Urban Networks of Wifi Malware

Urban Networks of Wifi Malware

Living in an urban apartment complex, my laptop computer usually detects signals for 9 separate wifi connections in my building. Sometimes, they interfere with my own connection.

Maybe one of these days I’ll get around to changing the channel on my router; usually, I just step into the other room.

Most of the connections have some security, but it’s most often the insecure WEP standard. One or two are also totally open networks…occasionally I’m tempted to hack them and send them a friendly note telling them to use a more secure protocol. But, so far I’ve resisted.

These dense urban networks are ripe for attack, and not just by a single virus. A recent study by Indiana University revealed that malware can spread in these networks the same way a biological epidemic spreads.

Simulations showed that in two weeks, tens of thousands of Wifi routers could be infected, and most were breached within a day or two.

Web Crawling : SEO or Security

Web Crawling–Good for SEO, Bad for Security

How do you separate the friendly, search-engine web crawlers from the nasty bots?

Rich Skrenta, famed as the author of the first computer virus ElkCloner, describes the challenges faced by a new search engine, Cuill, when it began indexing sites :

Cuill, the search startup from ex-googlers anticipated to launch soon seems to have run a rather high rate crawl when they were getting started that generated a large number of robots.txt bans. Here is a list of sites which have banned Cuill’s user-agent “Twiceler”.

A well-behaved crawler needs to follow a set of loosely-defined behaviors to be ‘polite’ - don’t crawl a site too fast, don’t crawl any single IP address too fast, don’t pull too much bandwidth from small sites by e.g. downloading tons of full res media that will never be indexed, meticulously obey robots.txt, identify itself with user-agent string that points to a detailed web page explaining the purpose of the bot, etc.

Looking at the list of sites that banned the crawler, though, Skrenta concludes that the bans might actually drive up the quality of the sites Cuill has indexed.

Blogroll Vulnerabilities

Blogroll–Vulnerabilities and Entanglements

A few big names in security flaws this week.

As usual Microsoft released some critical patches, the patches focus on Office.

One of them is for Leapord, and it’s Microsoft’s first Mac fix for Office 2008 apparently.

Adobe and Cisco also reported some flaws.

And not to leave anyone out, except maybe Google,

Apple is being sued by a company claiming patent infringement on the iPod and iTunes.

Blogroll Security Breaches

Blogroll–in Security Breaches

The past week seems to have revealed a lot of data breaches and vulnerabilities. Here is a review:

» Stedmans.com exposes some credit card information.

» Security blog MCWResearch was spammed via email posts, before the feature was disabled — it’s an unusual and interesting attack vector.

» Asterisk announced four security vulnerabilities and suggests an upgrade.

» Security folks are drawing lessons out of the recent national security news that our presidential candidates’ passport files were riffled through. Realtime IT Compliance has a lot of questions and suggests that you could apply some of the analysis and insights to your own organization.

» Naturally our election insecurity doesn’t stop there. Here’s more news that voting machines are insecure — The Sequoia voting machines used in the New Jersey election can’t even properly add.

» Microsoft has released a warning about Word running on Windows 2000, XP and 2003 Server SP1. Originally pointed out by firms like Symantec and Panda Security, it appears the .mdb file and Jet Database Engine are vulnerable. MS is working on a fix; meanwhile, impacted users should disable Jet or block .mdb files at the gateway, says Douglas Schweitzer.

» USA Today reported “Botnet Scams are Exploding” with a review of today’s largest botnets and some handy figures pulled from Message Labs and Support Intelligence: “On a typical day, 40% of the 800 million computers connected to the Internet are bots.”

Blogroll Threats

Blogroll Threats

What’s going on this week in the vulnerabilities arena? Let’s take a look :

» The MacBook Air got pwned at a hacker convention in 2 minutes. Makes one wonder whether the winner had practiced ahead of time. Experts warn against using Safari to browse the Net.

» Tax Day is near — and like any holiday or event, hackers are exploiting it as a phishing attack. By sending emails to consumers that are allegedly from the IRS, they hope to get them to divulge personal info. But it’s an easy one to spot, because the IRS won’t ever contact you by email.

» A computer hacker placed a phone call that led 911 to send a SWAT team to someone’s house…now he’s getting 3 years in jail and a hefty fine.

» Indiana has closed up a loophole in its Data Breach Law, leading to better security. Go Indiana!

» Also, Mac OS X had a security fix this week, at least for 10.4. Update, update, update.

More Wild Predictions for 2008

More Wild Predictions for 2008

Put away your tarot cards and palmistry books — the experts have beaten you and I to making predictions for the future. Maybe they are not so wild, but here they are :

» IDC’s report on the future of storage market — more online storage and better systems

» Analog wireless systems will shut down in February, rendering some security systems non-functional

» IPTV is spreading

» Andrew Hay predicts more breaches, more potential for cyberwar, and research into better forensic systems for analyzing logs

» Google continues to dominate search and will go up against traditional telcos in the next spectrum auction

» Ike Elliot also discusses how telecommunications will change in other ways — with Verizon opening their networks, third-party VoIP products and the introduction of the iPhone to global markets

» Lastly, John Batelle has some great predictions for the future of Google and other specific companies in 2008, and optimistically predicts that web-based advertising businesses will have a strong economic year, despite everyone’s fears of economic downturn.

Poor Coding

Microsoft Defends Against Poor Coding Practices

Who’s to blame? A recent report reveals that a huge percentage of Web sites are vulnerable to SQL injection. In its wake, Microsoft’s defending its IIS Web Server and SQL server products, saying the problem isn’t the products, but the poor coding practices used by developers:

U.S. CERT issued a warning about SQL injection attacks that have compromised a large number of legitimate Web sites. Affected Web sites contain injected JavaScript that attempts to exploit several known vulnerabilities. U.S. CERT recommends disabling JavaScript and ActiveX.

Because otherwise legitimate Web sites deliver this attack, SAN Internet Storm Center handler Donald Smith observes that the concept of a “trusted” or “legitimate” site is no longer meaningful. The attack has reportedly affected the Web sites of the United Nations and the U.S. Department of Homeland Security, to name a few.

Computer security firm F-Secure said that it had found the offending JavaScript code on over half a million Web pages. The company said that IT administrators should immediately block nmidahena.com, aspder.com, and nihaorr1.com, three domains associated with the injection attack.

Automated Exploits

Reversing a Security Patch with Automated Exploits

Here’s an interesting phenomena — hackers that use automated tools to engineer an exploit just after a patch for the vulnerability is released. Since many don’t know about vulnerabilities until a patch comes out, and many people don’t apply patches immediately, the new information gives hackers an extra in, into the systems.

Hackers exploit this period of time - the so-called patch window - to launch attacks against unpatched machines. Typically, exploits are developed by skilled hackers versed in the arcane intricacies of reverse engineering.

However, hackers have now begun using off-the-shelf tools to at least partially automate this process, a development that might lead to exploits coming out hours instead of days after the publication of patches.

Darknet has a good discussion of the original article, check them out.

Threat of SQL Injection

Flash Player + Windows = Threat of SQL Injection

Apparently Adobe Flash players that aren’t patched and up to date on Windows might be vulnerable to a new SQL injection–there are apparently 18 variants of the new exploit.

SecureWorks has the details :
Attackers insert SCRIPT and IFRAME tags into the content of trusted, legitimate web sites via a known SQL injection attack. Those tags redirect the user to the attacker’s server which hosts the Flash exploit. Tens of thousands of web sites are vulnerable to the SQL injection attack, meaning the distribution potential is high.

The vulnerability is not “zero-day”; however, these are the first known public exploits targeting it. The SecureWorks Counter Threat Unit (CTU) has analyzed 18 variants of the exploit, and all attempt to leverage the integer overflow vulnerability originally discovered by Mark Dowd (CVE-2007-0071), which was patched by Adobe with release of version 9.0.124.0 of the Flash Player.

While some have reported that the latest version is vulnerable, the CTU was unable to duplicate these results with samples taken from known exploit sites. The only confirmed vulnerable version is (pre-patch) 9.0.115.0.

Get Viruses For ....

Get Viruses For
Job Hunters, ID Theft,
and Criminal Opportunities

Recent job candidates have been getting malware infections instead of job prospects when they log on to monster.com and at least one other job search service.

SecureWorks, a security firm based in Atlanta, reports that the personal information for over 40,000 job hunters was compromised by malicious advertisements on the sites. Some users were infected when they clicked the ads, but in other cases, the malware installed itself as soon as the page with the ads loaded.

According to Symantec, who has been studying the attacks, the malware transmits user information to the hackers’ computers and sends out more junk mail from the infected system. The malware is a variant from a black market toolkit, which creates Trojans that search for security vulnerabilities that it can exploit with virus attacks.

Brian Krebs of the Washington Post reports in his blog that the criminals may be attacking the sites because they’re used by a large number of people, and that the hackers may also be attempting to recruit employees. Many “work at home” jobs are usually schemes run by organized criminal groups, who use the recruits to engage in criminal activity, sometimes unknowingly.

Krebs recommends the following:
» Update with the most recent patches available for your system. Microsoft released a large pack of patches on Monday
» Never respond to solicitations or spam.

I’d add a couple more:
» Use other venues for your job search for the time being
» Don’t click the ads

If you’re looking for work, a great way to start is through local listings like craigslist.com, or on professional trade organizations, rather than gargantuan, generalized sites like Monster. And, good luck!

Pacific Islands with Spam

Pacific Islands Infested with Spam

If only we could quarantine the spam infestation to tiny islands. Not so for the global Internet — in fact, according to a recent report by Sophos, the most spam per capita is transmitted from little Pacific islands rather than their larger continental neighbors:

Pitcairn Island — a tiny spot where the mutineers of the HMS Bounty were marooned in 1790 — relays more spam per person than any other location in the world, according to Sophos. The island’s population is about 50 people.

The rest of the top 10 offenders are, in order: Niue, Tokelau, Anguilla, the Faroe Islands, Monaco, Bermuda, Falkland Islands, Andorra, and Aruba.

You might imagine those sneaky hackers are sitting in the sun, drinking Long Island Ice Teas with little umbrellas, while they casually engineer mass spam attacks. More likely, the computers responsible for spamming on those islands are owned by unwitting islanders, whose computers have been affected by malware that really originated elsewhere.

So, Sophos gives us a bit of advice: “All computer users, wherever they are in the world, need to wake up to the threats and ensure their PCs are properly protected.”

Illegal Product to Threaten

Illegal Product to Threaten

Can people who write illegal software, then sell it illegally on the black market, try to threaten legal action if the purchasers don’t behave as they want?

It seems authors of the Zeus malware kits are trying to do so, by writing an end-user license agreement into their software.

An excerpt from Ars Technica–

It’s obviously difficult for the manufacturers of an illegal product to threaten legal sanctions against an infringer, but the Zeus authors give it their best shot. According to the EULA, “In cases of violations of the agreement and being detected, the client loses any technical support.

Moreover, the binary code of your bot will be immediately sent to antivirus companies.”

Frankly, “We’ll blow your kneecaps off and feed them to you,” might be a bit more effective as a threat, but I suppose it’s a bit hard to carry out that threat over the Internet.

If the folks behind Zeus are serious—and they seem to be—they’ve obviously got a rather warped sense of reality.

Guys developing illegal hacking software, selling it on the black market — sounds pretty warped to me to begin with. Why not add some humor?

ID Theft increase in 2008

ID Theft increase in 2008

How consumers can keep personal information and accounts secure. At that time, I’d only ever heard second-hand about people who had been victims, and I thought the subject was a touch sensationalistic.

Unfortunately, I learned on new year’s that a few old friends of mine have had their bank accounts compromised, and had poor credit as a result, so I’m seeing it touch my life now as an ever growing problem.
According to Info Week, the number of data breaches reported in 2007 grew by 40% over 2006 — although 2006 was actually low compared with 2005:

Some 127 million data records were exposed during 2007. In 2006, nearly 20 million records were exposed. In 2005, there were 158 breaches reported involving about 65 million records.

If you want to keep your information safe, make sure to check your accounts regularly, use strong passwords, and all those safety precautions — really, everyone should know those precautions by now, but we all get lazy about them sometimes.

Yet, taking those extra steps is helpful in the long run, to avoid the problem one of my friends recently faced — her credit application was denied because she had something on her credit report she was unaware of. It turned out some hacker had been opening accounts in her name, some of which they weren’t even using, for Netflix, eBay and other places.

Reality Check-ID Theft

ID Theft Reality-Check

Is ID Theft running rampant over the Web or is it just a myth? Dark reading has a post today outlining the top ten myths of ID Theft, citing a few different studies, with some interesting findings.

For example, they debunk the myth that anonymous hackers are responsible for all or most of the ID Theft cases — in fact, it turns out, someone you know might be more likely to steal your identity than a stranger:

In the TV cop shows, they always cite statistics to show that murder is often committed by someone you know, rather than a stranger. Apparently, this is true of identity theft as well.

In the Javelin study, approximately 14 percent of thefts occurred through traditional “hacker methods” such as Trojans, viruses, or phishing. Data breaches accounted for another 7 percent of thefts — but even taken together, these account for less than a quarter of all ID fraud.

So where does the rest of it come from? About a third (33 percent) comes from physical theft — a lost or stolen wallet, purse, or credit card. But a surprising 17 percent of identity theft is perpetrated by friends, relatives, or in-home employees, the study says.

No Privacy on Facebook/MySpace

No Privacy on Facebook/MySpace

It’s not just your friends reading your personal details — any widget or app you add to a facebook profile might glean details about you and your personal information, which can be used for targeted advertising or other potentially more dangerous ways.

Here are some details about what’s collected and the implications:

Each site has come up with its own policies on the data that developers are allowed to see. MySpace, the largest social network, with 110 million members, said developers can see users’ public details — name, profile picture and friend lists — when they download a program.

When a user installs one on Facebook, which has 70 million members, the developer can see everything in a profile except contact information, as well as friends’ profiles. Members can limit what is seen by changing privacy controls, and both companies say developers are allowed to keep those data for only 24 hours.

Developers can collect other data from members once they’ve download the applications.

Ben Ling, director of Facebook’s platform, said that developers are not allowed to share data with advertisers but that they can use it to tailor features to users. Facebook now removes applications that abuse user data by, for example, forcing members to invite all of their friends before they can use it.

Google Trends

With Google Trends,

you can make blogger to adsense and see this keyword.

how about Google Trends see HERE