Tag Archive for Virus

Risky Celebrities

Risky CelebritiesComputer security firm McAfee says talk show host Jimmy Kimmel is the most dangerous celebrity to search for online. The company says that a search for ABC’s Kimmel carries nearly a 1 in 5 chance of landing on a website that has tested positive for spyware, viruses, or malware. Cybercriminals can use celebrities as bait to install malicious software and steal passwords or other personal data.

Risky celebrities

RankCelebrityRisk %
1
Jimmy Kimmel 19.38%
2 Armin van Buuren19.33%
3 Ciara
19.31%
4 Flo Rida
18.89%
5 Bruce Springsteen
18.82%
6 Blake Shelton18.47%
7
Britney Spears 18.19%
8Jon Bon Jovi
17.64%
9
Chelsea Handler17.22%
10 Christina Aguilera16.67%

In addition to Jimmy Kimmel (No. 1) and Chelsea Handler (No. 9), a number of funny people made McAfee’s top fifty risky celebrities list. Other notable comedians in the riskiest top 50 include Jimmy Fallon (No. 12), Adam Sandler (No. 14), Jason Segel (No. 19), Wee Man (No. 35), and Cameron Diaz (No. 41).

Risky musicians

The music industry is also well represented in the McAfee top 10 riskiest with  Armin van Buuren (No.2), Ciara (No. 3), Flo Rida (No. 4), Bruce Springsteen (5), Blake Shelton (No.6), Jon Bon Jovi (No.8).

Bruce Springsteen one of 2016s most dangerous celeb onlineOther musicians in McAfee’s riskiest 50 are 50 Cent (No. 13), Cheryl Cole (No. 16) Calvin Harris (No. 17) and Iggy Azalea (No. 20). Additional superstars heating up the McAfee top 50 are Jason Derulo (No. 24), Jay Z (No. 26), Chris Brown (No. 28), Paul McCartney (No.29), Jennifer Lopez (No. 31), Pitbull (No. 34), Jessie J (No.44), Rihanna (No.45), Justin Timberlake (No.46), Carrie Underwood (No.47), and Pharrell Williams (No. 49).

rb-

I have covered these tidbits for a while and one sign of hope for humanity is that last year, searching for downloads of Kanye West, Kourtney Kardashian, Kim Kardashian, Khloe Kardashian, and Kris Jenner were popular among Americans. This year, the Kardashian clan is nowhere to be found.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Superman Most Dangerous on Web

Superman Most Dangerous on WebSuperheroes are supposed to be our friends but sometimes a plot twist allows their arch-enemies to trick our heroes turn against us. This is also true on the intertubes. Attackers are using our superheroes to infect computers to scam people into visiting compromised sites and downloading dangerous software according to Santa Clara, California-based McAfee.

The security company scoured the web and identified the most dangerous superheroes online. The report, “Most Toxic Superhero 2014” estimates how likely the average user is to come across malware by searching for the name of any given superhero.

McAfee lined up 11 likely suspects. They gathered viable threat evidence from popular search engines like Google (GOOG), Yahoo (YHOO), and Microsoft (MSFT) Bing for spyware, adware, spam, phishing, viruses, and other malware. The company also searched each superhero’s name in conjunction with common phrases like “free torrent download” and “free app,” as seeding fake torrents is a common way for attackers to infect computers.

The most dangerous superheroes online by percent of his search traffic leading to unsafe sites are:

  1. Superman 16.5%
  2. Thor 16.35%
  3. Wonder Woman 15.7% (tied)
  4. Aquaman 15.7% (tied)
  5. X-Man Wolverine 15.1%
  6. Batman 14.2%
  7. Black Widow 13.85%
  8. Captain America  13.5%
  9. Green Lantern 11.25%
  10. Ghost Rider 10.83%

McAfee tells citizen do-gooders to protect themselves by:

  • Beware of clicking on third-party links. You should access content directly from the official websites of content providers.
  • Ensure you use web protection that will let you know of risky sites or links before you visit them. Stick to official news sites for breaking news.
  • Don’t download videos from suspect sites. This should be common sense, but it bears repeating: don’t download anything from a website you don’t trust — especially video. Most news clips you’d want to see can easily be found on official video sites and don’t require you to download anything.
  • “Free downloads” are by far the highest virus-prone search term. Anyone searching for videos or files to download should be careful not to unleash unsafe content such as malware onto their computers.
  • Always use password protection on your phone and other mobile devices. If you don’t and your phone is lost or stolen, anyone who picks up the device could have access to your personal information online.
  • Don’t “log in” or provide other information: If anything asks for your information—credit card, email, home address, Facebook login, or other information—to grant access to an exclusive story, don’t give it out. Such requests are a common tactic for phishing that could lead to identity theft.
  • Search online using an Internet security program in the background. These tools protect users from malicious websites and browser exploits. A complimentary version of McAfee’s SiteAdvisor software can be downloaded at www.siteadvisor.com

rb-

Whether you live in Metropolis or Gotham, do-gooders need not work very hard to avoid these scams. Avoid dark alleys where superhero websites tend to have the same flaws as any other unsafe page. Keep an eye out for typos and files that look suspicious. Run an Internet security program in the background (your antivirus or anti-malware program probably has one built-in). Lastly, check what other commenters say before downloading a torrent.

Related articles
  • Mobile malware: Past and current rends, prevention strategies (cloudentr.com)

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Your Smartphone Can Kill

Your Smartphone Can KillWe all love our smartphones. But did you know that your phone can kill you? And not only texting while driving can kill you and other people. A man in Uganda reportedly contracted Ebola from a mobile phone. Reports say he stole the smartphone from a quarantined ward of a hospital, near the site of a recent Ebola outbreak.

Next time you come down with the flu or Ebola, blame your cell phone. According to the London DailyMail, researchers have discovered there are more bacteria on the average smartphone than you will find in a toilet.

Tests at the University of Arizona by microbiologist Charles Gerba found there was up to 10 times the amount of bugs that can cause nausea, stomach problems, or even death on cell phones than are present in a lavatory.

The expert explains that germs are spread by phones that are often passed between people but are never cleaned which allows the germs to keep on building up. The University of Arizona researcher says the bugs get on a phone because it is so close to our hands and mouths. When somebody lets a friend or a stranger use their smartphone their bacteria easily gets on the device too.

Add to this frenzy of activity that germs thrive in warm places. Not only does your smartphone generate its own heat, but it also gets some help from your own body heat by spending time in your hands and next to your mouth.

ProGerms on your cellfessor Gerba added that because mobile devices are electronic some people are reticent about cleaning them. He says that phones are just not part of our cleaning routine whereas we should think about giving them a wipe with an antibacterial substance now and then.

In order to clean your iPhone, Apple (AAPL) says:

  1. Unplug all cables and turn off iPhone (press and hold the Sleep/Wake button, and then slide the onscreen slider).
  2. Use a soft, slightly damp, lint-free cloth. Avoid getting moisture in openings.
  3. Don’t use window cleaners, household cleaners, aerosol sprays, solvents, alcohol, ammonia, or abrasives to clean your iPhone. The front and back glass surfaces have an oleophobic coating.
  4. To remove fingerprints, simply wipe these surfaces with a soft, lint-free cloth. The ability of this coating to repel oil will diminish over time with normal usage, and rubbing the screen with an abrasive material will further diminish its effect and may scratch the glass.

rb-

Yick… I also wrote about the filthiness of keyboards here. Clean your mobile phone before it kills you!

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

A History of Mac Malware: Part 2

A History of Mac Malware: Part 2Graham Cluley at Sophos recently wrote an excellent history of Apple Macintosh malware. He points out that Mac malware is a subject that raises strong emotions. There are some who believe that the problem is over-hyped and others who believe that the malware problem on Macs is underestimated by the Apple-loving community. The author writes that hopefully, this short history will go some way to present the facts and encourage sensible debate. (rb- We have just taken on a new customer which is 85% Mac and 15% PC. I have had this very conversation with my Apple certified tech who does the field support.)

Click here to read part 1 of the History of Mac Malware. Click here to read my recent series commemorating the 25th anniversary of the computer virus.

Sophos logoBig changes to the Mac malware scene arrived with the release of Mac OS X – a whole new version of the operating system which would mean that much of the old malware would no longer run. All future, Mac-specific malware would have to be written with a new OS in mind.

2004 – The Renepo script worm (also known as “Opener”) attempted to disable Mac OS X security including the Mac OS X firewall. The author reports that the Renepo worm would download and install hacker tools for password-sniffing and cracking, make key system directories world-writable, and create an admin-level user for hackers to later abuse.

Renepo script wormIn 2004, hackers also wrote a proof-of-concept program called Amphimix which demonstrated how executable code could be disguised as an MP3 music file on an Apple (AAPL) Mac. Amphimix appeared to been written as a proof-of-concept highlighting a vulnerability in Apple’s software.

2006 – The first virus for Mac OS X was discovered in 2006. OSX/Leap-A was designed to use the Apple iChat instant messaging system to spread itself to other users. As such, it was comparable to an email or instant messaging worm on the Windows platform.

iChatThe author concludes that it was correct to call OSX/Leap-A a virus or a worm. It was not correct to call OSX/Leap-A a Trojan horse. Not that that stopped many in the Mac community claiming it wasn’t a real virus.

2007 – Sophos discovered an OpenOffice multi-platform macro worm capable of running on Windows, Linux, and Mac computers. The BadBunny worm dropped Ruby script viruses on Mac OS X systems and displayed an indecent JPEG image of a man wearing a rabbit costume.

BadBunny wormThe first financial malware for Mac appeared in 2007. The OSX/RSPlug-A Trojan horse was first detected by researchers at Intego. Mac users infected themselves by downloading and running a fake codec that claimed to help users view pornographic videos. Once on a victim’s Mac, RSPlug changed that machine’s DNS settings so that, while browsing the web, users would redirect to phishing sites or sites containing advertisements for other pornographic sites.

According to Kasperskey’s Threat Post, RSPlug’s various incarnations are all forms of the DNSChanger malware. DNSChanger featured prominently as the target of the FBI’s 2011 take-down of the malware network, dubbed Operation Ghost Click.

2008 – Apple malware became more sophisticated in 2008. Cybercriminals targeted Mac and PC users in equal measure, by planting poisoned ads on TV-related websites. If accessed via an Apple Mac, surfers would be attacked by a piece of Macintosh scareware called MacSweeper. Close relatives of MacSweeper including Imunizator, claimed to find privacy issues on the user’s computer.

The author details the growing sophistication of Mac malware in 2008.

  • Mac scarewareThe OSX/Hovdy-A Trojan horse would steal passwords from Mac OS X users, open the firewall to give access to hackers, and disable security settings.
  • Troj/RKOSX-A a Trojan horse is a Mac OS X tool to assist hackers to create backdoor Trojans, which can give them access and control over your Apple Mac computer.
  • The Jahlav Trojan was similar to other malware campaigns, cybercriminals created a bogus webpage claiming to contain a video. Visiting the site produces a message saying that you don’t have the correct codec installed to watch the video whereupon the site offers you a DMG file for Apple Macs.

Ironically Apple issued a support advisory in 2008 urging customers to run anti-virus software – but after media interest, rapidly deleted the page from their website.

OSX/iWorkS-A Trojan horse2009 – ThreatPost reports that in 2009 Symantec found the OSX/iWorkS-A Trojan horse. The malware was added to a version of Apple’s iWork ’09 software suite that popped up on BitTorrent file sharing sites. The incident was noteworthy because the trojan was packaged with the actual iWork application, so the Mac users, many of which do not use an antivirus solution, would have no reason to suspect that their machines were infected because of the download. The trojan itself communicated with a remote server and was intended to scan machines for data and track Internet history and keystrokes. A new variant of the Trojan was distributed in a pirated version of Adobe (ADBE) Photoshop CS4.

Online video was a major conduit for Mac malware in 2009.

  • Sophos reported on how hackers were planting versions of the RSPlug Trojan horse on websites, posing as an HDTV program called MacCinema.
  • Hackers planted a version of the Jahlav Mac Trojan horse on a website posing as a portal for hardcore porn videos.
  • The Twitter account of celebrity blogger Guy Kawasaki had a malicious link posted onto it, claiming to point to a sex video of Gossip Girl actress Leighton Meester. In reality, however, the link leads unsuspecting users to malware that could infect Mac users.

Leighton MeeterIn 2009 Apple finally began to build some rudimentary anti-malware protection into Mac OS X. Although it wasn’t really equal to a true anti-virus product (it only protected against a handful of Mac malware, doesn’t defend you if you try to copy an infected file from a USB stick for instance, and doesn’t offer clean-up facilities), it was still encouraging to see some attempt to offer more protection for Mac users.

2010 – Throughout 2010 Mac malware was distributed disguised as a legitimate application.

  • The OSX/Pinhead Trojan (aka HellRTS) was disguised as iPhoto, the photo application which ships on modern Macs. The backdoor Trojan horse can allow hackers to gain remote control over your iMac or MacBook.
  • Boonana cross-platform wormA Java applet distributed via Facebook (FB) was used to target not just Windows computers but Mac OS X and Linux too. The Boonana cross-platform worm appeared, disguised as a video and runs in the background, and reports system information to servers on the Internet, which can be a big breach of personal information. The Trojan also attempts to spread itself by sending messages from the user account to other people through spam.
  • A piece of Mac spyware called Spynion (also known as OpinionSpy or PremierOpinion) came to light, attached to screen savers and other add-ons for users’ Macs. it’s a variant of Windows spyware that has existed since 2008. Spynion would take advantage of users not properly reading End User License Agreements (EULAs), allowing it to spy on browsing habits and search behavior.

In late 2010, Sophos issued a free anti-virus for Mac home users. Early reports indicated that there are plenty of Mac users with malware on their computers – some of it Windows malware, some Mac OS X, and some cross-platform. The author states that there’s no doubt that the Windows malware problem is much larger than the Mac threat, but that doesn’t mean that the danger of malware infection on Mac OS X is non-existent.

The events of 2011 would make it clearer to Mac users than ever before that the malware threat was real..

Related articles

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

What is Malware?

MalwareMost users I talk to about malware seem to use the following terms interchangeably; malware, virus, trojan, keylogger, worm, backdoor, bot, rootkit, ransomware, adware, spyware, and dialer. Raymond.cc offers some standard definitions to clarify the conversations.

MalwareMalware is short for Malicious Software where all the terms above fall into this category because they are all malicious. The different term being used instead of just plain virus is to categorize what the malicious software is capable of doing.

Virus spreads on its own by smuggling its code into application software. The name is in analogy to its biological archetype. Not only does a computer virus spread many times and make the host software unusable, but also runs malicious routines.

Trojan horseTrojan horse/Trojan is a type of malware disguised as useful software. The aim is that the user executes the Trojan, which gives it full control of your PC and the possibility to use it for its own purposes. Most of the time, more malware will be installed in your system, such as backdoors or key loggers.

Worms are malicious software that aims at spreading as fast as possible once your PC has been infected. Unlike viruses, it is not other programs that are used to spread the worms, but storage devices such as USB sticks, communication media such as e-mail, or vulnerabilities in your OS. Their propagation slows down the performance of PCs and networks, or direct malicious routines will be implemented.

Key loggerKey loggers log any keyboard input without you even noticing, which enables pirates to get their hands on passwords or other important data such as online banking details.

Dialers are relics from a time when modems or ISDN were still used to go online. They dialed expensive premium-rates numbers and thus caused your telephone bill to reach astronomic amounts. Dialers have no effect on ADSL or cable connections, but they are making a comeback with mobile devices and QR codes (I covered Attaging here).

BotnetBackdoor / Bots is usually a piece of software implemented by the authors themselves that enable access to your PC or any kind of protected function of a computer program. Backdoors are often installed once Trojans have been executed, so whoever attacks your PC will gain direct access to your PC. The infected PC, also called “bot”, will become part of a botnet.

Exploits are used to systematically exploit vulnerabilities of a computer program. Whoever attacks your PC will gain control of your PC or at least parts of it.

Spyware is software that spies on you, i.e. collect different user data from your PC without you even noticing.

AdwareAdware is derived from “advertisement”. Besides the actual function of the software, the user will see advertisements. Adware itself is not dangerous, but tons of displayed adverts are considered a nuisance and thus are detected by good anti-malware solutions.

Rootkit mostly consists of several parts that will grant unauthorized access to your PC. Plus, processes and program parts will be hidden. They can be installed, for instance, through an exploit or a Trojan.

Rogues / Scareware are also know as “Rogue Anti-Spyware” or “Rogue Anti-Virus”, rogues pretend to be security software. Often, fake warnings are used to make you buy the security software, which the pirates profit from.

RansomwareRansomware “Ransom” is just what you think it is. Ransomware will encrypt personal user data or block your entire PC. Once you have paid the “ransom” through an anonymous service, your PC will be unblocked.

There are different categories of malware the author says that most of the malware today combines different kinds of malware to achieve a higher rate of infection and giving more control to the hacker. Most malware is invisible that runs silently without your knowledge to avoid detection except for ransomware and adware.

Using “virus” as a catch-all phrase to include all types of malware is no longer right. The correct word to use should be malware. However, don’t expect the big anti-virus companies to rebrand their products to Kaspersky Anti-Malware or Bitdefender Anti-Malware because doing that may risk losing their brand identity even if they do offer a complete anti-malware solution.

The blog says it doesn’t mean that you’re safe if you don’t see it so it is important to run an anti-virus software from reputable brands such as Kaspersky, ESET, Avast, Avira, AVG (at one time AVG was installing a Yahoo toolbar without notice) MSE together with a second opinion anti-malware such as HitmanPro, Malwarebytes Anti-Malware, and SUPERAntiSpyware. As for Emsisoft Anti-Malware, it comes with its own Anti-Malware engine and Ikarus Anti-Virus Engine.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.