Bits & Bytes Computer Store

Adware biggest offender for computer infections

From http://www.connectitnews.com/canada/story.cfm?item=5549

Adware was the worst offender for causing malware infections in the first quarter of 2008, but Trojans were close behind the as the second most active category.

According to the Panda Software’s PandaLabs Q1 malware analysis and detection report, adware was the cause of 28.58 per cent of all infections, making it the leading cause of infections during the first three months of the year. Trojans followed closely behind with 25.46 per cent of all infections.

“Adware is a type of malicious code that shows ads while users surf the Web. Besides being annoying, many variants can compromise the computer’s security or performance, so users should take precautions,” said Luis Corrons, technical director of PandaLabs, in a statement.

After adware and Trojans, the figures dropped significantly. Worms accounted for 9.94 per cent of all infections, representing the third worst offender in the first quarter of 2008.

In terms of new malware strains that appeared in the first quarter, there were more new Trojans than anything else (62.16 per cent of new malware strains detected in Q1 were Trojans), followed by adware (20.34 per cent) and worms (8.87 per cent).

“The huge amount of new Trojans put in circulation every month indicates that cyber-criminals are interested in creating new strains more frequently, making detection increasingly difficult for security solutions, which will be unable to update signature files in time, leaving users unprotected,” Corrons said.

The two most active viruses in the quarter were adware. Comet topped the list as the most active virus, followed by NaviPromo. After that, the most active viruses were, in descending order, W32/Bagle.HX.worm, W32/Bagle.RC.worm, W32/Bagle.RP.worm, SaveNow (adware), Starware (also adware), W32/Puce.E.worm, Zango (adware) and Virtumonde (spyware).

The report also included a special section on threats to cell phones, smartphones, iPhones, etc. PandaLabs stated the three biggest threats to such devices are worms, Trojans and spyware.

“Their behavior and features are similar to those of malicious codes for computers,” said Corrons. “Trojans designed to steal confidential data like e-mail passwords, instant messaging contacts, etc., are the most prevalent, with 54.48 per cent of all infections. This shows attacks against cell phones are becoming increasingly sophisticated.”

The most common effects of malware for cell phones include cell phone blocking, battery consumption, sending of SMS to premium numbers, deletion of folders and messages, and theft of phone numbers, SMS or other sensitive data stored on the devices.

Botnet scams are exploding

http://www.e-channelnews.com/ec_storydetail.php?ref=415753

Two days after actor Heath Ledger died, e-mails began moving across the Internet purportedly carrying a link to a detailed police report divulging “the real reason” behind the actor’s death.

Bots are compromised computers controlled by profit-minded crooks. Those e-mails were spread by a network of thousands of bots, called a botnet. Anyone who clicked on the link got instantly absorbed into the fast-spreading Mega-D botnet, says security firm Marshal. Mega-D enriches its operators, mainly by distributing spam for male-enhancement pills.

Largely unnoticed by the public, botnets have come to inundate the Internet. On a typical day, 40% of the 800 million computers connected to the Internet are bots engaged in distributing e-mail spam, stealing sensitive data typed at banking and shopping websites, bombarding websites as part of extortionist denial-of-service attacks, and spreading fresh infections, says Rick Wesson, CEO of Support Intelligence, a San Francisco-based company that tracks and sells threat data.

“It’s like a disease you can’t even feel,” Wesson says. “The mechanisms we use to protect our networks simply are not working.”

The botnet problem shows no sign of easing. Security firm Damballa pinpointed 7.3 million unique instances of bots carrying out nefarious activities on an average day in January - an astronomical leap from a daily average of 333,000 in August 2006. That included botnet-delivered spam, which accounted for 91% of all e-mails in early March, up from 64% last June, says e-mail management firm Cloudmark.

The upshot of this deluge is profound, if not immediately obvious, says Adam O’Donnell, Cloudmark’s director of emerging technology. Telecoms and Internet service providers must absorb the cost of carrying botnet traffic; they can be expected to pass that expense onto companies and consumers, he says. Meanwhile, tens of millions of botted computer users are experiencing degraded performance with no clue why.

Beyond that, cybercrime gangs are stockpiling enough stolen data to fuel identity theft scams for years to come. Meanwhile, law enforcement is negligible, and security protections for consumers and businesses remain, at best, patchwork and haphazardly deployed, says Somesh Jha, computer science professor at the University of Wisconsin-Madison. “The botnet landscape is shifting, and the worst hasn’t happened yet,” says Jha, who is also chief scientist at security software firm NovaShield.

A perfected Storm

Exhibit No. 1 showcasing botnets’ criminal potential: the mega botnet Storm.

At first, the e-mail that began circulating on Jan. 19, 2007, appeared to security researchers to be a garden variety e-mail virus. It carried a tainted link to a news story about a deadly storm. In fact, the gang that released the e-mail had spent months preparing a strategy for amassing a sprawling, impenetrable botnet designed to self-replicate.

Fourteen months later, Storm remains entrenched as the largest, most active botnet clogging the Internet. Security experts credit Storm’s operators with breakthroughs now being widely emulated by copycat botnet operators.

Storm was first to make wide use of peer-to-peer, or P2P, communications - the technology that allows one computer to share files with any other computer across the Internet. Bots in a botnet typically receive instructions from a central PC, called the command-and-control server. Authorities are getting better at discovering and shutting down such central servers.

So Storm’s operators perfected a way to use P2P communications to issue commands from a rotating subset of PCs inside the botnet. As extra protection, Storm became the first botnet to encrypt its instructions.

“They’ve built a very resilient infrastructure,” says Dmitri Alperovitch, principal researcher at Secure Computing. “If one command server gets shut down, it moves to the next.”

Meanwhile, Storm rewrote the book on the psychological ploys - known as social engineering - that lure victims into clicking on tainted attachments or Web links. Storm e-mails arrived with irresistible links to holiday-themed greeting cards, Beyoncé Knowles and Kelly Clarkson music videos, even an NFL game-tracking tool. Storm peaked last July, infecting an estimated 1.7 million PCs, according to Symantec.

Anti-virus firms began to block Storm e-mail, and Microsoft (MSFT) helped clean up Windows PCs infected by Storm. But Storm’s operators proved adept at dodging the latest anti-virus filters. Subscribing to the idea that the best defense is an aggressive offense, they also began attacking any researcher who tried to isolate any of their bots. Outsiders detected trying to establish contact with a Storm bot are inundated by an avalanche of nuisance requests launched from the wider botnet.

“Storm has a self-defense mechanism,” Alperovitch says. “Any time someone probes the botnet too much, it reacts automatically and starts a denial-of-service attack against that researcher.”

Tool of choice

The result: Storm endures as the king of botnets with several hundred thousand infected PCs doing its bidding on any given day. Yet Storm is really a one-trick pony. It generates cash mainly by spewing spam urging recipients to buy shares in obscure companies, the linchpin to an array of scams spinning off the artificial inflation of the share price.

Another tier of smaller, multipurpose botnets spring from widely available tool kits that make it easy for anyone to infect computers, assemble a basic botnet and embark on a criminal career. Dozens of crime rings, for instance, have cropped up to run phishing scams that lure victims into clicking on fake Web pages where they get tricked into divulging passwords and other sensitive data.

Botnets distribute phishing spam, host phishing Web pages and store phished data. Since 2005, phishers have used botnets to take aim at more than 1,750 companies and government agencies, mainly financial institutions, including 106 fresh targets in the fourth quarter of 2007, according to a survey by security data firm Cyveillance.

Phishing expeditions are just one of many uses of botnets. Some botnets crawl the Internet looking for Web pages that can be corrupted with pop-up ads selling fake anti-spyware; some implant programs on popular Web pages to harvest any sensitive personal data typed there by visitors; some repeatedly click on online advertisements to earn fraudulent “click through” revenue.

“Botnets have become the tool of choice for bad guys,” says Rick Howard, director of intelligence at VeriSign iDefense. “You take over a box (PC), put it in your botnet and forevermore you own that box and can do whatever you like with it.”

One particularly invasive collection of botnets, known as Zbot, is controlled by Russian crime groups going by the online designations UPLEVEL, CAR Group and Glamorous Team. Zbot’s operators late last year got away with swiping millions from banks in four nations, says Don Jackson, a senior researcher at SecureWorks who has been monitoring Zbot.

“We know that the amount stolen in December, which affected banks in the USA, U.K., Italy and Spain, was just over $6 million,” Jackson says. “This is based on sources within the banks and law enforcement that work with us.”

The scammers enticed bank customers to click on a link purportedly to download an updated digital certificate, the equivalent of a digital ID card. Instead, Zbot installed a program that positioned it to come along for the ride the next time the user successfully accessed the account. Zbot then automatically executed cash transfers to other accounts controlled by its operators - while the victim did his or her online banking.

“This scheme is extremely clever and quite ironic considering that digital certificates are provided by financial institutions to protect online bank users from fraud,” Jackson says.

Spyware the real cost

From Connect IT News.

http://www.connectitnews.com/canada/story.cfm?item=5538

In a recent survey commissioned by CompTIA and conducted by Washington, D.C.-based consultancy Kotler Marketing Group, which polled 537 non-IT employees at businesses with 10 to 200 computer users, more than one in four end users reported having their productivity impacted by a spyware infection during the past six months. Of these, more than one-third reported multiple spyware infections.

According to Steven Ostrowski, director of corporate communications at Oakbrook Terrace, Ill.-based CompTIA, lack of training seems to be behind much of the spyware problem. “Users don’t know oftentimes how to compute safely, how to do e-mail the proper way, and that they shouldn’t open certain e-mail attachments or visit certain web sites,” Ostrowski explained. He added that education has to become more of a business issue rather than a responsibility that sits on the shoulders of the IT department. “The human element continues to be probably the biggest factor in computer security issues that companies are facing…but it has not resonated with a lot of companies that they need this educational component.”

The spyware problem is also cropping up more frequently simply because there is more of it. “The numbers continue to increase despite the efforts of companies to come up with anti-spyware technology,” said Ostrowski. “It seems to multiply and for every step we take to address the problem, it seems that (spyware makers) are two steps ahead.”

The survey also found that users of spyware-infected computers reported living with the problem for 18 work hours — more than two full work days — before getting it repaired. This tended to happen even though users realized that their work productivity was reduced due to the problems associated with spyware. In fact, respondents estimated that their productivity was reduced by 21 per cent when the spyware issue was first noticed, and was reduced by 32 per cent when the problem was at its peak.

While there may be some users who are simply unaware that spyware has infected their computers, it is likely more common that employees will know the source of the problem but will not report it because they are afraid of getting into trouble, Ostrowski said. “There is a fear factor involved because they may be doing something they shouldn’t be doing on their computers during work hours,” he explained. “Eventually after a day and a half they will call the IT department and say ‘I’ve got this problem.’”

CompTIA also polled 200 IT professionals who support small and mid-sized businesses on some of the issues they face. PC support pros who had fixed at least one spyware incident during the past year reported spending an average of 2.8 labour hours per infected PC. That translates into more than 20 hours of reduced worker productivity for each spyware incident at a small business.

Ian says: “This is why I try and educate customers about the hazards of peer-to-peer networks and other risky behaviour when using their computers”

No wonder he gets a little grumpy when he’s told “It’s my computer I can do what I like with it”

Little Red Riding Hood Fights Online Fraud

http://www.e-channelnews.com/ec_storydetail.php?ref=415698 

Online fraud is on the rise, and fraudsters have developed sophisticated means of accessing consumers’ sensitive personal information over the Internet. Canadians are being caught by malicious phishing emails and spoof websites, and it’s getting harder to differentiate between what’s real and what’s not.

March is Fraud Prevention Month. With a mandate to “Recognize It, Report It, Stop it,” the Fraud Prevention Forum aims to educate consumers and raise awareness about the dangers of online fraud.

Technology expert, author, journalist and consultant, Marc Saltzman is eBay Canada’s Online Safety expert and can provide advice and tools for identifying and avoiding online fraud and identity theft.

To help Canadian consumers identify and combat phishing attempts and spoof websites, Saltzman uses a video tutorial using the iconic fairy tale figure, Little Red Riding Hood.

- Just over 13,000 unique phishing reports were received by the Anti-Phishing Working Group in August 2005. By August 2006, that number grew to over 26,000.

- More than 10,000 phishing websites exist worldwide to date; almost double the number that existed in 2005

- Reports of phishing complaints to the APWG increased by 34% in the last 12 months

- Up to 5% of these complainants have taken the ‘phishermans bait’ and experienced financial loss as a result of online fraud

McAfee notes malware becoming localized

http://www.connectitnews.com/canada/story.cfm?item=5429

A new report released by McAfee Inc. notes that malware attacks are becoming more regionalized where attacks are being tailored to different cultures and technologies as well as in a person’s own language.

“Two years ago we couldn’t have this conversation, as 98 per cent of threats globally were written in the English language or targeted at the English language. Contrast that to last month where seven per cent of attacks were not in English. It just really means more and more people around the world are getting attacked in their local language,” said Dave Marcus, security research and communications manager at McAfee Avert Labs.

Some of the trends noted in the report, entitled “One Internet, Many Worlds,” include sophisticated malware authors have increased country-, language-, company-, and software-specific attacks and that cyberattackers are increasingly attuned to cultural differences and tailor social engineering attacks accordingly. For example, Marcus noted that attackers targeting people in Germany developed spam geared towards specific cultural interests or events such as the 2006 FIFA World Cup.

Additionally, cyber criminals, particularly those in the United States, will recruit malware writers in countries with high unemployment and high levels of education such as Russia and China in order to get them to write malware code in their local language.

“It is going to be difficult for malware writers in the U.S. to write effective malware to target Chinese people. They need someone that speaks Chinese so they get someone local or contract that task out,” said Marcus.

Other trends noted include cybercriminals taking advantage of countries where law enforcement is lax and that around the world, malware authors are exploiting the viral nature of Web 2.0 and peer-to-peer networks. Also, more exploits than ever before are targeted at locally popular software and applications.

Geographic trends include the U.S. becoming a great malware melting pot where malware in the country includes elements of malicious software seen around the world.

Marcus said the best defense against these localized attacks is education along with having up-to-date security technology.

“If you are a world traveler you got to be aware that certain parts of the world will experience certain threats that may not be in other parts of the world. I need to be educated so I can take action on it or that I am appropriately protected,” he added.

As well, Marcus believed that these localized malware attacks are here to stay and expects the number of attacks to double over the next year.

“It speaks to the fact that more people around the world are coming online and if you really want to steal their identities you have to talk to them in their local language. It is just going to be an even greater problem in the future,” said Marcus.