Spyware, viruses, & security forum: NEWS - October 15, 2010

When you're travelling, is the thought of using someone else's computer unsettling? The thought of having to use a public kiosk or a hotel computer can feel a lot like using someone else's toothbrush. You're never really sure where it's been.

The Air Force's Lightweight Portable Security (LPS) team has a solution for that (the computer part. You're on your own for the toothbrush) and they've even won a GISLA Award for their efforts.

Software Protection Initiative team leader Rich Kutter told Federal News Radio it not only makes your web surfing safe, it also saves you from having to make major changes to your home computer if you need to use a Smart Access card to log in.

The idea is that everything a computer user needs for web browsing or telework can be downloaded from DoD and put onto a CD. Then, when you want to surf or work safely, you start up the computer from the CD and not the hard drive.

LPS, said Kutter, meets two key ATSPI security tenets: it 1) focuses on what's critical (web browsing in the public version and telework in the remote access version) and 2) it works Out-of-Band of the threat. Even if there's malware on the hard drive, since the program runs out of RAM, it's running where the threat isn't. "It ignores your local hard drive and any nasties that might be hiding out there," said Kutter.

Another feature for the truly security conscious: it doesn't leave any trace on the computer you're using of which sites you've been to or what you did there.

When asked why everyone doesn't have a computer that can do all this, Kutter laughed and said "You can! You can download it from our website at spi.dod.mil if you want to play with the public version."

http://www.federalnewsradio.com/?sid=2079074&nid=15

SmartScreen will favour Windows Logo-rated apps.

Microsoft has activated a feature in its forthcoming Internet Explorer 9 browser that will eliminate security warnings when Internet surfers download "reputable" software, but the feature could potentially trigger malicious software warnings on legitimate products developed by smaller organisations or the open source community.

In a blog post, Microsoft program manager Ryan Colvin said that the SmartScreen application reputation feature was designed to "reduce the number of generic, unhelpful warnings consumers see when downloading programs".

Programs that are identified by Microsoft as reputable won't generate any warning before the user downloads them, but programs which are not commonly used will continue to trigger an on-screen message.

Currently, IE generates warnings for virtually any kind of download, which often results in users ignoring them. Colvin predicted that with the new arrangement, most users would not see a warning about potential malware more than three times a year, potentially improving their effectiveness. The application reputation option builds on a similarly-branded feature added to IE8 to identify potentially malicious sites.

http://www.itnews.com.au/News/235379,microsoft-turns-on-reputation-check-for-ie9.aspx
http://blogs.msdn.com/b/ie/archive/2010/10/13/stranger-danger-introducing-smartscreen-application-reputation.aspx

users' computers

Kaspersky Lab announces that almost 32 million vulnerable applications and files were detected on users' computers in Q3 of 2010. The 10 most widespread vulnerabilities even included some for which vendors had distributed patches in the period 2007 to 2009.

Cyber criminals often use flaws in program code to gain access to data and resources on targeted computers. Malicious programs that are designed especially to take advantage of these vulnerabilities are called exploits and are increasingly widespread. They regularly dominate the Monthly Malware Statistics ratings compiled by Kaspersky Lab's experts.

The notorious Stuxnet worm, which exploits not one, but four zero-day vulnerabilities in Windows, is yet another example of just how popular these programs are with cyber criminals.

?Previously, cyber criminals mainly targeted vulnerabilities in the MS Windows family of operating systems. However, over the last few years they have shifted their focus to include Adobe products such as Flash Player and Adobe Reader,? commented Vyacheslav Zakorzhevsky, Senior Virus Analyst at Kaspersky Lab and author of the article: 'Cybercrime Raiders', devoted to the problem of exploits.

?As a result, a new product called Adobe Updater was released to perform a function similar to that of Windows Update: the automatic download and installation of patches for programs installed on users' computers. At present, Sun, whose Java engine also has vulnerabilities targeted by exploits, is also trying to resolve its update situation.?

Unfortunately, many users do not regularly update the software on their computers.

http://www.itweb.co.za/index.php?option=com_content&view=article&id=37818%3Adisturbing-statistics-over-30m-vulnerabilities-detected-on-users-computers&catid=359&Itemid=86

Recently a new piece of malware has emerged that operates similarly to Conficker. This malware, named Murofet, is similar to Conficker in that it generates thousands of domains daily that it then contacts for updates.

Immediately upon executing, Murofet starts a thread that attempts to download malware updates. It generates pseudo-random domain names based on the year, month, day, and minute of execution. The algorithm used for domain generation is simple, using the previously mentioned data, it generates two DWORD values. The first is composed of the month, day, and low byte of the year of the date of execution, plus 0x30 (48). The second DWORD value is based on the minute of execution, multiplied by 0x11 (17). This number is hereafter iterated 800 times to generate multiple domains. The resulting QWORD value is then hashed with the MD5 algorithm and each byte of the result is then used to generate one letter of the domain name by dividing it into 2 nibbles and, if a valid numeric representation of a letter of the alphabet, converted into that letter by adding 0x61 ('a'). For example, 0x42 = 0x4 + 0x2 = 0x6 = 'g' (zero represents 'a'). Each letter is then concatenated into a domain name. Once the letter conversion loop is finished, Murofet applies a few rules to decide which domain extension to use. If the current iteration of the value derived from the minute value is divisible by 5, it uses ".biz". Failing this, if the derived value [bitwise] AND 3 results in zero, the extension ".info" is used. If this fails, it checks to see if the number is divisible by 3, in which case it uses ".org". Finally, if the number is divisible by 2 it uses ".net", otherwise it uses ".com".

http://community.websense.com/blogs/securitylabs/archive/2010/10/14/murofet-domain-generation-ala-conficker.aspx

From Google Online Security Blog:

Recently, we announced Safe Browsing Alerts for Network Administrators. Today we?re adding phishing URLs to the notification messages. This means that in addition to being alerted to compromised URLs found on networks, you?ll be alerted to phishing URLs as well.

We?d also like to point out the XML notification feature. By default, we send notification messages in a simple email message. However, we realize that some of you may want to process these notifications by a script, so we?ve added the ability to receive messages in XML format. Click on an AS in your list to modify preferences, such as enabling the XML notification feature. If you decide to use XML email messages, you should familiarize yourself with the XML Schema.

http://googleonlinesecurity.blogspot.com/2010/10/phishing-urls-and-xml-notifications.html

"Bill Shock"

The Federal Communications Commission (FCC) has proposed new rules that would require mobile service providers to provide usage alerts and related information that will assist consumers in avoiding unexpected charges on their bills. The proposed rules would empower consumers with simple alerts and easy-to-find tools and information so they can make smart decisions about their mobile plans.

The record thus far indicates that mobile ?bill shock? -- an unexpected increase in the monthly mobile bill -- is a growing challenge for the surveyed consumers, and that current tools could be improved. According to an April-May 2010 FCC survey, 30 million Americans -- one in six mobile users -- have experienced bill shock. More than half those consumers saw an increase of $50 or more, but many were not alerted by their provider before they incurred the charges. The tools in place to eliminate bill shock vary widely between service providers and type of service, and can be difficult to find. Most of the alerts that are offered do not cover all services or are not sent before the overage charges are incurred.

To address this challenge the FCC is proposing and seeking comment on rules that would prevent bill shock. The proposed rules would require mobile companies to provide consumers with simple alerts before and when they incur overages, using technology widely available today.

http://www.fcc.gov/ in doc and pdf format

Also in fcc.gov website: FCC Takes Action to Unleash Video Innovation and Consumer Choice.

Nearly half of all home Wi-Fi networks in the UK could be hacked within five seconds, according to CPP.

The life assistance company employed the services of ethical hacker Jason Hart to roam six major cities across the UK and use specially developed software to identify home networks that were at risk of 'Wi-Fi jacking'.

Wi-Fi jacking see hackers piggybacking on a net connection and allows them to illegally download files, purchase illegal goods or pornography or even sell on stolen goods, without being traced. It also allows them to view the private transactions made over the net, providing them with access to passwords and usernames that can subsequently be used to commit identity fraud.

CPP's research, which has been conducted ahead of National Identity Fraud Prevention Week, revealed 40,000 home Wi-Fi networks were at risk.

CPP also said that despite the fact 82 percent of web users believe their Wi-Fi connection is secure, nearly a quarter of private wireless networks are not password protected.

http://www.networkworld.com/news/2010/101410-half-of-home-wi-fi-networks.html