Spyware, viruses, & security forum: NEWS - March 06, 2012

Millions of PCs sickened by a global computer contagion known as DNSChanger were slated to have their life support yanked on March 8. But an order handed down Monday by a federal judge will delay that disconnection by 120 days to give companies, businesses and governments more time to respond to the epidemic.

The reprieve came late Monday, when the judge overseeing the U.S. government's landmark case against an international cyber fraud network agreed that extending the deadline was necessary "to continue to provide remediation details to industry channels approved by the FBI."

DNSChanger modifies settings on a host PC that tell the computer how to find Web sites on the Internet, hijacking victims' search results and preventing them from visiting security sites that might help detect and scrub the infections. The Internet servers that were used to control infected PCs were located in the United States, and in coordination with the arrest of the Estonian men in November, a New York district court ordered a private U.S. company to assume control over those servers. The government argued that the arrangement would give ISPs and companies time to identify and scrub infected PCs, systems that would otherwise be disconnected from the Internet if the control servers were shut down. The court agreed, and ordered that the surrogate control servers remain in operation until March 8.

Continued : http://krebsonsecurity.com/2012/03/court-4-more-months-for-dnschanger-infected-pcs/

Also: DNSChanger victims get extension until 8 July

As Android smartphones and tablets grow in popularity, it's no surprise that the number of malware outbreaks is growing. Mobile antimalware apps can give your phone or tablet an extra layer of protection--but which ones do the job? Independent security testing lab AV-Test evaluated 41 virus scanners for Android, including those by mainstream security companies like Norton and Trend Micro. AV-Test used the Android emulator built into the Android SDK and ran each of the apps through a series of malware detection tests. To ensure that everything lined up, all the results from the emulator were tested on a real device.

Only 7 of the 41 virus scanners had detection rates above 90 percent, with over half of the remaining apps having detection rates under 40 percent. The top 7 apps were....

Continued : http://www.pcworld.com/businesscenter/article/251345/which_android_security_tools_are_worth_your_time.html

Adobe SWF Investigator lets users take a look at the inner workings of Flash files. Whether a security expert wants to look into a Flash exploit or a developer wants to debug their own project, the tool collection can be used, among other things, to decompile SWF files in order to then examine the ActionScript source code. [Screenshot]

It includes an XSS fuzzer to check files for cross-site scripting vulnerabilities (XSS) and a HEX editor to modify those files. SWF Investigator, built in Adobe Air, was developed by Peleus Uhley, a member of Adobe's security team.

SWF Investigator is available to download for Windows and Mac OS X. The source code can also be downloaded and is available under the Mozilla Public Licence 1.1 .

http://www.h-online.com/security/news/item/Adobe-provides-tool-for-analysing-Flash-files-1464864.html

From David Harley @ the ESET Threat Blog:

It was back in the 1990s when someone told me that operating systems like Windows NT were getting so safe that AV would soon be out of business. And I hear on a regular basis that AV is so ineffective it's not worth having. Because I get some of my income from the anti-virus industry, no doubt you'd expect me to disagree. I do, but that's not why.

Kevin Townsend asked my opinion of a Wired article quoting several security people at RSA saying that they don't use anti-virus (also summarized here). You can read some of my response in a good, balanced article in Infosecurity Magazine, which shares my concern that non-experts will be misled into assuming that because some security people say that, it's fine for everybody to take it off their machines. But I'm going to expand on those points because I think this is important.

As it happens, there was a time back in the 90s when I didn't use AV on my own machines except for test purposes. But I do now, and I probably know more about malware than most of the guys outside the AV sector who are now saying that AV is unnecessary. Originally, because I envisioned a rise in 0-day-type compromises where the security of an OS or an application was beyond my control - and I wasn't wrong - and more recently because sometimes I have to look at URLs or files that may be risky, AV software doesn't guarantee my safety from malicious code, or anyone else's, but I'm not going to refuse an extra layer of security...:

Continued : http://blog.eset.com/2012/03/05/security-professionals-do-use-anti-virus

Related: Information Security Disconnect: RSA, USB, AV, and reality

From the Zscaler Research ThreatLab Blog:

Pinterest is a new social network that has been getting a lot of press lately. Basically, Pinterest is a virtual board, where users can pin things they like online. They can share the content with their friends, follow other people, etc. [Screenshot]

Like Facebook, Pinterest users can add items to their board from the website, but also by clicking on "Pin it" widgets set up by webmasters on any website, which are equivalent of the Facebook "like" widgets. Any new pin shows up as a notification for all people following you. Although Pinterest is very new (you need to first apply for an invitation to get your login after a couple of days) and has a small number of users, spammers are already abusing the "Pin it" widget.

This week, I found spam campaigns at pinterestpromo.info and giftinterest.com that use Pinterest as the main tool to propagate scams.

The scam is very similar to some previous Facebook spam campaigns: users have to click on the "Pin it" widget in order to receive a free iPhone or iPad. On these two sites, scammers have used a fake "Pin it" widget rather than the official widget code

After clicking on the widget, the site redirects to another website, such as:

Continued : http://research.zscaler.com/2012/03/are-pinterest-pin-it-going-way-of.html

From The Mac Security Blog: Flashback Mac Malware Uses Twitter as Command and Control Center

The Flashback malware, which Intego pointed out was infecting an increasing number of Macs, turns out to be using a novel technique to operate. Many types of malware use command and control servers that they connect to, in order to get instructions from the creators of the malware. The problem with using these servers is that their IP addresses are specified in the malware code, and the servers can generally be taken down.

Flashback, however, uses an interesting method of getting commands: it uses Twitter. And rather than use a specific Twitter account, which can be removed, it queries Twitter for tweets containing specific hashtags. These hashtags aren't as simple as, say, #Flashback or #MacMalwareMaster, but are seemingly random strings of characters that change each day. Intego's malware research team cracked the 128-bit RC4 encryption used for Flashback's code and discovered the keys to this system.

The hashtags are made up of twelve characters. There are four characters for the day, four characters for the month, and four characters for the year. The characters used are in the following table:

Continued : http://blog.intego.com/flashback-mac-malware-uses-twitter-as-command-and-control-center/