Attack Computer Wiz

Chester Wisniewski over at Sophos posted an article yesterday on the inner workings of a fake anti-virus company. It is a good story and well worth the read. You can find it at the link below. Often support people and users ask me how these types of virus’, worms, etc., make it past our firewalls, AV, and other controls that they spend so much money on. This story points out that this particular fave AV vendor updates there payloads every two hours.

Wow!

This is an example of how technology cannot fix stupid human behavior. Really, how can vendors create definitions within a two hour window? Fake AV is not a technology problem, it is a people problem. In many cases fake AV is a social engineering trick that dupes the user into infecting their own system. People need to be educated on what these types of attacks look like, how to prevent them, and who to notify when they occur (or are suspected).

 "A sneak peek into fake anti-virus affiliate support"

Posted by Mike Wright

David Kernell, son of Democratic Representative from Tennessee Mike Kernell, was convicted by jury of “Hacking” Sarah Palin’s Yahoo account. The 22 year old Kernell was convicted of unauthorized access to a computer and obstruction of justice.

Kernell used information that Palin herself made available to the public to guess her challenge questions that ultimately lead to his ability to gain access to her Yahoo account. Once he gained access to her account he changed her password and posted screen shots of emails on the internet.

On her Facebook page, Sarah Palin released the following statement (in part):

“My family and I are thankful that the jury thoroughly and carefully weighed the evidence and issued a just verdict. Besides the obvious invasion of privacy and security concerns surrounding this issue, many of us are concerned about the integrity of our country’s political elections. America’s elections depend upon fair competition. Violating the law, or simply invading someone’s privacy for political gain, has long been repugnant to Americans’ sense of fair play. As Watergate taught us, we rightfully reject illegally breaking into candidates’ private communications for political intrigue in an attempt to derail an election.”

Posted by Mike Wright

I collect swag, I will not deny it, actually I challenge myself to see how many t-shirts, flashlights, mugs, and other goodies I can pick up at the events I attend. (See our RSA 2010 photos on our Facebook page) For me, and many others, the best and most useful piece of swag you can score is a thumb drive. Once upon time it was 64mb or 256mb if you got lucky. Then came the 500mb and the 1gb. Now it is not uncommon to snag a 2gb drive. To my left I have a plastic bowl half full of thumb drives I have collected over the years.

I wonder though; Does the average person think about what may be launching from that drive that they pick up at some expo? Or heaven forbid pick up in the Taco Bell parking lot!

Before you go and plug that device into your computer you may want to keep some things in mind.

1. Do you trust the person or company that gave it to you?
2. Are you sure that they have not installed some malicious software on it that could gain access to your computer?
3. Did some other person drop a drive into the bowl with the legitimate drives?
4. Did you pick it up off the floor or parking lot?

1. Insert the device into a system running Linux, Ubuntu, or Mac OS. These operating systems are less popular then Windows and therefore are less targeted my malicious coders.
2. Once inserted, scan the files with a reliable anti-virus/anti-malware product.
3. Preform a complete format of the device erasing all data.
4. Disable the "Auto-Play" feature that is built into your Windows system. (How to)
5. You may also want to disconnect the system from the network first in order to protect other systems.

Posted by Mike Wright

I just saw a great piece on CNBC about a security company called Trace Security and how they used a targeted phishing/social engineering scam to take complete control over a computer. Basically Jim Stickley of Trace Security sent webcams via snail mail to five of his friends and family members. The package included a letter explaining that they had been randomly selected to conduct a survey. The installation software had been modified so that Jim could take complete control of the user’s computer and the webcam itself. Jim could download keystrokes, cookies, files, data, take screen shots and control webcam images and video. Jim even modified the webcam to disable the light that would normally be turned on when the webcam was in operation.

In the video he calls up his brother-in-law, one of his ‘victims’, his brother-in-law said that he did not think anything of installing the webcam and running the software. He also said that he had no idea that any of it was going on until Jim actually called him on the phone.

Posted by Mike Wright

RIM has announced a new BlackBerry Attachment Service PDF Distiller File Parsing Vulnerability for it's BlackBerry Enterprise Server. This vulnerability could inject malicious code into an affected system after the launching of an infected PDF file. Since the PDF would be crafted with the malicious code it would also likely require the use of Phishing or targeted Phishing in order to successfully infect a system.

This is not the first one that we have seen but this time it was very easy to fix and does not really disrupt service during the patching. The process is very simple and should be done immediately. Use the link below to download and follow their instructions. But basically you download a few dll files, un-register the old, over write them with the new, and re-register them. Easy Stuff!

BlackBerry Enterprise Server

BlacBerry Unite was also affected by this.

BlackBerry Attachment Service for BlackBerry Unite

Posted by Mike Wright

I found this video (LINK) over at Schnier on Security today and I thought it was worthy to share. It is a great example of social engineering. While watching this think about how one could implement similar techniques to gain access to restricted areas.

For more videos check out YouTube, start here (LINK). Read Kevin Mitnick’s first book, he is truly the master!

Posted by Mike Wright

Here in Northern California we have been ravaged by wild land fires forcing the evacuation of tens of thousands of residents, over 80,000 acres and at least 140 homes have burned in my County alone. The local news channels are doing a decent job of keeping the community informed and now after a month we are finally in the recovery stage. Now the media is keeping us informed about fire safety, where to donate, and what to do to prepare yourself should this happen (when this happens) again.

One piece of advice they recently gave was to inventory your possessions and keep all of your important documents where you can get to them quickly. With this in mind they recommended a 'free' web site where you can upload photos, blueprints, and scans of important documents, cards and other paperwork. While it is a good idea to have the documents, photos, and inventory available; Should you take your local Medias advice and trust them to have researched the web site that they are recommending you upload your life to?

Here is what I found when I researched the site.

Posted by Mike Wright

Extortionware = A piece of software, most commonly in the form of a virus or self replicating code, that infects a computer system taking control of files or processes that in addition to being annoying and difficult to remove, has built in advertisements that promise removal only upon payment. (That’s my definition) Some may refer to this as “Ransomware”, however I believe they are wrong. Ransomware, in my opinion, implies that the criminal has in their position something of yours and are demanding money for its return. In fact, in the case of extorntionware, the criminal possesses only knowledge on how to remove a virus or restore a file that the victim still possesses but may have limited or no access to.

Most all of us have seen some sort of extortionware. Most the time it comes in the form of a program that advises a user that they have a virus and that this virus can only be removed using “brand-X” virus protection software that they must purchase. These programs, while extremely annoying, are most of the time nothing more than that, an annoyance. They can usually be removed by a system restore or other methods of rooting out registry entries and files.

Gpcode.ak on the other hand, is not your average extortionware. This virus attacks files by encrypting them with an extremely strong RSA-1024 bit key. In laymen’s terms, this is like taking someone’s documents, putting them in a filing cabinet, then locking that cabinet with thousands of combinations locks, each with a different combination. Then giving the cabinet to the owner of the documents along with a message telling them if they want to read their documents again it will cost them X-amount of dollars. This RSA-1024 bit encryption is all but impossible to crack. According to Kaspersky; it could take 15 million computers running an entire year to break the key (LINK).

This virus, just like any other virus (malware, spyware, adware, and so on) has a human factor. It has been said that the weakest part of any system is located directly between the chair that the keyboard. Unless you don’t know, that is you (and me). The human factor removed, for the most part, this virus cannot infect a system. If a user does not click pop-ups, does not visit fraudulent websites, does not install the “free screen savers”, does not open infected email or email attachments, does not use administrator accounts, and keeps system passwords strong and private (to name a few) then it would be nearly impossible for a system to be infected with this or any other virus.

Crackers (aka hackers) can use technological methods to infiltrate a system. But, generally speaking they won’t. Why should they spend hours of work trying to hack a system, when they can just sit back and let you do the work for them by mass mailing spam, relying on users to forward chain letters, put up fraudulent websites, and other practices that are used to entice you, their victims, into installing the virus’s for them.

Posted by Mike Wright