SANS Webcast on Feb 1st: The Spyware Threat Today

Join SANS and Sunbelt Wednesday at 1PM ET:

The Spyware Threat Today
Featuring: Dave Shackleford, SANS Instructor and Greg Kras, VP Product Management, Sunbelt Software

Spyware is quickly becoming one of the most pervasive threats to organizations of all types. The majority of infections occur through basic Web browsing, and existing security controls are often not configured to detect spyware or prevent it from spreading. In addition to this, spyware can cause organizations to lose sensitive information, resulting in a number of compliance-related issues, as well. There are a number of steps that security staff can take to adopt a defense-in-depth strategy addressing spyware at both the system and network levels. This presentation will discuss the state of spyware today, how it infects systems, and network- and host-level methods of detection and prevention.

Managing Spyware with CounterSpy Enterprise
Spyware has become the new headache for IT. Systems become rapidly infected and system admins are often forced to physically go to the end-user and manually run spyware removal tools to get rid of these data threats. CounterSpy Enterprise is a policy-based, antispyware solution that provides a scalable, centrally managed solution that is capable of detecting and removing a broad range of adware, malware and other spyware from corporate networks. This brief overview will show how system admins can effectively manage spyware within their organizations using CounterSpy Enterprise.

Click here to join the webcast.

USB Security

USB drives carry their own security risks.  Have you ever lost your keys?  Well, how about if your keys have a USB thumdrive on them?

So security is something to keep in mind. If you need a decent overview of USB security, faithful blog reader Ed Stankiewicz passed on this link to me at TheInfoBox.com.   It gives a basic overview of security on USB drives. Link here.

Alex Eckelberry

Who’s Reading your Mail?

Since the dawn of the written word and throughout history, humans have been devising new and better ways to send messages to others who are far away. Ancient civilizations used couriers who traveled by foot or by horseback to deliver letters. The U.S. postal service was created in the early days of our country to transport our written communications. In the 1800s, those letters traveled by stagecoach, Pony Express, railroad and steamship.

In the early days, you had to take the letter to the post office to mail it and the recipient had to go to the post office to pick it up. Later (mid-1800s), the postal service delivered mail to residencies – first only in the cities, then to rural areas as motor vehicles became common. The twentieth century brought us air mail, as well as some innovative ideas that never quite panned out (such as the delivery of mail via guided missile, with which the Navy experimented in the 50s). (For more info on the history of U.S. Postal Service, click here.)

Today, there are many ways to get our messages through, whether we’re sending them next door or all the way around the world. Many of us routinely circumvent the post office (and private delivery services) altogether by sending most of our written communications via email. It’s a lot faster, a lot easier and a lot cheaper. What’s not to like? (For a brief history of the development of email, click here.)

Trouble is, because it’s so much quicker, many of us write much more informally in email than we do in “real” letters. Yet many of us also seem to assume that we have the same level of privacy as we have with our postage-paid letters. And as we use email more and more for both business and personal communications, that can become a problem.

I’ve said it many times before, but it bears repeating: your email is at least as public as sending a postcard through the “snail mail” – which anyone whose hands it happens to pass through can read. Yet many folks continue to act as if they can say anything they want in email without consequences, despite the many news stories detailing how people’s email messages have been used against them in civil and criminal actions.

Note: Although there are still federal laws against opening someone else’s mail, snail mail, too, is becoming less private all the time. Particularly, the government has taken steps to make anonymity more difficult. Renting post office boxes or even mail boxes run by private companies now requires furnishing identification, and in 2003 the Presidential Commission on the Postal service called for a way to identify the sender of every piece of mail as a way to improve national security. A concept called “intelligent mail,” supported by Pitney Bowes and others, advocates implementing a system that can provide information about senders, recipients and even contents of postal mail. While it has advantages such as the ability to track your mail, it also has privacy implications that worry some.

But back to email: many people believe that the National Security Agency (NSA) reads all of our email. The sheer volume of electronic mail that goes across the Internet every day makes that unlikely, but it would certainly be possible to intercept and send mail through filtering software to flag messages that appear to be “of interest” to the government. Last month, Bruce Schneier’s blog quoted some instructions from Richard M. Smith on how to test whether your mail is being monitored. Click here.

You don’t have to be a super secret, well funded spy agency to read other people’s mail, though. Network administrators do it all the time, “just for fun.” Your employer has the legal right to snoop in the mail you send from or receive on company machines or via your company email account. And there’s a plethora of real spyware software available that can be used by suspicious spouses, concerned parents or curious friends or co-workers who want to know what you’re up to.

Even knowing all this, folks continue to say things in email that can come back to haunt them later. And getting fired, divorced, arrested or at least humiliated because of it. When you hit that Send button, you really never know who will end up eventually seeing your dirty jokes, derogatory comments about your boss, love letters, or other self-incriminating information. It’s often been said that you shouldn’t put anything in email that you would be ashamed to see on the front page of the newspaper and, indeed, that’s where it might wind up. Or on a public Web site for any and everyone to peruse. For example, you can search through hundreds of thousands of email messages that were sent to and from former Enron executives and employees here.

Is encryption the solution? Despite the availability of low-cost email encryption technologies, few people encrypt the email that they send. There are undoubtedly many reasons: lack of knowledge about encryption options, plain old laziness, the belief that if you aren’t doing anything wrong (i.e., illegal), you don’t need to hide what you’re doing. Yet another reason encryption has never really caught on among the general email-sending public is interoperability. Both sender and recipient need to have the software for encrypting and decrypting mail, and you can’t assume that all or even most of the people with whom you exchange mail will be able to decrypted your encrypted communications.

Many experts say encryption won’t become standard until it’s built into the popular email clients and Webmail services and made transparent to the user. That is, it should be as simple as clicking a button to encrypt a message (no having to fuss with installing extra software or obtaining a digital certificate).

But it’s also likely that many people don’t use encryption simply because it’s not in widespread use. This makes those messages that are encrypted stand out like a sore thumb. Encrypting your mail may actually raise suspicions where there were none before. However, if you’d like to give encryption a try, here’s a link that tells you how to do it using PGP (Pretty Good Privacy).

What do you think?

Deb Shinder

 

Online ID theft not as big as people may think

From InternetNews:

If recent stats are to be trusted, incidents of fraud from Internet-based means may well be on the decline.

According to a report set to be released tomorrow from Javelin Strategy and Research, in cases where the source of the identity theft was known, only 9 percent were reported to have come from hacking, viruses and phishing.

In contrast, a lost or stolen wallet or credit/debit card was the cause of 30 percent of the incidents.

The study also found that fraudulent activity is mostly (over 70 percent) conducted offline via phone or mail.

Link here via techdirt.

 

Alex Eckelberry

180solutions withdraws lawsuit

Back in the fall, 180solutions sued Zone Labs for making “false and misleading statements” about 180solutions.

They’ve withdrawn the lawsuit.

“Although the new labeling is still in our view overly aggressive, the immediate purpose of the lawsuit has been served,” said 180 chief compliance officer Ken McGraw in a statement. 180Solutions is currently facing a complaint to the FTC brought on by the Center for Democracy and Technology digital watchdog group, alleging improper business tactics.

Link here.

ZoneLabs press release here.

Alex Eckelberry
(Thanks Ben, Suzi)

Wendy Seltzer responds

Saturday, I blogged about a lawyer at the Berkman Center at Harvard Law bringing up the word “zealots” in relation to antispyware activitities.

She’s responded well:

Several commentors here and elsewhere have seen my post Spyware as an Ecosystem Blight as an attack on those who have exposed spyware. It isn’t.

First, as a lawyer who takes seriously the duty of “zealous advocacy” owed to my clients and causes, I see “zealot” as a badge of honor more often than as criticism. Second, I was referring my own criticism specifically to those who have levered poorly-justified lawsuits against alleged spyware — not to those who have preceded StopBadware.org in exposing the mechanisms by which malware gunks up computers against the users’ will.

The most visible “anti-spyware” forces to me, a lawyer, have been those such as U-Haul, Wells Fargo, Washington Post, and 1-800 Contacts, who have run amok in the courts trying to shut down popups with theories I think are harmful to the fabric of the law. I don’t think the user-centered movement gains when trademark or copyright law is extended to prevent a user from covering the on-screen display of a web page or trademark — what if the user wants to browse with Greasemonkey or show her own pop-ups?

It’s unfortunate when the companies making misleading legal claims or lobbying for overreaching law become the most visible piece of the anti-spyware spectrum — though it may be that they’re only the most visible to those wearing lawyer-colored glasses. So, to make clear: thank you to all those working to enhance user choice by informing the public about the software that wants to install itself on our computers.

Link here.

Thanks Wendy, for clearing that up! 

Zealots rule.

 

Alex Eckelberry
Btw — this is a light blogging week for me — board meetings.  Have to pay the bills…

Seen in the wild: Phishing gang site

Just some of the typical random junk we run across in our research:  http://sharky-socks(dot)net is a backdoor to a phishing gang.

Subdirectories we have found on the site: 

CitiScam/               
adminlist/              
cgi-bin/                
citibank/               
me/                     
proxyservice/           

So typing in http://sharky-socks(dot)net/citibank will give you the Citibank scam site.

Sharkysphishingmachine

Whois info.

Everyones Internet is hosting it.

 

Alex Eckelberry
(Thanks to Sunbelt researcher Eric Howes)

 

Latest (In)Secure Magazine

(In)Secure Magazine is a great magazine on security and the latest issue is out.

Covered topics in this issue:

  • Web application firewalls primer
  • Review: Trustware BufferZone 1.6
  • Threat analysis using log data
  • Looking back at computer security in 2005
  • Writing an enterprise handheld security policy
  • Digital Rights Management
  • Revenge of the Web mob
  • Hardening Windows Server 2003 platforms made easy
  • Filtering spam server-side   

Alex Eckelberry
(Hat Tip to Martin McKeay.)

Oh, there goes that whole zealots thing again

Faithful readers of my blog will remember when I was branded a zealot by 180solutions. (Actually, I found out later that the 180 fellow who said this may not have meant me directly, but the words were in immortalized in print.  And what the heck: I admit to rather liking the title.)

Now, Wendy Seltzer (a fellow with the Berkman Center for Internet & Society at Harvard Law School) brings up the “zealots” word, in a blog supportive of the new StopBadware.org project (a project operated by the Berkman Center and the Oxford Internet Institute).

…I still dislike anti-spyware zealotry, but I’ve come to see that the higher-order consequences of spyware — the tactics of its opponents and the reactions of users who are plagued by it — are also problematic. A measured approach to malware can help avert those problems without distorting the law around it. That’s why I’m encouraged by the Berkman Center’s new Stop Badware project:

Link here.  

Alex Eckelberry
(Btw — her blog seems hopelessly broken.  Trackbacks and comments didn’t work when I tried them.  You can email her directly if you like.)

One step ahead of the game

The Blackworm/Kama Sutra worm drops its deadly payload February 3.

Microsoft will release its Malicious Software Removal tool on February 14:

…As described in the write-up, the worm will corrupt common document format files, first on February 3rd 2006 and on the third day of every month moving forward. As always, we strongly recommend running an up-to-date antivirus program on your computers and being wary of opening suspicious e-mail attachments even if they were sent from a familiar mail address.

…Microsoft releases a new version of the Windows Malicious Software Removal Tool every month on the second Tuesday of the month together with the other security updates. The next version, targeted for release on February 14th will detect and remove this worm.

Also, the beta version of Windows OneCare Live protects against this threat. It can be obtained here:  http://www.windowsonecare.com.

More here.

Alex Eckelberry

Does Download Accelerator Plus merit listing in the CounterSpy database?

Ok, perhaps not the most thrilling title for a blog, but we’ve done a re-review of our exhaustive study on Download Accelerator Plus (DAP): 

…Sunbelt’s research team recommends that Sunbelt continue to offer DAP as an optional “low risk adware” detection with a default action of “Ignore.” The Sunbelt research team does
recommend that Sunbelt review the description provided in Sunbelt’s database for DAP and revise the more general description for “Low risk adware” to better fit the programs such as DAP
that fall in that category of detections.

(Listing an application with a default action of Ignore means that CounterSpy will detect the application and present it to the user.  The choice of removal is left to the user, as opposed to automatically defaulting to “Quarantine” or “Remove”.)

You can read the full review here.   

 

Alex Eckelberry

Friday Off Topics

Off Topic #1:  Even though it was constant background music in the house, I never cared much for Mozart growing up.  And when I went for my musical training (originally piano, then later flute), I was interested in earlier baroque, Bach-centered music.  In short, I was a Bach snob.

But when you play Mozart, you really appreciate his work.  It wasn’t until much later that I worked on my first Mozart piece, the Romance from the Piano Concerto No. 20 in D Minor, that I finally saw Mozart’s magic. (I recently heard a snippet of one recording of this particular movement that I thought was done incorrectly — slow and sweeping.  The piece plays for the pianist in a more spirited manner —  you can almost feel his sense of mischief coming through the keys.  It’s a lot of fun for the musician.). 

Anyway, today is the 250th anniversary of Mozart’s birthday.  NPR has a great site with a bunch of great interviews and specials on the life of this musical genius. Link here.

Off topic #2: Amidst all this hullabaloo about Google censoring results for its Chinese search engine, one critical fact has been left unsaid:  They’re filtering Guiness.com

The revolution starts today, people.

Off Topic #3:  Ok, I get to plug someone, but it’s family. My brother, Marc Eckelberry (a futures trader), has started what is turning into a pretty nice blog on futures trading.

Check it out, including this fun multimedia look at yesterday’s market.  I have absolutely no idea if he’s wrong or right on his advice (and his advice is only for pros) but it all looks impressively technical and there’s lots of pictures. 

Personally, I’ll stick to software.  And on that note, I’m going back to work.

 

Alex Eckelberry

Interesting stats on Blackworm

The folks at Lurhq have posted some stats on Blackworm, working with the ISP that’s actually hosting the infamous counter we’ve discussed in the past (this worm reports back to a server that is keeping track of the number of infections).

In the charts, you can see the DDoS attack that increased the counter so dramatically:

Counter-total-hits

 More excellent charts, along with the actual infection statistics (closer to 300,000) here, via WebSense.

 

Alex Eckelberry

 

Another movie by Paperghost

While the hip and trendy freeze at the Sundance Film Festival, I have a better alternative.

Following on our tradition of showcasing promising young antispyware movie makers (our first film fest was held in July of last year, when Robert Redford was pining for snow), we present another dark, cutting edge film by the notorious Paperghost.

I present: Adware-Man.

And the music makes the movie.

 

Alex Eckelberry