Tag Archive for 2011

| December 1, 2011
2 comments

Blackhole Malware

Blackhole Malware Dark Reading reports that attackers are increasingly using the Blackhole exploit kit in phishing campaigns. The latest phishing scam poses as an email notification from an HP (HPQ) OfficeJet Printer that has sent around 36,000 per minute resulting in nearly 8 million emails thus far and uses 2,000 domains to serve up the malware.

BotnetResearchers at AppRiver told Dark Reading the trend demonstrates how Blackhole is following the pattern of popular malware kits Zeus and SpyEye. Blackhole traditionally has been used to infect legitimate websites for drive-by infection purposes. “This attack is unique because Blackhole added an email vector to its format and is flooding the Internet with similar methods used by Zeus, SpyEye, and others, essentially moving it into prime time,” says Fred Touchette, senior security analyst for AppRiver.

Blackhole, which was previously marketed as a high-end crimeware tool, costing $1,500 for a one-year license, in May was unleashed for free in some underground forums. That has propelled more use of the toolkit according to the AppRiver blog.

Appriver logoMr. Touchette said that attackers using Blackhole have changed tactics, “This is the first that I have personally noticed that leads email recipients to Blackhole websites. Before that, people using the Blackhole Kit relied on techniques such as SEO poisoning to lead victims to their sites,” he says.

The OfficeJet email campaign, like other Blackhole attacks, is trolling for victims’ online banking credentials according to Dark Reading. It works a lot like Zeus and others, using browser vulnerabilities on victims’ machines and creating a backdoor for downloading and installing the Trojans. AppRiver’s Touchette says Blackhole appears to favor Sun Oracle (ORCL) Java (I wrote about Java holes here) and Adobe (ADBE) bugs (I wrote about Adobe bugs here).

HP“This most recent campaign is still trickling in, but will soon stall as most of its domains have been picked up and blacklisted by security professionals … we were seeing malicious emails related to this campaign coming in at a rate of around 36,000 per minute,” Mr. Touchette says.

Recent botnet takedowns have spurred an increase in malware attacks recently as botnet operators try to rebuild, AppRiver’s Touchette told Dark Reading.

rb-

Yeap- We are still seeing these trickling in and still have users reporting they can’t access their OfficeJet.

Related articles
  • Positive Trend in Malware: Rootkit Developers Killing Each Other’s Code (pcworld.com)
Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.
Category: Uncategorized | Tags: , , , , , , , , , , , ,
| November 24, 2011
3 comments

How-secure-is-my-password Tells You

How-secure-is-my-password Tells YouThe former DownloadSquad points out howsecureismypassword.net. How secure is my password is basically like a full-screen version of one of those password-strength meters websites sometimes use. But instead of showing you a bar going from “weak” to “strong”, it shows you an estimation of how long your password would take to crack. That’s a much more visceral way to understand why your password is strong.

How Secure is My Passowrd

rb-

How secure is my password helps make password best practices meaningful.

For example, when I entered “Detroit”, it came back with “your password is one of the 1090 most common passwords. It could be cracked almost instantly.  “D3troit!” would take 57 days, and “!D3tro1tM!” would take 928 years to crack.

Password best practices include using:

8 or more characters, that is not a dictionary word, which includes capital letters, digits, and a symbol or two.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , ,
| November 22, 2011
7 comments

Apple OS X Security Update

Apple OS X Security UpdateThe magical virus-proof Apple operating systems have had a rough couple of weeks. Apple (AAPL) released security updates for OS X Lion and Snow Leopard, iOS, Numbers for iOS, and Pages for iOS. UK-based security company Sophos says that the OS X patch addressed 75 known vulnerabilities. Most of the vulnerabilities could lead to arbitrary code execution, while others lead to denial of service or privilege escalation. The bug fix weighs in at a whopping 880MB with recovery download.

Apple OS X LionNext Apple released a gargantuan update to iTunes for Windows that fixes 79 vulnerabilities. Sophos reports that the patch fixes 73 holes that could cause remote code execution in WebKit, used to render HTML content. Other fixes resolve remote code execution bugs.

Despite the huge patches, cyber-criminals have figured out how to disable the rudimentary anti-virus protection XProtect Apple has built into Mac OS X by enhancing an existing trojan horse Flashback. The Flashback trojan leaves the Mac vulnerable by preventing XProtect from receiving security definition updates. Sophos makes the point that Mac malware writers are eager to infect Apple computers because of the potential financial rewards.

Sophos logoThe Mac malware authors are not resting on their laurels. Within days, of spotting Flashback in the wild, Sophos reported that Tsunami, a new backdoor trojan horse for Mac OS X, had been discovered. Sophos indicates that the new Mac malware may be a port of Kaiten, a Linux backdoor Trojan horse that uses an IRC channel for instructions.

Code like this is used to commandeer compromised computers into a DDoS (distributed denial-of-service) attack, flooding a website with traffic. ESET notes that as well as enabling DDoS attacks, the backdoor can enable a remote user to download files, such as more malware or updates to the Tsunami code.  The malware can also execute shell commands, giving it the ability to essentially take control of the affected Mac.

Tsunami, a new backdoor trojan horse for Mac OS XOnly a few more days passed before the DevilRobber (Miner-D) Mac OS X Trojan horse was discovered. DevilRobber was embedded in hacked versions of Mac OS X image editing app GraphicConverter version 7.4 distributed via file-sharing torrent sites such as PirateBay. Miner-D tries to generate Bitcoins, the currency of the anonymous digital cash system, by stealing lots of GPU (Graphics Processing Unit) time. GPUs are better than regular CPUs at performing the mathematical calculations required for Bitcoin mining.

Sophos reports that in addition to Bitcoin mining, Miner-D also spies on its victim by taking screen captures and stealing usernames and passwords. In addition, it runs a script that copies information to a file called dump.txt regarding truecrypt data, Vidalia (TOR plugin for Firefox), Safari browsing history, and .bash_history. To complete the assault – if the malware finds the user’s Bitcoin wallet it will also steal that.

DevilRobbe Mac OS X Trojan horse was discovered.DevilRobber was recently been updated according to F-Secure researchers. F-Secure researchers point out that the newly discovered Trojan is the third iteration of the malware and that it poses as the popular image-editing app PixelMator.

Help Net Security says this version of DevilRobber has new features that the original version is lacking. It tries to harvest the shell command history, the system log file, and the contents of 1Password, the popular software for managing passwords. Unfortunately, its Bitcoin mining and stealing capabilities are still there, as well.

rb-

safe computing.So despite Apple’s continued instance that their machines do not need anti-malware software, standard malware prevention techniques apply to Macs. Clearly, Mac users like their Windows cousins should practice safe computing. Some of the safer computing practices for Mac and Windows users include

  1. Never open an email attachment unless you are POSITIVE about the source.
  2. Do NOT click on any pop-up that advertises anti-virus or anti-spyware software especially a program promising to provide every feature known to humanity.
  3. Use an AntiVirus program. A free one is better than none. There are several free versions that work well, like Microsoft Security Essentials which is also free has had good reviews.
  4. Keep your OS and AV updated. Make sure that you install those important updates. An out-of-date antivirus program does not help in detecting new infections.
  5. Use a personal firewall. Use a firewall between your DSL router or cable modem and the computer will protect you from inbound attacks. A software firewall on the computer can protect you from both inbound and outbound attacks.
  6. Do NOT download freeware or shareware unless you have must. These often come bundled with spyware, adware, or fake anti-virus programs. Be especially wary of screensavers, games, browser add-ons, peer-to-peer (P2P) clients, and any downloads claiming to be “cracked” or free versions of expensive applications.
  7. Avoid questionable websites. Some sites may automatically download malicious software onto your computer.
  8. Browse responsibly. Sometimes you might not even have to download and install something but just open a website in your browser for a rogue program to infect your computer. So be careful where you go when you are browsing.
  9. Pay attention to your incoming e-mails. Some of them can contain viruses or content pointing to malicious sites. Don’t click on links provided by false institutes that invite you to change passwords or similar.
  10. “Phishing” describes scams that attempt to acquire confidential information such as credit card numbers and passwords by sending out e-mails that look like they come from real companies or trusted people. If you happen to receive an e-mail message announcing that your account will be closed, that you need to confirm an order, or that you need to verify your billing information, do not reply to the e-mail or click on any links. If you want to find out whether the e-mail is legitimate, you can go to their website by directly typing their address into your browser or by calling them.

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , ,
| November 15, 2011
Comments Off on Which Mobile OS is Most Hit by Malware?

Which Mobile OS is Most Hit by Malware?

Which Mobile OS is Most Hit by Malware? Help Net Security reminds us that most mobile phone users still don’t have a mobile AV solution installed on their devices making. This makes it hard to gauge just how many of them have been hit by mobile malware. To overcome this fact, Microsoft (MSFT) researchers observed that mobile phones often get synched with the users’ computers. Also, users often use their computers to search for mobile apps on third-party application markets and file-sharing sites. These habits allow mobile malware to occasionally end up on their desktop/laptop computers and gets detected by desktop anti-virus software.

MicrosoftResearchers at the Microsoft Malware Protection Center (MMPC) were able to use thes detection to get an idea of what malware attacks the various mobile operating systems. The MMPC found was that Symbian users’ devices are getting hit with a disproportionately bigger number of threats than those targeting other operating systems. In August 2011, Microsoft detected around 42,000 of them.

Malware attacks

Microsoft’s Marianne Mallen says that Symbian-specific malware seems to be evolving and Zeus-in-the-mobile (“ZItmo“) and SpyEye-in-the-mobile (“Spitmo“) are the most recently detected malware and arguably the most dangerous for the user.

JavaThe Sun Oracle (ORCL) Java ME platform takes second place in the MSFT research, with nearly 24,000 threats detected in August 2011, mostly apps sending text messages to premium-rate numbers.

The MMPC found that Google‘s (GOOG) Android malware numbers were rather low when compared to Symbian and Java ME platforms. There were around 2,800 hits in August, but have been steadily rising since February. Much of the Android malware uses privilege-escalation exploits to install itself or other components on the device without having to ask the user for permission.

At the end of the MSFT list are Apple (AAPL) iOS and Research In Motion (RIMM). No new threats for Apple’s mobile OS have been discovered this year, and the total number of threats detected in August was around 590. RIM brings up the rear with only 5 malicious apps detected during that month and can boast of only one completely new threat springing up for it this year:.

Apple ComputersMs. Mallen’s advice to mobile users is to scan applications downloaded when possible, even when it’s already on a mobile device. Ms. Mallen says that even apps from the official app stores, may have been repackaged with malware that can run stealthily without the user being made aware of the underlying payload,” she points out. “The payload can include data-theft, silent SMS-sending in the background, and downloading and installing of other malware components, among other things. This malware (or links to it) could also be spammed or sent through email, using social engineering to entice the user to download a copy of the malware onto the desktop.”

rb-

UMMM no critique of mobile malware issues on WinPhones?

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , ,
| November 8, 2011
One comment

Gartner’s Top Tech Trends For 2012

GartGartner's Top Tech Trends For 2012ner VP David Cearley described their top ten strategic technology trends for 2012 to attendees of the Gartner Symposium IT/Expo. Gartner (IT) defines a strategic technology as one with the potential for significant impact on the enterprise in the next three years. Here are Gartner’s top strategic technologies for 2012.

Gartner logoMedia tablets and beyond: Bring-your-own-technology (BYOT) at work has become the norm, not the exception.  By 2015 tablet shipments will reach around 50% of laptop shipments and Windows 8 will likely be in third place behind Google‘s (GOOG) Android and Apple’s (AAPL) iOS. The net result is that Microsoft‘s (MSFT) share of the client platform, be it PC, tablet, or smartphone, will likely be reduced to 60% and it could fall below 50%, Mr. Cearley says.

Apple iPadThe implication for IT is that the era of PC dominance with Windows as the single platform will be replaced with a post-PC era where Windows is one of a variety of environments IT will need to support. Gartner says it expects iOS/Android will dominate the market with 80% of tablets shipped by 2015. IT leaders need a managed diversity program to address multiple form factors, as well as employees bringing their own smartphones and tablet devices into the workplace.

Mobile-Centric Applications and Interfaces. User interfaces with windows, icons, menus and pointers which have been in place for more than 20 years are changing. The UI will be replaced by mobile-centric interfaces emphasizing touch, gesture, search, voice, and video. Applications themselves are likely to shift to more focused and simple apps that can be assembled into more complex solutions. By 2015 half the applications that would be written as native apps in 2011 will instead be delivered as Web apps.

The Internet of Things (IoT)Internet of Things: The Internet of Things (IoT) describes pervasive computing where cameras, sensors, microphones, image recognition, everything, is now part of the environment. In addition, increasingly intelligent devices create issues such as privacy concerns. Gartner says. Drivers of the IoT are:

  • Near Field Communication (NFC) payments allows users to make payments by waving their mobile phone in front of a compatible reader.
  • Embedded sensors which detect and communicate changes are being built into an increasing number of places and objects.
  • Image Recognition technologies identify objects, people, buildings, places logos, etc. that has value to consumers and enterprises.

App Stores and MarketplacesApp Stores and Marketplaces: Application stores by Apple and Android provide marketplaces where hundreds of thousands of applications are available to mobile users. Gartner forecasts that by 2014, there will be more than 70 billion mobile application downloads from app stores every year with an enterprise focus. With enterprise app stores, the role of IT shifts from that of a centralized planner to a market manager providing governance and brokerage services to users and potentially an ecosystem to support entrepreneurs. Enterprises should use a managed diversity approach to focus on app store efforts and segment apps by risk and value.

Big DataBig Data: The size, complexity of formats, and speed of delivery exceed the capabilities of traditional data management technologies; Gartner says it requires the use of new technologies simply to manage the volume alone. One major implication of big data is that in the future users will not be able to put all useful information into a single data warehouse. Logical data warehouses bringing together information from multiple sources as needed will replace the single data warehouse model.

Cloud Computing: This topic is still an important trend. It will become the next-generation battleground for the likes of Google and Amazon (AMZN). Going forward, enterprise IT will be concerned with developing hybrid private/public cloud apps, improving security and governance, Mr. Cearley says. While the market remains in its early stages in 2011 and 2012, it will see the full range of large enterprise providers fully engaged in delivering a range of offerings to build cloud environments and deliver cloud services. Oracle (ORCL), IBM (IBM), and SAP (SAP) all have major initiatives to deliver a broader range of cloud services over the next two years. As Microsoft continues to expand its cloud offering, and these traditional enterprise players expand offerings, users will see competition heat up and enterprise-level cloud services increase.

Cloud ComputingEnterprises are moving from trying to understand the cloud to making decisions on selected workloads to implement on cloud services and where they need to build out private clouds. Hybrid cloud computing which brings together external public cloud services and internal private cloud services, as well as the capabilities to secure, manage and govern the entire cloud spectrum will be a major focus for 2012. From a security perspective, new certification programs will be ready for the initial trial, setting the stage for more secure cloud computing. On the private cloud front, IT will be challenged to bring operations and development groups closer together using “DevOps” concepts in order to approach the speed and efficiencies of public cloud service providers.

Other key predictions Gartner had included:

  • Contextual and Social User Experience: Context-aware computing uses information about an end-user to improve the quality of interaction and anticipates the user’s needs and proactively serves up the customized content. By 2015, 40% of the world’s smartphone users will opt in to context service providers that track their activities with Google, Microsoft, Nokia (NOK), and Apple continuously tracking daily activities Mr.Cearley says.
  • The growing use of flash memory for In-Memory Computing is a long-term technology trend that could have a disruptive impact comparable to that of cloud computing.
  • The adoption of Extreme Low-Energy Servers built on low-power processors typically used in mobile devices will increase for non-compute intensive workloads or delivery of static objects to a website. Gartner says that 10%-15% of enterprise workloads are good for this.
  • Next-Generation Analytics Gartner says over the next three years, analytics will mature from structured and simple data analyzed by individuals to the analysis of complex information of many types (text, video, etc.) from many systems.
Related articles
  • Expecting a recession, Gartner urges ‘creative destruction’ (networkworld.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedIn, Facebook, and Twitter. Email the Bach Seat here.

Category: Uncategorized | Tags: , , , , , , , , , , , , , ,
« Older Entries   Recent Entries »