Spyware Sucks

Fraudware: IE Defender

I see on one of my mailing lists that there has been an upsurge in reported infections by a fraudware known as IE Defender.

A description of the fraudware (including screenshots) and cleanup instructions can be found here - thankfully it's easy enough to remove. 

Note the various tricks the product uses to fool victims into purchasing the product - the pop-ups warning of a non-existent infection on computers, the fake info-bar and web browser error page, and the hijacked Google and Yahoo searches with fake results.

While you're at bleepingcomputer, you should check out the other information that is available there - it's an excellent resource of descriptions and screenshots of various malware and fraudware, as well as clean-up tools.

Thanks to Lawrence for putting the article together...

IE7 phishing filter success...

Hi all,

According to the latest mail-out by the Windows Team at Microsoft Australia ("Exploring Windows"), the IE7 phishing filter is now preventing nearly one million visits per week to known dangerous websites - that's one million potential malware infections, one million potential financial thefts, one million potential identity thefts.

The October 2007 mail-out also features my article "Better Browsing", which is cool.

If you have not upgraded to IE7 yet, why not?  It's been more than a year, now, since IE7 was first released and I would hope that most sites and add-ons would have been updated by now to work with IE7.

If you have a business application that is preventing you from upgrading, then I encourage you to talk to your vendor about when an upgrade will be made available - IE7's safety improvements are simply too important in the current Internet threat environment.  Granted, IE7 is not a panacea (look at the recent Adobe / IE7 / Windows XP vulnerability), but in the current environment of iframe exploits, browser-hijacking Flash based advertisements, drive-by downloads and phishing, your users need all the help they can get.

If you would like to subscribe to the Microsoft Australia "Exploring Windows" newsletter you can do so here (you'll need a passport ID).

Google: another sign of the next Evil Empire?

Check this out:
http://www.microsoft-watch.com/content/web_services_browser/who_jacked_my_browser_to_google.html?kc=MWRSS02129TX1K0000535

"During the first hour or so, I needed to search for something. Live Search was the only provider, as would be expected. Sometime later, I decided to add Google as a search option. But when I clicked on the Microsoft link to "find more providers," IE 7 went to a Google search page. I also found Google to have been added as a second search option, but not by me. The redirection meant that I couldn't directly add other search providers. I had two choices: Google and Windows Live Search.

Does this strike anyone else as strange coincidence? Google becomes a second search provider, and redirection to a Google search page prevents the addition of more providers?

Google has loudly squawked about IE 7 search—that Microsoft leveraged its monopoly in an anti-competitive way. I don't agree. Windows XP users upgrading to IE 7 keep their IE 6 search defaults. For Vista, the OEM decides the search defaults. On Dell PCs, Google is the default. In addition, IE 7's feature for adding more search providers is strikingly similar to Firefox. If it's good enough for Firefox, surely IE 7 is good enough, too.

I long have believed that Google accused Microsoft of what it is guilty [of]: cutting deals where it is the exclusive search provider. Microsoft won't do that because of its monopoly. Microsoft got into legal trouble for exclusive deals during the browser wars with Netscape. Those days are gone. Microsoft goes for choice in search (at least so far), contrary to Google allegations."

The redirection of "add more search providers" to block out all competitors and allow only Google is not something I have heard of before, and it worries me.  Don't get me wrong - I haven't got a lot of respect of Joe - some of the stuff he has said over the years has been utter bullshit.. but if he is saying that he has been hijacked by Google, whether it be by his own mistake or Google doing the wrong thing... well, if Joe, a supposed professional, is confused.. where the hell does this leave the vast majority of users who are naivettes?

Joe is not the only person to experience problems where Google seems to be a player.  Read here.

"I click on the expander icon to the right of the search box.
I click “Change Search Defaults.”
I only saw Google in the list, so I clicked “Remove” – this doesn’t work as I need to find another search provider first, Microsoft tells me.
I click on “Find more providers...” at the bottom of the dialog.
The dialog closes... and nothing happens."

And here, by Pierre at May 23, 2007 12:45 AM :

"everything was fine until I clicked find more providers. I get sent to a Google search page. http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7. I do not want anything related to google, but google won't let me change it. How do I force another search provider around the evil google? :)"

I know that Gateway has ties with Google.. cite this link.

It has been a long time since I have believed that Google truly intend to abide by their "do no evil" mantra (my apologies if I have not got the mantra quite right).

Oh, and did you hear about the latest scandal about Google's oops MySpace's Tom Anderson lying about his age for all these years?  I have this rule, you see for when I interact with people... and that rule is "if I can't trust you with the little things, I can't trust you with the big things".  Ok, so for me, *age* is a little thing, although for Tom it seems to have been a big thing... but, if the guy is willing to build an entire personality based on a 3 year time difference, and seemingly doesn't have a problem wiith that... then how can I trust him to walk the hard road when faced with something *really* important.

Admin announcement

The signal to noise ratio with regard to trackbacks and pings has gotten so bad that I have (reluctantly) disabled Trackbacks.  So much crap was coming through, so often, that I had no choice.  The spammers have finally worked out that, at least for CS, even if comments are all set to 'must be approved', trackbacks and pings are still automatically published.

It sucks, but such is life.  Until such time as Telligent wake up to themselves, drag their sorry asses into the real world, and give us the ability to manage trackbacks like we can manage comments, then the status quo will have to remain.

Panda Labs: a new way of social engineering

I recommend that you read the following article on the Panda Labs site, published last Friday.  It is a great example of how the low-lifes are thinking outside the box and coming up with very clever ways to get around our various online protections (in this case, captcha).

http://pandalabs.pandasecurity.com/archive/A-new-way-of-social-engineering.aspx

Computer OOPS of the week...

Courtesy of Qantas Club Lounge, Sydney - a nice STOP error....

Danger - Possibility Media web sites compromised

Source: http://blog.trendmicro.com/malicious-iframes-hosted-on-e-zines-a-media-possibility/

Note: Possibility Media has been bought out by GM Media Worldwide

"A handful of online magazines (e-zines) owned by Possiblity Media, some of which are related to IT, are hosting malicious IFRAMEs. Security Researcher Dancho Danchev shared this discovery with the rest of the security community. Some of the e-zines that are hosting malicious IFRAMEs are:

• webweekmag.com - Web Week Magazine (site unavailable at time of writing)
• itweekmagazine.com - IT Week Magazine
• technologyweekmag.com - Technology Week Magazine
• theinternetstandardmag.com - The Internet Standard
• securitystandardmag.com - Security Standard

Danchev notes that there are a total of 24 e-zines, all of which are owned by Possibility Media, that have malicious IFRAMEs embedded in them. Trend Micro threat analyst Jonell Baltazar checked some of the e-zines’ URLs and was able to obtain different binary files that are detected by Trend Micro products as PAK_GENERIC and POSSIBLE_STRAT-6. Other files are now under analysis."

Some more affected sites include:

networkweekmag.com - Network Week Magazine (site unavailable at time of writing)
portablecomputingmag.com - Portable Computing Magazine
businesscomputingmagazine.com - Business Computing Magazine
communicationsworldmag.com - Communications World Magazine
communicationsweekmag.com - Communication Week Magazine
ipworldmag.com - IP World Magazine
networkweekmag.com - Network Week Magazine
thebestpcmag.com - The Best PC
theitstandard.com - The IT Standard
hostingweekmag.com - Hosting Week (site unavailable at time of writing)
enterpriseweekmag.com - Enterprise Week
computernewsmagazine.com - Computer News
ceweekmag.com - CE Week Magazine
ebusinessmag.com - Ebusiness Magazine
healthcareitmagazine.com - Health Care IT Magazine

Some of the sites have hyperlinks to xaknet.ru added.

The bad guys have encoded the script in question, as follows.  A peak at the source of the itweekmagazone.com home page reveals:

Which when translated reveals:

iframes are extremely popular with the low-life's that are hacking into and compromising web sites.  It would be well worth your while to check your users' iframe security settings.  By default, IE7 sets "launching programs and files in an IFRAME" to prompt, as you can see below.  You may feel that it is better in the current environment to disable that option - after all, too many users will simply click 'yes' if prompted.

When you use Remote Desktop Connection to connect to a terminal server, PNG images do not appear in IE7 during that RDP session

This problem occurs when you configure the Remote Desktop Connection to use the "256 colors" display mode.

http://support.microsoft.com/default.aspx/kb/935560

Note to self: check email more often...

Just in case you're wondering why I still haven't answered your email ....

Ok, so Direct Revenue are dead... but....

There is some partying going on because of the news that Direct Revenue is apparently defunct.

Now, don't get me wrong, I am very pleased that Direct Revenue (or a portion thereof) is no longer around, but at risk of being the only person to rain on this particular parade, let me remind everybody of something...

Back in July 2007 the FTC issued final approval for a $1.5 million settlement against Direct Revenue, but there was one dissenter - Commissioner Leibowitz.  He said, and I quote:

"The consent order in this matter, to which the Commission has now accorded final approval, includes strong injunctive relief that will put an end to practices that allowed DirectRevenue to foist unwanted software on untold millions of consumers. The injunctive provisions, like those in Zango, Inc., f/k/a 180 Solutions, Inc., will serve as a model to adware companies in future. But the $1.5 million in monetary relief that the Commission obtained as part of the consent order is a disappointment because it apparently leaves DirectRevenue’s owners lining their pockets with more than $20 million from a business model based on deceit."

 I ask you... is it really that painful to shut up shop when you know you get to keep $20 million or so???  Hell, I could retire on that quite happily - invest it and live on the interest proceeds month to month.

I'll let you in on a little secret.. I reckon while so many are partying because of the news of the demise of Direct Revenue, there are some other people partying all the way to the bank. Sure, the injunctive relief meant that they couldn't earn *more* dosh, but what the heck, they still have their $20 million.  They can afford to shut down and go do something else... grow purple bananas or something like that.

Until such time as the fines imposed on malware companies are large enough actually inflict some sort of realistic *pain*, the bad guys will continue to operate.  Seriously... $1.5 million to a company like Direct Revenue is no more than a blip on the radar... it's a business expense...  no more than another tax to be paid.

New IE7 KB articles

HOTFIX:  On a computer that has IE7 installed, the security zone of the network drive that you map by using the subst command appears as "Internet"

On a computer has Windows Internet Explorer 7 installed, you create a disconnected network drive by running the subst command at a command prompt. When you open this network drive in Windows Explorer, it appears as Disconnected Network Drive. Additionally, the security zone for the network drive appears as Internet in the status bar.

However, on a computer that has Internet Explorer 6 installed, the security zone of the network drive appears as Local Intranet in the status bar.

Note This behavior also occurs if you map a network drive by using the system context.

This issue is caused by a design change in Internet Explorer 7.

When you map a network drive, the operating system tries to obtain the name of the network share so that the operating system can determine whether the security zone of the network share is Internet or Intranet. This action may fail when you use the subst command or when you map a drive in the system context. If the operating system cannot obtain the share name on a computer that has Internet Explorer 7 installed, the system sets the security zone of the network share to Internet. Therefore, this problem occurs.

By contrast, if the operating system cannot obtain the share name on a computer that has Internet Explorer 6 installed, the system sets the security zone of the network share to Local Intranet.

http://support.microsoft.com/default.aspx/kb/941000

-----

HOTFIX: When you use IE7 to visit a web page that contains IFRAME elements, the contents of an edited IFRAME element are not rendered correctly

Consider the following scenario:

• You develop a Web page that contains IFRAME elements. 
• To make the Web page editable, you set the DesignMode property for an IFRAME element to ON.
• You set the width property and the height property for the IFRAME element as a percentage value.

When you use Windows Internet Explorer 7 to visit the Web page in this scenario, you notice that the contents of the IFRAME element are not rendered correctly. Instead, the IFRAME element is blank. Or, you cannot edit the contents of the IFRAME element even if the contents are displayed.

http://support.microsoft.com/default.aspx/kb/943245

PDF vulnerability being exploited

Hi all,

Back on 20 September SANS reported on an alleged vulnerability affecting Adobe Acrobat and Reader, a vulnerability that was confirmed while I was away, on 9 October 2007 (https://isc.sans.org/diary.html?storyid=3477).

SANS now reports that the vulnerability is being actively exploited, disabling the native Windows firewall, downloading a file via FTP and then executing it.

Source: http://isc.sans.org/diary.html?storyid=3537

We don't use Adobe Reader here at the office, and maintain only a single copy of Acrobat for the occasional PDF that doesn't work with our chosen Adobe replacement, NitroPDF.  I am assuming that Nitro is not affected by the vulnerability, but of course nothing is certain in this day and age.  I'll check into that, and update this blog entry with any information that we receive.

Source: http://www.adobe.com/support/security/bulletins/apsb07-18.html

Sun Java vulnerability reported

The bad guys *love* exploiting Sun Java, and a vulnerability has been reported in Sun JRE, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an unspecified error within the handling of Java applets. This can be exploited by malicious, untrusted applets to read and write local files, or to execute local applications.

The vulnerability is reported in the following products:

* JDK and JRE 6 Update 2 and earlier
* JDK and JRE 5.0 Update 12 and earlier
* SDK and JRE 1.4.2_15 and earlier
* SDK and JRE 1.3.1_20 and earlier

The solution is to update to the latest version of the affected software, or apply the relevant patches.

JDK and JRE 6 Update 3 or later
http://java.sun.com/javase/downloads/index.jsp

JDK and JRE 5.0 Update 13 or later:
http://java.sun.com/javase/downloads/index_jdk5.jsp

SDK and JRE 1.4.2_16 or later:
http://java.sun.com/j2se/1.4.2/download.html

SDK and JRE 1.3.1_21 or later (Windows and Solaris 8 only):
http://java.sun.com/j2se/1.3/download.html

And then I read...

http://www.vladville.com/2007/10/of-asses-and-dumptrucks.html

Reminders of mortality

Sad.  I received a brief email from a dear friend this morning canceling our lunch plans because her Mom has died, suddenly and unexpectedly, from a heart attack.  I can only imagine the pain that she must be feeling right now.  I can't do a damned thing to lessen that pain, and I hate that!

The news comes at a time when I have been struggling for a while to find the enthusiasm and energy to keep fighting the good fight against the bad guys, and when I find myself turning away from mailing lists and online relationships that I have had for years, and regretting it afterwards - but sadly, once some doors are closed they cannot be reopened. 

A faint silver lining in the cloud hanging over my dear friend's head, is the fact that her pain and loss has resulted in my cuddling on the couch with my family, instead of sitting at the computer, staring at a blinking cursor, trying to work out what the heck I'm going to write for my blog that isn't merely a regurgitation of the latest KB articles, all the while lamenting the loss of my Muse, and longstanding associations.  My friend's loss has given me back my perspective, albeit too late.

Teresa - I am and always will be here for you.  Hugs to you.

MS07-057: Cumulative security update for IE

Microsoft has released security bulletin MS07-057. The security bulletin contains all the relevant information about the security update. This information includes file manifest information and deployment options. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
http://www.microsoft.com/protect/computer/updates/bulletins/200710.mspx

• IT professionals:
http://www.microsoft.com/technet/security/bulletin/ms07-057.mspx

Source: http://support.microsoft.com/default.aspx/kb/939653

Internet Explorer 6 Knowledge Base articles

When you IE6 to move from a Web site on an XP SP2-based computer, IE may crash

On a Windows XP Service Pack 2 (SP2)-based computer, you use Microsoft Internet Explorer 6 to move from a Web site that contains a reference to a style sheet. In this case, Internet Explorer 6 may crash.

This problem occurs if you have installed cumulative security update 933566 (MS07-033) for Internet Explorer or later cumulative security updates for Internet Explorer.

http://support.microsoft.com/default.aspx/kb/943120

-----

When IE6 is installed on an XP based computer, it takes longer than expected to browsde the subfolders in the Favorites folder and to open a network share that is mapped to a toolbar

This issue occurs if the network share is connected to the network through a high-latency/low-bandwidth WAN connection. This issue may occur because of the time that is required to fetch the metadata for the Favorites folder and for the toolbar items. This metadata is used to display tooltips for the Favorites folder and the for the toolbar items.

http://support.microsoft.com/default.aspx/kb/940277

Firefox 2.0.0.8 released

This build of the Web browser supports Mac OS/X 10.5 (note that there are some bugs that you need to be aware of).  Eight vulnerabilities have been addressed, including 2 listed as critical.  Two new languages have been introduced (Georgian and Romanian) and Kurdish is available in beta.

Release notes

Download here

Holidays snaps #3

We made a quick side trip to Memphis, Egypt.  The star of that particular area of the country is the most amazing statue of, if I recall correctly, Rameses.  You can get a true perspective of the size of the statue from the people standing next to it, barely a metre away.  The lady in white is our Egyptologist guide - a lovely, extremely knowledgeable, lady.

Castlecops attacker arrested

This news broke while I was overseas, with no internet access, and it is quite ironic that I did not notice it before now, especially considering I referred to the attacks against Castlecops during my presentation at www.securitycampoz.com.  It is embarrassing how far out of touch I have fallen in the space of just a few weeks.

Anyway, a person alleged to be behind a DDOS attacks against Castlecops has been arrested.

Indictment and arrest document here

"United States Attorney McGregor W. Scott announced today the arrest of GREG KING, 21, of Fairfield, California, and the unsealing of an Indictment returned on September 27, 2007, charging KING with four counts of electronic transmission of codes to cause damage to protected computers.

This case is the product of an extensive investigation by the Federal Bureau of Investigation.

According to Assistant United States Attorney Matthew D. Segal, a prosecutor with the Computer Hacking and Intellectual Property section of the U.S. Attorney’s Office who is handling the case, the Indictment alleges that KING used a “botnet” to attack computer servers. A botnet is a network of infected computers that, unbeknownst to their owners, are compromised by a hacker and programmed to respond to a hacker’s commands. The infected computers are referred to as “bots,” “zombies,” or “drones.” According to documents filed with the court, KING allegedly controlled over seven thousand such “bots” and used them to conduct multiple distributed denial of service attacks against websites of two businesses. In a distributed denial of service attack, a hacker directs a large number of infected computers (“bots”) to flood a victim computer with information and thereby disable the target computer. On the Internet, KING was also known as “Silenz, Silenz420, sZ, GregK, and Gregk707.”

Indictment here - the indictment makes for interesting reading.  The sheer naivety of people like King, who think that they can hide behind smart-ass passwords and the use of Gmail, Yahoo and wireless internet access at McDonalds and Best Buy is staggering.  Oh, and as for his attempt to hide his laptop under some bushes in the garden? Puhlease, who was he trying to fool?

It reminds me of the "good old days" when the script kiddies used various virus generators to create a "virus attachment of the week", fooling themselves into thinking they were l33t coders.  Uh, yeah, not.  Sadly, nowadays, the script kiddies are a spent force and we are now fighting against organised, professional organisations (King, by the way, does not qualify for the category of professional, or organised).