How To Avoid Koobface and Other Social Networking Worms

Koobface is a classic example of a worm that spreads via social networking sites such as Facebook, Bebo, and Friendster. Koobface has been particularly problematic for Facebook users and maintains a rather consistent presence among Facebook social network users. Following are four easy-to-follow tips that can help you avoid infection by Koobface and other social networking worms.

Difficulty: Easy

Time Required: Ongoing

Here's How:

1. Avoid promiscuous friending. Spammers, phishers, and worm distributors abound on social networking sites. Rather than attempting to win an imaginary and virtual popularity contest, demonstrate your self-confidence and restraint by not accepting friend invites from strangers. Your real friends will appreciate it.
2. Log out of the social networking site when it's not being used. Worms like Koobface can only spread when you are logged on to Facebook or other social networking account. Staying logged off when not in use can help minimize the potential for spreading Koobface or other social networking worms.
3. Use a unique strong password on each account. If you have multiple social networking accounts, use a unique password for each. For an easy to remember secure method, see: Creating and Maintaing Strong Passwords.
4. Never click links in messages received unexpectedly and never, ever login to any site as a result of clicking a link in a message. If you do follow a link that instructs you to login afterwards, close the page, then open a new page and visit the site using a previously bookmarked or known good link.

Read more...

60 Minutes, Conficker, and April's Fool

On March 29th or thereabouts, CBS' 60 Minutes presented a report titled "The Conficker Worm: What Happens Next?". While malware is a complicated subject, given the venue - an allegedly serious news show like 60 Minutes - one might have expected an objective, accurate portrayal. Instead, the report merges several unrelated threats and discusses them as if they were one, erroneously warns of an impending time bomb set for April 1st, and overall provides the type of malware coverage that causes many in the general public to believe all malware reports are nothing but hype. And it's the type of coverage that makes serious security researchers cringe.

This is indeed unfortunate. The following is provided in an attempt to clear up the confusion and fear that might result from the 60 Minutes broadcast.

Myth: The Conficker worm is delivered via the Web.
Reality: Web delivered malware is a very real threat and compromised websites pose a very real problem. However, Conficker has nothing to do with either. Conficker is a retro-style network worm. It is not delivered via the Web and users won't 'catch it' by visiting a compromised website.

Myth: The Conficker worm may be encountered via Facebook or other social networking sites.
Reality: Koobface is an example of a social networking worm. Conficker should not be confused with Koobface. Conficker is a network worm, not a social networking worm. Likewise, Conficker does not use email or social engineering to spread.

Conficker spreads by exploiting certain vulnerabilities in Windows, as well as spreading via autorun and via weakly protected network shares. For a full discussion of how Conficker spreads and how to prevent it, see the Conficker description.

Myth: The Conficker worm is set to detonate on April 1st.
Reality: The Conficker worm continually polls a subset of domains from a list of about 50,000. A few hundred of these have an update date of April 1st. The vast majority do not. Further, only the less prevalent Conficker variants are using these particular domains. In any event, April 1st has little international significance and implying there is some insidious significance is misleading at best.

Myth: The Conficker worm is designed to steal data and identities.
Reality: It's not exactly known what Conficker is intended to do since to date the worm has done absolutely nothing but spread. The earliest variants tried to connect to a rogue affiliate site, which would imply the intent is for rogue affiliate advertising revenues. However, even this is unproven as the worm has yet to take any action.

Myth: Conficker is exactly the type of threat with which we should be most concerned.
Reality: Conficker is exactly the type of threat with which we should be almost least concerned. Worms like Conficker are easily preventable by keeping security patches up to date, properly disabling autorun, and using strong passwords. These are exactly the types of things any enterprise should be doing on a routine basis. Conficker and worms like it are also very noticeable - so it's hard to imagine not knowing you were infected by it. The real threats - the actual data theft trojans - are much more silent and surreptitious. Those threats siphon your data over a long period of time and pose serious risks to intellectual property and security.

Read more...

PowerPoint Zero Day Vulnerability In-the-Wild

Microsoft has released Security Advisory 969136 warning of a newly discovered zero day PowerPoint vulnerability. The flaw impacts PowerPoint versions found in Windows versions of Office 2000, 2002, 2003, and Office 2004 for Mac. Successful exploit allows for the execution or arbitrary code which is granted the same permissons available to the logged in user. By default, on most versions of Windows, the user is logged in as Administrator, thus giving malicious code full rights to the system.

According to security researchers at Trend Micro, currently observed variants are being sent via email and the PowerPoint slides may masquerade as 'Celebrities Without Makeup' or 'Turn Off Your Power for 1 Hour'.

When the malicious PPT is opened, the file 'fssm32.exe' is dropped and run, which in turn creates %temp%\setup.exe.

A second variant of the PPT exploit drops 'temp.exe' and runs it, which then creates 'suhost.exe' in the system temp folder.

The newly created file in the temp folder (either setup.exe or suhost.exe) is then run, resulting in the following files dropped to the infected computer:

%ProgramFiles%\Internet Explorer\IEUpd.exe
%ProgramFiles%\Internet Explorer\iexplore.hlp

To confirm Internet access, the trojan attempts to connect to www.download.microsoft.com. The trojan is also coded to send system information to remote attackers, including parsing directory structures and sending lists of the contents. Other capabilities of the trojan includes the ability to download additional malware to impacted systems.

Detection:
Trend Micro detects the malicious PowerPoint file as TROJ_PPDROP.AB. The files dropped are detected as TROJ_KUPS.F and BKDR_KUPS.F.

Antivirus vendor Symantec detects the malicious PowerPoint file as Trojan.PPDropper.H. Detection for the dropped files was not listed on the Symantec site when this article was written.

Microsoft detects the malicious PPT as Exploit:Win32/Apptom.gen. The dropped files are detected by Microsoft as TrojanDropper:Win32/Apptom.A, TrojanDropper:Win32/Apptom.B, TrojanDropper:Win32/Apptom.C, and Trojan:Win32/Cryptrun.A.

Prevention:
A patch to guard against the exploit of this vulnerability is not available (at the time of this article). However, Microsoft provides several workarounds to prevent the exploit. These workarounds are described in Microsoft Security Advisory 969136. In addition to applying these workarounds, exercise caution when opening PPT files received via email or encountered on a website.

Read more...

Conficker: More Conflict than Worm

When it comes to naming a threat, the Conficker worm might be more aptly named the Conflicting worm. Barely a week after the 60 Minutes April Fools' Conficker doomsday update failed to materialize, the closely watched Conflicker.C did finally manage an update. And in an ironic twist, the new worm debunks much of the hype circulating about Conficker.

The following is intended to help clear up a couple of the continuing conflicting reports about Conficker and is best read in conjunction with the original report titled "60 Minutes, Conficker, and April's Fool.

Myth: The new version of Conficker downloads keyloggers and other data theft trojans.
Reality: Conficker didn't download keyloggers; instead the worm download a scareware program and a new variant of the spam-related Waledec trojan. Waledec is believed to be written by the same group behind the Storm trojan, and both are malware connected with sending spam.

Myth: The Conficker Eye Chart can tell whether there is a Conficker infection.
Reality: While some have made much of Conficker's ability to block access to antivirus vendor sites, disabling antivirus and preventing access to updates and information is a common characteristic of nearly all malware in circulation today. The "Conficker Eye Chart" will show at a glance if access to F-Secure, Trend Micro, or a handful of other security sites is blocked. Basically, if you view the page and can't see the images, this is supposed to be indicative of a Conficker infection. But while it may be a catchy PR title, in reality a failure of the images to display could indicate infection by the majority of malware circulating today and may have nothing to do with Conficker whatsoever.

Myth: Millions are infected with the Conficker worm.
Reality: In another ironic twist, it appears the authors of Conficker have provided a means to measure potential victims without relying on complex measurements and educated guess. Immediately after updating to Conficker.E, the new updated worm tried to connect to a domain for which traffic can be directly counted. Suffice to say that Quantcast and other traffic monitoring systems report this domain as having too little traffic to be measurable. This lack of traffic during the update cycle - when the worm was alleged to be actively hitting the site - calls into question the high number of victims that have been reported. And it raises the question of whether what's really been reported in the past is really just the result of traffic activity emanating from other antivirus vendors' honeypots.

Read more...

Fear-Based Reporting: Have You Been a Victim?

Fear sells. Whether intentional or otherwise, this can sometimes work to the advantage of the media and the disadvantage of consumers. Have you ever been influenced by fear-based reporting, only to find out later that the reports were wrong? If so, help others become more discerning news consumers by sharing your own experience. Share Your Experience

Is Symantec the source?

Conflicker fear reporting was seen elsewhere on TV. In every report I saw, the video was produced in Symantec facilities with Symantec spokespersons (practically every scene had a Symantec logo prominently displayed). Were 60 Minutes and other 'news' venues paid to run a Symantec commercial as a news story?

—Guest nutso fasst

Consumer Resistance

The thought of having to deal with computer viruses put me off becoming an internet user for years. Eventually other users persuaded me to be less resistant to going on-line, and to find out how easy it can be to safeguard against most viruses.

—Hedgecutter

confickervirus

i was so scared of this worm that i defragged my hard disc and ran updated on all my security. turned out that microsoft had already automatically run an update to protect my computer from "conficker". why do these people put the fear of god in you like that. its not fair, and a waste of time.

—Guest jocelyncanning

Fear-Based Reporting

Has anyone ever conducted a study to determine how much actually occurs in the U.S.? It's not just CBS and 60 Minutes. A while ago, one of the networks did an hour-long documentary on the "exploding" gas tanks on the General Motors pick-up trucks. Upon review of the videos used in that presentation, and studies done by GM and others, NBC finally admitted to using devices to cause the actions seen in the video. And GM only asked for an apology!?!?!?! Instead of putting NBC out of business!!! They seemed to have the basis for putting an end to sensationalism, selling fear and fear-mongering, and yet they didn't. Why? I have my own thoughts on the matter, but would be nice to know what all was "really" considered/evaluated/decided that resulted in the request for a public apology!

—Guest Arnwulf01

Fear based reporting is a HUGE problem

Fear seems to have replaced truth in media. Be it Conficker, the latest hurricane, the amount of snowfall to be expected, a terror threat - you name it. You really, really, really have to think for yourself when you listen to media reports about ANYTHING - from the weather, to Obama, to a food scare.

—timfisher

Fear based Reporting

Here is another reason for me not to watch CBS News and 60 minutes. How can you do this to trusting public who watches your news and 60 minutes religiously. These people shoudl be terminated immediately for spreading a fear which is not true. From now on no more 6o minutes and no more CBS News. I guess CBS Executives did not learn from the fiasco Dan rather created. Good bye CBS for ever.

—Guest Narvinnie

Threat level orange

As soon as I saw the U.S. government set up a color coded threat level system, I knew that fear mongering was alive and well in Washington.

—Tom_Nelson

Read more...