Category: Uncategorized

Sunbelt and Aberdeen Webinar April 16th

We’re hosting a complimentary webinar in conjunction with The Aberdeen Group on Thursday, April 16th at 2 p.m. EDT entitled, “Why Small Businesses Should Think Outside the Box When Choosing Endpoint Security Solutions.” The webinar will present fact-based research that underscores the idea that “bigger isn’t necessarily better” for small enterprises when it comes to selecting an antivirus vendor to protect an organization’s network.

For more information on the webinar read the press release.
To attend, register here.

That email from a friend may not be real at all

You may have recently received an email from someone you know, telling them to send you money because of an emergency, or to tell you about a new shopping site.

Well, people’s email accounts get hacked, and then their whole address book is spammed with various junk.

Here’s one I received today from a friend, whose hotmail account was hacked:

Shopping238888

Worse, here’s one I received from a friend, who forwarded it from a friend, thinking it was a really his personal message about a great new shopping site:

Shopping238888a

And here’s an email I received from someone whose hotmail account was hacked, requesting money.

Shopping238888b

Always feel free to ask… “did you send this email to me?”

Alex Eckelberry

Bizarre 419 scam letter

I think this one takes the cake.

From: FEDERAL BUREAU OF INVESTIGATION [mailto:fbisecuritydeptoffice@org]
Sent: Tuesday, April 07, 2009 9:40 AM
Subject: FEDERAL BUREAU OF INVESTIGATION HELP STOP SCAMS ON INTERNET

Federal Bureau of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001, USA

FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE INTERNET

The Federal Bureau of Investigation (F.B.I) write to you in correspondence to the meeting we recently had with the Federal Republic of Nigeria Government on the ERADICATION of SCAMS on the internet, Federal Bureau of Investigation
(FBI) Washington, DC in conjunction with some other relevant Investigation Agencies like Internal Revenue Service here in the United states of America have recently been informed through our Global intelligence monitoring network that you presently have a transaction with the Central Bank of Nigeria (CBN) as regards to your over-due contract payment which was fully endorsed in your favor accordingly.

After the meeting held on Monday 31st March 2009 at the Bank Auditorium Center , the whole conflict of SCAMS was revealed to us by the Board of Truste of Federal Republic of Nigeria mostly by the three arms of Government.

(The Judiciary, the Legislature and the Executive).

These three arms of Government has made us realize that the rampad of SCAMS over floating around the United State of America and some other part of the world was been set up by the root of some CBN Ex-Workers that have been suspended for sometimes due to their dubious characters of initiating people to impersonate the Government Workers to receive peoples hard earn money from them, mostly with the Executive Governor identity.

For these reasons, the Central Bank Executive Governor was invited to this office to defend the allegation against Him while he made complain that his office was not in charge of foreign transfer of funds, that the accredited office was Federal Ministry of Finance Department (FEDMINAP) in person of (Rev.Paul Badmus) as the Accountant General in charge of all foreign transfer payment files.

They also told us that the only problem they are facing right now is that some unscrupulous element are using this project as an avenue to scam innocent people off their hard earned money by impersonating the Executive Governor that is why the Federal Government has appoint Rev. Paul Badmus as the Payment Director of the Central Bank office.

The Federal government of Nigeria has approved that all overdue outstanding payments must be Paid on OR before 25th, April 2009, for the preparation of their next category to be paid which might leads to recalling of funds back to the Bank Treasury.

Meanwhile, we are also informed that a Man with an America passport number
(3028882234) came to the Central Bank affiliated bank office in U.K few days ago with a letter, claiming to be your true representative.

Here are the man informations bellow:

Name: Denis Marion
Bank Name: City Bank
Bank Address: Arizona, USA
Account Number: 6503809008.

INSTRUCTION/WARNING FROM ROBERT S. MUELLER III.

NB: You are urgently advised to please reconfirm the following to the Office of the Accountant General, as a matter of urgency if this Man is from you so that this office will not issue your fund and be held responsible, If this man isn’t of your true representative, you are requested to contact for your inheritance claim valued of US$12,500,000.00M (Twelve Million, Five hundred thousand United States Dollars)only will be remitted into your nominated bank account.

1) Your full name.
2) Phone, fax and mobile #.
3) Residential address.
4) Company name, Office position and Company address.
5) Profession, Age and marital status.
6) Working I’d / Int’l passport.

And should incase you are already dealing with anybody or office claiming to be from the Central Bank of Nigeria, you are further advised to STOP further contact with in person from africa in your best interest and then contact immediately the real office of the Central Bank of Nigeria (CBN) only with the below information’s accordingly:

NAME: REV. PAUL BADMUS
OFFICE ADDRESS: Central Bank of Nigeria,
Central Business District,
Cadastral Zone,
Abuja, Federal Capital Territory,
Nigeria.

TEL: 001234-01-4328033
0012347032032230

Email: paulbadmus_desk@live.com

IMPORTANT NOTICE.

Note: we are on investigation and security watch over any message with Central Bank, to benefit the satisfaction of all the United States Citizen by seeking to wiretap scams on the internet with the help of Nigeria Government and also with the assistance of all United states Citizen, by listening to the instructions we give out to avoid falling for SCAMS on INTERNET.

All modalities has already been worked out even before you were contacted and note that we will be monitoring all your dealings with them as you proceed so you don’t have anything to worry about, All we require from you henceforth is an update so as to enable us be on track with you and the Central Bank of Nigeria, without wasting much time, will want you to contact them immediately with the above email address so as to enable them attend to your case accordingly without any further delay as time is already running out.

Should in case you need any more information’s in regards to this notification, be free to get back to us so that we can brief you more as we are here to guide you during and after this project has been completely perfected and you have received your contract fund as stated.

Thank you very much for your co-operation in advance as we earnestly await your urgent response to this matter.

Best Regards,

Robert S. Mueller III
Federal Bureau of Investigation
J. Edgar Hoover Building
935 Pennsylvania Avenue, NW Washington, D.C. 20535-0001, USA internet.securitys_federalbureauofinvestigation@live.com

(Thanks to Jeff)

Alex Eckelberry

Bots that destroy the operating system

Ugly.

This time we are taking a close look about what things could happen with an infected computer when the running bot receives an specific command about to kill the Operating System. Not all type of bots usually have this functionality, but banking Trojans usually have. We will take three examples (InfoStealer, Zeus/Zbot and Nethell/Ambler), these are the most common Trojans where we’ve definitely found in their binaries the malicious code that is responsible for the Execution of Windows.

Link.

Alex Eckelberry

Another online multi-scanning site

Our friends at Opswat have a new online scanner site, filterbit.com, currently in beta.  Using Filterbit, you can upload a file and get results from 9 different scanners. 

Filterbit is another site available to users, security researchers, administrators and the curious to upload files to see if they’re detected.  This activity is an increasingly popular trend at places like Virustotal.com, Jotti, and Virscan.

Alex Eckelberry

Another miscarriage of justice?

This is worrisome. Marist College Professor James D. Kent stands accused of having porn on his system.

I don’t know anything about the case, but this statement is flat-out false:

Under questioning by Kent’s attorney, D. James O’Neil, Investigator Barry Friedman said he had found evidence of some viruses, so-called “trojans” and other unwanted software on Kent’s computer when he analyzed its hard drive at the state police Forensic Investigation Center in Albany. The placement of a “trojan” on a computer makes it easier for other kinds of potentially harmful viruses to find ways to attach themselves to a computer, Friedman explained.

Under questioning by Senior Assistant District Attorney Marjorie Smith, however, Friedman said none of the viruses or “trojans” he found on Kent’s computer would have enabled someone to download, sort or file the more than 60,000 images of children in provocative poses discovered on the computer.

“No known virus is capable of doing those things,” Friedman testified. [emphasis mine]

That’s simply not true (assuming that Friedman’s use of the term “virus” is the common misuse, to refer to any malware). I even posted a video on YouTube a while back showing a situation where porn was displayed automatically on a user’s system.

Let’s hope this is not another miscarriage of justice.

Alex Eckelberry
(thanks to IDG’s Robert McMillan for sharing the link)

10/21/2010 Update here.

Please, the world is NOT ending on April 1

Some people are getting hysterical about Conficker’s deadly payload on April 1. 60 Minutes’ infomercial for Symantec special didn’t help, either.

Relax.

Randy Abrams at ESET does a nice job of explaining the situation:

Yeah, Conficker is a serious problem, but not for home and corporate users who employ best practices already. The real problem is for the security professionals trying to prevent the worm from impacting the millions of people who fail to learn anything about security.

So, you still want to protect against Conficker? Here is what to do. Make sure that the Windows Security center is functioning and you are up to date on your Microsoft security patches. You can go to http://update.microsoft.com to manually check for updates. Make sure you’re antivirus product is up to date. Your antivirus product should be tested by Virus Bulletin (www.virusbtn.com) and/or certified by ICSA Labs, or have West Coast Labs Checkmark certification. Send me an email at askeset@eset.com if you need help determining this. Exercise caution in what websites you visit and never open attachments unless you have verified that you know the person who sent them and that they really meant to send the attachment and that they also know what it is. These instructions are not specifically for Conficker, this is simply part of how you protect against all of the threats out there.

In other words, all that happens on April 1 is that Conficker’s next stage goes into place on already infected systems. This does not mean masses of new users will be infected. This seems to be the confusion.

As you know, the Conficker worm takes advantage of a vulnerability in Windows that Microsoft fixed in October of last year. If a machine is patched with this update from Microsoft, then that system cannot get infected by Conficker.

The reason some people are getting infected by Conficker is because their system(s) are unpatched. Or, they are patched, but are joined to a network where there is a computer that isn’t patched, in which case Conficker typically hops from a network share onto the local box when logging in with a domain admin account.

Nevertheless, Conficker is being really hyped as something terrifying on April 1. It’s true that “something” will happen on April 1, but you need to be infected first with the worm for this event to affect you. If you’re not infected, nothing will happen. And as Joe Stewart says, if you’re reading his blog page, you’re probably not infected (because Conficker targets his site).

So, just make sure your system is updated with the latest updates from Microsoft, and keep your antivirus software updated.

If you’re worried in general about vulnerabilities in your computer, you can always go run the free inspection tool at Secunia.com. It will tell you what programs on your computer need to be updated.

You can also run the free Sunbelt Conficker scanning tool here.

Alex Eckelberry

Ghostnet

By now, most of you have read about the massive spy operation allegedly being run from China. Researchers from Cambridge and the University of Toronto worked jointly on the investigation, dubbing the spy operation “Ghostnet”.  

It’s a big deal.  Sadly, it’s not surprising.

I’ve posted the full, Cambridge-Toronto collaborative report here (pdf).  Separately, Dr. Shishir Nagaraja and Ross Anderson at Cambridge have written a summary, available here. 

Worth reading.

Alex Eckelberry
(Thanks to Les Bell and Paul Ferguson for hunting these down.)

The RealAge privacy issue

From the NY Times today:

“Americans yearn to be young. So it is little wonder that RealAge, which promises to help shave years off your age, has become one of the most popular tests on the Internet.

According to RealAge, more than 27 million people have taken the test, which asks 150 or so questions about lifestyle and family history to assign a “biological age,” how young or old your habits make you. Then, RealAge makes recommendations on how to get “younger,” like taking multivitamins, eating breakfast and flossing your teeth. Nine million of those people have signed up to become RealAge members.

But while RealAge promotes better living through nonmedical solutions, the site makes its money by selling better living through drugs. “

As Sunbelt’s Eric Howes says, “Not all online privacy threats come in the form of malware/adware/spyware. And it is still true that one of the easiest ways to get people to do things they would not normally do (e.g., cough up sensitive medical history data) is to construct an appeal to fear or vanity, or both.”

Alex Eckelberry

Doing a Thoreau — unplugging from the grid

Wayne Porter, a good friend and Microsoft Security MVP, decided to unplug for six months.

All experiments must come to an end or so they say. I have spent the last six months on an interesting pilgrimmage. During four of those six months I completely “unplugged” from the grid. No e-mail, No Web, No Net, No cell phone- Nothing…I explored nature, toured back alley graffiti covered alleys controlled by gangs, explored hollows, talked to a wide-range of people and had a host of other adventures. Most of the time I simply thought about things. Exactly where am I going and why?

Yikes.  I could not survive this long without being connected.   

Anyway, he’s back now, and is blogging again. 

Alex Eckelberry

Nasty little Twitter hack

Something our friend Lance James came up with: 

Computer security researchers have devised a new Twitter attack that they say could spread virally, much like a worm on the microblogging service.

The attack, posted online Thursday by researchers at Secure Science is an innocuous proof of concept that forces users to send out a predetermined twitter message, but it could be repurposed into a very nasty worm, said Lance James, chief scientist with Secure Science.

“You can couple an attack with our code and it would just tear the crap out of Twitter,” he said.

Link here.

Alex Eckelberry