US Treasury Sites Reportedly Infected With Malware

It's never a good sign when your federal government - especially the US Treasury - ends up with compromised web sites that are serving up malicious code. So what's going on?

According to security vendor AVG, three domains associated with the Bureau of Engraving and Printing's home page were infected by malware. The three domains have since been taken offline.

Via Yahoo News:

According to Thompson, hackers had added a small snippet of virtually undetectable iframe HTML code that redirected visitors to a Web site in the Ukraine that then launched a variety of Web-based attacks based on a commercially available attack-kit called the Eleonore Exploit pack. 

Still to come are the details behind how the malicious iframe code got placed on the sites. There have been a large number of hosting providers that have been compromised of late, so perhaps these domains were part of the same attack scenario.

Beware of Fake Anti-Virus Software

It's an unwritten rule that you never need anti-virus software until you need it badly. The corollary to that edict is that, being signature based, AV programs are only as good as what they already know, and studies have shown that leading anti-malware offerings fail to detect upwards of 50% of malicious code.

If that isn't enough to make you ponder an existence as an internet hermit, then perhaps the concept of fake anti-virus software will push you over the edge.

Researchers are reporting that increasingly, users are tricked by web site pop-ups and bogus warnings of virus infection detections followed by "suggestions" to download readily-available virus removal programs that are themselves malicious code. Once the user willingly runs the program, their machine is immediately compromised and often proceeds to download additional malcode in the background.

What can you do to protect yourself? Here are a couple of key things to remember.

1. Never, ever install a program or run a command unless you are absolutely certain of its source.
2. Ignore pop-ups, warning banners, and browser redirects. Trust me - the Internet is not one big loving community that exists to help you out. Rely only on warnings from programs you've installed yourself.
3. Always have a rescue CD available for virus removal, and don't be shy about using it if you're concerned. Brian Krebs has an excellent post on finding and using rescue CDs at his Krebs on Security blog.
4. Move off of Internet Explorer. I recommend Firefox with the NoScript add-on, but Google Chrome or Opera are other good options.
5. Keep your computer patched. If you're running Windows, enable automatic updates, and use a free product like Secunia PSI to help keep track of updates to popular applications like Adobe Reader, Sun Java, QuickTime, and other frequently overlooked programs.

Let's be careful out there.

Vodafone Android Phone Comes With Mariposa Malware

It's always helpful when vendors ship malware right to your doorstep with the products you've purchased.

Panda Security has reported that they've discovered Mariposa malware on a brand new Android phone purchased from Vodafone.

From SANS:

It didn't infect the phone proper, but it did have autoexec.inf and autoexec.bat files designed to infect whatever Windows machine the phone was plugged into via USB cable.

 If you haven't disabled autorun on your Windows machines, and if you don't have some sort of malware protection on your mobile devices, you're a sitting duck.

You've been warned.

Facebook's FarmVille: Fertile Fraud Terrain

More than 75 million Oliver Douglas wanna-bes play FarmVille, making it the most popular game application on Facebook. But it's possible that something smells, and it's not virtual manure.

The dangers of apps like FarmVille and Mafia Wars were part of a larger discussion of the perils of social networking at the 2010 ShmooCon security conference. As more people gravitate toward sites like Facebook and Twitter, both locations become target-rich environments for malware authors and those seeking to abscond with your personal information for fraudulent purposes.

If your aunt or nephew can't figure out how to post a picture on their wall, what confidence do you have that they have correctly configured their sharing and privacy preferences for optimal protection?

More to the point, how likely are they to click on a bit.ly link provided by a "friend" that purports to be an official update or better yet, tips or tricks, or the latest information on how to score unlimited "farm coins"?

From ComputerWorld:

"Facebook has 350 million users with 12 million logging in daily. Twitter is getting 6.2 million new users a month. The target base keeps growing," said Eston, a penetration tester for a Fortune 500 financial services organization.

In one of their more colorful examples, the trio explained how actress Jessica Biel is the most dangerous woman on the Internet because of all the fake profiles of her scattered throughout the social networking landscape.

People on Twitter are easily duped into thinking Biel is following them in Twitter. The Facebook folks proudly count her among their friends, not realizing the page is really under the control of a malicious operator who wants you to click on malicious links on the page.

We would all like to think that Jessica Biel is following us, rather than the other way around (stupid restraining order!). But let's be honest - she's just not that into you. But Russian organized crime members are, and they have all sorts of sites they want you to visit with your unpatched Windows laptop with outdated antivirus software running Internet Explorer 6. Oh yes.

Why do people rob banks? Because that's where the money is.

Why do fraudsters frequent Facebook? Because that's where the low-hanging fruit is.

You've been warned.

Image via Wikipedia

Catching a Virus On the Web

If you want to avoid catching the flu, stay out of public buildings and airplanes. If you want to keep your computer from catching malware, avoid web sites.

Seems drastic, right? But a recent report by Dasient identifies 640,000 web sites and 5.8 million web pages as being infected by malware.


If that's not frightening enough, how about this handy information?

Meanwhile, the Google blacklist of malware infected sites has more than doubled in the last year, registering as many as 40,000 new sites in one week.

Most of the malware is delivered via JavaScript or iFrames injected into otherwise legitimate sites, which means two things - first, that web developers are still doing a crappy job of securing their code, and second, you can't even trust mainstream sites.

That means it's time for me to again rant about using a browser other than Internet Explorer, advise you to keep your Windows OS (if you insist on sticking with Microsoft) and any applications fully patched at all times (Secunia PSI is a good choice, especially for peripheral apps), and run a recognized antivirus product that's updated at least daily.

Oh, and if you're using your computer for online banking, financial transactions, or shopping, you may want to check out my posting here on using a Live CD to keep malware from stealing your information.

Via cnet Insecurity Complex

Image via Wikimedia Commons

Microsoft Office Web Components Vulnerability

So you system admins out there thought you would get a vacation this summer? Not if Microsoft has anything to say about it!

Redmond has released Microsoft Security Advisory 973472 regarding a quirky vulnerability in Microsoft Office Web Components. The flaw seems to be in the Spreadsheet ActiveX control, and if successfully exploited, the attacker could end up with the same rights as the local user.

Damn you, ActiveX! Damn you to hell!

While Microsoft reports that exploits appear to be minimal and targeted, several antivirus vendors are seeing websites, mostly in China, dishing up the exploit as part of a pre-canned kit that downloads and runs a Windows executable. One vendor, Sophos, calls it "Mal/Generic-A."

A number of products are affected, including (but not limited to) Office XP & 2003, ISA Server 2004 and 2006, and Office Small Business Accounting 2006. For the full listing, check out the advisory.

As usual, Microsoft has a workaround that deals with setting killbits, but make sure you know what this might break prior to implementing, especially if you do a lot of displaying and/or publishing of charts and spreadsheets to the web.

ATM Malware

Great - just when I was getting good at defending myself from phishers, vishers, social engineering, viruses, trojan horses, keystroke loggers, cross-site scripting attacks, forged SSL certificates, and other such threats to my personal banking, word comes from Eastern Europe that crooks have decided to cut out the middle man and just install malware directly on the automated teller machines.

The malicious code captures PINs and magnetic stripe data from the ATM's memory, which they then use to drain cash from accounts.

This is a highly sophisticated attack and certainly steps up the game. Since most modern ATMs are loaded with Windows XP, there are plenty of holes to be exploited. It took financial institutions years to get their ATMs off of legacy Windows NT Workstation and Windows 2000 Professional operating systems, and most only did so because vendors were leery of supporting hardware for which Microsoft refused to provide OS security support.

This new attack still takes an insider, either an ATM technician or someone with keys to install the malware, but since the average ATM contains $600,000 when fully stocked, paying someone off wouldn't be that difficult.

Time to go back to stuffing cash in the mattress.

New ATM Malware Captures PINs and Cash , via Wired

Adobe Drops Patch Tuesday Hammer on Us

Adobe products have been the proverbial deer in the security headlights the last couple of years, with the firm standing accused of everything from shoddy application development to long turn-around times on their fixes when problems are discovered.

Some of the same charges were historically leveled at Microsoft, who responded with a hailstorm of security patches each time they had a fix to roll out.

Beleaguered system administrators and corporations wailed about how difficult it was to keep up with the pace, since one hotfix had barely been tested and deployed before another was in the chute.

Microsoft responded by designating the 2nd Tuesday of each month as "Microsoft Patch Tuesday", as it came to be known amongst the tech crowd. While it didn't necessarily stem the flood of fixes needing deployed, it did allow for better resource management and regular cycles for UAT testing prior to distributing the code into the production environment.

It seems Adobe has taken a lesson from Microsoft, in that they have announced that they will release security fixes on a quarterly basis, on the 2nd Tuesday of every third month.

Adobe, responding to criticism of poor security practices and a maddeningly slow response to known vulnerabilities, also promised to release emergency fixes on a more timely basis while doing a better job of continuously reviewing their products from a security engineering perspective, the hope being that they will identify (and close) vulnerabilities before they become widely known and exploited. This would be welcome news for security professionals, who have seen Adobe products targeted in almost half of the targeted attacks so far this year.

By emulating Microsoft's refined process already institutionalized in most companies, Adobe hopes to piggyback off of the painful lessons learned in Redmond. That strikes me as an admission that Adobe doesn't know how to execute core vulnerability management processes or develop them internally.

This approach is obviously meant to stop the bleeding as more infosec professionals are contemplating moving away from Adobe's platform to alternative products that have less of a target painted on them.

While I wish Adobe success in their endeavor, I'm not optimistic that they will be able to maintain the pace of the security patch treadmill over the long term.

Give Someone W32.Sality.AE for Christmas

If you're looking for that last minute gift idea for a friend or co-worker who isn't on your "nice" list, how about a nice virus that infects executable files and then attempts to download malicious software from the Internet?

I know what you're thinking - I would never give a present like that. If you're handing out digital picture frames, don't be too sure.

As seems to happen every year, some digital picture frames are coming pre-loaded with assorted malware. In this case, it's the Samsung Frame Manager 1.08 software for Windows XP that comes bundled with a number of various Samsung frames.

Amazon.com took the unusual step of distributing the following communication to customers who purchased the SPF-85H 8-Inch Digital Photo Frame:

"The alert involves the SPF-85H 8-Inch Digital Photo Frames w/1GB Internal Memory, designed to work with Windows-based PCs via a USB connector," the warning states. "They were sold between October and December 2008 for about $150. ... If you are using Vista or a different version of Frame Manager, this issue does not affect you."

Samsung has an updated version of the Frame Manager software available for users, and they recommended using your favorite antivirus program to quarentine the virus. 

Thanks, Samsung! I have a better idea - how about if you stop shipping me infected stuff?

This issue first popped up more than a year ago, and it leverages a known weak point in the exploit matrix - users will plug anything into their computers without giving a second thought to where it comes from or what it might do. 

In the early days of personal computing, floppy disks were the primary delivery mechanism for viruses, because computers weren't networked like they are today, so transport via disk was the preferred distribution method. Users got (somewhat) comfortable with doing a quick virus scan of the media before running it. If they didn't, it wasn't long before a corrupted Master Boot Record or trashed registry reminded them. Hard lessons tend to be remembered longer.

As we moved out of physical media into a networked world, more malware was delivered digitally, either embedded within other software (you didn't think that downloaded copy of Microsoft Office was completely free, did you?) or as a self-executing file attached to an email that ran when the message popped up in your email program's preview pane.

This caused us to develop media malware amnesia, and we turned sloppy when we opened a new CD or DVD and inserted it into our machine. After all, we sort of trusted the company who sold us the media, and in any event, our antivirus/antispyware/OS defender program would save us. Right?

But as always, it's up to the user to provide the last line of protection against the various forces of evil that are out there. As my friend Kevin, an incident handler at the SANS Internet Storm Center says, "The user's ability to do stupid things continues to trump my ability to keep them safe."

So if you're looking for a good gift for your friends and family this year, how about a list of computer security tips to remind them of how easy it is to do their part?

For that, you can reference Mark Hofman's ISC diary entry on The 12 (or so) Hints of Christmas.