DP's Security Bits

A virus that infects AMD64-based Windows systems uses some tricky techniques to make defensive reverse engineering more difficult, security firm Symantec said this week.

The virus, dubbed W64.Bounds, is not spreading in the wild, but was submitted as a proof of concept to antivirus researchers. The program is not easy to detect because it encrypts itself using a new algorithm and exploits a Windows feature available only on AMD64 systems to control execution, Peter Ferrie, senior antivirus researcher for Symantec, said in a post on the company's research blog.

Securityfocus

Searching for free stuff on the Internet? Beware what you find.

That's the message form Web safety firm SiteAdvisor. Building on a Wall Street Journal analysis of the 20 million search queries leaked by America Online that found "free" to be the most popular search term, SiteAdvisor warned that the results produced by such searches frequently lead to malicious Web sites.

"Often, so-called 'free' items are anything but free," the company, recently bought by security firm McAfee, stated in its advisory. "Free screensaver and games sites are notorious for bundling spyware and adware with downloads... Free e-card sites often share users' e-mail addresses with third parties and can lead to a never-ending influx of spam... Ringtone sites frequently lure consumers with misleading offers of free tones that ultimately lead to automatic enrollment in paid subscriptions."

Story at securityfocus.com

The software maker decided against adopting security modifications to the Linux kernel developed by the National Security Agency, known as SE Linux, because of the system is extremely difficult to configure. Instead, the Waltham, Mass. firm developed a framework for restricting applications known as AppArmor, which it released as an open-source project in January.

Securityfocus