TechBlog

Unlike the first malware authors who wrote viruses seeking fame through destruction, their motivation has changed to financial gain. Nevertheless, there are still the ones out there who share the first authors’ intent. I was analysing a simple Trojan today and saw the following message: It is not uncommon for malware authors to leave messages in their code for Researchers to read. This one did bring a smile to my face, so he was rewarded by it being named BackDoor-EKD which is an increment of one from BackDoor-EKC 😉

As any reader of this blog knows, cybercriminals can steal your money not just by putting malware on your machine, but by phishing attacks too. Phishing attacks don’t just target online banking and e-payment systems, but almost any site which asks the user to input sensitive data. Sites run by national government agencies are a prime example as they often demand a wealth of personal information which goes far beyond a simple user name or account number + PIN. While filling in a tax return online might seem like a great way to save time and paper, it gives cybercriminals a great opportunity to scoop all your details at once – data which could then be used to steal your identity and/or commit further crimes in your name. ...

The third version of Firefox has emerged as the most successful leader in the browser category of all alternatives to Internet Explorer. Since the official launch of its first release in mid 2008 has not only grown in use but also in popularity, although during this time there was a launch of the greatest threat that has known so far, Google Chrome. That is why, people from Mozilla are working hard to beat newcomer in the race to become the most popular browser. It is true that the current “saga” still has to cut fabric, then Firefox 3.6 It is planned for early 2010, and Firefox 3.7 will happen a few months later, respectively including versions 1.9.2 and 1.9.3 Gecko engine. ...

SysProtector and ApcDefender are two new rogue antispyware programs released in the past 48 hours. SysProtector and APCDefender are potentially very dangerous PC infections. These rogues use fake security alerts and warnings to trick people into thinking their PC is under attack, all the while they drop fake files on the system. These rogues will also prevent other programs from opening, hijack the web browsers and render the PC nearly useless. Below is a screenshot of a hijacked browser, showing fake threat warnings. ...

California software company Cybersitter LLC, has sued the People’s Republic of China and seven computer manufacturers in U.S. Federal court for stealing 3,000 lines of its Internet filter software code and using it in last year’s Green Dam fiasco in China. The suit, “Cybersitter v. the People’s Republic of China,” was filed in U.S. District Court, Central District of California (Los Angeles). It also names Acer, Lenovo, Sony Corp., Toshiba, Asustek Computer Inc., Benq Corp. and Haier Group as defendants. ...

PCProtectar is the latest rogue security software infecting PC’s across the interwebs. PCProtecter uses false security warnings and system scan results to trick people into buying the software. If your PC has been infected with PCProtectar, don’t fall for the scam. Do not buy this software, it is completely useless and an infection in itself. PCProtectar is a potentially dangerous infection that may cause programs to stop working, web browsers to not open, making it impossible to access the internet. PCProtectar should be removed from infected computer systems immediately. ...

We have a tool available to do just that. Click Here. How to use dd2010_decrypter.exe to do batch processing: Place the encrypted files in a directory (i.e. c:\encrypted_files\) Copy dd2010_decrypter.exe into another directory and FROM THAT DIRECTORY, run the following command: for %f in (“c:\encrypted_files\.”) do dd2010_decrypter.exe %f %f.decrypted All files in the encrypted_files folder will be processed and the new decrypted files will have the same name but their extension will be “.decrypted.” ...

Koobface is still going strong despite not making the headlines so much anymore. Well, the Koobface gang took the time to send a Christmas card and wish security researchers a happy new year. Very nice of them… For a couple of days now I’ve been looking at their infection method and trying to see any interesting patterns. The bad guys use bogus blogpost.com blog pages to redirect users to the actual Koobface malware. The redirection consists of several attempts to connect to compromised PCs, through their IP address. Below is a Fiddler log showing those attempted connections (in red are failed connections). Once a host has successfully responded, the users are redirected to a fake page prompting them to install a video codec. ...

There has been extensive news coverage this week of Adobe’s plans for ramped-up security in its popular Reader, Acrobat and Flash Player applications, especially the Reader and Acrobat updates promised next week. A vulnerability that was publicized in December in Reader and Acrobat allows an attacker to execute arbitrary code with a specially crafted PDF file using ZLib compressed streams. In a short time, proof-of-concept code was made public. In the past week, anti-virus companies began intercepting malicious .pdf files that exploit the vulnerability to install a back door on victims’ machines. ...

Seal Shield, a Jacksonville, Fla., company that makes washable computer keyboards and mice, said it will introduce the world’s first washable cell phone at the Consumer Electronics Show in Las Vegas this week. The company’s washable mice, keyboards and TV remotes can be cleaned in a dishwasher. This might be good. I have three 20-something step children who have discovered that cell phones as we have come to know them do not survive being dropped in toilets. ...