Spyware Sucks

Congratulations Mary Liske!

A certain proud-as-punch friend of mine pinged me this evening to let me know that his lady-love is Mayor-Elect of Luna Pier, Michigan.

Here is the announcement in the Monroe News, and here is Mary's blog.

It's so very obvious from chatting with Dave that he is so very proud of Mary he could just about burst. I've known Dave since late 1999 and have watched him go through various highs and lows over the years. Its so very wonderful to see he and Mary's lives coming together so well.  They deserve every happiness and success.

((hugs)) to both of you.

Sandi

For heavens sake, tell us something we don't already know...

The Register trumpets "Thousands snared by malware warning from big-name websites" in an article just published:
(http://www.channelregister.co.uk/2007/11/07/rogue_antispyware_ads/)

The article quotes Don Jackson at SecureWorks who says:

"These are pretty well-respected, high-traffic websites," and that "several hundred to 1,000" sites "which tend to be related to television and entertainment" have been affected.

Well, excuse me while I go and hit my head against the nearest brick wall in an abortive attempt to stop myself from yelling "for gawd's sake, what have I been writing about for the past year or so???"

The article then goes on to mention MalwareAlarm.. yep, that's the product that was being advertised via the malicious PDF SWF that we discussed just the other day.

Don goes on to say "The tainted ads are being sold by outfits posing as small online advertising agencies. They then purchase ad space from the large websites. It's hard to spot anything fishy about the ads. They look legitimate are are programmed to only occasionally serve up malicious code, thwarting attempts by security personnel to filter out harmful ads.".  It is not that simple.  The advertisements not only trigger only occasionally, there are also time zone / IP checks and other shenanigans to avoid detection.  The 'trigger only occasionally' restiction can generally be neutralised by clearing out your cookies, IE cache and cached Flash files.  Time zone / IP checks can be a little harder to get around.

Oh well, as frustrating as it is to see this stuff being waved in the air as if it is something new (it isn't - it's been going on for a long time now), at least the word is spreading a bit further.  That being said, to say that the incidents tend to only affect sites related to television and entertainment is simply wrong.  Any site can be hit, no matter what their target audience or theme may be.

While we're on the topic of malicious advertisements....

You might like to read this...

http://www.sophos.com/security/blog/2007/11/748.html

If you've been reading this blog for a while you'll know that many big name brands have been hit by advertisements that steal away their site visitors, or have experienced the embarrassment of discovering that one of the sites or pages has been hacked - in fact, when I was getting to present at www.securitycampoz.com a big problem for me was who I could/should mention, whether it be because their sites had been hacked, or because they had been the victim of malicious banner advertisements.  I think I'll leave it to you to browse through some historical articles on this blog... see how many big names you can spot (and ponder the fact that there are some names that I have not written about because, although I have heard the whispers, I have not been able to gather reputable evidence).

I'd *love* to know who the "global brand" is behind the Sophos story - the surfing public as a whole need to know that *any* site is a potential risk, especially if it uses advertisements to earn an income, and revealing the name of big name brands who fall victim can really shake people out of their comfort zones.

Hijacking Flash banner advertisements again...

I received a plea for help a few days ago from a high traffic Web site's Customer Service Representative ("CSR") who was hoping for some assistance in tracking down an advertisement that was hijacking visitors to his web site and redirecting them to a "Performance Optimizer" web site.  As always happens in these situations, the CSR was unable to reproduce the hijacking behavior.

The CSR works for a pretty substantial, popular site - it has a 7/10 Google Rating, and an Alexa site ranking in the 23,000's.

This time, I could not reproduce the redirect either (as happens every so often), but fear not gentle reader, within hours of sending an email out to a private mailing list I had the data I needed.  Sadly, I cannot tell you who recorded the essential data and give them the public congratulations that they deserve, for obvious reasons - we work best under a cloak of secrecy and we don't want them to know where in the world we are when we catch them out so that they cannot code their wares to avoid us.

Anyway, here it is - the hijacking advertisement we found was the one you can see below - it looks innocent enough, doesn't it. 

The good news is that the SWF in question is no longer available at the URL that we found it at, being:

h t t p:// a248.e.akamai.net/7/800/14845/1189781201/oasc04.247realmedia.com/RealMedia/ads/Creatives/Traffic/Poetry.com_728x90/poetry_728x90.swf?

That being said, the hijacking we caught is *not* the one that was being complained of, being "Performance Optimizer".  We found MalwareAlarm instead.  Therefore, I fear the CSR who asked for help may not be out of the woods yet.

One thing I have noticed in recent times is that the quality of the malicious creatives being submitted by the rogue advertisers is improving constantly, and they continue to get better at avoiding detection.  But, when you have access to a mailing list with members all over the world, well, it can be damned hard to hide...

So, let's see what happened if you were caught by the redirect.  Check out what happens when you load the URL below, harvested from the same hijacking incident - of course, do NOT do this if you are not running IE7 / Vista.  At time of writing the URL was still live, although that will (hopefully) change.

URL:  prevedmarketing.com/?tmn=mwatmp&aid=5ide5run&lid=keyin_ao_4216_1853_2358_ao_&ax=1&ed=2&mt_info=4216_1853_2358

If you load the prevedmarket.com URL you will end up at scanner.malware-scan.com - a pretty typical Winfixer type site - first you see this error:

Then, when you use the red x to close the alert (do NOT use the Cancel button) you see the web page below - of course, you should ignore the dialogue box in in the middle of the window - simply Alt-F4 or use the red close button in the very tip right of screen (or, if you have more than one tab open, you'll be able to close that one tab).

By the way, the test system that I was using doesn't have a D drive, or a DVD-Ram, or a shared documents folder, for that matter.  The page that you see is designed to trick the visitor into thinking that a scan really is running, but nothing will install until you click on that OK button (assuming you are running XPSP2 / Vista / IE7 with at least the default security settings.

Note also how the fraudsters try to look XP'ish by the use of the Security Shield, green arrows, blue panel down the left of screen and standard system fonts and icons.

Calling all XNA Enthusiasts in Melbourne and Sydney

Posted by request...

Pete Isensee from the global Microsoft XNA team is in Australia for the Game Connect Asia Pacific conference to speak about developing for the Xbox 360 and PC platforms.

Pete is talking at an informal evening about the XNA framework, Game Studio tools and will answer questions about your own XNA projects.

Admission is free but you will need to register via the appropriate Windows Live Event link below.

Who should attend?

·         XNA Game Studio Express users

·         Game development and design enthusiasts

Melbourne Event Live Events Page

Date and time:
Friday, 16 November 2007
6:30 PM - 9:00 PM

Location:
Microsoft Melbourne Office
Level 5, 4 Freshwater Place, Southbank, VIC, Australia

Sydney Event Live Events Page

Date and time:
Wednesday, 14 November 2007
6:30 PM - 9:00 PM

Location:
Microsoft Sydney Office
1 Epping Rd, North Ryde, NSW 2113, Australia

Pete Isensee, Director XNA Development Connection, Microsoft

Pete is the director of the XNA Developer Connection (XDC), an engineering team specializing in game developer support, deep performance insight and technical illumination of gaming platforms like Xbox 360 and Windows Vista. XDC works with game developers and content creators worldwide to ensure titles are taking advantage of all the features and performance provided by Microsoft hardware, software and service. Before joining Microsoft in 2001, Pete was a game programmer for six years, and worked on titles ranging from casual games to massively multiplayer games. He's been programming in C++ since 1993, focusing on templates, STL, security and optimization technology.

ALERT: Vulnerability in Macrovision SECDRV.SYS Driver on Windows Could Allow Elevation of Privilege

"Microsoft is working with Macrovision, investigating new public reports of a vulnerability in the Macrovision secdrv.sys driver on supported editions of Windows Server 2003 and Windows XP. This vulnerability does not affect Windows Vista. We are aware of limited attacks that try to use the reported vulnerability. Microsoft is actively monitoring this situation to keep customers informed and to provide customer guidance as necessary.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This will include providing a security update through our monthly release process.

Microsoft is concerned that this new report of a vulnerability in the Macrovision secdrv.sys driver on supported editions of Windows Server 2003 and Windows XP was publicly disclosed, potentially putting computer users at risk. We continue to encourage responsible disclosure of vulnerabilities. We believe the commonly accepted practice of reporting vulnerabilities directly to a vendor serves everyone's best interests. This practice helps to ensure that customers receive comprehensive, high-quality updates for security vulnerabilities without exposure to malicious attackers while the update is being developed."

Note: An attacker must have logon permissions to the operating system to exploit the vulnerability.  Microsoft are investigating workaround, but none are available as of yet.

Source: http://www.microsoft.com/technet/security/advisory/944653.mspx

US-CERT alert - MAC OSX Leopard

"US-CERT is aware of reports of possible flaws in the Application-Based Firewall in Mac OS X Leopard. According to these reports, users may be misinformed of the status of their firewall rule set, thus placing users with listening network services at an increased risk."

What *were* Apple thinking?  "Block all incoming connections" should do exactly that.

Heise Security have a detailed analysis of the Leopard firewall's protections, or more precisely lack thereof, and their verdict is:

"The Mac OS X Leopard firewall failed every test. It is not activated by default and, even when activated, it does not behave as expected. Network connections to non-authorised services can still be established and even under the most restrictive setting, "Block all incoming connections," it allows access to system services from the internet. Although the problems and peculiarities described here are not security vulnerabilities in the sense that they can be exploited to break into a Mac, Apple would be well advised to sort them out pronto."

Ok, so the Leopard firewall is off by default, even if you had your firewall turned on before upgrading to Leopard; it doesn't distinguish between network types (unlike Vista which allows you to set different security levels for different networks); it is application based (identifying programs via code signatures) and no longer not port based, and there are the reports of applications being unable to access the internet (Skype and World of Warcraft being two that come to mind).

Quicktime updated - disables access to untrusted Java applets

Apple has patched 7 flaws in Quicktime, 6 of which could be used to get malware on to a computer.

Details here: http://docs.info.apple.com/article.html?artnum=306896

Note that QuickTime for Java is no longer accessible to untrusted Java applets (CVE-ID: CVE-2007-3751).

You can download the latest version of Quicktime here

I love my server!

I win.

Snippets of news

Too much to do... too little time... thought you might find these interesting...

A New Jersey man was sentenced to more than two years in prison on Friday for helping send "spam" e-mails to more than 1.2 million America Online subscribers.

AN online auction of Rene Rivkin's watches has been brought to a halt by a computer hacker.  CRS Warner Kugel's Steven Kugel said the security of the site and personal details of those placing bids had not been compromised. No information had been lost, he said, and the firm had put in place additional security measures.  "We believe the site was hacked into,".  (Does anybody else see a problem with Kugel's statements?  They were hacked but their security was not compromised?)

The ubiquity of computers, particularly home computers, has led owners to treat them like refrigerators or toasters -- plugging them in, adjusting some initial settings, and using them until they break or until a different set of features is desired. This is a recipe for disaster because without education and the right security software, the end user doesn't stand a chance.  ...  In the U.S., it is estimated that 80 percent of home computer users have some form of potentially unwanted software in their systems. Moreover, the longer spyware stays on a system  undetected, the more data it can transmit back to its creators who, in turn, sell that personal information to other criminals. As such, it is essential that consumers protect themselves and their assets.

An executable used by the Mount Scan feature of Symantec AntiVirus for Macintosh and Norton AntiVirus for Macintosh runs with root access. A member of group admin could replace this executable with code of their choice, and gain user root access. ... The folder /Library/Application Support has group ownership admin (gid 80). The folder is also group-writable, so programs launched by users with admin privileges can rename folders with /Library/Application Support without explicitly alerting the user. This could potentially be used to spoof the Disk Mount scanner into launching an arbitrary executable when a disk is inserted.

Holiday snaps #4 - Egypt

It is time for some more holiday snaps, yes?

I think the hardest photographic challenge of my trip was trying to capture a realistic perspective of just how large the Pyramids are... add to that the fact that my poor camera, purchased in 1999, really struggled to cope with the overwhelming brightness and glare of the area, and you can understand why I have had to discard many photographs.

This is a shot of a smaller pyramid)... it is a marvelous shot, I think, if only because it shows so clearly the blocks of stone that were used to build it (and check out the tiny "no climbing" sign).  With regards to perspective, it is not that good - but, that being said, to the right you can see a head... that person was not too far from the base of the pyramid... you can see how tiny her head is compared to the pyramid.

We went inside this Pyramid... there is a tunnel that goes down at 45 degrees or so, then there is a short level area, then it goes up again at 45 degrees or so until you reach the burial chamber... and it is *hot* inside... the Pyramids have had thousands of years to warm up.. the air is very stale, it is very hard to breathe... but being inside that tunnel, with the immensity of all that rock above us... it's an amazing experience... our guide was telling us about the amazing preservative effect of the Pyramids.. how an apple, placed inside, will dry out perfectly and not rot.. while another apple of equivalent age outside, will rot...  nobody quite understands why this is so... heck, they don't know how the Egyptians managed to move those enormous stones when building the pyramids.

The next shot is pretty cool - you can see two people in the background and it gives you a great idea of the sheer size of the largest pyramid.. Cheops Pyramid.  The gentleman on the camel was actually very unwelcome, and he and his kindred were continually chased away by the Tourist Police... you see, what they will do is offer various naive tourists "free" rides on their camels... but once you are on the camel, well, they are awfully tall, and you can't get off when they are standing.

Anyway, once the tourist is tricked into sitting on the camel, and it stands, they are stuck there and the supposedly "free" trip suddenly costs what is, for the Egyptians anyway, a lot of money.  More than once I saw a member of the Tourist Police, also on a camel, chasing a hapless (and invariably Asian) tourist, who was trapped on a camel that was running away at the behest of its owner...

There are many vendors at the pyramids, selling souvenirs, and water... but the water is very expensive.  We could purchase water from our tour operator, on the bus, for $2.50 Egyptian per bottle... but at the Pyramids themselves, the vendors were selling bottled water for $10.00 Egyptian per bottle.

To be continued...

Geek Girl Blogs is live...

And yes, I'm on the list

Apple acting infantile

At a time when I am pondering some disturbing reactions bu various MAC fanboyz to the trojan outbreak targetting MAC users, I see this:

"Today I read about the OS X 10.5 network icons. Apparently when you browse the network with Leopard you will get an icon of Windows computers that is representing an old-school CRT monitor with a BSOD . This gives me an impression that Apple still wants OS X to be a niche product and I think it's pretty childish and arrogant."

"It's pretty clear that Apple left no stone unturned in Leopard, making changes and fixes throughout the new operating system. Unfortunately, that also included an upgrade to its crucial smugness subsystem: the image you see above of an old school CRT monitor with a blue screen of death is actually the not-so-subtle gag icon Leopard uses to represent Windows machines on your local network. (Is it any wonder why PC and Mac fanboys tend to get in so many fights?) Granted, many Leopard beta users have seen this icon since the early releases, but we didn't actually think the shipping version would include something so pompous and galling to the other 90%."

"Apple's got my money, to the tune of thousands of dollars. But this level of sneering arrogance, at a time when a little humble appreciation of success is well in order, would go a long way. You're succeeding. Act like it."

Hmm, it seems some people are not too happy with Apple. 

HOTFIX: The content color does not appear as expected when you view a Web page that uses an ICM profile for the ICMFilter filter in IE7

You can request a hotfix using this online request page: http://support.microsoft.com/?kbid=935195

When you develop a Web page, you use a Image Color Management (ICM) profile for the ICMFilter filter. This filter improves the appearance of specific content in the Web page. However, when you view the Web page in Internet Explorer 7, the ICMFilter filter does not work. Therefore, the content color does not appear as expected.

This problem occurs because of an error in the Dxtmsft.dll file. Because of this error, Internet Explorer 7 cannot find the ICM profile.

http://support.microsoft.com/default.aspx/kb/942171

HOTFIX: After Internet Explorer Maintenance Group Policy settings are configured in a domain, a 20 second delay occurs when you log on to a domain from a client computer that has IE7 installed

(Note: I have seen this problem - you'd be surprised how much a 20 second or so delay can irritate users.)

You can request a hotfix using this online request page: http://support.microsoft.com/?kbid=935195

PROBLEM:

In an Active Directory directory service domain environment, you configure the Internet Explorer Maintenance Group Policy settings. A user logs on to the domain from a Windows XP-based, or a Windows Server 2003-based client computer that has Internet Explorer 7 installed. However, the user experiences a 20-second logon delay compared with a client computer that has Internet Explorer 6 installed.

To verify this delay, you can view the contents of the Branding log file (Brndlog.txt) for Internet Explorer Maintenance.

Note The Brndlog.txt file is in the following folder:

%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer

In the Branding log file, you may see the information that resembles the following:

10/25/2007 10:36:37        Refreshing browser settings...
10/25/2007 10:36:37        Broadcasting "Windows settings change" to all top level windows...
10/25/2007 10:36:57        Done.

This sample shows that a 20-second delay occurs in the following phase:

Broadcasting "Windows settings change" to all top level windows

Internet Explorer 7 introduced an error that causes this problem. This error occurs when Internet Explorer 7 parses command line parameters.

http://support.microsoft.com/default.aspx/kb/941158

More on the MAC malware

Word is starting to spread about the MAC targetting malware "MacCodec" aka OSX.RSPlug.A, but I admit to being concerned at some of the reactions that I am seeing.

"A spokesperson for Symantec suggested that Intego "has a tendency to over-hype things" - excuse me??  What an unhelpful statement by Symantec.

"It's not going to spread far because it prompts for the Administrator password" - ah, if only life were that simple, but reality is those dancing pigs are just too darned tempting....

"Practice safe browsing: lock-down your browser (instructions below), and only download from sites you trust and install programs that you download intentionally. If you are unsure whether a program is legitimate, you can check to see if that program is also available from a trusted download site like MacUpdate.com or VersionTracker.com (not all legit programs are available on these sites, but they can serve as a good reality check)." (source: http://www.smith.edu/its/technotes/?p=41)

My apologies in advance to the people at Smith College TechNotes - this isn't personal, ok? Your article just happened to be high up in a Google search and contained the type of advice that I wanted to highlight.

Ok, so let's look at the above in segments...

"Practice safe browsing: lock down your computer (instructions below)" - locking down your computer does not protect you from social engineering attacks where you are tricked into running what you think is a safe file, a file that is seemingly required to complete whatever task it is that you are doing on the computer.  Locking down your computer only protects you from exploits and "drive by downloads", neither of which apply to the MAC trojan under discussion.

And, just what is "safe browsing" anyway?  The hacking of *legitimate* "safe" web sites is becoming commonplace.  I could tell you about some very big names that have had their Web sites hacked, or who have involuntarily offered infected files for download, or who have hosted malicious Flash based banner advertisements - names that you would never expect to be a danger.  The MAC world is going to have to become far more distrusting, and far more cynical, now that the bad guys are targeting them.

"Only download from sites you trust" - see the previous paragraph - and anyway, does anybody actually trust a porn site?  I don't.  And what will happen when the bad guys start using less nefarious topics such as, for example, a "how to stay safe on the internet" as the theme for their websites and malicious movies?

"..and install programs that you download intentionally" - ok, but the user is expecting to view a video - he or she *wants* to view that video and being prompted to install a codec is not unusual.  The trick (a fake codec) is a commonly used, and far too often successful, trick used in the Windows world.  In light of that reality, I'm not sure how this little snippet of advice helps in a situation like the MAC trojan.

"if you are unsure whether a program is legitimate, you can check to see if that program is also available from a trusted download site..." - sorry, this ain't gonna work unless you decide that if a product or codec isn't listed, you're not going to run it AND that you will only download and run from said trusted site, AND it assumes that the site itself has not been compromised.  AND, what happens when the bad guys mimic the name of a well-known, trusted product?  In the Windows world, the bad guys often mimic the names of Windows system files, and well known software.

And, in the end, users are lazy.  They're not going to stop what they're doing, write down the name of whatever it is they have found that wants to install, load another page so that they can view whatever download site and search for the file in question before deciding whether or not to enter their Administrator password.

MacWorld's article about the trojan is here:
http://www.macworld.com/2007/10/firstlooks/trojanhorse/index.php

So what does this all boil down to?  All of the above advice is good, traditional, advice and it would have been enough in the past - but nowadays it is not a panacea and much of the advice is negated by social engineering attacks anyway.

MAC users are being targeted in a porn trojan social engineering attack

Source: http://www.theregister.co.uk/2007/10/31/in_the_wild_osx_trojan/