Spyware, viruses, & security forum: NEWS - March 19, 2012

iYogi Refers to Incident as 'Tylenol Moment'

Avast, an antivirus maker that claims more than 150 million customers, is suspending its relationship with iYogi, a company that it has relied upon for the past two years to provide live customer support for its products. The move comes just one day after an investigation into iYogi by KrebsOnSecurity.com indicating that the company was using the relationship to push expensive and unnecessary support contracts onto Avast users.

In a blog post published today, Avast said it came to the decision after reports on this blog that "iYogi's representatives appear to have attempted to increase sales of iYogi's premium support packages by representing that user computers had issues that they did not have."

"Avast is a very non-traditional company in that positive referrals and recommendations from our user base drive our product usage," Avast CEO Vince Steckler wrote. "We do not distribute our products in retail, via computer manufacturers, or other similar channels. This model has served us well and has made us the most popular antivirus product in the world. Last year we added over 30M new users on top of almost 30M new users in the previous year. As such, any behavior that erodes the confidence our users have with Avast is unacceptable. In particular, we find the behavior that Mr. Krebs describes as unacceptable."

Continued : http://krebsonsecurity.com/2012/03/avast-antivirus-drops-iyogi-support/

Related: Aghast at Avast's iYogi Support

A hard-to-detect piece of malware that doesn't create any files on the affected systems was dropped onto the computers of visitors to popular news sites in Russia in a drive-by download attack, according to security researchers from antivirus firm Kaspersky Lab.

Drive-by download attacks are one of the primary methods of distributing malware over the Web. They usually exploit vulnerabilities in outdated software products to infect computers without requiring user interaction.

Kaspersky Lab researchers recently investigated such an attack on visitors to www.ria.ru, a website that belongs to the Russian RIA Novosti news agency, and www.gazeta.ru, a popular Russian-language online newspaper.

The attack code loaded an exploit for a known Java vulnerability (CVE-2011-3544), but it wasn't hosted on the affected websites themselves. Instead, it was served to their visitors through banners displayed by a third-party advertising service called AdFox.

What's interesting about this particular attack is the type of malware that was installed in cases of successful exploitation: one that only lives in the computer's memory.

Continued : http://www.pcworld.com/businesscenter/article/252093/javabased_web_attack_installs_hardtodetect_malware_in_ram.html

Related: A unique 'fileless' bot attacks news site visitors

A group of researchers who recently asked the public for help in figuring out a mysterious language used in the DuQu virus have solved the puzzle, thanks to crowdsourcing help from programmers who wrote in to offer suggestions and clues.

The language, which DuQu used to communicate with command-and-control servers, turns out to be a special type of C code compiled with the Microsoft Visual Studio Compiler 2008.

Researchers at Kaspersky Lab, who put out the call for help two weeks ago after failing to figure out the language on their own, said they received more than 200 comments to a blog post they wrote seeking help, and more than 60 direct emails from programmers and others who made suggestions.

DuQu, an espionage tool that followed in the wake of the infamous Stuxnet code, had been analyzed extensively since its discovery last year. But one part of the code remained a mystery - an essential component of the malware that communicates with command-and-control servers and has the ability to download additional payload modules and execute them on infected machines.

Kaspersky researchers were unable to determine the language in which the communication module was written and published a blog post asking programmers for help. Identification of the language would help them build a profile of DuQu's authors.

Continued : www.wired.com/threatlevel/2012/03/duqu-mystery-language-solved/

Related: Researchers Seek Help in Solving DuQu Mystery Language

Think that a passphrase of multiple, random dictionary words is as unguessable as long strings of gibberish, but easier to remember?

Research from the Computer Laboratory at the University of Cambridge suggests that this might not be so.

While passphrases using dictionary words may not be as vulnerable as individual passwords, they may still be cracked by dictionary attacks, the research found.

Security researcher Joseph Bonneau reports, in a recent paper (pdf) written with Ekaterina Shutova, that his team studied the problem by turning not to the theoretical space of choices but rather the real-life passphrases that people actually string together.

To find such a selection of passphrases, his team used data crawled from the now-defunct Amazon PayPhrase system, introduced last year for US users only.

Continued : http://nakedsecurity.sophos.com/2012/03/19/multi-word-passphrases/

"Software Metropolitan Police will use to help coordinate operations during the Games struggled during London riots, finds report"

The Metropolitan Police Service will use software from the 1980s to coordinate the command and communications of its policing operations during the London Olympic Games.

The software, known as MetOps, is installed in the force's special operations room (SOR), the central control room providing communications support during more than 500 major incidents and events each year, according to a report by the Met into the riots of August 2011.

MetOps, a messaging and recording system, was not designed for dynamic incident management, and means commanders have no simple way to view the latest situation during an evolving incident, the report says.

The age of MetOps system means that it is not linked directly to the software used in the force's central communications centre, known as the computer aided dispatch (CAD) system. "This can result in the central communications centre being unaware of what is being dealt with within SOR, and conversely SOR being unaware of what is being dealt with through the CAD system," says the report.

Continued : http://www.guardian.co.uk/government-computing-network/2012/mar/16/met-police-using-80s-software

Also:
30 Year-Old Software to Be Used by Metropolitan Police During Olympics
Met plod will use 1980s software to police Olympics

Users of the business-related social network LinkedIn have reported receiving email notifications that are tainted with a malicious link intended to infect the targeted recipient's computer.

The operation was identified by researchers at security provider GFI Labs, and documented on the company's blog.

"Be advised that there are fake Linkedin invitation reminders in circulation sending users to a BlackHole exploit which attempts to drop Cridex onto the PC," writes GFI's Chris Boyd.

The Cridex malware is commonly utilized in spam-based attack operations, and the use of messages designed to look like LinkedIn notifications potentially makes this particular attack all the more effective, as users are accustomed to receiving numerous communications from the platform daily.

"Cridex is a rather nasty piece of work that does everything from target banks and social networking accounts to a little bit of CAPTCHA cracking," Boyd said.

GFI Labs provided a sample of one of the malicious notifications: [Screenshot]

Continued : http://www.infosecisland.com/blogview/20754-Spoofed-LinkedIn-Messages-Serving-BlackHole-Exploit.html

From The Mac Security Blog:

Intego has discovered a new version of the Imuler Trojan horse, which the company first discovered in September, 2011. At the time, the sample discovered masqueraded as a PDF file containing Chinese text. This was not found in the wild, and the risk was considered to be low.

The latest version, Imuler.C, has been found to be disguised as image files. Intego found two samples of this malware on the VirusTotal website, a site used by security companies to share malware samples. Two samples were found, both in zip archives: "Pictures and the Ariticle of Renzin Dorjee.zip" and "FHM Feb Cover Girl Irina Shayk H-Res Pics.zip." In both cases, an application was included among the various files, with an icon making it look like an image: [Screenshot]

This technique is not new, and takes advantage of a default setting in the Mac OS X Finder, whereby file extensions are not displayed. Users double-clicking on the application launch the malware, which quickly deletes itself, replacing the original application with a real JPEG image corresponding to the one that was an application, and displays this image in the user's default image viewer. There is no visible trace of the application after this point.

Continued : http://blog.intego.com/new-version-of-imuler-trojan-horse-masquerades-as-image-files/

From F-Secure: Mac Malware at the Moment

From Ben Edelman and Wesley Brandi:

Since 2004, I've been tracking and reporting all manner of rogue affiliates -- using spyware and adware to cover competitors' sites; using trickier spyware and adware to claim commission on merchants' organic traffic; typosquatting; stuffing cookies through invisible IFRAME's and IMG's, banner ads, and even hacked forum sites; and the list goes on. I now have automation catching these practices in ever-increasing quantities.

While I've written up dozens of rogue affiliates on this site and in various presentations, today Wesley Brandi and I are introducing something better: query-based access to our records of affiliate fraud targeting top affiliate merchants. Enter a merchant's domain name, and we'll tell you how much affiliate fraud we've seen targeting that domain -- handy for merchants wanting to check whether their program is clean, and for affiliates wanting to confirm the trustworthiness a program they're considering promoting. We're not currently posting details of the specific perpetrators, but we have affiliate ID numbers, domain names, and packet log proof on file for each violator, and we can provide these upon request.

Take a look: Affiliate Fraud Information Lookup.

http://www.benedelman.org/news/031912-1.html

From Symantec's Security Response Blog:

Phishing sites with adult content are not uncommon. Phishers have often used adult content as bait in fake social networking applications. In March 2012, a phishing site spoofing a gaming brand claimed to have an adult webcam application. The phishing site was hosted on a free web hosting site and the phishing page was in Italian.

A fake offer was given on the phishing site and an adult webcam image was placed below it. According to the fake offer, the gaming brand had prepared a list of users who were willing to perform nude webcam shows for a small price, even free.

The phishing site further claimed that by entering login credentials one could receive through email the names of the users willing to perform and be able to add them to their contact list. The phishing site explained that login credentials were required because the brand decided could not disclose the names of performers outside the network to maintain privacy. To gain the users' confidence, phishers assured there was no scam involved in this offer and verified each performer did perform nude in the webcam shows. The cost for each performance was set at 1 or 2 credits or free, depending on the performer. After login credentials are entered, the phishing page displays the message: "Incorrect password". If users fell victim to the phishing site by entering their login credentials, phishers would have successfully stolen their information for identity theft purposes. [Screenshot]

Continued : http://www.symantec.com/connect/blogs/phishers-introduce-adult-cams-gaming-scams