Race to zero

You’ve probably heard of Race to Zero (if not, you can get the concept here).

It has not been the most popular thing in the security industry. Eugene Kaspersky (one of the most respected individuals in the industry) was downright vehement against it, as others have been. On the other hand, Virus Bulletin ran an online survey and found that many, in fact, rather like the idea.

Today, another highly respected name in the space, Randy Abrams, weighed in eloquently on the issue:

So what does all of this have to do with the “Race to Zero” and other such ignorant projects? It is not the antivirus companies who are complaining. It is not the sales or marketing departments who are complaining. The PR firms are silent on this. It is the research community who are complaining. It has nothing to do with “embarrassing” an antivirus company. The people who are complaining are the people who are actually trying to do something about the problem. The people who are complaining are the people who will openly acknowledge the limitations of security products and staunchly promote defense in depth. These people also sign their real names to what they say and do not hide behind pseudonyms. We are proud of what we have to say and will openly say exactly who we are.

Link here.

Alex Eckelberry

Evolution of phishing — embedded forms

A new type of phish, which uses a form embedded in the email.

Paypal12388

This makes things easier: No phishing site to have to maintain. No browser-based phishing filters to worry about.

This particular one posts to a account hosted in California. (The images are all pulled from PayPal, like this one, always a source of annoyance.)

(Clarification: I’m not saying this hasn’t been done before — it has. But it’s not common to see these, and also, what I’ve seen in the past doesn’t neccessarily have the sophistication of this phish.)

Alex Eckelberry

Ed Bott weighs in on UAC

With Windows 7 on the roadmap, it would be a great opportunity for Microsoft to tweak UAC so that it actually makes sense. Personally, I think it’s vital from a standpoint of security.

Ed Bott over at ZDNet weighs in on the issue.

“I was all prepared to lay out my modest proposal for how Microsoft should tweak UAC in Windows 7. And then I said, “Hey, wait a minute! I already did this.”

And sure enough, with a little help from Google I was able to reread “How Microsoft can save User Account Control.” which I wrote way back in May 2006, while Vista was still in beta. In that post, I offered four “suggestions that might ease the pain” of UAC. Two years later, I think those recommendations are still valid, so I’m reprinting them here, with a little updated commentary on each one:”

Link here.

Alex Eckelbery

Some recent oddball spams

Amidst a sea of Cialis ads, “enlargement” products, luxury watches and various malware scams, there is the occasional spam that truly leaves us scratching our heads. I figured I’d highlight a couple of them recently seen in our honeypots.

Over-achieving parent department: This spam asks only that you vote for a baby. There’s a cute baby contest over at SkyRadio in the Netherlands, and this person wants their baby to get the most votes.

Cute baby. But what a way to garner votes…

Voteformybaby12388

(In the spam, there’s also a picture of the baby included.)

Darn, I’m low on my Cialis inventory, what else can I sell… Now we’ve seen it all: A spam selling feminine napkin products.

Feminienapkins

Yes, that’s right. Feminine napkins.

Truly bizarre.

Alex Eckelberry

Microsoft: What we got here is a failure to communicate

Some men, you just can’t reach: Microsoft says that a large problem with Vista is lack of understanding of key features (via Donna). Failuretocommunicate1238188

These are:

“• User Account Control – A key goal of UAC in Windows Vista is to help nudge Independent Software Vendors towards designing applications that function in standard user mode. One reason this feature is misunderstood is because UAC isn’t a single feature; it’s a set of technologies to help end users run with standard user privileges, and reserves Local Administrator privileges for IT staff or limited specific circumstances.

• Image management – Few people relish change, especially when it comes to getting their jobs done. For IT Professionals managing the image creation and deployment process, Windows Vista represents some significant changes over Windows XP, and image management is an area where Windows Vista provides the most benefit for implementation. The goal of the architectural change is to simplify the image creation and management process, but this does involve a few differences and tradeoffs.

• Display Driver Model – One trade off of the Aero interface is that it requires a graphics processing unit (GPU) that supports the Display Driver Model, and has dedicated memory on the graphics card. PCs with an integrated graphics card may not support the Aero visual interface. However, the stability and performance advantages of WDDM are available independent of Aero. NOTE: PCs that are not up to the hardware requirements for Windows Vista should be operated in “Basic” mode with Aero turned off.

• Search – One of the most significant improvements in Windows Vista is the ability to rapidly search all the files on the desktop, whether they reside in folders, as an email attachment, or somewhere else on the PC. Search does require that the system index file locations so they can be quickly retrieved at will, though the approach taken by Windows Vista should not interfere with system performance while in use.

• 64 bit architecture – 64-bit computing is definitely the direction of the future, and its primary advantage over 32-bit computing is in access to system memory. The 32-bit edition of Windows is Vista limited to 4GB of memory, and depending on the devices present, can access between 2 and 3.5 GB of “user available” memory. In contrast, the Business, Enterprise and Ultimate editions of 64-bit Windows Vista can access 128GB of memory. An important consideration, however, is when and how a user should install Windows Vista in 64-bit (x64) over 32-bit (x86). For mainstream consumers and businesses, Windows Vista x86 will be the preferred operating system for the next couple of years.

Each of feature has specific benefits for desktop (and laptop) management, but they also make adoption a bit tougher since they affect two key areas: application compatibility and hardware performance. This article explains the rationale behind these features, shows how they actually make PC administration more controllable and robust, and provides guidance and tips to make them easier to work with.”

(Full document PDF link here.)

Ok, putting aside my typical insouciance (and a good reason for Microsoft to once again reject my MVP nomination), Microsoft does have some valid points here. However, UAC could certainly have been handled better. It does something the security industry has been well aware of for a long time — it creates the “cry wolf” problem of popup fatigue (people turn off or ignore the popups after awhile). Vista is more secure than XP, despite what others might say, but it still gets infected. Since over 80% of all infections are based on social engineering, the popups should focus on that weak point. If UAC targeted the key areas where people run into trouble (as opposed to harrasing the user on inane actions), it would be far more helpful and potentially make a really significant impact on infection rates. This would be the subject of a far longer and more intellectual blog post than I care to get into right now, so I’ll let someone else go through that rationale if they are motivated in that direction.

I also think that the Microsoft marketing folks were really not cool in their approach to licensing, doing the old IBM trick of leaving features in but disabling them depending on your license — and charging big dollars to get incremental additional features. I bought a Home Premium Vista system for my wife, and couldn’t TS into it, because TS isn’t supported unless you buy Ultimate (so I had to run a silly hack, which is frustrating when the functionality is right there in the OS). If you want to know something that really upsets off techies, it’s this kind of stuff. And it doesn’t help with that whole adoption thing we all learn about in high tech marketing.

If you want to win in markets, give the customer more than they paid for — don’t nickel and dime them. Simple trick, works wonders. Really, this is a key business axiom, it’s not just fluffy happy stuff.

I personally find running Vista frustrating, but then again, I haven’t delved into it with any great vigor. I’m also a UI luddite — the first thing I do on any system — XP or Vista, is put the start menu back to classic, all the folders back to classic, etc. (I’d still be running DOS with DESQview if I could). So I took the easy way out — I simply downloaded Oddbasket’s XP Vista Pack and I fake the Vista experience.

Alex Eckelberry
(Incidentally, we recently started a free newsletter on Vista, and you can subscribe here.)

Zango responds to Ben Edelman

Well, well.

“Taking a Memorial Day weekend break from his day job as “an assistant professor at the Harvard Business School in the Negotiation, Organizations & Markets unit,” Ben Edelman devotes hundreds of online words to “a man’s naked buttocks,” all glimpses of Angelina Jolie – gasp!, and prank phone calls by a pair of Canadian disc jockeys.

All of this entertainment content and more is available at Zango.com. That apparently irks Edelman, although the “why” is much less obvious – even after reading his “research.” Here are the facts about our business. Zango licenses and aggregates online entertainment content from approximately 100 different content providers. Edelman does not – thankfully – review our legal agreements relating to the licensing and use of that content. More to the immediate point, however, he does not let that lack of knowledge get in the way of biased, unqualified blogging.

Like all companies our size and larger in the online entertainment space, we make every effort to abide by the Digital Millennium Copyright Act (DMCA) provisions regarding copyright infringement claims. We occasionally do receive copyright-related inquiries about content available at Zango.com and via our syndication platform. In each and every instance, we investigate those claims quickly and resolve them on a case-by-case basis, in accordance with the DMCA and its safe harbor. That job starts with the hard work of our content licensing specialists, who have secured permission to utilize the content available to Zango users on our site and via our platform.

Edelman does not like our business model or our content. He never has liked our model, and he probably never will. We’re fine with that, in large part because millions of consumers every day, month after month, year after year, accept the value proposition and do enjoy the content. But what are a few million happy folks amongst “friends”?

On that score, one thing can be said for certain: consumers enjoy Zango a lot more than they do Edelman’s content offerings, at least according to a recent comparison of Alexa rankings. In case you can’t see it, the barely visible line in dark red at the bottom of the chart is his traffic; the dark blue line at the top is Zango’s. And, for the sake of comparison, the olive green line in the middle depicts our partner Revver’s traffic.”

Link here.

Ben made a comment in response to this:

Interestingly, Zango does not respond to my demonstration of Zango showing explicit content unrequested.

But Zango does claim that its staff “have secured permission to utilize the content available to Zango users on our site and via our platform.” Sounds like it’s time to contact more rights-holders — Fox, HBO, Comedy Central, Playboy, etc. — to see whether they agree that Zango has in fact “secured permission” to use their works.

Alex Eckelberry

Update on Flash situation

Symantec just revised their thinking, believing it may not be a zero-day threat.    

The DeepSight ThreatCon currently at Level 2 in response to the discovery of in-the-wild exploitation of a vulnerability affecting Adobe Flash Player. The flaw occurs when processing a malicious SWF file.

Originally it was believed that this issue was unpatched and unknown, but further technical analysis has revealed that it is very similar to the previously reported Adobe Flash Player Multimedia File Remote Buffer Overflow Vulnerability (BID 28695), discovered by Mark Dowd of IBM. However, we are working with Adobe to identify the precise details, because we have observed the malicious files affecting patched versions of Flash, suggesting that it may be a variant or may have been incorrectly patched.

We have begun to observe numerous attacks. The original attacks observed involve two Chinese sites known to be hosting exploits for this flaw: wuqing17173.cn and woai117.cn. The sites appear to be exploiting the same flaw, but are using different payloads. Further analysis into these attacks, specifically the woai117.cn attack, uncovered another domain involved: dota11.cn. We have discovered that this site is being actively injected into sites through what is likely SQL-injection vulnerabilities.

A Google search reports approximately 20,000 web pages (not necessarily distinct servers or domains) injected with a script redirecting users to this malicious site. Other reports are suggesting upwards of 250,000 affected pages. A new attack, involving the play0nlnie.com domain, was recently reported. This attack works slightly differently and appears to be more sophisticated. The attack uses multiple layers of SWF redirection and generates URLs designed to target specific Flash version and browser combinations, supporting both Internet Explorer and Firefox. Symantec currently detects the SWF files as Downloader.Swif.C and the malware associated with these attacks as Infostealer.Gamepass and Trojan, respectively. Network administrators are also advised to blacklist the offending domains to prevent clients from inadvertently being redirected to them.

The following actions are also advised: Avoid browsing to untrustworthy sites. Consider disabling or uninstalling Flash until patches are available. Deploy script-blocking mechanisms, such as NoScript for Firefox, to explicitly prevent SWFs from loading on all but explicitly trusted sites. Temporarily set the kill bit on CLSID d27cdb6e-ae6d-11cf-96b8-444553540000 until patches availability is confirmed. This vulnerability is currently being tracked as: Adobe Flash Player SWF File Unspecified Remote Code Execution Vulnerability (http://www.securityfocus.com/bid/29386)

Alex Eckelbery
(Thanks, Matt)

The long tail of phishing

Phishers are going after all kinds of odd-and-ends these days.  What’s happened is that the big guys (Chase, Bank of America, Paypal, etc.) have been phished to death.  The phishers are looking around for any new stuff.

For quite a while now, they’ve been going after little-known credit unions and other oddball stuff — anything to phish. Just recently, for example, we observed a first — a phish for an ADP card.  

Adp123488234

This is the same with recent Apple phishing campaigns and so on.  They’re running out of material to mine.

Alex Eckelberry

Zero day flash

I’m sure you’ve all been bombarded with information about this new Flash zero day threat.

It is serious, as there is no known patch available from Adobe, and no known workaround.  What’s happened is that hackers, using SQL injection, have hacked a large number of sites to redirect to a malicious SWF file, which has a PDF exploit in it.

Useful links:

Security Focus
Dancho Danchev
Sans
Secunia

Alex Eckelberry

Zango

Ben Edelman’s report today on Zango is well worth reviewing.  Basically:

  • Questions about whether Zango has actually paid for its material.
  • Widespread sexually-explicit material.
  • Vast amounts of content that is freely available elsewhere, at no charge.

If you’re not familiar with the backstory, it goes something like this:  Zango, unable to justify installations through drive-by downloads and the like through affiliates, needed to offer some “value” in exchange for their adware.  The plan was their so-called “content economy”, where they would provide content in exchange for your system becoming a Zango advertising kiosk.

If the content, however, is relatively useless, it becomes questionable what value is being received.

Alex Eckelberry

Fresh new rogue antispyware programs

Some to avoid…

IP and domain:

66.199.252.162 antivirus-scanonline.com
64.92.174.68 vipantiscanner.com
64.92.174.68 vipantisetup.net
64.92.174.68 vipantispy.com
64.92.174.68 vipantispyware.com
72.233.62.16 spywareiso2008.com
72.233.62.20 si-install.net
Not Active easyfindsystem.com
72.233.62.17 spywareisopro.com
72.233.62.18 spywareisoscanner.com
72.233.62.19 spywareisodownload.com
72.233.62.21 waytoprotect.com
72.233.62.22 spywarequarantine.com
72.36.198.3 xpprotectionsoftware.com
72.36.198.5 drivemyclick.com
72.233.81.234 xpdownloadcenter.com
62.176.16.161 antivirus2008pro.info
62.176.16.161 sextubecodec93.com
62.176.16.161 antivirus-2008-pro.com
62.176.16.161 antivirus-2008-pro.info
62.176.16.161 antivirus-2008-pro.net
62.176.16.161 antivirus-2008-pro.org
62.176.16.161 antivirus-2008pro.com
62.176.16.161 antivirus-2008pro.net
62.176.16.161 antivirus-2008pro.org
62.176.16.161 antivirus-2008pro.org
62.176.16.161 antivirus2008pro.info
62.176.16.161 antivirus2008pro.net
62.176.16.161 antivirus2008pro.org
62.176.16.161 antivirus-2008pro.name
85.255.119.92 ebtadejfqm.com
85.255.119.93 ehagvzyfrt.com
85.255.119.92 eaelzkkodp.com

Alex Eckelberry
(Thanks, Patrick Jordan)

Another hack to keep an eye on

There’s plenty of word these days about SQL injection (Dancho Danchev’s blog is an excellent reference on this trend). Add another one to the list, a fairly extensive cross site scripting hack currently in action, pushing porn, and ultimately malware.

The images displayed are extremely graphic in content. When an image is clicked, the user is redirected to a site pushing a fake antispyware program.

Xss238823488

Xss238823488aa

Xss238823488b

Searching Google for the term “href=//imagesoap” pulls up a large number of results. (Warning: the results returned are highly graphic in content, and do lead to malware.)

Xssgooglesearch1238

Sites observed as infected include:

faa.org
movieweb.com
finlayongovernance.com
exmoorcastingsupplies.co.uk
interbrand.com
montecarlofans.com
ceiling-fans.biz
paxworld.com
travelandleisure.com
flexexamples.com
venganza.org
killerfrog.com

And plenty more.

Alex Eckelberry
(Thanks Francesco and Adam)

More spoofed sites

With thanks to Xavier for the help, here’s a quick follow up to my earlier posts here, here and here about the Vladzone malware gang spoofing legitimate sites.

We have more sites masquerading as legitimate ones. The following are run by the same group:

IP 207.226.177.244
Attrezzi biz
Foltax com
Master-x info
Siriusinter net
Slimcash com
Trasferimento biz

IP 209.8.151.190
Adslim com
Awmdev com
Gunbrethren com
Literaryaccess com
Nzpr com
Rosewedding net
Squareonerecords com
Tocsite com

And, one errant site, not necessarily Vladzone:

IP 216.255.179.140
dorifora com

Alex Eckelberry

Tough life in Florida

Today our friends at F-Secure posted pictures of their office during the winter and summer.  Same shot, same location, but dramatically different weather.

We do feel a great deal of empathy with them.

For example, like F-Secure, we took a shot of a local scene in the middle of winter:

Rjla_tampabay0814

Here is that exact same shot, only this time, taken during the summer:

Rjla_tampabay0814

It’s tough.  But we’re survivors.

Did I mention we’re hiring?

Alex

Yes, Haloscan is borked, and I don’t know why

A number of active commenters on this blog have noticed that Haloscan comments are being treated strangely. I have no idea what’s going on.  PG is seeing the same thing.

Hopefully it will fix soon.  Otherwise I’m going to have to do some serious re-plumbing (which I really don’t want to do…).

Alex Eckelberry

Lifelock CEO pwned

TODDEPICFAIL

Todd Davis has dared criminals for two years to try stealing his identity: Ads for his fraud-prevention company, LifeLock, even offer his Social Security number next to his smiling mug.

Now, Lifelock customers in Maryland, New Jersey and West Virginia are suing Davis, claiming his service didn’t work as promised and he knew it wouldn’t, because the service had failed even him.

Article link here.

Whatever. Incidentally, if you’re curious about these services, Dan Tynan did a good writeup recently, here. Also, the Fraudwar blog routinely writes on this area, and it’s worth putting into your feed if you have an interest in the subject.

Alex Eckelberry
(Thanks, Richard)