your home address & phone number from a Whois search.

Whoops.

We’ve notified Twitter about this bot creation system, and they’re looking into it. I’d also like to point out that they took exactly thirteen minutes to respond to my email, which is rather impressive by any standards.

We detect the infection file as Hacktool.win32.Twebot.A.

Christopher Boyd

At the tail end of last year, Botnets controlled by Twitter accounts started to make the news. They’ve kind of faded from view a little since then, but one enterprising coder is hoping they’ll make a comeback with a tool designed to make botting simple for script kiddies the world over.

This is the builder we’ll be looking at today:

Firing the program up gives the most basic of interfaces – all you can do is enter a Twitter Username and hit the “Build” button:

Once done, an executable file is created that will keep an eye on the named Twitter account for a series of commands used to infect, download, attack with DDoS and even kill the connection between Bot and Command channel. This is the file that’s created:

Of course, the attacker will change the name and the icon before attempting to send it to a victim. Should an end-user infect themselves, the attacker simply posts one of the following commands to their Twitter feed and the Bot will happily oblige:

.VISIT*link.com* (The attacker can add a 0 at the end to repeatedly open a weblink in an “invisible” manner, or a 1 if they want to pop open a website for giggles on the infected PC. Above, you can see a Twitter account telling all bots to open up Google.com in a visible web browser).

.DDOS*IP*PORT (This is a UDP attack).

.SAY* (This one takes advantage of the text to speech feature on a Windows machine, babbling a phrase of choice at the confused victim).

.DOWNLOAD*link.com/file.exe* (The attacker can add a 0 at the end to download, or a 1 if they want to download and execute a file).

.STOP (This will tell the Bots to cease their activities, regardless of whether that’s a DDoS attack or a world record attempt for the amount of times they can open up a Rickroll).

.REMOVEALL (This cuts the connection between bot and Twitter account).

Here’s a screenshot of Youtube popped open on an infected PC courtesy of a .VISIT command – note the shot of the Wireshark traffic indicating the bot / Twitter connection just before the browser opens:

All in all, a very slick tool and no doubt script kiddies everywhere are salivating over the prospect of hitting a website with a DDoS from their mobile phones. However, something to keep in mind: anyone using this as an attack method is horribly exposed.

For one thing, this doesn’t work if the person controlling the bots attempts to hide their commands with a private Twitter page; the bots will just flail aimlessly as they wonder where their master has gone. There are two side effects of “being public” as a result:

1) In theory it should be easy for Twitter to track / filter / block anyone issuing these commands – and security researchers on Twitter who go hunting for these things will probably ensure offending accounts are reported and banned.

2) It only takes a quick Twitter Search to reveal who is using this Bot method at the moment:

Even better, things get extremely complicated if you’re apparently posting Bot commands from a Twitter feed that contains your full name, your geographic location and a link to your homepage that gives up your home address & phone number from a Whois search.

Whoops.

We’ve notified Twitter about this bot creation system, and they’re looking into it. I’d also like to point out that they took exactly thirteen minutes to respond to my email, which is rather impressive by any standards.

We detect the infection file as Hacktool.win32.Twebot.A.

Christopher Boyd

Diaspora

Four students at the NYU Courant Institute have raised more than enough money to spend the summer writing the code for a “privacy aware, personally controlled, do-it-all distributed open source social network” that they are calling “Diaspora.”

As of mid-afternoon today their web site said they’d raised $33,179 from 1027 backers. They had been seeking $10,000 to support themselves over the summer while they finished the project.

Their web site describes the project: “Enter your Diaspora ‘seed,’ a personal web server that stores all of your information and shares it with your friends. Diaspora knows how to securely share (using GPG) your pictures, videos, and more. When you have a Diaspora seed of your own, you own your social graph, you have access to your information however you want, whenever you want, and you have full control of your online identity. Once we have built a solid foundation, we will make Diaspora easy to extend to facilitate any type of communication, and the possibilities will be endless.”

Diaspora site here.

There’s a word I love: “Quixotic.” It was derived from great novel “The Ingenious Hidalgo Don Quixote of La Mancha.” I think it applies here. It’s great.

Tom Kelchner

Diaspora

Four students at the NYU Courant Institute have raised more than enough money to spend the summer writing the code for a “privacy aware, personally controlled, do-it-all distributed open source social network” that they are calling “Diaspora.”

As of mid-afternoon today their web site said they’d raised $33,179 from 1027 backers. They had been seeking $10,000 to support themselves over the summer while they finished the project.

Their web site describes the project: “Enter your Diaspora ‘seed,’ a personal web server that stores all of your information and shares it with your friends. Diaspora knows how to securely share (using GPG) your pictures, videos, and more. When you have a Diaspora seed of your own, you own your social graph, you have access to your information however you want, whenever you want, and you have full control of your online identity. Once we have built a solid foundation, we will make Diaspora easy to extend to facilitate any type of communication, and the possibilities will be endless.”

Diaspora site here.

There’s a word I love: “Quixotic.” It was derived from great novel “The Ingenious Hidalgo Don Quixote of La Mancha.” I think it applies here. It’s great.

Tom Kelchner

The head of the FBI’s cyber crime section said that the bureau in planning to prosecute money mules – people who send funds stolen by online banking fraud to criminal organizations outside the U.S.

Patrick Carney, the acting chief of the FBI Cyber Crime section made the announcement at a Federal Deposit Insurance Corporation symposium in Arlington, Va., according to the Wall Street Journal and security blogger Brian Krebs, who writes the Krebs On Security blog.

Krebs piece here: “FBI Promises Action Against Money Mules”

WSJ piece here: “FBI Targets Cyber ‘Mules'”

Money mules are usually recruited through on-line employment sites and work-at-home schemes. It is believed that most know they are participating in illegal actions, although some are dupes.

The mules are an essential link in bank fraud schemes. They receive fund transfers from hacked accounts and transfer the money to organized crime groups that often operate in Eastern Europe, Ukraine and Russia.

Last fall, the FBI said such bank fraud was responsible for $40 million in losses just to small to mid-sized companies in the last six years. They said of the 205 cases they had investigated, the thieves had attempted to steal $85 million but security measures stopped the transfer of all but the $40 million. The thefts boomed in 2009.

In the UK, losses for all categories of enterprises totaled £59.7 million ($103 million USD) in 2009, according to the UK Cards Association.

Tom Kelchner

The head of the FBI’s cyber crime section said that the bureau in planning to prosecute money mules – people who send funds stolen by online banking fraud to criminal organizations outside the U.S.

Patrick Carney, the acting chief of the FBI Cyber Crime section made the announcement at a Federal Deposit Insurance Corporation symposium in Arlington, Va., according to the Wall Street Journal and security blogger Brian Krebs, who writes the Krebs On Security blog.

Krebs piece here: “FBI Promises Action Against Money Mules”

WSJ piece here: “FBI Targets Cyber ‘Mules'”

Money mules are usually recruited through on-line employment sites and work-at-home schemes. It is believed that most know they are participating in illegal actions, although some are dupes.

The mules are an essential link in bank fraud schemes. They receive fund transfers from hacked accounts and transfer the money to organized crime groups that often operate in Eastern Europe, Ukraine and Russia.

Last fall, the FBI said such bank fraud was responsible for $40 million in losses just to small to mid-sized companies in the last six years. They said of the 205 cases they had investigated, the thieves had attempted to steal $85 million but security measures stopped the transfer of all but the $40 million. The thefts boomed in 2009.

In the UK, losses for all categories of enterprises totaled £59.7 million ($103 million USD) in 2009, according to the UK Cards Association.

Tom Kelchner

As much as five percent of the world’s supply of electronic parts could be counterfeit, putting data at risk and causing machine failures, according to an investigation by Engineering & Technology magazine and reported by TheInquirer.net

“Not only are they spreading like viruses, but many of the dodgy parts even include viruses themselves. In fact trading standards experts spoken with by E&T warned that viruses or malware have been found in all kinds of gadgets, from simple gizmos like digital photo frames to USB keys,” they said.

The counterfeit parts come from the “grey market,” components which were not approved by the original manufacturer, or through the “green market,” refurbished and second-hand goods. The parts often pass as new in Internet brokerages, E&T said.

The Inquirer story here: “Counterfeit electronics trade is killing the industry”

Tom Kelchner

As much as five percent of the world’s supply of electronic parts could be counterfeit, putting data at risk and causing machine failures, according to an investigation by Engineering & Technology magazine and reported by TheInquirer.net

“Not only are they spreading like viruses, but many of the dodgy parts even include viruses themselves. In fact trading standards experts spoken with by E&T warned that viruses or malware have been found in all kinds of gadgets, from simple gizmos like digital photo frames to USB keys,” they said.

The counterfeit parts come from the “grey market,” components which were not approved by the original manufacturer, or through the “green market,” refurbished and second-hand goods. The parts often pass as new in Internet brokerages, E&T said.

The Inquirer story here: “Counterfeit electronics trade is killing the industry”

Tom Kelchner

Adobe has released two updates this month:

APSB10-12 (Security update available for Shockwave Player)

Rated: Critical

“Vulnerabilities have been identified in Adobe Shockwave Player 11.5.6.606 and earlier versions on the Windows and Macintosh operating systems. The vulnerabilities could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system. Adobe recommends users of Adobe Shockwave Player 11.5.6.606 and earlier versions update to Adobe Shockwave Player 11.5.7.609…”

APSB10-11 (Security update: Hotfixes available for ColdFusion)

Rated: Important

“Vulnerabilities have been identified in ColdFusion 8.0, 8.0.1, 9.0 and earlier versions for Windows, Macintosh and UNIX. The vulnerabilities could lead to cross-site scripting and information disclosure. Adobe has provided a solution to the reported vulnerabilities. It is recommended that users update their product installation…”

Bulletins and links to patches here: http://www.adobe.com/support/security/

Tom Kelchner

Adobe has released two updates this month:

APSB10-12 (Security update available for Shockwave Player)

Rated: Critical

“Vulnerabilities have been identified in Adobe Shockwave Player 11.5.6.606 and earlier versions on the Windows and Macintosh operating systems. The vulnerabilities could allow an attacker, who successfully exploits these vulnerabilities, to run malicious code on the affected system. Adobe recommends users of Adobe Shockwave Player 11.5.6.606 and earlier versions update to Adobe Shockwave Player 11.5.7.609…”

APSB10-11 (Security update: Hotfixes available for ColdFusion)

Rated: Important

“Vulnerabilities have been identified in ColdFusion 8.0, 8.0.1, 9.0 and earlier versions for Windows, Macintosh and UNIX. The vulnerabilities could lead to cross-site scripting and information disclosure. Adobe has provided a solution to the reported vulnerabilities. It is recommended that users update their product installation…”

Bulletins and links to patches here: http://www.adobe.com/support/security/

Tom Kelchner

Two bulletins, both considered critical:

MS10-30:Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542)

MS10-31: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)

Info here: http://www.microsoft.com/technet/security/bulletin/ms10-may.mspx

Tom Kelchner

Two bulletins, both considered critical:

MS10-30:Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution (978542)

MS10-31: Vulnerability in Microsoft Visual Basic for Applications Could Allow Remote Code Execution (978213)

Info here: http://www.microsoft.com/technet/security/bulletin/ms10-may.mspx

Tom Kelchner

A variety of sources are reporting that blog hosting sites with WordPress-created sites and php-based management systems such as Zen Care eCommerce are being infected with malicious scripts.

Websites hosted by ISP DreamHost, GoDaddy, Bluehost and Media Temple have been found with the malcode, according to H-Online.com.

The malicious scripts download malcode and block Google’s Safe Browsing API from alerting users.

Story here: “Large-scale attack on WordPress”

The Sucuri Security blog has offered clean-up instructions for those with infected pages here.

Tom Kelchner

A variety of sources are reporting that blog hosting sites with WordPress-created sites and php-based management systems such as Zen Care eCommerce are being infected with malicious scripts.

Websites hosted by ISP DreamHost, GoDaddy, Bluehost and Media Temple have been found with the malcode, according to H-Online.com.

The malicious scripts download malcode and block Google’s Safe Browsing API from alerting users.

Story here: “Large-scale attack on WordPress”

The Sucuri Security blog has offered clean-up instructions for those with infected pages here.

Tom Kelchner

Twitter, which along with the rest of the social media world continues to add strange constructs to the English language, has fixed a bug (feature?) that allowed a Twitter user to force another user to follow him. The command “accept@their_name_here,” was discovered and publicized by a number of blogs, according to CNET.com.

The command only worked in the Twitter interface and not in third-party software.

Story here: “Twitter confirms awkward ‘auto-follow’ bug”

Twitter noted on its Status blog that the feature was eliminated and any changes from it in users’ accounts were rolled back They said that if Twitter users find themselves following someone they don’t choose to follow they can block them with Twitter’s “unfollow” tools.

Blog here: “Follow bug discovered, remedied”

Tom Kelchner

Twitter, which along with the rest of the social media world continues to add strange constructs to the English language, has fixed a bug (feature?) that allowed a Twitter user to force another user to follow him. The command “accept@their_name_here,” was discovered and publicized by a number of blogs, according to CNET.com.

The command only worked in the Twitter interface and not in third-party software.

Story here: “Twitter confirms awkward ‘auto-follow’ bug”

Twitter noted on its Status blog that the feature was eliminated and any changes from it in users’ accounts were rolled back They said that if Twitter users find themselves following someone they don’t choose to follow they can block them with Twitter’s “unfollow” tools.

Blog here: “Follow bug discovered, remedied”

Tom Kelchner

Researchers at matousec.com have reported a bait-and-switch vulnerability in the 30 leading anti-malware products on the market today including VIPRE. The vulnerability exploits Windows driver hooks in anti-virus programs, sending them a piece of non-malicious code to bypass security checks then exchanging it for malicious executables.

Although their report has resulted in screaming headlines worldwide, researchers have pointed out that the vulnerability has existed for years without anyone exploiting it. Also, to be successful, an attacker would need the ability to run code on a computer (in which case a victim has much larger problems than this) and the exploit code is very large.

Sunbelt Software Chief Technology Officer Eric Sites said: “The matousec.com blog published a possible attack method that could be used for researching actual vulnerabilities. All of the security products he listed may or may not be vulnerable to this method of attack. VIPRE uses SSDT hooks only for older version of Windows and then only sparingly where APIs provided by Microsoft don’t exist or are too buggy to use. VIPRE does not use SSDT hooks for 64-bit versions of Windows because of Microsoft’s PatchGuard technology and Microsoft new APIs for security software. That said we are reviewing our drivers to make sure our products are not vulnerable to the method of attack.

“If any of the vendors’ security products do have an actual vulnerabilities to this attack method it is very sad that matousec.com did not use responsible disclosure and give the security vendors time to review their products before publicly disclosing this information and putting everyone at risk. matousec.com notified us about the attack method and possible vulnerability on April 20th and then promptly released this information on May 5th which does not give any vendor time to review tens or hundreds of thousands lines of code to hunt for possible vulnerabilities. And no time at all to fix, test and deploy updated versions of security products. This is very sad and very irresponsible.”

The Register put the vulnerability in perspective in the eighth paragraph of their story:

“Still, the exploit has its limitations. It requires a large amount of code to be loaded onto the targeted machine, making it impractical for shellcode-based attacks or attacks that rely on speed and stealth. It can also be carried out only when an attacker already has the ability to run a binary on the targeted PC.”

Story here: “New attack bypasses virtually all AV protection”

Dwight Silverman on the Houston Chronicle’s TechBlog puts the vulnerability in further perspective. He quotes Lucian Constantin of Softpedia: “There is still a debate about the impact of this vulnerability, especially since the underlying problem has been known for years, yet no practical attack has been detected in the wild. On the other hand, it is also true that multi-core processors, which drastically increase the success rate of this attack, have since become widespread in desktop computers. Nevertheless, from information we received in confidence, some antivirus vendors were already planning to stop using SSDT hooks in the next version of their products, since before this research came out.”

Blog here: “In theory, your antivirus software is worthless”

Tom Kelchner