Zombie Awareness Month

Today is the first day of Zombie Awareness month.

As such, I’d like to talk to you about the computer type of zombies.

You see, computers can become zombies quite easily if they are not properly cared for. Unlike humans, for whom there is no known zombie virus, there are a ton of nasty infections that can turn your computer (be it a PC, or a Mac) into a zombie.  Bad folks on the internet intent on using YOUR computer to make THEM money will set up websites designed to download just such an infection to your computers which will in turn allow the attacker to take over the mind of your computer, making it a zombie (sometimes also referred to as a bot).  These zombie computers link into something called a botnet and are then controlled by the zombie master (bot herder) who set up the site that infected them in the first place.

This nasty person bent on controlling your PC to his/her advantage may then send SPAM from it, use it to attack other computers or websites on the internet, run some money making scheme involving lots of processing (like bitcoin mining) from it, log your keystrokes and use what you type to learn your passwords to your bank and other places where the attacker could steal money from you.

The thing about computer zombies is that they have to talk to their master to learn what he/she wants them to do next. A good protection against that is a firewall that can alert you to new programs trying to make outbound connections. Most paid antivirus programs come with such a firewall, newer versions of Microsoft Windows even have one like that built in, and for older Windows computers that don’t, there is always the free ZoneAlarm or Comodo firewalls.

If your home computer asks you if it’s ok to let a new program connect to the internet, that’s what I am talking about. If you see it ask about letting a program you didn’t install make connections, just say no, run a virus scan and maybe a tool like Malwarebytes to search out the source of the infection. If you are not comfortable doing this on your own, seek help from a professional. Don’t let your zombie computer continue to use the internet, nothing good can come of that.

Microsoft EMET

Over the holidays some of you may have seen some version of this story:
http://thenextweb.com/microsoft/2012/12/29/criminals-use-adobe-flash-and-new-ie-vulnerability-in-targeted-attacks-ie9-and-ie10-users-are-safe/

or if you are a security geek, this one:
https://community.rapid7.com/community/metasploit/blog/2012/12/29/microsoft-internet-explorer-0-day-marks-the-end-of-2012

Once again, a new 0-day Internet Explorer vulnerability was discovered that affects IE7 and IE8. On the 29th an exploit for it was introduced into Metasploit, and you know they say, crimeware advances at the pace of Metasploit. (Metasploit is open source, so any programmer can see exactly what they did to expolit the bug and copy that if they have not already figured it out for themselves.)

You may note that aside from upgrading to IE9/IE10 there is a suggestion that you could mitigate this vulnerability by running EMET. The only realistic action for many businesses to take would be EMET.

This is not the first time you might have seen this suggestion, but most people I have talked to who are not well read on IT security have never even heard of EMET.

The tl;dr executive summary is:
EMET stops malicious programs running in the context of legitimate programs by killing the whole process before the malicious code can do it’s damage. This allows us to protect against some unpatched vulnerability exploits. It is free and MS supports it.


What does EMET do?
EMET (Enhanced Mitigation Experience Toolkit, I think that’s a rather poor name, so I will always refer to it as EMET) is a free program from Microsoft (fully supported by MS) that allows you to specify various security mitigations that are built into Windows, but not often implemented in software.

DEP, ASLR, and SEHOP can be turned on at a system level (although they are not by default)
DEP, SEHOP, NULL Page, Heap Spray, Mandatory ASLR, EAF, and Bottom-up ASLR protections can be turned on for individual applications. (see manual for more info)

DEP is already mandatory on 64bit Windows for all 64 bit processes, but not for 32bit programs. All of the rest are optional, and often not implemented by software developers even if there is no reason they need to avoid them. EMET allows you to turn these abilities on even for programs that were not designed for them. (Caution, some of these may break things for some programs, but they are easy to switch on and off)


EMET has 3 lists of defaults that can be set for applications. These defaults have already been tested by engineers at Microsoft. They can be set by importing one of the 3 default lists that come with it, or via GPO (more details below)

Sophos False Positive for Shh/Updater-B

I have been talking about Sophos a lot lately, so I feel kind of responsible if someone started using it because of me and woke up this morning to a startling "outbreak" of Shh/Updater-B.

This is a false positive that accidentally disabled the Sophos updater. It somehow made it past Sophos QA and caused a lot of people headaches last night.

The IDE that is responsible is agen-xuv.ide

This is a quick little script that stops the Sophos Antivirus service, deletes that IDE and restarts the service. You can run this on the update servers and any workstations that give you problems afterward via PStools.

net stop savservice

if %PROCESSOR_ARCHITECTURE%==x86 (
  rem 32 bit
del "c:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide"
) else (
  rem 64 bit
del "c:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide"
)

net start savservice

After running this Acknowledge alerts in the Enterprise console.
I hope this helps a few of you.

If you need to empty quarantines on individual machines try this, but be careful not to empty a quarantine that contains a real virus, this releases the lock on quarantined files if you are using the recommended setting of deny access instead of move or delete.

net stop savservice
del "%ALLUSERSPROFILE%\Sophos\Sophos Anti-Virus\Config\Quarantine.xml"
net start savservice

Thanks to The folks at Sophos who published this last night and tweeted it out to the world.  http://nakedsecurity.sophos.com/2012/09/19/sshupdater-b-fsophos-anti-virus-products/

Sophos Mac Antivirus Home Edition

Did you know that while Sophos doesn't have a home edition of their PC antivirus they do have a FREE home edition for Mac?

It supports OSX 10.4 (both Intel and PPC) all the way up to 10.8 Mountain Lion.

What's that you say? Macs don't need Antivirus? are we still arguing that old point? Well then, yes they do!

At the SecTor security conference at the beginning of October, Seth Hardy will be talking about a new development in Mac malware attacks. Targeted attacks:

APT ALL THE THINGS: are Mac users no longer safe? - Seth Hardy

A new development of 2012, targeted attacks (APTs) against human rights now often include malware specifically designed to compromise Macs. Mac users have long thought they're safe, for a variety of reasons including: "nobody ever targets us" (not anymore!), "Macs are based on Unix so have additional security" (not if new vulnerabilities are found, or you choose to run the program), and "we're not using Internet Explorer or Outlook so most threats don't work" (other software can be just as buggy).

One region in particular has started using malware "bundles" that detect the target's operating system and serve up the appropriate program to compromise computers within NGOs and other human rights organizations. This is a relatively new development, with names starting to become more familiar: e.g. SabPab (related to the known LuckyCat campaign), Lamadai, and MacControl. This also coincided with the rise of the Flashback botnet - a Mac-specific botnet believed to at one point be over 600,000 strong. In this talk we'll look at targeted Mac malware, observe similarities and differences to "conventional" targeted attacks, and go over some end-of-year thoughts as to where Mac malware may be going next.

For home users on PC, you can get Sophos' virus removal tool  for free, but if you want the real deal, you have to buy at least 6 licenses of the coprorate product.  While it is good, I'd recommend most home users on PC look at another product.

Sophos

This is going to sound like a sales pitch, but I assure you I am not being paid by Sophos to say this.

I've been deploying Sophos Anti-virus at work in stages over the last month or so, and I am continually amazed at how many of the JavaScript Trojan droppers and Fake Antivirus programs it is finding in people's temp and temporary internet files, or buried in system restore points that the previous antivirus just plain missed.

I'm not talking about bleeding edge definitions for variants that just came out the day before the switch either. I'm talking about stuff that's been sitting in temp for months in some cases.

If you are curious how it'd do in your environment, download the free removal tool and run a one time scan of your system. or sign up for a trial of the full thing. It really does find stuff that the other guys miss. http://www.sophos.com/en-us/products/free-tools/virus-removal-tool/download.aspx

Sophos doesn't have a home user product like most of the other antivirus companies, but even for small businesses they have packages that are fairly affordable, especially if you bundle several products. With our government pricing we managed to get a replacement for our antivirus including e-mail servers, plus a spam appliance as a VM and mobile device management, endpoint encryption, and a few other things for about what we were paying for maintenance on the anti-virus parts with another company.

Advanced Evasion Techniques - Stonesoft and ICSA

I attended SC Congress Canada 2011 on Tuesday and Wednesday this week, and perhaps the most interesting talk I attended was Stonesoft and ICSA's Advanced Evasion Techniques.

Stonesoft discovered that with certain evasion techniques (particularly when combined in particular combinations) they could sneak common exploits past many (including their own, at the time) IDS/IPS systems. They built a tool to repeat these tests on a variety of systems, and proved that with the right know how, and the right tool set (including a custom TCP/IP stack) attackers could sneak past our best defenses. Packet captures were sent to ICSA along with info so they could try to reproduce these results in their own labs. They did!

This is real and they foresee a not -too distant future where things like botnet kits will have this as a checkbox feature.




These evasion techniques are not attacks on their own, but rather a sneaky way to get whatever attack you want to use past the network monitoring and policing systems to the target host.
It's not about the bad-guy asking "How can I hack in?", but "How can I hack in without being seen?"




Check out the research paper, and packet captures if you are really techie, at http://www.antievasion.com/

Epsilon: Be wary of Phishing attempts coming from legitimate looking e-mails

We all subscribe to e-mail newsletters in some form or another.
We all get those deal of the day e-mails telling us the latest deals at our favourite retailers or Air Miles updates with links back to the Air Miles site and vacation deals.

We all need to be a lot more careful.

Last month Epsilon, a marketing firm that deals with many of the retailers we all know and trust was hacked.
At first it was downplayed as not important because the hackers only got names and e-mail addresses. No credit card data was ever stored by Epsilon on the systems that were breached, and in fact they would not have that info in most cases because they are just the guys who send out those e-mail newsletters on behalf of retailers and banks.

Not long after, people started to realize the implications of this breach, but the problem is, even the tech press never really got the point across very well, and it was usually ignored by readers because the news sites only ever listed a handful of companies that were affected.

Most people reading about the breach are probably thinking, "I don't deal with those companies, I'm ok" looking at the short list of 3-4 examples in most news stories about it, or "so they got my e-mail address who cares, I get spam all the time".

The issue is they got e-mail addresses, and names linked to retailers and banks that you DO deal with and that you are already used to getting e-mails from. ...e-mails that already link to a 3rd party, that takes stats then forwards you to the retailer's website. So you are used to seeing links in these e-mails pointing to somewhere other than the official website, but eventually taking you there.

This is prime data for a wide spread, and likely to be highly successful, Phishing expedition.

They send you an e-mail that looks like every Sears ad you've gotten on a monthly basis for years, it has a great bargain on BBQs... You think "It's spring, I should probably check out this deal on BBQs" and you click it. It takes you to what looks like a Sears website (and yes they can be VERY convincing) but it is not. It is a fake Sears website that they set up just for the purpose of collecting more info about these people that they already know are Sears customers... Maybe you will attempt to order that BBQ and they will get your credit card, and you won't know it till it is way too late.

The other scam that they are running is a fake Epsilon breach news update site (copied from the actual press release site) that offers up a downloadable tool that they tell you to run to see if the hackers have your e-mail address... That tool is a Trojan!

So do they have your e-mail address? Probably. Do you get regular e-mails from any of these companies?

1-800-FLOWERS
AbeBooks
Abercrombie & Fitch (WFNNB)
AIR MILES Reward Program (Canada)
Ameriprise
Ann Taylor (WFNNB)
AshleyStewart (WFNNB)
Avenue (WFNNB)
Barclays Bank of Delaware
Beachbody
Bealls (WFNNB)
bebe
Best Buy
Best Buy Canada Reward Zone
Benefit Cosmetics (see below)
BJ’s Visa (Barclays Bank of Delaware)
Brookstone
Capital One
Catherine’s (WFNNB)
Chadwick’s (WFNNB)
Charter Communications
Chase
Citigroup
City Market
College Board
Crate & Barrel (WFNNB)
Crucial
David’s Bridal
Dell Australia
Dillons
Disney Destinations (The Walt Disney Travel Company)
Domestications (WFNNB)
Dressbarn (WFNNB)
Eddie Bauer Friends
Eileen Fisher (doesn’t name Epsilon but same template letter)
Ethan Allen
Eurosport Soccer (Soccer.com)
Express card (WFNNB)
ExxonMobil Card (Citi)
Fashion Bug (WFNNB)
FINA (WFNNB)
Food 4 Less
Fred Meyer
Fry’s
Gander Mountain (WFNNB)
Giant Eagle Fuelperks! (WFNNB)
GlaxoSmithKline Consumer Healthcare (GSK)
Goody’s (WFNNB)
Hilton Honors
Home Depot Card (Citi)
Home Shopping Network (HSN)
J Crew (WFNNB)
J.Jill
Jay C
Jessica London (WFNNB)
JPMorgan Chase
Justice (WFNNB)
KingSize Direct  (WFNNB)
King Soopers
Kroger
Lacoste
Lane Bryant (WFNNB)
L.L. Bean Visa (Barclay’s)
M & T Bank
Marriott Rewards (FAQ on site)
Marks & Spencer
Maurice’s (WFNNB)
McKinsey Quarterly
MoneyGram
MyPoints Reward Visa
New York & Company
NTB Card (Citi)
One Stop Plus (WFNNB)
PacSun (Pacific Sunwear) (WFNNB)
Palais Royal (WFNNB)
Peebles (WFNNB)
Polo Ralph Lauren
PotteryBarn/PotteryBarnKids (WFNNB)
Quality Food Centers (QFC)
QualityHealth
RadioShack (WFNNB)
Ralphs
Red Roof Inn
Reeds Jewelers (WFNNB)
Ritz-Carlton (FAQ)
Robert Half International
Scottrade
Sears (Citi)
Shell (Citi)
Smile Generation Financial
Smith’s Food & Drug Centers (Smith’s Brands)
Sportsman’s Guide (WFNNB)
Stage (WFNNB)
Stonebridge Life Insurance
Target
Tastefully Simple
TD Ameritrade
The Limited (WFNNB)
The Place (Citi)
TIAA-CREF
TiVo
Trek (WFNNB)
United Retail Group (WFNNB)
US Bank
Value City Furniture (WFNNB)
Verizon
Victoria’s Secret (WFNNB)
Viking River Cruises
Walgreens
Woman Within (WFNNB)
World Financial Network National Bank




For more info:

http://www.databreaches.net/?p=17374

http://www.net-security.org/malware_news.php?id=1696&utm_source=Help+Net+Security+Daily+News&utm_campaign=6de5c5076e-RSS-hns&utm_medium=email

Another Reason To Be Careful Where You Download From

HelpNet Security News has an article today on a new trojan that sort of holds your computer ransom.

This software is distributed as installers for popular software like Divx or uTorrent, and distributed through sites with domain names that look official to those not already familiar with what the real site's name ought to be.

Once you've downloaded and installed it, the program asks you to "unlock" it by sending an SMS text message from your cell phone to what is essentially a 1-900 type service. You send a text message, they send you the "unlock" code, and your cell phone gets billed for the "service".

Fortunately, this version isn't a drastic as some other ransom-ware that actually prevents you from using the computer until you get the unlock code.

http://www.net-security.org/secworld.php?id=9892

Small Businesses Hammered By Cybercrime

There is a good article over on Infosec Island by Ashesh Mamidi contributed by fellow blogger Theresa Peyton:

https://www.infosecisland.com/blogview/6481-Small-Businesses-Hammered-By-Cybercrime.html

The jist of it, as I've been trying to tell people: Viruses and Malware are NOT just an annoyance anymore. They are a real threat to your financial well being.

Everyone should be running at least a good firewall and an antivirus program. Better yet, I'd recommend trying a software whitelisting program like Faronics Anti-Executable ... if it's not on the approved list it doesn't get run.

Firefox 4.0 Beta Download Scam

People will fall for anything. There is a scam going around twitter and other social networking sites telling users that if they follow a certain shortened URL (see here for more on the dangers of shrotened URLS), they can then download a cracked version of Firefox 4.0 or a key generator for Mozilla Firefox 4.0.

This of course only leads you to a place to download all kinds of malware onto your computer.

This is ridiculous, as Mozilla Firefox is Open Source (as in free, always!)
You can download the REAL Firefox 4.0 beta from the Firefox site FREE! Keep in mind it IS a beta, there WILL be bugs.

Microsoft Security Advisory 2286198

Microsoft Security Advisory (2286198)  is about to get a patch!
It's about time. We've all (at least those of us who pay attention to these things) been waiting for 2 weeks for this very important fix. MS says they will have it ready to roll on Monday.

For those not watching MS's every move, this bug allows a malicious user to create a special .lnk file (shortcut) on a USB drive, or hard drive, or shared drive on a network... etc. and when you just browse to the folder containing it, it exectues! No double-click, you just have to look at the folder it's in. Thanks to the folks at MS who fixed it so quickly. This was a scary bug.

Note, if you don't want to wait till Monday, you can fix it now. Just disable the "WebClient" service under Control Panel>Administrative Tools>Services
If you don't know what WebDAV is, you don't need that service running.


Oh, and one more thing:

Recognize and avoid fraudulent e-mail to Microsoft customers:
=============================================================
If you receive an e-mail message that claims to be distributing
a Microsoft security update, it is a hoax that may contain
malware or pointers to malicious Web sites. Microsoft does
not distribute security updates via e-mail.

The Microsoft Security Response Center (MSRC) uses PGP to digitally
sign all security notifications. However, PGP is not required for
reading security notifications, reading security bulletins, or
installing security updates. You can obtain the MSRC public PGP key
at
https://www.microsoft.com/technet/security/bulletin/pgp.mspx.

To receive automatic notifications whenever
Microsoft Security Bulletins are issued, subscribe to Microsoft
Technical Security Notifications on
http://www.microsoft.com/technet/security/bulletin/notify.mspx.

(quoted directly from a Microsoft Security Bulletin)

Beware Of Photo Printing Kiosks, There Be Dragons

Morgan Storey, a security researcher in Australia, recently blogged about something that hadn't occurred to me before, but should have.... You know those photo printing kiosks in the mall, Walmart, Costco, etc. Have you ever noticed that they run Windows? Sometimes they are built on outdated hardware, so probably they are running old, unpatched, out of date Windows?

How many USB sticks and memory cards get plugged into them every day? More importantly, how many virus infected USB sticks and memory cards? ...and how many previously un-infected cards and sticks come home from them with brand new infections?

This is a serious issue. Protect your own systems by doing one or all of these things:

1. turn off Windows' ability to run autorun.inf files. Autorun.inf files are used to automatically start install programs when you insert a CD-ROM or USB stick with software you want. Windows Vista/7 will still pop up the auto PLAY pop up asking what you want to do with your newly inserted USB drive, but it won't execute the instructions in the Autorun.inf file on it.

Copy these lines into notepad and save as disableautorun.reg

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Then simply double click the disableautorun.reg file.


2. use only USB/SD devices with a read-only switch on them. Switch it to read-only mode before sticking it in the mall's computer.

3. Format the card (if you are using the camera's card) in your camera right after you get home. So far there are no cross-platform viruses that infect both computers and cameras. That doesn't mean there will never be, but for now that's a safe assumption that a virus you got from the kiosk won't infect your camera.

4. ask your favorite photo printing place if you can upload the photos to their website from home instead of bringing them in on a card/USB stick.

The "Aurora" Attack That Got Google And Adobe

This is why you MUST get off IE6 and onto an up to date version, and KEEP it up to date, and run an up to date Antivirus.

I'm sorry, this is really technical, but it is important. 



YouTube video courtesy of Sophos Antivirus.

Adobe Virus Update

Users can undo the change, as it is in the Current User part of the registry, but here are the lines to add to the login script.

reg add "HKCU\Software\Adobe\Adobe Acrobat\9.0\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f
reg add "HKCU\Software\Adobe\Acrobat Reader\9.0\JSPrefs" /v bEnableJS /t REG_DWORD /d 0 /f

You need both lines to get Adobe Reader and full Acrobat Reader/Writer.

The new Reader 9.2 gives the users a better warning saying that it can be potentially hazardous to turn it on and allows them to choose to turn it on "for this document" or permanently. (until they log in again and the script shuts it off again.)

More Adobe PDF Viruses On The Loose Patch On The Way

"You can get viruses from a PDF?" you say??
YES you CAN!!! and Seth Hardy of Symantec's MessageLabs just did a talk the other day at SecTor 2009 about how he's been able to (in a test lab) create a virus, embed it in a PDF and get past every known antivirus. This is scary stuff folks, and there is one little thing you can do to stop most of it.

HelpNet Security says that a new round of these viruses is out in the wild and Acrobat 9.1.3 is vulnerable, but a patch is coming on Oct. 13th. In the meantime they recommend turning off Javascript.

Open up Adobe Reader/Acrobat and turn off JavaScript! Yes, PDFs can have Javascript, though you've probably never even seen a PDF file that legitimately uses Javascript.

Here is how you do it in Reader 9.1.x :
Click on the Edit menu, click Preferences.

Select Javascript from the Categories menu.
Click the checkbox OFF next to Enable Acrobat JavaScript

VirusTotal

VirusTotal is a free service that lets you check a suspicious file against 35 different Antivirus tools.
If you get an e-mail attachment that you really are not sure about, and your own AV doesn't see a problem, you can check it here and know with some certainty that at least no other AV vendor sees the problem.

Klingons need antivirus too.

http://www.sophos.com/klingon/

You think you're immune just because you run MacOS or Linux, but not even the Klingons can keep today's malware at bay without a little help.