Google fixes redirects, now it’s DoubleClick’s turn

On May 25th, we noticed that spammers and malware distributors had moved from using Google redirects, to Doubleclick redirects. 

If you’re tracking this stuff, you’re undoubtedly seeing extensive use of these redirects, like this one:

Doubclickredirect123189

The reason is that Google has done quite a bit to fix the redirect problem, as you can see from this example:

Googleredirect12388

So the party’s just moved on to a different location.  Let’s hope that DoubleClick (err, Google) can fix this soon.  They are aware of the problem.

Alex Eckelberry
(thanks, Adam Thomas)

More on the Apple Safari/Windows blended threat

If you’re a bit confused about the recent Microsoft advisory on the Safari blended threat, you’re probably not the only one.

Microsoft’s advisory speaks of a threat that “allows remote code execution”. However, if you review the work of Nitesh Dhanjani, who discovered the vulnerability, the exploit only allows sites to carpet bomb users with files. So, what remote code execution are they talking about?

According to Aviv Raff, there’s more to the story. It turns out that there is a method to allow remote execution, using Nitesh’s method, as well as a method that Aviv previously reported to Microsoft.

Solution? Don’t use Safari until this is resolved. Easy. (As the chorus of yawns echoes through the Blogosphere.)

Alex Eckelberry

The dirty truth about the Wildlist

Larry Seltzer tells it like it is

Similar points were made by Andreas Marx at his presentation at last year’s Virus Bulletin, “The Wildlist is Dead, Long Live the Wildlist”.

The Wildlist (the primary method of certifying antivirus products) is an anachronism in today’s environment.  That doesn’t mean, however, that all AV engines are crap — far from it.  Despite the constant negativity out there, there are, in fact, some extremely good engines on the market that have kept up with real threats in an admirable fashion. We just need a better method of certification. 

As to the calls about “we need to move to whitelisting because blacklisting is dead”, I don’t agree with these sentiments.  Hopefully I’ll have more time this week to write more on that subject.  

Alex Eckelberry 

Quividi’s spying billboards

 

A story in the New York Times wrote about Quividi, a company that developes technology for billboards to anonymously track the demographics of the viewers.   Now add that on top of the cell phone tracking, CCTVs and all the rest, and you’re going to start having a rather hunted feeling at your local mall.

The video above is from Minority Report, showing the Brave New World of advertising.  The video below is Quividi’s, demonstrating their technology.

 
Alex Eckelberry

Apple’s Safari problem

You’ve probably heard of the current problem with Safari running under Windows. It’s basically a trivial method to “carpet bomb” a users desktop (or other folder) with files.

Now, as far as I can tell, it’s not a way to actually execute code on a user’s system. It merely provides the ability to put tons of files on a system, which could then be executed.

However, according to the Nitesh Dhanjani, who discovered the exploit, Apple believes this is not an issue and won’t be fixing it.

“…the ability to have a preference to “Ask me before downloading anything” is a good suggestion. We can file that as an enhancement request for the Safari team. Please note that we are not treating this as a security issue, but a further measure to raise the bar against unwanted downloads. This will require a review with the Human Interface team. We want to set your expectations that this could take quite a while, if it ever gets incorporated.” [Emphasis mine]

Nitesh goes to great pains to emphasize that Apple has been extremely responsive and a great pleasure to do deal with. And I have no doubt that they have been — Apple is comprised of a great deal of very nice, very smart people.

But maybe they don’t understand the Windows environment, in the broadest sense. They’ve shown they don’t understand the mores of Windows users, by forcing out security updates that include an unrelated application. And maybe they don’t understand our security environment. Perhaps life has been so pleasant in Apple Land that it’s like taking someone from the back-country and throwing them into the hardest areas of New York.

Anyone who has ever seen an infected spyware system knows what the desktop looks like: It’s a sea of icons providing shortcuts to various dubious sites. This method provides exactly that type of capability — a malware author can push all kinds of junk onto a desktop, saying ”Click me for special savings!” and it could very well be malware.

But you’d have to have gone through that to understand how bad a “carpet bomb” can actually be. Perhaps Apple folks have been living in a bubble and simply haven’t seen this thing.

I hope this is fixed soon. Thankfully, Safari’s usage is still under 3%.

Alex Eckelberry

Commodities pricing

Although I’m loathe to admit it, I spent several years in the professional financial markets earlier in my life, but contain myself from commenting on the various financial shenanigans going on in the world (with some exceptions). However, the reason rise in commodity prices and the attendant finger pointing and “solutions” has driven me to at least make a couple of points, because the level of disinformation out there is getting a bit alarming. I spent my time in the equity markets, so I’m by no means a commodities expert. However, it seems to me that there are some fairly straightforward reasons as to why we’re seeing what we’re seeing.

This rise is oil prices is not a permanent problem. It is a speculative bubble. Oil is something that we have lot of historical data on, and it always regresses to the mean, despite one “crisis” after another. There’s also plenty of it, despite what people say otherwise.

There are a number of reasons why oil is going through the roof. Some people are convinced that drilling offshore or in Alaska will solve the immediate problem (it won’t), and some people want the government to “do something about it”, by nationalizing oil, or giving oil tax holidays, or other silliness. These ideas, often spoken with great vituperative zeal, are not the solution to the immediate problem. Both the right and the left are bellowing about various solutions which fit their own agendas, but we need to get past this — food needs to get on the table and we need cheap gas again, before we lose more truckers and airlines.

Putting aside the fact that it’s disappointing from a technological standpoint for a 21st century society to still rely on burning some type of fuel for power, the main reasons why oil has shot through the roof are largely ignored because they are a bit too complex to make into a campaign slogan, or for a radio show host to ignite the fire of his listeners. Start talking about derivates and yield curves to most people, and they start getting sleepy. Start blaming the problem on the other political party or belief, and they brighten up.

The driving forces behind the increase in prices are primarily related to financial reasons, not necessarily supply or demand. Yes, China is competing for our oil, Iraq and Nigeria aren’t producing, yada yada, but that’s not the primary problem. So here goes:

– The decline of the dollar: This is a factor in the current problem: Oil is priced in dollars, and the dollar has declined precipitously. A major aspect of the price increase is the fact that the dollar is crap these days (due to a spiraling budget deficit, the Fed selling lots of dollars at firesale prices, inflation in Europe, etc.). But that’s not going last forever. Also, the dollar has not dropped 80% in the last year to mirror the increase in oil prices. So it is only part of the problem.

Massive inflow of investment. It’s pretty much a first principle that any major influx of capital into a market creates an attendant rise in prices. In the commodities markets, we’ve seen an inflow of dollars by professional funds that is staggering. In the past five years, investment by commodity index funds has gone up almost 20x. The result is obvious: think of tulips, the dot com bubble or the recent real estate bubble. Hence, we have another asset bubble, which we keep getting because of monetary policy — whether it’s the dot com boom, the real estate bubble or the current oil bubble.

It should be noted that it should be of some concern to have commodity markets be anything more than a mechanism to buy and sell tangible and necessary goods. You turn them into investment vehicles, and you’re going to have problems.

– Speculators. Speculation is a healthy dynamic in any market, but unchecked, it creates disaster (think of what happened in 1929). It’s been allowed to go too far, in part because the rules on how much speculators can borrow are too lax. In the stock market, post-depression rules only allow investors to get a loan (margin) on 50% of what they own. The commodities markets are different — you can leverage your money up to 20 times. This was fine in the old days, when places like the Merc was actually there to give Kelloggs or General Foods a place to buy corn or wheat. But now commodities buyers have to complete with day traders and hedge funds.

Fundamentally, you have a problem where commodities markets have turned into major financial investment vehicles, with the not-surprising outcome of inflationary pressure and volatility. Going to Saudi Arabia and begging for more oil does nothing. Oil company executives issuing stern pronouncements that they need to be able to drill in ANWAR is similarly ridiculous. “Huge problems with supply”, “too much demand” and “peak oil” is nonsense: there’s plenty of the stuff out there. Oil prices are on a parabolic bubble-like curve, but actual supply and demand is not parabolic. There is a miss-match in price vs. the actual situation.

These markets are, in principle, simple things, a place where producers and buyers buy and sell commodities. These markets have existed since the dawn of humanity, and the derivatives (futures and options) are simply more sophisticated methods of providing risk management. However, if you throw gunpowder (lots of speculation and lots of extra liquidity) onto a gently burning fire, you’re going to start getting some sparks. It’s not a question of whether or not the markets need to be regulated, but whether or not they are managed. This may require regulation, but it also could be fixed by the various oversight organizations.

As far as the reasons why food is going through the roof, the above explains part of the problem, but it is exacerbated by other problems, and I’ll let someone else jump on that subject.

I believe, like Soros and others, that we’re dealing with a speculative bubble, and that we’ll see oil prices reach some degree of sanity again in the not too distant future — which would free up quite a bit of capital again for economies to start kicking again. It’s also going to seriously burn some investors, but I suspect that there won’t be much sympathy going around when it happens.

Alex Eckelberry

Race to zero

You’ve probably heard of Race to Zero (if not, you can get the concept here).

It has not been the most popular thing in the security industry. Eugene Kaspersky (one of the most respected individuals in the industry) was downright vehement against it, as others have been. On the other hand, Virus Bulletin ran an online survey and found that many, in fact, rather like the idea.

Today, another highly respected name in the space, Randy Abrams, weighed in eloquently on the issue:

So what does all of this have to do with the “Race to Zero” and other such ignorant projects? It is not the antivirus companies who are complaining. It is not the sales or marketing departments who are complaining. The PR firms are silent on this. It is the research community who are complaining. It has nothing to do with “embarrassing” an antivirus company. The people who are complaining are the people who are actually trying to do something about the problem. The people who are complaining are the people who will openly acknowledge the limitations of security products and staunchly promote defense in depth. These people also sign their real names to what they say and do not hide behind pseudonyms. We are proud of what we have to say and will openly say exactly who we are.

Link here.

Alex Eckelberry

Evolution of phishing — embedded forms

A new type of phish, which uses a form embedded in the email.

Paypal12388

This makes things easier: No phishing site to have to maintain. No browser-based phishing filters to worry about.

This particular one posts to a account hosted in California. (The images are all pulled from PayPal, like this one, always a source of annoyance.)

(Clarification: I’m not saying this hasn’t been done before — it has. But it’s not common to see these, and also, what I’ve seen in the past doesn’t neccessarily have the sophistication of this phish.)

Alex Eckelberry

Ed Bott weighs in on UAC

With Windows 7 on the roadmap, it would be a great opportunity for Microsoft to tweak UAC so that it actually makes sense. Personally, I think it’s vital from a standpoint of security.

Ed Bott over at ZDNet weighs in on the issue.

“I was all prepared to lay out my modest proposal for how Microsoft should tweak UAC in Windows 7. And then I said, “Hey, wait a minute! I already did this.”

And sure enough, with a little help from Google I was able to reread “How Microsoft can save User Account Control.” which I wrote way back in May 2006, while Vista was still in beta. In that post, I offered four “suggestions that might ease the pain” of UAC. Two years later, I think those recommendations are still valid, so I’m reprinting them here, with a little updated commentary on each one:”

Link here.

Alex Eckelbery

Some recent oddball spams

Amidst a sea of Cialis ads, “enlargement” products, luxury watches and various malware scams, there is the occasional spam that truly leaves us scratching our heads. I figured I’d highlight a couple of them recently seen in our honeypots.

Over-achieving parent department: This spam asks only that you vote for a baby. There’s a cute baby contest over at SkyRadio in the Netherlands, and this person wants their baby to get the most votes.

Cute baby. But what a way to garner votes…

Voteformybaby12388

(In the spam, there’s also a picture of the baby included.)

Darn, I’m low on my Cialis inventory, what else can I sell… Now we’ve seen it all: A spam selling feminine napkin products.

Feminienapkins

Yes, that’s right. Feminine napkins.

Truly bizarre.

Alex Eckelberry

Microsoft: What we got here is a failure to communicate

Some men, you just can’t reach: Microsoft says that a large problem with Vista is lack of understanding of key features (via Donna). Failuretocommunicate1238188

These are:

“• User Account Control – A key goal of UAC in Windows Vista is to help nudge Independent Software Vendors towards designing applications that function in standard user mode. One reason this feature is misunderstood is because UAC isn’t a single feature; it’s a set of technologies to help end users run with standard user privileges, and reserves Local Administrator privileges for IT staff or limited specific circumstances.

• Image management – Few people relish change, especially when it comes to getting their jobs done. For IT Professionals managing the image creation and deployment process, Windows Vista represents some significant changes over Windows XP, and image management is an area where Windows Vista provides the most benefit for implementation. The goal of the architectural change is to simplify the image creation and management process, but this does involve a few differences and tradeoffs.

• Display Driver Model – One trade off of the Aero interface is that it requires a graphics processing unit (GPU) that supports the Display Driver Model, and has dedicated memory on the graphics card. PCs with an integrated graphics card may not support the Aero visual interface. However, the stability and performance advantages of WDDM are available independent of Aero. NOTE: PCs that are not up to the hardware requirements for Windows Vista should be operated in “Basic” mode with Aero turned off.

• Search – One of the most significant improvements in Windows Vista is the ability to rapidly search all the files on the desktop, whether they reside in folders, as an email attachment, or somewhere else on the PC. Search does require that the system index file locations so they can be quickly retrieved at will, though the approach taken by Windows Vista should not interfere with system performance while in use.

• 64 bit architecture – 64-bit computing is definitely the direction of the future, and its primary advantage over 32-bit computing is in access to system memory. The 32-bit edition of Windows is Vista limited to 4GB of memory, and depending on the devices present, can access between 2 and 3.5 GB of “user available” memory. In contrast, the Business, Enterprise and Ultimate editions of 64-bit Windows Vista can access 128GB of memory. An important consideration, however, is when and how a user should install Windows Vista in 64-bit (x64) over 32-bit (x86). For mainstream consumers and businesses, Windows Vista x86 will be the preferred operating system for the next couple of years.

Each of feature has specific benefits for desktop (and laptop) management, but they also make adoption a bit tougher since they affect two key areas: application compatibility and hardware performance. This article explains the rationale behind these features, shows how they actually make PC administration more controllable and robust, and provides guidance and tips to make them easier to work with.”

(Full document PDF link here.)

Ok, putting aside my typical insouciance (and a good reason for Microsoft to once again reject my MVP nomination), Microsoft does have some valid points here. However, UAC could certainly have been handled better. It does something the security industry has been well aware of for a long time — it creates the “cry wolf” problem of popup fatigue (people turn off or ignore the popups after awhile). Vista is more secure than XP, despite what others might say, but it still gets infected. Since over 80% of all infections are based on social engineering, the popups should focus on that weak point. If UAC targeted the key areas where people run into trouble (as opposed to harrasing the user on inane actions), it would be far more helpful and potentially make a really significant impact on infection rates. This would be the subject of a far longer and more intellectual blog post than I care to get into right now, so I’ll let someone else go through that rationale if they are motivated in that direction.

I also think that the Microsoft marketing folks were really not cool in their approach to licensing, doing the old IBM trick of leaving features in but disabling them depending on your license — and charging big dollars to get incremental additional features. I bought a Home Premium Vista system for my wife, and couldn’t TS into it, because TS isn’t supported unless you buy Ultimate (so I had to run a silly hack, which is frustrating when the functionality is right there in the OS). If you want to know something that really upsets off techies, it’s this kind of stuff. And it doesn’t help with that whole adoption thing we all learn about in high tech marketing.

If you want to win in markets, give the customer more than they paid for — don’t nickel and dime them. Simple trick, works wonders. Really, this is a key business axiom, it’s not just fluffy happy stuff.

I personally find running Vista frustrating, but then again, I haven’t delved into it with any great vigor. I’m also a UI luddite — the first thing I do on any system — XP or Vista, is put the start menu back to classic, all the folders back to classic, etc. (I’d still be running DOS with DESQview if I could). So I took the easy way out — I simply downloaded Oddbasket’s XP Vista Pack and I fake the Vista experience.

Alex Eckelberry
(Incidentally, we recently started a free newsletter on Vista, and you can subscribe here.)

Zango responds to Ben Edelman

Well, well.

“Taking a Memorial Day weekend break from his day job as “an assistant professor at the Harvard Business School in the Negotiation, Organizations & Markets unit,” Ben Edelman devotes hundreds of online words to “a man’s naked buttocks,” all glimpses of Angelina Jolie – gasp!, and prank phone calls by a pair of Canadian disc jockeys.

All of this entertainment content and more is available at Zango.com. That apparently irks Edelman, although the “why” is much less obvious – even after reading his “research.” Here are the facts about our business. Zango licenses and aggregates online entertainment content from approximately 100 different content providers. Edelman does not – thankfully – review our legal agreements relating to the licensing and use of that content. More to the immediate point, however, he does not let that lack of knowledge get in the way of biased, unqualified blogging.

Like all companies our size and larger in the online entertainment space, we make every effort to abide by the Digital Millennium Copyright Act (DMCA) provisions regarding copyright infringement claims. We occasionally do receive copyright-related inquiries about content available at Zango.com and via our syndication platform. In each and every instance, we investigate those claims quickly and resolve them on a case-by-case basis, in accordance with the DMCA and its safe harbor. That job starts with the hard work of our content licensing specialists, who have secured permission to utilize the content available to Zango users on our site and via our platform.

Edelman does not like our business model or our content. He never has liked our model, and he probably never will. We’re fine with that, in large part because millions of consumers every day, month after month, year after year, accept the value proposition and do enjoy the content. But what are a few million happy folks amongst “friends”?

On that score, one thing can be said for certain: consumers enjoy Zango a lot more than they do Edelman’s content offerings, at least according to a recent comparison of Alexa rankings. In case you can’t see it, the barely visible line in dark red at the bottom of the chart is his traffic; the dark blue line at the top is Zango’s. And, for the sake of comparison, the olive green line in the middle depicts our partner Revver’s traffic.”

Link here.

Ben made a comment in response to this:

Interestingly, Zango does not respond to my demonstration of Zango showing explicit content unrequested.

But Zango does claim that its staff “have secured permission to utilize the content available to Zango users on our site and via our platform.” Sounds like it’s time to contact more rights-holders — Fox, HBO, Comedy Central, Playboy, etc. — to see whether they agree that Zango has in fact “secured permission” to use their works.

Alex Eckelberry

Update on Flash situation

Symantec just revised their thinking, believing it may not be a zero-day threat.    

The DeepSight ThreatCon currently at Level 2 in response to the discovery of in-the-wild exploitation of a vulnerability affecting Adobe Flash Player. The flaw occurs when processing a malicious SWF file.

Originally it was believed that this issue was unpatched and unknown, but further technical analysis has revealed that it is very similar to the previously reported Adobe Flash Player Multimedia File Remote Buffer Overflow Vulnerability (BID 28695), discovered by Mark Dowd of IBM. However, we are working with Adobe to identify the precise details, because we have observed the malicious files affecting patched versions of Flash, suggesting that it may be a variant or may have been incorrectly patched.

We have begun to observe numerous attacks. The original attacks observed involve two Chinese sites known to be hosting exploits for this flaw: wuqing17173.cn and woai117.cn. The sites appear to be exploiting the same flaw, but are using different payloads. Further analysis into these attacks, specifically the woai117.cn attack, uncovered another domain involved: dota11.cn. We have discovered that this site is being actively injected into sites through what is likely SQL-injection vulnerabilities.

A Google search reports approximately 20,000 web pages (not necessarily distinct servers or domains) injected with a script redirecting users to this malicious site. Other reports are suggesting upwards of 250,000 affected pages. A new attack, involving the play0nlnie.com domain, was recently reported. This attack works slightly differently and appears to be more sophisticated. The attack uses multiple layers of SWF redirection and generates URLs designed to target specific Flash version and browser combinations, supporting both Internet Explorer and Firefox. Symantec currently detects the SWF files as Downloader.Swif.C and the malware associated with these attacks as Infostealer.Gamepass and Trojan, respectively. Network administrators are also advised to blacklist the offending domains to prevent clients from inadvertently being redirected to them.

The following actions are also advised: Avoid browsing to untrustworthy sites. Consider disabling or uninstalling Flash until patches are available. Deploy script-blocking mechanisms, such as NoScript for Firefox, to explicitly prevent SWFs from loading on all but explicitly trusted sites. Temporarily set the kill bit on CLSID d27cdb6e-ae6d-11cf-96b8-444553540000 until patches availability is confirmed. This vulnerability is currently being tracked as: Adobe Flash Player SWF File Unspecified Remote Code Execution Vulnerability (http://www.securityfocus.com/bid/29386)

Alex Eckelbery
(Thanks, Matt)

The long tail of phishing

Phishers are going after all kinds of odd-and-ends these days.  What’s happened is that the big guys (Chase, Bank of America, Paypal, etc.) have been phished to death.  The phishers are looking around for any new stuff.

For quite a while now, they’ve been going after little-known credit unions and other oddball stuff — anything to phish. Just recently, for example, we observed a first — a phish for an ADP card.  

Adp123488234

This is the same with recent Apple phishing campaigns and so on.  They’re running out of material to mine.

Alex Eckelberry

Zero day flash

I’m sure you’ve all been bombarded with information about this new Flash zero day threat.

It is serious, as there is no known patch available from Adobe, and no known workaround.  What’s happened is that hackers, using SQL injection, have hacked a large number of sites to redirect to a malicious SWF file, which has a PDF exploit in it.

Useful links:

Security Focus
Dancho Danchev
Sans
Secunia

Alex Eckelberry

Zango

Ben Edelman’s report today on Zango is well worth reviewing.  Basically:

  • Questions about whether Zango has actually paid for its material.
  • Widespread sexually-explicit material.
  • Vast amounts of content that is freely available elsewhere, at no charge.

If you’re not familiar with the backstory, it goes something like this:  Zango, unable to justify installations through drive-by downloads and the like through affiliates, needed to offer some “value” in exchange for their adware.  The plan was their so-called “content economy”, where they would provide content in exchange for your system becoming a Zango advertising kiosk.

If the content, however, is relatively useless, it becomes questionable what value is being received.

Alex Eckelberry

Fresh new rogue antispyware programs

Some to avoid…

IP and domain:

66.199.252.162 antivirus-scanonline.com
64.92.174.68 vipantiscanner.com
64.92.174.68 vipantisetup.net
64.92.174.68 vipantispy.com
64.92.174.68 vipantispyware.com
72.233.62.16 spywareiso2008.com
72.233.62.20 si-install.net
Not Active easyfindsystem.com
72.233.62.17 spywareisopro.com
72.233.62.18 spywareisoscanner.com
72.233.62.19 spywareisodownload.com
72.233.62.21 waytoprotect.com
72.233.62.22 spywarequarantine.com
72.36.198.3 xpprotectionsoftware.com
72.36.198.5 drivemyclick.com
72.233.81.234 xpdownloadcenter.com
62.176.16.161 antivirus2008pro.info
62.176.16.161 sextubecodec93.com
62.176.16.161 antivirus-2008-pro.com
62.176.16.161 antivirus-2008-pro.info
62.176.16.161 antivirus-2008-pro.net
62.176.16.161 antivirus-2008-pro.org
62.176.16.161 antivirus-2008pro.com
62.176.16.161 antivirus-2008pro.net
62.176.16.161 antivirus-2008pro.org
62.176.16.161 antivirus-2008pro.org
62.176.16.161 antivirus2008pro.info
62.176.16.161 antivirus2008pro.net
62.176.16.161 antivirus2008pro.org
62.176.16.161 antivirus-2008pro.name
85.255.119.92 ebtadejfqm.com
85.255.119.93 ehagvzyfrt.com
85.255.119.92 eaelzkkodp.com

Alex Eckelberry
(Thanks, Patrick Jordan)