Subscribe in a readerAnother fake anti spyware site
All these fake sites and applications are becoming a bigger problem. The latest is called removal-tool . com (warning, do not try going to this site). It appears to be a collection of spyware removal tools except that it actually tries to install quite a few different bits of malware on your computer. It’s a malicious web page in disguise.
The web site looks nice, contains a blog, a news section, and reviews. The authors went to some effort to make it look convincing. Most of the links on the site even work. It would be difficult to tell that this site will compromise your computer.
Good anti virus software these days has the option to filter all web pages and they stop most of these sites before your web browser starts loading them. It’s a good investment.
Another technique to avoid these traps is to use a less popular web browser such as Firefox or Opera, or to use a less popular operating system such as Mac OS or Linux.
At the moment the majority of malicious code is designed to target Windows and Internet Explorer. That’s not to say that other systems are immune, malware is just less common on them.
.com.au.com
Any web address that ends with .com.au.com should be treated with caution. At the moment these pages are redirecting to a fake anti spyware page, tricking people into downloading malicious software.
For example an address such as importantcompany.com.au.com
- is not the same as importantcompany.com.au
- is not the same as importantcompany.com
Because the last few letters are different it takes users to a completely different site. Even having one different letter or the dot in a slightly different position is enough for your computer to go to a different site, one owned and operated by an individual with questionable intentions.
In this example importantcompany could be any company or web site you’re familiar with (eg Google).
This is a problem because people are good at recognising patterns and the addresses look similar. However they are in fact different. Care should always be taken with deceptive addresses.
HP Laptop Support Software
HP laptops come with some software to keep them updated and to help HP provide support. Lately there have been a couple of vulnerabilities discovered in these tools.
A support feature on HP computers is something called HP Virtual Rooms, an online collaboration suite. There’s a flaw in the ActiveX control that it uses and it’s possible to create a web page that lets someone install programs on your computer.
The file at risk is called HPVirtualRooms14.dll. If you have an HP computer you can check the properties of this file (do a search for the file), if it’s version 1.0.0.100 then it’s at risk.
The best defence is to have a good anti virus package, and to update this tool when HP get around to releasing an update.
The second HP vulnerability is with HP’s Software Update utility. This utility keeps the computer patched, which is always a good thing to do. Except that it also has a vulnerability and the computer can be compromised by visiting a web page with malicious code.
The program affected is called HP Software Update Client, version 3.0.8.4.
Again, use a good anti virus program and update the update tool when HP releases a fix.
MSN Worm
There’s another bit of malware spreading through MSN’s messaging network (MSN Messenger and Live Messenger), known as the IRCBOT-RB Trojan, also called a worm because of how it spreads.
It works by showing people a message with links to pictures on MySpace and Facebook. It includes messages such as "Wanna see my pictures before i send em to facebook?". Clicking on the link takes the user to a web page with malicious code.
This particular worm/trojan changes the message into different languages, depending where the user is located.
Once infected a user’s machine waits for instructions from the malware author and will let them control the machine at will.
Heath Ledger Malware
As always whenever something becomes popular with the media dozens of malware sites appear overnight promising to have interesting articles. Instead they link to malicious code that can end up being installed on your computer.
In short, if you search for Heath Ledger and end up at a website asking you to install “A new version of ActiveX Object” close your web browser immediately.
A good anti-virus package will filter malicious web sites and help protect you.
Symbian Phones
There’s a new worm (malicious code) going around infecting mobile phones that use the Symbian system (see below for a list of phones). There are two variants called the Beselo.A and Beselo.B worms.
It gets transmitted by Bluetooth or by MMS so you can’t really avoid receiving it. It consists of two parts:
- An attachment with an interesting name, such as beauty.jpg, sex.mp3, or love.rm
- A text message asking you to “install” the attachment to view it
With MMS messages it’s not necessary to “install” anything to view a picture or to play an audio attachment. What’s really happening is there’s no picture or audio file attached, it’s a malicious program. The wording of the message is just a trick to install the worm (a technique known as social engineering). If it were really a picture you’d be able to see it without installing anything, and likewise for audio attachments.
If you receive a message asking you to install something and it promises to show you a picture or play an audio file, say no. Delete the message.
F-Secure make an antivirus package specifically for phones that use Symbian, and that would detect the file. But common sense and the explanation above should be sufficient to avoid it.
Below are some of today’s popular phones that use Symbian S60. If your phone is on this list then it’s vulnerable to this attack.
- LG - JoY
- Nokia - 3250, 5500 Sport, 5700, 6110 Navigator, 6260, 6290, 6600, 6630, 6680, 6682, E50, E51, E60, E61, E61i, E65, E70, E90, N70, N72, N73, N75, N76, N80, N81, N90, N91, N92, N93i, N93, N95, N95 8GB, N82, N81 8GB, 6120, N77
- Nokia (discontinued) - 6681, 6670, 3230, 7610, 3650, 3600, 3660, 3620, 7650, N-Gage, 6620
- Panasonic - X800, X700
- Samsung - SGH-D720, SGH-D730, SGH-i450, SGH-i520, SGH-i550, SGH-i560
- Sendo - X
- Siemens - SX1
A New Skype Vulnerability
Skype, the popular internet phone software, has a new vulnerability with the way it handles video links. There aren’t any reported exploits yet but as always it’s only a matter of time.
Skype is susceptible to this vulnerability if all of the following happen:
- Your computer uses Windows
- You use Skype version 3.6.0.244 or older (versions 3.5 and 3.6)
- You do a video search from within Skype
- The search takes you to a page that’s been hacked
The damage from this is still unproven but it’s fair to say that if someone can write the required malicious code they could use it to any effect they like (such as installing spyware on your computer or taking over its control).
Skype has responded with disabling adding new videos to their Dailymotion gallery. This will slow down the chance of an exploit spreading. And Skype will release a new version soon to fix the vulnerability.
Skype’s report is located here.
World of Warcraft Scam
There’s another scam targeting World of Warcraft players. It starts with an email claiming that the recipient’s World of Warcraft account has been suspended. There’s a long explanation and a link to a website.
The website asks for a username and password. It then passes on the username and password to whoever wrote the email, it’s not a legitimate service.
This is called phishing. It works by tricking people into typing in their credentials onto a fake site.
These days good anti-virus packages can filter for these sites. You should also pay careful attention to the web page address. Read this explanation on how to identify false addresses (URLs).
Digital Picture Frames with malware
Now you also have to be careful when you buy digital picture frames. There have been numerous reports of some of these devices being infected with a virus. When you put in a photo memory card it installs a trojan onto the card. Then later, if you put the card into your computer it can install the trojan onto the computer.
It then tries to stop any anti-virus system the computer may have and then starts stealing passwords. Pretty serious stuff.
And it seems the digital picture frames came from the factory with this already installed. No one had tampered with the devices beforehand. This has been happening to quite a few digital gadgets such as MP3 players.
A good anti-virus system will detect this and prevent itself to be disabled, so if you haven’t already done so invest in one. And if you come across such a device have a chat to the store you bought it from, it’s possible they have no idea it’s happening.
Update (26 Jan 08): Best Buy were selling these devices with the brand name Insignia. They’ve just realised and have taken the off the shelf and are trying to contact customers who bought them.
Is it safe to give out your bank account number?
No, it’s not safe to give everyone your bank account details.
Jeremy Clarkson of Top Gear fame believed that all people could do with his bank account number is put money into his account. He was so sure he published the details in a newspaper.
Soon after he found £500 missing from his bank account, someone had set up a direct debit from his account and donated it to a charity called Diabetes UK.
Lesson? Don’t give out your bank account details to just anyone. In fact, give out as little personal details as possible. There are so many people in the world looking for opportunities to commit fraud and to take your money, usually using what’s called identity theft.
Sometimes you have no choice, e.g. you want to sell someone an item and you want them to deposit money in your account. It’s difficult to completely avoid these situations, but keep the information as private as possible.
Read about the incident here, it’s amusing.
Photo Gallery Downloads
This isn’t a new trick but scammers still try it. An email is sent telling the story of a tragic accident that’s happened (e.g. a nuclear meltdown in some city). There’s a link to a website with photos. It seems interesting except you’re asked to download a plugin (or codec) to view the photos.
You don’t need any plugins or codecs to view photos. And more importantly, the story about a nuclear meltdown or whatever other large disaster they think of is most probably false.
Be very cautious of anything that asks you to download a plugin or codec. It’s almost always not worth the effort and it’s almost always malware of some sort.
Valentine’s Day Malware Reminder
As with every festive event Valentine’s Day brings a whole new wave of malware. Emails are already being sent around the internet carrying dangerous attachments. While the subject keeps changing, the more common attachments seen so far are:
- withlove.exe
- with_love.exe
- Greeting card.exe
- love_me.exe
- porno_03.exe
- valsday.exe
Never open attachments that end with .exe. Unless you’ve specifically asked someone to send you a file with that exact name, it’s almost certainly malware. Delete it.
False Malware Cleaners
There are some programs that claim to test your computer for malware, then it will always tell you it found something bad. After that it either asks you for money to clean it or does some other misleading action.
Based on some security company’s research there are now 500 of these programs, including some for Mac as well as for Windows.
They look like serious programs, have interesting names, and are complete with websites. Below are some of the more recent ones:
- AVSystemCare
- DriveCleaner
- MalwareAlarm
- AntiSpywareSheild
- MacSweeper (written for the Mac)
Avoid all of these programs (don’t download or install them).
Unfortunately this is a growing trend with new products popping up all the time. Use a trusted antivirus package such as the kind that can be purchased from shops.
Only 5% of Windows PCs are fully patched
A recent survey by a security company called Secunia shows that only 5% of computers are fully patched. The other 95% are running insecure software.
It’s important to patch all of your software. This includes the operating system itself (e.g. Windows, Mac OS, Linux), your web browser (e.g. Internet Explorer, Firefox), and all your applications. And of course in an office environment patches should be carried out by IT administrators (complete with backups).
This serves as a gentle reminder to our previous post on patching. Read Secunia’s article here.
Don’t trust public computers in hotels
If you use public computers in hotels and similar environments (e.g. internet cafes) you need to keep in mind that the computer could be capturing your passwords. You can’t just assume it’s a safe computer.
This week a man was sentenced for installing key-logging programs on hotel computers in Miami, Las Vegas, and other US cities. Customers used these computers and whenever they entered a credit card number, the number was captured and used to buy over US$400,000 worth of products and services.
Mario Alberto Simbaqueba Bonilla, a 40 year old engineer, was arrested in Miami International Airport last year and has just pleaded guilty. He installed the key-logging software onto hotel computers and watched as hotel guests used the computers.
This isn’t a once off incident. If the computer isn’t yours then you just have to assume someone can capture your passwords or credit card numbers. If you need to use these computers to log into a corporate network or some other secure service (such as online banking) then think twice. Is it really that important? If so, then change the password as soon as you get onto a different computer.
MySpace Pages Can Carry Viruses
There have been some pages on MySpace that cause a window to popup telling used to install a Microsoft Security Update. And instead of installing a security update it installs some malicious code.
The last one to make the news involves requests coming from a user called "Rita". This is just an arbitrary name that someone has setup, and it won’t be the last.
So if websites like MySpace or Facebook ask you to install programs on your computer you should generally ignore or deny them.
-
-
Ads
-
-
Stats