Rogue Monday! Another one — Malwarewiped

I’m sorry, we didn’t plan on having so many new rogue antispyware apps up today. But things just happen like that sometimes.

There is a new variant of Spyaxe (related to the Virusburst folks), called Malwarewiped.

IP: 85.255.120.18   
malwarewiped(dot)com

Malwarewiped.com12182006

Application screen:

Malwarewipedmainroguesmenu

Obviously, stay clear of these rogue applications. If you are infected, the latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry
(With a hat tip to PIRT handler Nosirrah.)

More fake codecs: imageactivex and apassmanager

Two more fake codec sites:

IP: 85.255.117.197 
apassmanager(dot)com       

Apassmanager.com12182006

IP: 85.255.117.197 
imageactivex(dot)com         

Imageactivex.com12182006

 

Obviously, do not download these fake codecs as they are malware. If you are infected, the latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry

 

Open Relay database shutting down

The Open Relay Database is shutting down, as “Our volunteer staff has been pre-occupied with other aspects of their lives. In addition, the general consensus within the team is that open relay RBLs are no longer the most effective way of preventing spam from entering your network as spammers have changed tactics in recent years, as have the anti-spam community.”

My only comment?  Good.  Open relay RBLs had their use years ago, but even then generated false positives.   They’re useless now.

Alex Eckelberry
(Hat tip to Donna)

On Skype and firewalls

There has been some discussion on the net of a recent article written by Jürgen Schmidt about how Skype gets around firewalls.

From the article:

Naturally every firewall must also let packets through into the local network – after all the user wants to view websites, read e-mails, etc. The firewall must therefore forward the relevant data packets from outside, to the workstation computer on the LAN. However it only does so, when it is convinced that a packet represents the response to an outgoing data packet. A NAT router therefore keeps tables of which internal computer has communicated with which external computer and which ports the two have used.

Schmidt hits the point and a basic tenet of firewalls.  A response to an outgoing connection is trusted by the firewall.  

A variant of this same theory is used by web-based conferencing and remote control systems like Go2MyPC, as well as some games:  They broadcast a message out, and the response coming back in is trusted.  It’s one reason why programs such as Go2MyPC are generally looked on askance by IT managers.   It just sits there, chirping happily away, looking for a friend to talk to.  (Note that Go2MyPC and Skype are quite different in their methods, but the basic theory remains the same).

Does this mean Go2MyPC or Skype will bring down your system through attack?  Not necessarily. This is not something worthy of getting into any deep paranoia, but really just an observation: Just because you have all the ports locked down on your firewall does not mean it can’t be accessed remotely.  All that’s needed is a client installed on a user’s PC to establish an outbound connection, and then “bring in” another connection. If you’re truly worried, you can get a free desktop firewall (like mine or Zone’s) which will note what’s going out and provide you with the ability to block it.

Alex Eckelberry

Another new rogue antispyware on the loose: MrAntispy

A new Spysheriff clone is on the loose — MrAntiSpy.

Creatively, they ripped off the Mr. Clean logo.  Anyone with contacts at Procter and Gamble?

Mrantispy.com_mrclean.com12182006

We can see in their satisfaction guarantee their relationship to Spysheriff:

Mrantispy_spysheriff

One interesting aspect about this rogue is the owner in the whois records — the same one as procounter(dot)biz, which has been running malware files via vxgame-related sites last year and part of the Cool.WebSearch world since 2002. Nice bunch of folks, eh?

Stay away from these.  The latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry
(Credit to PIRT handler Nosirrah for the tip).

New rogue antispyware product: SpyMarshal

Another new rogue antispyware product, designed to rip you off:  SpyMarshal.

A SpySheriff clone, related to BraveSentry and KillAndClean through the same company, Stratex International, (which also markets ScanAndClean and UnspyPC). Dizzy? You should be, it’s not all simple out there.

 

Spymarshal.com12182006

Identical license agreements show the relationship of “Stratex International.”

Spymarshal_eula_killandclean_same12182006

Note that KillAndClean and ScanAndClean are all marketed through Digital River’s subsidiary, Regsoft.  Anyone with any contacts there?

 

Spymarshal_killandclean

One can see that the installations are identical to BraveSentry.  This is a BraveSentry clone.

Spymarshal_designed from bravesentry

Stay away from these.  The latest version of CounterSpy (or the CounterSpy 2.0 beta) should remove them just fine.

Patrick Jordan and Alex Eckelberry 

Gromozon has evolved

Gromozon, just about the nastiest piece of malware/spyware we’ve ever seen, dropped off the radar recently (I had described it in an interview with Search Security as a piece of malware that “drips blood”).

However, it’s techniques have evolved. The same people behind it are now using a variant of the Rustock trojan, Rustock.b (Rustock.a has been around since around June).  

Now, we’ve only seen Gromozon in Italy (researchers — you need an Italian IP to get the malware).  Why Italy, you ask? I would guess poor legislation and enforcement, and a plethora of vulnerable machines.

Symantec actually had a pretty good writeup on this trojan. 

– Rootkit detectors can detect hidden processes, but Rustock.A has no process. The malicious code runs inside the driver and in kernel threads.
– Rootkit detectors find hidden files, so Rustock.A uses NTFS Alternate Data Stream
to hide its driver into the “System32:18467” ADS. In addition, this ADS can’t be enumerated by ADS-aware tools since it is protected by the rootkit.
– Some detectors check for the presence of system hooks by analyzing native API
and scanning for hooked functions, however Rustock.A does not hook directly any native API.
– Rootkit detectors also check for the integrity of some kernel structures like the Service Descriptor Table, but Rustock.A controls kernel functions by hooking MSR_SYSENTER and other special IRP functions. [2]
– Rootkit detectors try to detect hidden drivers, but Rustock.A removes its entries from many kernel structures including the Services Control Manager, Object manager, and the loaded module list so that this enumeration fails.
– Last, but perhaps not least, the SYS driver is polymorphic and changes its code from sample to sample.
Moreover, the malware contains aggressive rootkit technologies because it scans for the following strings in loaded programs, and then changes its behavior to avoid any detection:
– BlackLight
– Rootkitrevealer
– Rkdetector

Note the statement “Rustock.A has no process. The malicious code runs inside the driver and in kernel threads,”  and then the statement that it changes its behavior to avoid detection by the popular rootkit detection programs BlackLight, Rootkitrevealer and Rkdetector. And, “It even seems able to achieve all of its stealth functionality without any problems on a beta version of Microsoft Windows Vista.”(Note that despite vehement opinions otherwise, this is one more reason why Microsoft needs to release the 64 bit Patchguard APIs earlier than 2008.  We cannot even imagine what future threats might look like.) 

So you get the picture?  This is one really nasty little bastard.   I feel sorry for Italians!

Alex Eckelberry

Counterinsurgency: A user’s guide

I am a bit of a military and political buff and recently saw something rather interesting, just published by the US Army.  Entitled “Counterinsurgency”, it’s a detailed look (281 pages) at practically all aspects of counterinsurgency.

1-5. Governments can be overthrown in a number of ways. An unplanned, spontaneous explosion of popular will, for example, might result in a revolution like that in France in 1789. At another extreme is the coup d’etat, where a small group of plotters replace state leaders with little support from the people at large. Insurgencies generally fall between these two extremes. They normally seek to achieve one of two goals: to overthrow the existing social order and reallocate power within a single state, or to break away from state control and form an autonomous entity or ungoverned space that they can control. Insurgency is typically a form of internal war, one that occurs primarily within a state, not between states, and one that contains at least some elements of civil war.

Interesting to me were the short case studies (in grey boxes) providing historical perspectives on past insurgencies.  Makes you wonder if anyone at the top levels of our government ever took a history class. What we’re going through in Iraq has happened so many times in the past it’s almost a joke.

For example, under a case study entitled: “Lose Moral Legitimacy, Lose the War”, we see this example:

During the Algerian war of independence between 1954 and 1962, French leaders decided to permit torture against suspected insurgents. Though they were aware that it was against the law and morality of war, they argued that—
• This was a new form of war and these rules did not apply.
• The threat the enemy represented, communism, was a great evil that justified extraordinary means.
• The application of torture against insurgents was measured and nongratuitous.

This official condoning of torture on the part of French Army leadership had several negative consequences. It empowered the moral legitimacy of the opposition, undermined the French moral legitimacy, and caused internal fragmentation among serving officers that led to an unsuccessful coup attempt in 1962. In the end, failure to comply with moral and legal restrictions against torture severely undermined French efforts and contributed to their loss despite several significant military victories. Illegal and immoral activities made the counterinsurgents extremely vulnerable to enemy propaganda inside Algeria among the Muslim population, as well as in the United Nations and the French media. These actions also degraded the ethical climate throughout the French Army. France eventually recognized Algerian independence in July 1963.

Or this example, under “Campaign Assessment and Reassessment”:

During Napoleon’s occupation of Spain in 1808, it seems little thought was given to the potential challenges of subduing the Spanish populace. Conditioned by the decisive victories at Austerlitz and Jena, Napoleon believed the conquest of Spain would be little more than a “military promenade.” Napoleon’s campaign included a rapid conventional military victory but ignored the immediate requirement to provide a stable environment for the populace. The French failed to analyze the Spanish people, their history, culture, motivations, and potential to support or hinder the achievement of French political objectives. The Spanish people were accustomed to hardship, suspicious of foreigners and constantly involved in skirmishes with security forces. Napoleon’s cultural miscalculation resulted in a protracted occupation struggle that lasted nearly six years and ultimately required approximately three-fifths of the Empire’s total armed strength, almost four times the force of 80,000 Napoleon originally designated.The Spanish resistance drained the resources of the French Empire. It was the beginning of the end for Napoleon. At the theater level, a complete understanding of the problem and a campaign design that allowed the counterinsurgency force to learn and adapt was lacking.

So if you really want to understand counterinsurgency, this detailed tome will be your answer:   Link here (via beSpacific). 

That is, if you can get through it without collapsing from the overwhelming amount of detail.

Alex Eckelberry

Iz delicious!!

We caught this post by an apparent (and decidedly foreign) troll on a newsgroup earlier today about a mail security product:

“I am using GFI Antispam and it is very delicious. If you make your
configuration good, it works very very fine. I tried different types of
antispam included Symantec mail security but GFI better. If you want any
information , do not hesitate to contact me.”

Antispam software delicious?  Love it!

To match the spirit, Greg here came up with our own yummy delicious logo for our own product!

 
1231200018288388
 
 
Yum!
 
Alex Eckelberry

Mirar folks send Sunbelt a cease and desist letter

Today, we received a cease and desist letter from NetNucleus, makers of Mirar

The letter has been referred to our high-priced lawyers and we will be filing a response in due course.

It should be interesting preparing our response, considering that even just recently, Mirar Toolbar was observed in a mass installation from fastmp3search.com

You can read their C&D here.

Alex Eckelberry

Q&A with Search Security

Bill Brenner over at Search Security interviewed me for a piece on malware, patchguard and other things. 

Symantec and McAfee were particularly critical of Microsoft over PatchGuard, and they were called crybabies by some in the media…
Eckelberry: I think the stand they took was absolutely warranted, and I don’t think it hurt the overall cause. There is often a general knee-jerk reaction when Symantec and McAfee complain about something Microsoft does, because people will inevitably think they’re just whining. However, what Microsoft has been doing with PatchGuard absolutely made their reaction justified. Symantec has a whole team that deals with Microsoft. You can bet their discussions broke down and went from a very diplomatic issue to turning into a press spat.

You can read the Q&A here.

Alex Eckelberry

Sunbelt Emulator Debugger

A major part of the new CounterSpy 2.0 is the inclusion of a number of antivirus technologies to combat the increasingly complex forms of malware out there.  For example, since over 90% of all malware is packed using UPX or other similar packers, we built our own generic unpacker. 

One thing we needed to do was to build our own x86 emulator that will run inside a future version of CounterSpy Anti-malware Engine.  As part of that, we built our own emulator/debugger for analyzing malware and automatically creating signatures.  I was playing with it over the weekend and it’s pretty cool (don’t worry, I only play a programmer on TV).  The malware executes inside the emulator and you can unpack it for analysis, similarly to how you might debug or analyze code in OllyDbg or the like.

SunbeltEmulator2

I’ll be writing more about our new technology in the coming weeks.  Lots more to talk about.

Alex Eckelberry

Al Shugart

As many of you know, one of the great computer industry pioneers died yesterday.  While I used to work down the street from 1 Disk Drive (the Seagate headquarters), I never got to meet Al.   I wish I had.

A great way to get an idea of what kind of person he was is from an interview he did years ago with Jill Wolfson at the San Jose Mercury News and Bruce Phebus for the Tech Museum of Innovation.

There’s some Shugart great quotes in there, like:

On education: “[Kids are] learning all kinds of junk stuff. They gotta learn how to read and write, learn how to communicate, and learn how to be computer literate. Beyond that, they ought to do what they like to do.”

On common sense: “There’s not enough logic any more. Common sense is dead.”

On the web: “If you find somebody who spends four hours a day surfing the web, they’re really not a very balanced person.”

On politics: “We’ve got to get rid of the Republicans and the Democrats and the lawyers and elect only independents.”

Interview link here.

He was a great man and he will be missed. 

Alex Eckelberry

Direct Revenue settles with California

From lawyer David Fish:

Yesterday, DirectRevenue closed out another case filed against it. The lawsuit filed on behalf of California residents was granted final approval by a Federal court in the Eastern District of California. …My understanding is that DirectRevenue is still litigating against the New York Attorney General. I am aware of no other consumer-based lawsuits.

I have noticed a trend. It seems to me that as American-based “adware” companies are being sued by consumers and being sued by government agencies and being criticized by bloggers, they are changing their behavior.

Link here, with copies of the settlement and more.

Alex Eckelberry

Crossing borders in the fight against spyware

One of the biggest issues with fighting malware and other internet crime is cross-border jurisdiction and information sharing.

There was a good push ahead in this area with the recent passage of the US SAFE WEB bill.  From the summary of the bill:

Authorizes the FTC, upon written request, to provide investigative assistance to a foreign law enforcement agency that states it is investigating or enforcing proceedings against violations of laws prohibiting fraudulent or deceptive commercial practices or other practices substantially similar to practices prohibited by laws administered by the FTC, other than federal antitrust laws, without requiring that the conduct identified constitute a violation of U.S. laws. Requires FTC consideration of specified factors in determining whether to provide assistance, including whether the requesting agency has agreed to provide reciprocal assistance to the FTC. Authorizes the FTC to negotiate and conclude an international agreement for providing such assistance, materials, or information. Stipulates that this Act does not authorize the FTC to take any action or exercise any power with respect to a bank, savings and loan institution, or federal credit union. Prohibits FTC investigative assistance to foreign law enforcement agencies from foreign states which repeatedly provided support for acts of international terrorism.

And, CDT link here.

Alex Eckelberry