http://www.securitypronews.com Breaking news and updates in Internet security en-us Thu, 11 Mar 2010 12:42:23 EST rrobinson@ientry.com mike@ientry.com http://www.securitypronews.com/rss.gif http://www.securitypronews.com 55 266 http://www.SecurityProNews.com/news/securitynews/spn-45-20091208GoogleGoesAfterImpersonatorScammers.html

Google Goes After Impersonator Scammers

A post on the Official Google Blog announced today, "[D]espite hundreds of consumer complaints and our own efforts to keep these sites from tricking people, some scams continue. To fight back, we're working to stop various fraudulent 'Google Money' schemes, and this week filed suit against Pacific WebWorks and several other unnamed defendants."

The post then added, "[W]e're still working constantly to remove scammy URLs from our index, and we'll permanently disable AdWords accounts that provide a poor or harmful user experience, whether or not they use Google's trademarks illegally."

The problem continues to exist, though.

So fair warning: The scams are known to operate under names like the Earn Google Cash Kit, Google Adwork, Google ATM, Google Biz Kit, Google Cash, Google Fortune, Google Marketing Kit, Google Profits, Google StartUp Kit, Google Works, and the Home Business Kit for Google. From there, they tend to be fairly standard make-money-from home affairs.

As always, stay sharp.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20091118SenateUncoversOnlineCreditCardTricks.html

Senate Uncovers Online Credit Card Tricks

An investigation ordered by Senate Commerce Committee Chairman John D. Rockefeller IV discovered that Affinion, Vertrue, and Webloyalty "gain access to online consumers by entering into financial agreements with reputable online websites and retailers," according to the official report.

Then, "[T]he three companies insert their sales offers into the 'post-transaction' phase of an online purchase, after consumers have made a purchase but before they have completed the sale confirmation process. These offers generally promise cash back rewards and appear to be related to the transaction the consumer is in the process of completing. Misleading 'Yes' and 'Continue' buttons cause consumers to reasonably think they are completing the original transaction, rather than entering into a new, ongoing financial relationship with a membership club operated by Affinion, Vertrue, or Webloyalty."

So individuals wind up paying $9 a month, and companies make millions. Millions upon millions, really. 1-800-Flowers.com, Buy.com, Priceline, and US Airways (among many others) were all given more than $10 million by Affinion, Vertrue, and Webloyalty. Barnes & Noble, eHarmony, and Pizza Hut received between $1 million and $10 million.

It's a bit scary to see this sort of trickery employed by such mainstream organizations. Hopefully the committee's report will force them to clean up their act.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20091117McAfeeCyberwarfareABigThreat.html

McAfee: Cyberwarfare A Big Threat

Dave DeWalt, the president and CEO of McAfee, said in a statement, "[S]everal nations around the world are actively engaged in cyberwar-like preparations and attacks." These include China, France, Israel, Russia, and the U.S., and it's no secret that the members of this group aren't all on great terms.

What's more, cyberwarfare's barrier to entry is so low in comparison to traditional hostilities (a roomful of computers vs. thousands of men, tanks, and airplanes) that lots of other countries are almost sure to pursue the idea.

Then, if and when the virtual bullets start flying, things could get really nasty. McAfee reported, "Attackers are not only building their cyberdefenses, but cyberoffenses, targeting infrastructure such as power grids, transportation, telecommunication, finance and water supplies, because damage can be done quickly and with little effort."

At least this state of affairs would create a good job market for security professionals. Everybody else might benefit in a physical manner from the dive-and-unplug exercises, too.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20091116ICSALabsFindsFlawsInNewSecurityProducts.html

ICSA Labs Finds Flaws In New Security Products

ICSA Labs, which is based in Pennsylvania and has been around for 20 years, tests and sometimes certifies products. Emphasis on "sometimes."

An ICSA Labs Product Assurance Report indicated that just 4 percent of security products attain certification following a first round of testing. Most have to try again between one and three times before making the cut.

And it's not guaranteed that a product will ever meet the necessary standards, either. According to ICSA Labs, only about 82 percent of products attain certification in the end, meaning about one-fifth of all applicants (and perhaps a much larger percentage of products) aren't up to snuff.

So leave the shakedown cruises to less cautious individuals. Just repeat "patience is a virtue" a few times and read reviews while you're waiting, and remember that things will be less likely to blow up in your face when you finally get onboard.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20091023NigeriaAnnouncesEarlyResultsOfAntiScammerInitiative.html

Nigeria Announces Early Results Of Anti-Scammer Initiative

Nigeria's Economic and Financial Crimes Commission is the force behind Project Eagle Claw, and with Microsoft's help, has just started ramping it up. Waziri explained in a statement, "We expect that Eagle Claw as conceived will be 100% operational within six months and at full capacity, it will take Nigeria out of the top 10 list of countries with the highest incidence of fraudulent e-mails."

She then gave some very interesting details, continuing, "[U]pon full deployment, the capacity to take down fraudulent e-mails will increase to 5,000 monthly. Further it is projected that advisory mails to be sent to victims and potential victims will be about 230,000 monthly."

Anything Nigeria can do to address the problem of scammers operating from within its borders will of course be good for the country's image. More than that, it might help honest Nigerians become part of the online world (since some entities have just taken to blocking troubled regions as a whole).

Then there will be the benefit to the rest of the world, with maybe millions of dollars not getting lost. For that reason, Project Eagle Claw is likely to gain a lot of fans.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20090925MessageLabsNamesMostAndLeastSpammedStates.html

MessageLabs Names Most- (And Least-) Spammed States

Somewhat surprisingly, the states you might imagine as being the "most wired" - California, New York, Washington - weren't at the top of the list. Instead, the state in which spam represents the highest percentage of all emails received is Idaho, with 93.8 percent.

In an email to SecurityProNews, a Symantec/MessageLabs representative then listed the other top states (in order) as Kentucky, New Jersey, Alabama, Illinois, Indiana, Massachusetts, Pennsylvania, Arizona, and Maryland.

The U.S. territory of Puerto Rico wound up on the opposite end of the list, followed by Montana, Alaska, Kansas, South Dakota, Tennessee, Vermont, Rhode Island, Wisconsin, and Florida.

We're not quite sure what to make of these findings; the states don't appear to be ordered according to Internet penetration rates, GDP per capita, overall population, physical size, or anything else. Still, if you're looking to move, now you have a better idea of how to decrease the odds of getting bombarded with spam at your new home.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20090910EnormousMalwareArchiveCreatesStir.html

Enormous Malware Archive Creates Stir

Don't jump to the conclusion that the project's run by a bunch of supervillains; the malware samples are supposed to be "offered for the purposes of analysis, testing and malware research."

Also, customers are screened, and a monthly access fee of about $1,235 should act to keep out some of the riffraff.

It actually seems possible that the Malware Distribution Project could be of great help to the security community. When you consider that medical researchers don't have to wander from house to house, asking people if they have cancer, every time they want to start a new experiment, certain practices start to seem a little outdated.

There is a potential for problems, though. One nightmare scenario relates to the Malware Distribution Project's figurative walls failing and everything getting out. Having all of that malware run amuck at once - particularly if security researchers' computers were the first things it'd come across - would be bad.

Then there's the possibility that some unpleasant person would gain access to the Malware Distribution Project's archive and just sort of go on a shopping spree. This way, some relatively stupid hacker might be able to get his (or her) hands on the most sophisticated viruses in existence.

As you might imagine, the Malware Distribution Project is definitely proving divisive.

Anyway, at last count, the repository contained a whopping 3,336,503 files.

UPDATE (10-13-09): Anthony Aykut, the Managing Director of Frame4 Security Services, got in touch with SecurityProNews this morning to pass along some information. In an email, he wrote, "[T]he malware is neither downloadable via the web site or accessible in any other way via the www; in fact, the (secure) servers where the malware is stored (or analyzed/processed) is not even connected to the outside world."

Aykut also stressed that nothing is sold to the public, and added, "Largely due to the security measure(s) mentioned above, and also based on to the fact that the storage media are protected by biometric devices, getting access to the MD:Pro archive is, well, pretty impossible."

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20090909AvsimHackerMaybeBroughtBeforeCops.html

Avsim Hacker (Maybe) Brought Before Cops

Avsim is one of the best-known flight sim communities in existence. It's been around for a long time, too. Unfortunately, a hacker managed to wipe about a decade's worth of modification info and forum posts from the site's servers back in May.

Now, though, Tom Allensworth, the publisher and CEO of Avsim, has told the BBC, "We . . . have incontrovertible evidence of the individual that performed the hack. We have protected the forensic evidence and provided that evidence to the London police. We are committed to bringing justice to bear on this case."

Allensworth is confident in the outcome, too, adding, "We fully expect that the criminal complaint . . . will result in the perpetrator spending some time behind bars - under UK law." (Since Avsim's located in the US, this means he's not pushing for extradition or anything of that sort.)

Neither London's Metropolitan Police Service nor the accused individual (who hasn't been publicly named) has made any comment yet.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20090908EmailPasswordHackersPresentRealThreat.html

Email Password Hackers Present Real Threat

Tom Jackman wrote in an article for the Washington Post, "[S]ervices as YourHackerz.com are still active and plentiful, with clever names like 'piratecrackers.com' and 'hackmail.net.' They boast of having little trouble hacking into such Web-based e-mail systems as AOL, Yahoo, Gmail, Facebook and Hotmail, and they advertise openly."

Jackman found that prices for passwords range from around $30 to $100, which means that even the average ten-year-old can probably afford these hackers' services.

Plus, unless someone important is involved or things get rather serious, law enforcement isn't terribly likely to look into (or at least resolve) the matter, because accessing a computer without authorization is just a misdemeanor in most areas and tracking down a perpetrator can be difficult.

And it doesn't help, of course, that all of these facts have now been publicized in a widely-read newspaper.

So if you've got some nasty business rivals or psycho exes, at least try to play it safe by changing your password often for as long as you're in the person's sights. Then there's always the option of putting a few more miles on the odometer, too.

]]> SecurityProNews News http://www.SecurityProNews.com/news/securitynews/spn-45-20090828LaptopsCDsAlarmGovernorsCreditUnions.html

Laptops, CDs Alarm Governors, Credit Unions

The laptops may represent the more interesting development. Robert McMillan reports, "The U.S. Federal Bureau of Investigation is trying to figure out who is sending laptop computers to state governors across the U.S., including West Virginia Governor Joe Mahchin and Wyoming Governor Dave Freudenthal. . . . According to sources familiar with the investigation, other states have been targeted too . . ."

New HP laptops are apparently just showing up, unsought but ready for use, at government offices. That's fine if some Bill Gates-like figure has decided to give small gifts to our country's political leaders, of course. It's less fine if someone's trying to steal all of their passwords and whatever sort of public and private info they'd use the laptops to view.

As for the CDs, the problem appears to be smaller. Indeed, the discs probably just exposed some lapses in judgment. Malware infected CDs that were sent to credit unions were "part of an authorized pen[etration] test," according to Johannes Ulrich, who spoke with a Microsolved representative.

It doesn't look like any damage has been done, then. Just try to keep in mind the old warnings about knowing where stuff's been and gifts being too good to be true.

]]> SecurityProNews News http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100311AVGOffersLimeWireUsersImprovedProtection.html

AVG Offers LimeWire Users Improved Protection

People who don't approve of file-sharing can view this as a sort of community health issue, perhaps similar to the way homeless individuals are given clean needles free of charge. Having less malware out there should benefit everybody in the end, since viruses don't just attack folks who break the law.

As for what, exactly, the new deal involves, a formal statement explained, "LimeWire LLC has licensed the AVG Anti-Virus SDK engine and has integrated the anti-virus/ anti-spyware protection into LimeWire Pro, its premium file sharing software. Through this partnership, all files will be scanned before LimeWire Pro will allow them to play or execute on an end user's computer, which prevents infected files from harming machines."

Jason Herskowitz, Limewire's vice president of product management, then said, "LimeWire is committed to providing peer-to-peer's best user experience and we are vigilant about user security. We are always looking for ways to improve, and with AVG's seamless integration into LimeWire, we will be providing users with peer-to-peer's most secure technology."

The LimeWire-AVG integration should be in effect now, and it doesn't appear that LimeWire will raise the price of its Pro service ($34.95 per year) as a result.

With any luck, this development will have a noticeable and immediate effect. LimeWire Pro users are likely to be trading lots more files than the average person, after all, so it may not take long for the benefits to become obvious.

The one problem might be if LimeWire Pro users - who are presumably somewhat tech-savvy - already have good security software in place, and it's regular LimeWire users who represent the real security risk.

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100310MostMaliciousWebsitesHostedInUS.html

Most Malicious Websites Hosted In U.S.

The AVG research study is based on the analysis of threats reported during the last 6 months from AVG's 110 million global users of its LinkScanner security product. The research indicates an increase in malware serving websites targeting end users, which usually focus on stealing online baking information, credit card information, personal identities and passwords to social sites.

After the United States countries hosting the most malicious websites include Germany and China at just five percent each. Many of these malware-serving websites are legitimate sites compromised by hackers to serve exploits on their behalf. In total, exploitive servers were found in nearly 4,600 locations throughout the U.S.

AVG says it is important to note the research makes no statement about who owns or is directing the servers and the criminal networks are located all over the world.

"The results of this study shatter the myth that malicious code is primarily hosted in countries where e-crime laws are less developed," said Karel Obluk, Chief Technology Officer, AVG Technologies. "Our research shows that malicious content is much more likely to show up on web servers in the U.S. than one in Asia or Eastern Europe. This makes perfect sense since the USA is a primary target market for the criminals and has rich and mature Internet infrastructure making the threats both highly accessible and cheap to host."

"What is most striking is the clear rise in the number of malicious servers in the last six months. Today's hacking techniques are highly evasive so the average user cannot tell if a website is serving malware or not. A web security product is needed."

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100309McAfeeWarnsConsumersOfFakeAntivirusSoftware.html

McAfee Warns Consumers Of Fake Antivirus Software

Scareware is the first scam outlined in McAfee's new Consumer Threat Alert program that warns people about the latest and most dangerous online threats.

"Even the savviest of computer users fall victim to online threats because cybercriminals have become so sophisticated," said Jeff Green, senior vice president of McAfee Labs.

"The Consumer Threat Alerts are a warning sound to keep consumers from falling victim to online dangers. We're on the front lines watching and protecting against threats, and we pass that knowledge onto consumers."

Scareware is one of the most widespread, dangerous and sophisticated online scams, victimizing an estimated one million people around the globe everyday. McAfee says cybercriminals make profits of $300 million worldwide from scamming consumers with scareware.

Fake antivirus software pops onto a users' screen and alerts the users their computer may be vulnerable. To disguise the scam, cybercriminals create legitimate looking logos of fake security companies.

The pop-up prompts the user to scan the computer for vulnerabilities, which they don't realize is fake, or even buy the "security software" which is actually malware in disguise. Cybercriminals get victims to input their credit card information, giving criminals' access to the user's computer and bank details.

"It's an incredibly lucrative business for cybercriminals," said Francois Paget from McAfee Labs, a security research expert.

"In fact, one company known as 'Innovative Marketing' made an estimated $180 million through these scams in one year, and more than four million consumers purchased their fake security software thinking it was real."

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100308FBIDirectorWarnsOfCyberThreats.html
The Director said U.S. intelligence indicates the threat of cyber terror is "real and rapidly expanding," including the rise of extremist websites to recruit, radicalize, and incite violence.

Terrorists have yet to launch a full-scale cyber strike, but have "executed numerous denial-of-service attacks" and even defaced the website of the U.S. Congress following President Obama's recent State of the Union address. The Director told the crowd of cyber professionals that al Qaeda and other extremists "have shown a clear interest in pursuing hacking skills."

According to the Director, the FBI's cyber capabilities and partnerships include:

*Cyber squads in each field office nationwide, with over 1,000 specially trained agents, analysts, and digital forensic examiners who run complex undercover operations, share intelligence with law enforcement and intelligence partners, and provide training to counterparts around the world;

*More than 60 overseas offices-called legal attachs-that share information and coordinate joint investigations with their host countries;

*Agents embedded with police forces in Romania, Estonia, the Netherlands, and other countries; and

*Mobile Cyber Action Teams-highly-trained groups of agents, analysts, and experts in both computer forensics and malicious code who travel the world to respond to fast-moving cyber threats.

The Director stressed the relationship with the private sector is vital in reporting breaches of cyber security. "No one country, company, or agency can stop cyber crime," he said.

"A 'bar the windows and bolt the doors' mentality will not ensure our collective safety. We must start at the source; we must find those responsible."

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100305JailSentencesNotCertainForMariposaBotnetAuthors.html

Jail Sentences Not Certain For Mariposa Botnet Authors

According to Brian Krebs, Captain Cesar Lorenzana, who works for the Spanish Civil Guard, explained that prison sentences typically aren't associated with deeds committed from behind a keyboard. Plus, some things simply aren't against the law.

"In Spain, it is not a crime to own and operate a botnet or distribute malware," he said. "So even if we manage to prove they are using a botnet, we will need to prove they also were stealing identities and other things, and that is where our lines of investigation are focusing right now."

Furthermore, Krebs wrote, "[T]he men are all free on their own recognizance. . . . [T]hey are free to hoover up as much stolen data as they please, as the Mariposa working group has not yet been able to shutter the Web sites that served as the repository for personal and financial data stolen from people whose systems were ensnared by the bot."

The good news is that Spain is trying to modernize its laws, so even if the Mariposa's authors get off this time, they (and/or other cybercriminals) shouldn't be in the clear forever.

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100304McAfeeIntellectualPropertyPoorlyGuardedInAuroraAttacks.html

McAfee: Intellectual Property Poorly Guarded In Aurora Attacks

George Kurtz, McAfee's CTO, explained late yesterday on the McAfee Security Insights Blog that he discovered some problems with respect to the companies' source code configuration management systems (SCMs). Enough problems to call them "inherently insecure," in fact, as he found that attackers were able to "siphon out source code or, worse, modify and add code."

Kurtz then continued, "SCMs are used by software engineers to manage their projects and are used to store source code, the crown jewels of any tech company."

And as you might suppose, leaving one's intellectual property exposed isn't the best way to run a business.

In response, McAfee is taking a closer look at how SCMs should be secured, and Perforce, which is a popular management system, has been scrutinized in what's supposed to be the first in a series of white papers.

These lessons should benefit a wide range of individuals and companies, considering that many organizations have probably modeled their security systems after what Google, Adobe, Rackspace, and other corporations hit by Operation Aurora have in place. Hopefully an Operation Aurora 2 will become impossible as a result. Or at the least, perhaps some less organized and skilled hackers will be repelled.

Meanwhile, efforts to identify the people behind Operation Aurora haven't progressed much since the last time we discussed them. A security company called Damballa did issue a statement earlier this week alleging that the hackers used a "garden variety botnet" and were "more amateur than average," but Google has disputed this claim.

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100303OpenIdentityExchangeLaunches.html
OIX is a nonprofit entity meant to make exchanging online identity credentials a more secure process. It's gotten off to a good start, too, having already been approved as a trust framework provider by the U.S. government.

This means that OIX solutions should at some point allow American citizens to access all sorts of vital information on the Web. Drummond Reed, Acting Executive Director of OIX, explained in a statement, "As we roll out progressively stronger levels of certification, this will empower U.S. citizens to access and manage their tax records, Social Security records, veteran's benefits, and many other government services online."

Also, "OIX is currently working on development of trust frameworks for public media, telecommunications, library services . . . and professional associations."

You may not have to wait long to see these possibilities brought to (figurative) life. In addition to being backed by so many important partners, OIX has received grants from the OpenID Foundation and Information Card Foundation, meaning it's probably in good financial shape.

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100302M86SecurityFindsURLFiltersAntiVirusScannersIneffective.html

M86 Security Finds URL Filters, Anti-Virus Scanners Ineffective

M86 Security's new report, "Closing the Vulnerability Window in Today's Web Environment," indicates that anti-virus scanning correctly identifies just 39 percent of Web threats, which isn't exactly impressive. But the practice of URL filtering fares even worse, detecting just 3 percent of threats.

Assuming these figures are accurate, something obviously needs to be done, and it seems that adding a third layer of security may be the trick.

Bradley Anstis, the vice president technical strategy at M86 Security, explained in a statement, "To counter the specific cases that we analyzed in this report, and to ensure maximum efficiency, we believe a three-pronged approach of combining URL filtering, anti-virus scanning and real-time code analysis should be best practice."

This practice achieved a 100 percent success rate in M86 Security's testing. Although people should of course exhibit caution online no matter how well-protected their computers seem to be.

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100301QualysIntroducesMalwareScannerForSites.html

Qualys Introduces Malware Scanner For Sites

This service is supposed to do everything shy of solve a problem. The process starts with it conducting daily scans. Then, it'll alert sites' owners to any issues it uncovers. Finally, it should point out vulnerable snippets of code, making the removal of malware easier. All without delivering false positives.

Philippe Courtot, the chairman and CEO of Qualys, explained his company's motivation for introducing this service by stating, "We created QualysGuard Malware Detection as a way to fight against cybercrime and to make the Web a safer place for everyone."

He then continued, "This is a comprehensive free solution that arms businesses of all sizes to monitor malware threats on their web sites and take steps to remediate vulnerabilities."

Hopefully QualysGuard Malware Detection will live up to its billing. A free way of keeping sites and their visitors safe certainly sounds good, and is bound to become quite popular if it works well.

]]> SecurityProNews Insider Reports http://www.SecurityProNews.com/insiderreports/insider/spn-49-20100226NYMansPleadsGuiltyToSellingPiratedSoftwareOnline.html
According to court documents, Robert Cimino, 59, of Syracuse, N.Y., advertised the sale of discounted popular software programs on a number of Internet advertising forums, operating under the business name "SoftwareSuite."

Customers would contact Cimino by email and would usually buy the products using PayPal. Cimino would mail them pirated copies of Adobe, Autodesk, Intuit and Quark programs he had burned to CD or DVD to the customers. Cimino admitted that from February 2006 to September 2009, he received at least $270,035 from his sales of infringing software products.

Cimino is scheduled to be sentenced by U.S. District Judge Anthony J. Trenga on May 28, 2010. Cimino faces a maximum sentence of five years in prison, three years of supervised release, a $250,000 fine, restitution and forfeiture.

]]> SecurityProNews Insider Reports