Month: December 2007

Some of you might want to know where to submit virus/malware samples to security companies. This blog post might help.

First, each vendor has their own submission process. For example, Symantec has this page, McAfee has this page, Sunbelt has this page — and so on. However, email addresses are available — you can package your malware sample into a zip or RAR file, password protect it (common practice is to use the password ”infected”) and send off the sample. A full list of submission addresses is here.

Now, if you’re feeling lazy (or just plain too busy), you can always submit a sample to Virustotal. All the vendors that are part of VirusTotal receive samples, so it’s an easy way to get a sample to a lots of companies. I’m not particularly sure if it’s the fastest way to get samples out there to the security companies, but the samples do ultimately get to all of us. (Clarification — VirusTotal gets us the samples immediately. But it’s up to the vendors to get these samples into their threat signatures. For some, this takes a bit of time.)

Finally, feel free to submit the malware to our sandbox. It gives us the sample, but also, gives you a nice report as to what the malware is actually doing.

And, of course, please don’t mess with malware samples unless you really know what you’re doing. Even expert security researchers have been known to infect themselves by accident on occasion.

Alex Eckelberry

After infection by this Trojan, you’re completely locked out of the system.

You get this screen –– it takes over your entire desktop:

Click on “Click to activate new license”, you get this screen:

Turns out it’s coming from a website, which I’ve posted the same screens, below:

Different countries have different numbers. For example, here is the UK:

And here is France:

Incidentally, a search on the US 900 number shows the first link as passwordtwoenter com, which shares an IP with a number of other similar sites:

p2e com
chargemybill com
chargemyphonebill com
password2enter com
passwordtoenter com
passwordtwoenter com
phonetoenter com
pin2enter com
pintoenter com
pintwoenter com
ptwoe com

Apparently, this is a payment processor that’s now being used for malware, whether they know it or not.

Alex Eckelberry
(thanks Adam Thomas and Patrick Jordan)

Update: Pay-by-phone processor cancels account. More here.

In the “Low-Maintenance Magic” category:

Low-Maintenance Magic
The tool that requires the least amount of ongoing attention:

1. Exploit Prevention Labs’ LinkScanner Pro: Just set it and forget it.
2. Sunbelt’s Messaging Ninja: Stealthily keeps your e-mail clean and healthy.
3. Microsoft’s WSUS: Plug it in, attach clients to it and they’re patched. The best part is it’s free.

Congratulations to our Ninja development team!

Alex Eckelberry

Following on a study by the Harvard School of Public Health that “concluded there is no evidence that the [TSA’s] measures actually increase the safety of the passengers”, we now have an airline pilot delivering a salvo against the TSA in a blog post on the New York Times website (via boingboing):

Thus, what most people fail to grasp is that the nuts and bolts of keeping terrorists away from planes is not really the job of airport security at all. Rather, it’s the job of government agencies and law enforcement. It’s not very glamorous, but the grunt work of hunting down terrorists takes place far off stage, relying on the diligent work of cops, spies and intelligence officers. Air crimes need to be stopped at the planning stages. By the time a terrorist gets to the airport, chances are it’s too late.

In the end, I’m not sure which is more troubling, the inanity of the existing regulations, or the average American’s acceptance of them and willingness to be humiliated. These wasteful and tedious protocols have solidified into what appears to be indefinite policy, with little or no opposition. There ought to be a tide of protest rising up against this mania. Where is it? At its loudest, the voice of the traveling public is one of grumbled resignation. The op-ed pages are silent, the pundits have nothing meaningful to say.

(“I’m not sure which is more troubling, the inanity of the existing regulations, or the average American’s acceptance of them and willingness to be humiliated.” That’s a good point. I suspect the reason is that no one in the mainstream press wants to make an issue out of this, because of some reader responses. I’ve seen a few nasty responses when I put up these types of blog posts, that I’m advocating something like forsaking America’s Great Liberty, etc. This is nonsense, of course. I’m advocating better security, not wasteful security.)

The reality is that reason has left the table, and has been left with fear.

The illogic is plain to see everywhere:

– If these security measures are so important and life-saving, why is it that airline personnel have to go through a security check, while airport personnel don’t?

– Where is the real proof that the liquids ban do anything to prevent a binary explosive from being created in a toilet? (Not that it’s even likely that this is possible.)

– Why is it that when I was in Vienna recently, there was an army guy walking around with an Uzzi, but I didn’t have to take my shoes off? Only when I landed in the US did I need to have my shoes checked. Vienna — gateway to the Middle East, and they’re not worried about shoes?

– And what is the real number of confiscated illegal goods? It’s supposed to be “in the millions”, but how many of those were hair spray bottles and lighters?

As someone involved in security, I get the problem. But also, as someone involved in security, I am aggravated by unnecessary actions, because putting aside the hassle factor, unnecessary actions actually degrade your security posture. By focusing on confiscating perfume bottles, the TSA isn’t spending the time on doing the right things. Even something as simple as having a trained agent simply look at passengers is a powerful measure. Can’t do that if you’re worried about shampoo and removing shoes.

To the TSA folks that read this blog: Peace. I’m not attacking you. I think you’re all dealing with an enormous task, and I respect the hard work you have to do — often without any thanks. So thank you for the hard work you do — really. But I’m trying to help you here.

Let’s rethink airline security. Let’s focus on what has really worked and makes sense (good intel, locked cockpit doors, higher passenger awareness, x-raying of checked bags, etc.) and get rid of the purposeless additional cautions. Because that’s making us less secure, not more.

Alex Eckelberry

12/3/2008 Correction/Clarification: This is not technically the Ask Toolbar. It’s actually a STOPzilla toolbar that uses Ask search results. More here.

Yet another security vendor succumbs to bundling the Ask Toolbar with their product — and again, pre-selected (and when you go to uninstall the STOPzilla, you’re still left with the Ask Toolbar to uninstall).

This is getting gross.

Ask pays handsomely for these bundling arrangements, but is money ever that important that you would treat a customer this way?

It seems most people feel the same way I do — previous comment storms here (Zone Labs) and here (WebRoot). However, there are always the apologists. Feel free to post your opinion.

Alex Eckelberry
(And thank for the heads-up, Scoobie)

Most, if not all, of the pages we discussed in our post on Wednesday about Blogger sites pushing fake codecs have been removed by Google.

However, we still continue to see a good number of sites pushing fake codecs.

Example:

For the most part, these go to a site which looks like this:

(Notice the attempt to push a fake video about the Bhutto assassination. They watch for the hottest keywords and then roll those out.)

And when you click, you get this:

Very deceiving.

Here are sites we found — there are certainly more (“.” replaced with a space):

abceuropewhere blogspot com
alertsukvideo blogspot com
americacnnalerts blogspot com
ballhoneys coachesreview com
beginverymore blogspot com
blogpaperalerts blogspot com
catchabctoday blogspot com
catchredtarget blogspot com
cnnredfree blogspot com
crisiscnnbehind blogspot com
crisistodaytoday blogspot com
cueorgtag blogspot com
diglivingvideo blogspot com
directblogtour blogspot com
directeuropeget blogspot com
endblognet blogspot com
endhotget blogspot com
europegovery blogspot com
europevideomy blogspot com
fallbehindcnn blogspot com
freeonlycue blogspot com
getnewyorkpress blogspot com
gettagfall blogspot com
hereenddigg blogspot com
hotfallcatch blogspot com
livingeuropefavor blogspot com
myfallalerts blogspot com
myfreecnn blogspot com
myusahot blogspot com
newadz blogspot com
newswheremore blogspot com
nonbeginliving blogspot com
noncrisisusa blogspot com
nowtodaynow blogspot com
onepollssnap blogspot com
oneputliving blogspot com
onlinemoresupra blogspot com
orgnewshot blogspot com
orgpaperusa blogspot com
orgveryuk blogspot com
paperwhytag blogspot com
radioorgdig blogspot com
radioukradio blogspot com
redpaperdigg blogspot com
redputalerts blogspot com
sharpnewscnn blogspot com
sharpredhot blogspot com
tagabcget blogspot com
tagdigdig blogspot com
tagsuprainfo blogspot com
taguktag blogspot com
targetdiggorg blogspot com
tourfreecue blogspot com
touronlyput blogspot com
ukusaliving blogspot com
usamoreblur blogspot com
verybeginradio blogspot com
verybehindamerica blogspot com
videolivingwhy blogspot com
whyredput blogspot com
whytodayusa blogspot com

What can you do? Feel free to report these sites when you find them to Google — through this link.

And Google’s filters need to do more, such as looking for links within blogs to known malware sites — in this case, places like oyaebu, video(dot)googl(dot)name, etc.

Alex Eckelberry
(Thanks Adam Thomas)

Interesting:

Features sell. Period. Under the SaaS model, software manufacturers add features incrementally and on-demand to satisfy client requests as well as remain competitive. This sounds like a good thing to both buyers and manufacturers. It is not, at least not under the current market circumstances.

The market incentive for software manufacturers is to add as many features as possible because features are part of the beauty contest among software applications. Security is not. This means SaaS applications are guaranteed to have a continuous and relentless stream of ad-hoc features (over an above the rate at which features are added to their multi-instance cousins) each of which add more complexity to the application and the likelihood that one or more of those features contains a bug (at best) or a vulnerability (at worst).

Features then, are the distinguishing element among software manufacturers, SaaS or otherwise. So low-quality, feature-rich software tends to dominate, driving higher-quality, secure software from the market. There is really no such thing as a “final release” in SaaS, making SaaS a particularly dangerous form of software. Features, and therefore potential vulnerabilities, tend to dominate. As such, buyers will never be free from acting as crash test dummies for the manufacturer (and paying handsomely for the privilege).

Link here.

Alex Eckelberry
(Thanks, Laurie)

codecultra(dot)net

Pushes both Windows and Mac TrojanDNSChanger. Sample binaries: Mac: codecultra(dot)net/download/codecultra1123.dmg. Windows: codecultra(dot)net/download/codecultra1123.exe. And please — don’t touch these binaries unless you know what you’re doing, as they are live Trojans.

Alex Eckelberry
(Thanks Patrick Jordan)

A new rogue by the IEDefender group: files-secure from files-secure(dot)com.

As you can see, it’s a rebranded clone of IEdefender:

Patrick Jordan
Sunbelt Software Malware Research

Fake codec trojans (so-called “required” components to watch a video, but in fact are malicious trojans) are a plague on the Internet. We’ve written about them extensively.

Often, they are seen in porn sites. However, by doing a few simple searches today, we can see that they’re available to those simply doing American football pools, checking bank hours or searching for New Year’s eve clipart. All of these are taking advantage of the free Blogger service.

For example, here’s a search for “NFL playoff bracket video” on Google:

And here’s a search for a recipe for deviled eggs:

How about checking the holiday hours at B of A?

Generally, clicking on one of those links will bring up a page like this:

Which, when clicked, leads to a page pushing a fake codec (and one not very widely detected by AV engines, incidentally):

And, in another case, off of the “holiday hours” search above, we get a different fake codec being pushed:

Now, clicking on that link brings us to a website that tries to make you believe it’s a Google Video site:

(Malware researchers, just try googling “”christmas dinner prayer” site:blogspot.com” for a rash of results — or playing with other search terms in the sites.)

Here’s a list of some sites that I found on some searches — I’m sure there’s more:

zagadko(dot)blogspot(dot)com
xboxlivevidz(dot)blogspot(dot)com
xa4ubablo(dot)blogspot(dot)com
videokfda(dot)blogspot(dot)com
video-ase(dot)blogspot(dot)com
video-aa(dot)blogspot(dot)com
veryhotpaper(dot)blogspot(dot)com
theneeeez(dot)blogspot(dot)com
supekom(dot)blogspot(dot)com
sukanahi(dot)blogspot(dot)com
page47vidz(dot)blogspot(dot)com
modotvidz(dot)blogspot(dot)com
melancholyvidz(dot)blogspot(dot)com
maxjetvideoz(dot)blogspot(dot)com
lohanvideoz(dot)blogspot(dot)com
kdotvidz(dot)blogspot(dot)com
habbovideoz(dot)blogspot(dot)com
greetingsvidz(dot)blogspot(dot)com
gaizocd(dot)blogspot(dot)com
f-videoq(dot)blogspot(dot)com
europemyusa(dot)blogspot(dot)com
dubigom(dot)blogspot(dot)com
dubigom(dot)blogspot(dot)com
directusapolls(dot)blogspot(dot)com
daysprings(dot)blogspot(dot)com
daibabla(dot)blogspot(dot)com
cityscoopvidz(dot)blogspot(dot)com
chattingcom(dot)blogspot(dot)com
carrievideoz(dot)blogspot(dot)com
bjpvideoz(dot)blogspot(dot)com
babliko(dot)blogspot(dot)com
10xgoogle(dot)blogspot(dot)com

Again, these sites are pushing real trojans. Please don’t go there if unless you know what you’re doing.

(Note that I wouldn’t put this in the same league as the massive Google poisoning we saw last month. That was an epic attack, using exploits and all kinds of nasty tricks. However, this is something to be aware of, and hopefully the good folks at Google will take them down lickety-split.)

Alex Eckelberry
(Thanks to David Glosser for the heads-up on this)

The CDT has published a list of deceptive music sites.

They include infamous sites such as allcoolmusic.com, freemusicnow.cc and allmusicdownloads.com.

As you know, there are people out there who actually believe that by signing up with these services, the music is somehow legit.  Of course, these are basically pirate sites.

Alex Eckelberry

Robert LaFollette, our creative director and a professional photographer, took some great pictures during the holiday.

He made an HDR photo that’s one of the best I’ve ever seen – shot on Christmas Eve on nearby Honeymoon Island.

Here’s his description of the picture:

Photomatrix was really quite easy to use, but to get the best results, one needed to get some specifics done right while out capturing the scene. Over the holiday break, I decided to study some more in HDR, so I set out to see what I can find.

While hiking on the trails at Honeymoon Island, Florida, I came across a scene that I have seen a hundred times before, but never attempted to capture it, for I knew the results would not be as good as I saw them. This time however, I met the challenge head-on. Typically, when one tries to photograph a landscape that has a lot of detail, and if the light is not right, the results look like it was taken with a point-n-shoot that we all have seen.

One of the tricks to a successful HDR photo, is of course knowing what you need. So, in this case, I had several tools to call upon to get the shot I was looking for. Those tools of course was my camera, wide angle lens, tripod, bubble level and remote release. The next trick is to set your camera at f/22, ISO 100, and once I get everything set up and the lens focused, switch the lens into manual focus so that is won’t change the focus point during your captures.

The reason for all this preparation is that you need to take at least 3 different shots, but the more the better. To do this, there are several different ways to accomplish this. The first, and perhaps the easiest, is to us your cameras AEB (Auto Exposure Bracketing) setting, whereas you will take 3 different exposures. Another way is to use your cameras Exposure Compensation, where when you take each frame, you expose the scene differently. Lastly, you can take the exposures manually. The end result will be one frame -1, the next at 0 and the last at +1 in exposure reading.

Of course, a steady tripod so that each frame is exactly the same, which is also true for the focal length, so one you get everything set up, the only thing you need to do is expose each frame differently. Also, keep in mind the Rule of Thirds for your composition, for without it, the shot will not be as dramatic!

For my shot, I used 5 frames, -2, -1, 0, +1 and +2, for the more frames you have, the more data you have to work with. Once you take all your shots, you are ready to assemble them in Photomatix.

I took all 5 of my frames (which I shot as RAW files), and ran them through Photomatix. Here, you can tweak the settings to get the desired results, which after you play around with them a bit, you can get the hang of just what they do and how they affect the output.

To learn more about how to use the software, here is a great tutorial on HDR photography that will explain everything. So the next time you want to try something new, give HDR a try, for once you see it’s powers, you will be addicted for life!

We’ll start with the shot with just one exposure:

And here are the five frames used to generate the HDR:

And here is the final image, produced in Photomatix:

(Another link here.)

There’s no special photoshopping going on here. Other than some small modification to the clouds (to compensate for their movement during the shot), it’s just Photomatix doing the work. It makes my playing around with Photomatix look infantile.

Robert also took some other great pics on the same day:

Incidentally, Robert did teach me one trick which has made me (a rank amateur) a much better photographer. I have a Canon Rebel XTi, and he taught me to simply shoot in Aperture Priority Mode (AV mode), playing with the ISO settings to compensate for light. It’s a wonderful trick that will enable you to consistently take great pictures, without worrying yourself over a lot of the technical details. It works for well over 90% of the pictures you might take.

And shifting off on a slight tangent — I like my Rebel XTi, but one camera I seriously considered when I was shopping last year (again, as a rank amateur) was the Nikon D40. I found out recently that Nikon’s ad agency, McKann Erickson, gave out 200 D40s to the residents of Georgetown, South Carolina and then put the results up on a website. It’s a great piece of PR (I’m not recommending one camera over another, I just found the effort interesting).

Finally, I hope all of you had a wonderful holiday!

Alex Eckelberry

I’m sure you all know by now that there’s a storm out there.

And some new malware sites recently popped up very recently:

Rogue antispyware pushers:

gatemc(dot) com

Sample: gatemc(dot)com/gatevc(dot)php?id=icn02 redirects to push the fake trojan VirusRanger:

gatedl(dot)com

Sample: gatedl(dot)com/gatech(dot)php?pn=srch0p23total7s2 redirects to push various trojans, made to look convincingly like a Windows dialog box:

Also, add protectionalerts(dot)com (sample at protectionalerts(dot)com/2/01-byu8kl/xp/index(dot)php) and ahomepcsafety(dot)com as new fake security scam pages.

And another new site, toolbaractivity(dot)com pushes fake antispyware (sample: toolbaractivity(dot)com/go.php?step=1, resolves to rdr(dot)hitmngr(dot)com/accs=147 and step=2 resolves to antispyshield(dot)com/advid=177)

Fake codecs:

avsmanufacture(dot)com (sample avsmanufacture(dot)com/download(dot)php?id=4075)
sysprocedure(dot)com (sample: sysprocedure(dot)com/download(dot)php?id=1737)

Fake 404 page:

dnserrortool.com (examples have been observed at either dnserrortool.com/ie6/ dnserrortool.com/ie7).

Please don’t go downloading and playing with these trojans unless you know what you’re doing. They’re real and quite dangerous.

Alex Eckelberry
(Thanks to Patrick Jordan)

Here.  (And just a clarification — the review mentions an antivirus engine built-in to CounterSpy.  In fact, the AV engine in CounterSpy is very basic, and is primarily used to improve the antispyware functionality of CounterSpy.  However, we are releasing our standalone AV product in Q1, called VIPRE, which will include all the functionality of CounterSpy but have full AV protection as well.   It will be a very inexpensive upgrade for any CounterSpy user.)

Alex Eckelberry

Seems every time I mention a security vendor bundling with Ask, I get a comment storm. Well, that’s good. This is a important issue and is worthy of debate.

I find the various arguments and statements quite interesting. There’s a lot of passion out there on this issue. You can see the latest storm here. here. Feel free to add your two cents.

Alex Eckelberry

First one, now another. Is this a trend? And what’s with pre-checking this option?

(You can see a post by a user on ZA’s forum here.)

Feel free to leave your comments as to what you think of this (let’s hope it’s not as rowdy as the last time).

Alex Eckelberry
(Thanks Suzi)

Clarification: This is not the full Ask Toolbar. It’s a subset which only offers the pop-up blocking. Nevertheless, you still get the Ask Searchbar, and it is pre-checked prior to install.

codecnice(dot)net:

Pushes both Windows and Mac Trojan.DNSChanger. Sample binaries: Mac: codecnice(dot)net/download/codecnice1126.(dot)dmg. Windows: codecnice(dot)net/download/codecnice1126.(dot)exe.

Not so nice . . .

As always, please don’t touch these binaries unless you know what you’re doing as they are live Trojans.

Adam Thomas

If you enjoy a bit of irony, have a gander at the Amazon.co.uk reviews (and comments) on the inexpensive Bic Crystal ballpoint pen. It seems some writers (British and non) are having a bit of fun with this trusty implement.

Some selections:

Very good if you need to write on paper.

Writes well – but it’s unmusical

A sad disappointment (it doesn’t have an inkwell)

A good product, but instructions could be clearer.

And, of course, a limerick and a poem.

Alex Eckelberry
(Hat tip to John Murrell)

(See update below.)

An article today on InfoWorld, entitled “Don’t be a phishing vigilante”, casts a bright light on Cyveillance (a firm which does consulting for banks, etc. on security).

The article indirectly slams PIRT, the CastleCops-founded group which does takedown of phishing sites.

While there have been some funny examples of people who have gone to great lengths to hoodwink phishers and other online fraudsters — and some people have even turned the pursuit into a full-time hobby, new research shows that playing games with the cyber-thieves just might not be a good idea.

Note that “full-time hobby” points to Castlecops.

The idea that a group like PIRT is some type of “hobby” is more than false, it’s actually a bit heartbreaking when I think of the thousands of hours of volunteer work done by vetted security professionals at PIRT, who do takedowns everyday, and have saved millions of dollars for consumers. People like Gary Warner, who certainly has earned his chops as a security professional. Or Robin and Paul Laudanski, the founders of PIRT, who are both highly regarded Microsoft Security MVPs. While I’m no longer an active part of PIRT, I feel quite protective of the volunteers there — who are amazing given the level of profesionalism of their work and the fact that it’s all done out of a passion for helping people (for no monetary gain).

I agree that phishing termination (or even going to a phishing site) should only be done by people who know what they’re doing. There is a real danger going to these sites, because of exploits and malware. But to put a broad stroke on it only serves the for-profit vendor highlighted in this blog.

I have a lot of respect for Cyveillance, as well as the article’s authors, Victor Garza and Matt Hines. Hopefully, this is only a misunderstanding.

Feel free to post your comments on their blog.

Alex Eckelberry

Update:

Got this from our friends at Cyveillance (edited for brevity):

The interview focused on individual consumers who find it humorous to provide bogus information to phishing sites…The point of the story was that these individuals could actually expose themselves to malware simply by accessing the site.

Cyveillance strongly supports the role of CastleCops in the battle against phishing and online crime.

And Matt Hines posts a nice clarification on his blog:

OK, I’ve been getting some feedback re the link to CastleCops and feel the need to clarify a bit.

I really only included the link to their site because they’re the best example of an organized group going about this sort of infiltration and takedown approach to fighting phishing.

To be fair, it is far from a “hobbyist” operation. More like it is made up of
real IT sec pros who want to help take out some of the baddies in their free
time, which is a really cool effort in general.

The post itself was aimed more at individual consumers who seem to feel that
they can frustrate the phishers by filling out their forms with curses and the
like, but who are getting infected by drive-bys (as highlighted in the
advice/research of Cyveillance).

My intent was not at all to discourage CastleCops or take anything away from
what they do, I personally think it is a really admirable and cool thing that
they do.. so, I’m pulling the link and apologize to any of the fine people
involved with CasteCops, again, my intent was not to detract from or discourage
their efforts (or imply that Cyveillance had done so).

Thanks, and sorry for the confusion! (it’s good to know people are actually
clicking on those links though!)

Rock on CastleCops!

Matt Hines

Looks like we’re all good now. And thanks to Cyveillance and Matt Hines for the clarifications!

codecpretty(dot)net

Pushes both Windows and Mac TrojanDNSChanger. Sample binaries: Mac: codecpretty(dot)net/download/codecpretty1123(dot)dmg. Windows: codecpretty(dot)net/download/codecpretty1123.(dot)xe. And please — don’t touch these binaries unless you know what you’re doing, as they are live Trojans.

Alex Eckelberry
(Thanks Adam Thomas)