Subscribe
Printer Friendly
Share this PageWorms
26% of Twitter messages contain links, half of which are from spammers and lead to malicious websites.
With only 140 characters per Twitter message, it makes sense to shorten URLs and leave characters to say what you have to say. But with shortened URLs you have no idea what your final web destination will be. A spreader of malware and malicious websites couldn't be happier!
Malicious Links in Abundance
Researchers at Kaspersky Labs have found that as many as one in every 500 links on Twitter lead to sites hosting malware. They have also discovered that about 26% of Twitter messages - tweets - contain links and about half of those are created by spammers and people with bad intentions.
The two most popular URLs that the Krawler found posted to Twitter so far passed through the system in September. Both directed users to online dating sites. One of the sites, getion.com, is known to have hosted malware in the past, Raiu said.
What Twitter is Doing
So why isn't Twitter doing something to keep its users safe? Well, it is to an extent. In August Twitter started using a filtering system by Google to detect malicious URLs. The system checks the URLs against a blacklist and then either blocks the malicious URL from being posted or warns users to think before clicking on the link. However, the system only scans URLs that are shortened using the Bit.ly shortening service - the most commonly used on Twitter. Any links shortened using any of the over 200 other formats are not picked up by Twitter's filter.
Malicious URLs were discovered over a year ago before Twitter gained it's current level of popularity. Now, malware links regularly appear in "trending topics" where people are often checking to see what is the latest and greatest.
What You Can Do
- There are several companies that have developed more inclusive filters to sift through the shortened URLs on Twitter. Kaspersky has developed the Krab Krawler that currently examines 500,000 unique URLs a day. Of the URLs examined, 100 to 1,000 a day are sites hosting malware.
- AVG Technologies offers LinkScanner, a tool that scans and strips URLs of any malware that they may contain. Finjan Inc. has a tool, SecureTwitter, that sends out a warning message when a malicious URL is detected.
- You also have the option of expanding the shortened link before you click on it. The bit.ly blog has instructions on how to get the plug-in tool to expand bit.ly (and other) shortened URLs.
- Consider using stand-alone Twitter software such as TweetDeck. They will often provide filtering of their own and/or a preference item to expand shortened URLs before you click them.
Video Interview with Kaspersky Lab Malware Researcher Costin Raiu
Read more at the Threat Level blog. Graph courtesy of Kaspersky Labs
Halloween is all about tricks, treats and pretending to be something your not. Scareware must think every day is Halloween.
Computer experts are reporting that scareware is on the rise. Scareware - a sneaky hacker technique used to steal personal information and spread viruses - is being found in more and more places online and even on trusted sites, like the New York Times.
"The recent scareware attacks are cropping up everywhere and can be found on even the most trusted Web sites online," said Alison Southwick, BBB spokesperson. "The threat of scareware undermines consumer trust in compromised Web sites, and on the Internet in general, but there are steps computer users can take to protect themselves."
How Scareware Tricks and Treats
Scareware usually presents itself as a pop up window on your computer that looks like it is from your computer. It gives some message that your computer has been infected with a virus that needs to be removed. Often the message tells you to go to the link provided to purchase and download anti-virus software. Once the software is purchased the download begins. Unfortunately, it is not anti-virus software that is being downloaded, but more viruses and malware.
If that weren't bad enough, now the hackers have your credit card information too.
This senario is playing out all over the internet. It was in mid-September that visitors to the New York Times web site started getting the infected pop up window. The New York Times traced the infected window back to an unauthorized ad. They later found out that the ad space was sold to hackers posing as Vonage.
But The New York Times is not the only site being affected and pop up windows are only half the story with scareware. According to Computer World Magazine, hackers are also "poisoning Google search results." Hackers monitor popular search topics and then create infected web pages with related content. They work to get those to the top of Google search results and when someone clicks a link in the search results - the infamous pop up window appears.
How to Protect Your Computer
Fortunately there are steps that you can take to protect your computer from scareware:
- Never let your guard down. It is a fact that scareware can show up on even the most trusted sites, Google, Twitter, The New York Times, etc.
- Protect your computer. Keep your operating system updated and install a good quality anti-virus program. We recommend the following packages: Norton 360
(includes backup and other features), Norton Internet Security 2010 (good all around option),
or avast! (free and good), and keep it up to date. Also make sure that all security patches and updates are installed for your webrowser and programs like Adobe Flash Player.
- Take immediate action during an attack. If a scareware window opens up, force close it using the task manager and then run your trusted anti-virus software.
If you clicked on the link and have downloaded the software all is not lost, but things aren't good. The Washington Post offers advice on their Security Fix blog of how to rid your computer of the viruses and malware. But if you aren't computer savvy, you may think about calling a professional to clean up the mess.
UPDATE: An article from Wired magazine's Threat Level blog sheds more light on how web sites are being targeted for malware distribution:
Web ads have become much more advanced over the years and many now include scripts that provide data tracking and other functions. Because of this, crooks are working to have their "ads" run on popular websites. Their ads also contain scripts, but the code displays scareware instead of tracking clicks or views.
In the article, Gawker Media - a major blog network of sites like Gizmodo, LifeHacker, Jalopnik and others - was targeted for ad placement, but fortunately Gawker has a team of geeks that digs into the code of any ad and confirms that it contains no malicious code. I'm guessing the NY Times now is enforcing a similar policy (yep, it is now).
Heaven help us when we visit sites that have no such team of geeks to protect us from malicious ads...
Consumers’ obsession with celebrity news and culture is harmless in theory, but one bad download can cause a lot of damage to a computer.
—Jeff Green, McAfee, Inc.
Jessica Biel Sites Are #1 for Malware
Internet security company, McAfee, Inc. has just released its yearly update of most dangerous celebrity web sites for online threats such as spyware, adware, spam, phishing, and viruses. In the survey, web searches for actress, Jessica Biel, had a one-in-five chance of ending up on a website that has tested postive for malware—putting Biel’s name at the top of the danger list and beating out last year’s most dangerous name, Brad Pitt. Biel became popular on TV’s “Seventh Heaven” and recently starred in “Easy Virtue”.
Pop star, Beyonce, placed second on the list. Web searches on “Beyonce ringtones” led to a dangerous website linking to a distributor of adware and spyware. Over 40 percent of the survey searches for “Jennifer Aniston screensavers” contained computer viruses. Other celebrities on this year’s list included Miley Cyrus, Ashley Tisdale, Lindsay Lohan, Megan Fox, Angelina Jolie and newlyweds, Tom Brady and Gisele Bundchen.
Every day, cybercriminals use celebrities’ names and images, like Kim Kardashian and Rihanna, to lure surfers searching for the latest stories, screen savers and ringtones to sites offering free downloads laden with malware.
What You Can Do
- Be aware of the connection between celebrity websites and malware. You may not visit those sites but your kids might.
- Be aware that malware-connected celebrity web sites change with the tide of popularity of the celebrities.
- Make sure you’re using anti-malware software on your computer and it is current.
More info from Reuters - http://www.reuters.com/article/internetNews/idUSTRE57O2P520090825
A recent article by Kevin Poulsen on Wired.com made a sobering observation: software hackers are becoming as sophisticated in their programming as the software they're trying to attack. Where hacking used to be something of a harmless, if annoying prank by bright, restless kids before they went off and got regular jobs, hackers are increasingly well-funded and making use of state-of-the art technology to design the trojans, viruses and spyware that attempt to get into your computer.
Today, the best hackers have the skill and discipline of the best legitimate programmers and security gurus. They're using mind-bending obfuscation techniques to deliver malicious code from hacked websites undetected. They're writing malware for mobile phones and PDAs.
The Case of the Clever Conficker
Poulsen cited the the worst case of computer infection in recent years, the Downadup worm , also known as the Conficker worm (see “Latest Worm Infect 9 Million PCs”). One reason the Conficker worm spread so quickly was that it was the first widely-released program—good or bad—to incorporate M6, a state-of-the-art cryptographic algorithm developed at MIT. When crypto expert Phillip Porras first dug into Conficker's code, M6 was available only from the websites of MIT and the U.S. National Institute of Standards and Technologies—and no one even recognized M6 at first. When it came to implementing M6 the bad guys had beat the good guys to the punch!
Other portions of Conficker were equally impressive: the way it doggedly hunts for anti-virus software on a victim's machine, and disables it; or the peer-to-peer mechanism. "There were points where it was pretty clear that certain major threads inside Conficker C seemed to be written by different people," Porras says. "It left us feeling that we had a more organized team that brought different skills to bear.... They aren't people who have day jobs.
Another reason the Conficker worm wriggled its way into so many computers was the flexibility and responsiveness of its software engineers. Just like legitimate software engineering teams, when the authors of Conficker discovered a security hole in the first release of their program they stayed up nights and patched their code within just a few weeks. Experts are observing new malware coming out as quickly as a couple of days after a new vulnerability is announced.
What You Can Do?
- Be proactive. Now. Believe that you're computers connected to the Internet are at risk and it's up to you to fortify them.
- If your anti-malware software doesn't run automatically get in the habit of running it daily. If you haven't updated your anti-malware software lately, do it today.
- Make sure your operating software is updated regularly. The best method is to let it download and update automatically. Software vendors will update their software as quickly as possible after a serious weakness is discovered.
More Info
Read the article - Future of Cyber Security: Hackers Have Grown Up.
Did that get your attention? Scammers are hoping it will.
Breaking News Malware Emails
An ongoing strategy of scammers is to send out spam emails with shocking or titillating subject lines. They've decided the recent nomination of Barack Obama is a perfect topic and Symantec has reported that emails are showing up that read something like this:
Sample Emails
Subject: Breaking news
Barack Obama refused to be the president of the United States of America
Yours Sincerely,
Cecily Lynn
Subject: What is going on with our country?
Yours faithfully,
Rodney Lynch
The link in the actual emails (we're not linking to anything in the examples above) point to the following site:
What is the Threat?
The site instantly attempts to bypass any browser security and install malware on your computer. If that fails, any link on the site will download and install malware software. The software is called W32.Waledac. Here's what it does, as described from the Symantec web site:
Rest assured that we detect this piece of malicious software under the name W32.Waledac. This particular piece of malware is capable, among other things, of:
- harvesting sensitive information on your computer
- turning your machine into a spam zombie
- establishing a back door on your computer that will allow it to be remotely accessed
How Can I Protect Myself?
Resist the Impulse to Click - scammers will try to provoke an emotional response in order to keep us from thinking about what we're doing. When you see an email like this, think for a moment if it's even reasonable. Ask why someone would send an email like this. What's the point?
Keep Your Software Up to Date - we've recently talked about keeping your Windows systems updated. The same goes for browsers, email clients, or anti-virus software. If you're software is up-to-date, you're more likely to avoid being hurt by scams like this.
By the way, Obama certainly didn't refuse to be president. I watched the inauguration myself and my thoughts and prayers are with him. Whatever your political affiliation or citizenship, we should all hope and work for his success.
The Worst Outbreak in Years
Using a flaw in the Windows Server service that was detected and patched months ago, a single worm has managed to infect nearly 9 million PCs in just over two weeks — and the rate of infection is increasing by the day. In just four days, the "Downadup" worm (which is also sometimes referred to as "Conficker,") spread from an estimated 2.4 million computers to 8.9 million. It has been described by many security experts as the worst outbreak of malicious software in years.
In October, Microsoft sent out a rare emergency security update for all of its operating systems, including Vista, XP, and Windows 2000. Unfortunately, this update seems to have been ignored by a large portion of PC users, leaving millions vulnerable to Downadup.
Full Dangers Still Unknown
Right now the intentions of developers responsible for the malicious software remains unclear. For the time being, the hackers have only bothered to send out a fake security security program, which creates pop-ups designed to annoy users into paying for a worthless program. But Downadup could potentially hijack millions of computers and use them as bots capable of carrying out whatever commands the hackers send them.
That the whole problem could have been averted if users had just bothered installing a patch Microsoft issued long ago, underscores the importance of setting your operating system to automatically download and install security updates. Those with infected computers undoubtedly let the patch languish for months in an update queue, alongside much less essential software updates.
How to Update Windows Automatically
Windows XP
To set your PC to update automatically in Windows XP, simply access the Control Panel in the start menu, click "Automatic Updates," and choose "Automatic."
Windows Vista
For Vista, open Windows Update in the start menu, select "Change Settings," and then select "Install updates automatically."
How to Remove the Worm
Your computer might not be showing any signs of infection or you may have seen some odd behavior.
From Microsoft:
If your computer is infected with this worm, you may not experience any symptoms, or you may experience any of the following symptoms:
- Account lockout policies are being tripped.
- Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender, and Error Reporting Services are disabled.
- Domain controllers respond slowly to client requests.
- The network is congested.
- Various security-related Web sites cannot be accessed.
If your PC has already been infected by Downadup, first install the emergency update, then run the latest edition of Microsoft's Malicious Software Removal Tool to remove the worm from your computer.
More information about the worm is available from Microsoft. You can also read more on Computerworld.
Myspacers have been dealing with identity theft scams for years, but now there's mounting evidence that hackers are targeting Myspace's more mature brother, Facebook. According to a Reuters wire story, a virus known as "Koobface" has been making the rounds using the Facebook messaging system.
How Does it Work?
Users are typically told that they "look awesome in this new movie" that the sender has uploaded, and are redirected to a site that in turn asks them to install a bogus Adobe Flash player update. If the user decides to take the bait, the Koobface virus is instantly installed on their computer, at which time it goes about its business gathering credit card numbers and other sensitive information.
How Do I Get Rid of It?
According to Guy Bunker of Symantec, Koobface is fairly easy to get rid of. Users can either install some anti-virus software (which will automatically find and destroy it,) or locate two files in their Windows directory. The files are named "tmark2.dat" and "mstre6.exe", and should be deleted immediately if found.
Find more details on detection, files affected, removal, etc. on the McAfee web site.
Even if Koobface itself isn't all that scary, the Reuters piece cites a security researcher with McAfee as saying that such viruses are on the rise on social networking sites. Presumably surfers are more trusting with these sites because they typically use them to connect with friends, and aren't expecting to be targeted the way they would in a random email from an unknown spammer.
In 2005 and 2006, Myspace suffered from a rash of security problems, the most widespread being a JavaScript virus named "Samy." Samy was relatively harmless since it targeted internet profiles rather than PCs. Nevertheless, more than 1 million users ended up displaying the message "Samy is my hero" on their Myspace profiles in 2005.
How Do I Protect Myself in the Future?
Social networking sites like Facebook turn us into fools when it comes to installing software.
- Want to throw a virtual snowball at someone? Install this application.
- Want to find out what kind of sandwich you are? Install this application.
- Want to know how you're going to die? Install this application.
That's why these sites are the newest playground for virus creators - people are connected, they click on stuff, they install stuff, rinse and repeat.
One good rule of thumb is to avoid redirect links in Facebook or Myspace messages unless you can absolutely verify that the URL is legit. Never download a file from a page you've been redirected to. Report the incident to the support staff at social networking site, and await further instruction.
You may know who your friends are in real life, but it's important to remember that an internet persona can always be hijacked---even if you do look really awesome in that movie.
Screenshots
Here's how the Koobface virus, and other related viruses appear within Facebook:
What Appears in Facebook
Notification in Your Email
Website Download
Updated to add:
Variants of this virus appear to be pointing to data collection or revenue generating web sites. Here are a few titles I've had reported recently:
"hey is this u on thebestphotosonline.com"
and...
"whats the deal with u bein on imdownwitu.com"
The Sober worm we talked about earlier will possibly start clogging email inboxes on January 6 or even January 5.
If you aren't running anti-virus software (huh?) or haven't updated your definitions file recently, you'll want to so in the next day or so. If not, you could be one of the computers spreading more Nazi propoganda.
So where can you scan your computer for free? Here are a few ideas:
- http://housecall.trendmicro.com/
- http://us.mcafee.com/root/mfs/default.asp
- http://www.pandasoftware.com/products/ActiveScan.htm
These services will allow you to scan for free, but you'll probably have to pay a small fee to remove anything they find. In either case, it's best to know if you're clean (or not).
F-Secure, a Finnish security company has been able to crack the code the Sober worm was using to update infected machines with new variants.
Here's how the worm works:
- a computer is infected with the worm.
- on a certain date the infected computer tries to "phone home" to receive new code from the worm creator.
- all infected computers able to reach the proper web address are infected with an updated variant of the worm.
Mikko Hyppönen, Chief Researcher at F-Secure described it this way:
"Sober has been using an algorithm to create pseudorandom URLs which will change based on dates. Ninety nine percent of the URLs simply don't exist ... however, the virus author can precalculate the URL for any date, and when he wants to run something on all the infected machines, he just registers the right URL, uploads his program and BANG! It's run globally on hundreds of thousands of machines"
If the security experts could determine the web address the worm was looking for it could be blocked and the worm would be deprived of new code. The problem is the virus and worm creators are a devious and crafty bunch and they don't make it easy to deconstruct what they're doing. Not crafty enough for F-Secure, evidently.
Read how F-Secure cracked the code and the list of potential download sites for new code.
Just to get an idea of how wonderful these worm creators are, here's a quote from F-Secure's blog:
Last thing: Several earlier Sober variants (most notably Sober.Q) have been sending out Neo-Nazi propaganda messages. According to iDefense, the activation date of January 5th is an anniversary date for the Nazi party.
Great. Neo-Nazi worm authors. What did Indiana Jones have to say on the subject? "Nazis. I hate these guys."
Is your computer a zombie? Not sure? Is your virus scanning software up-to-date? Have you even installed a virus scanner on your computer? No???
If not, your computer may be a zombie that is spreading a particularly nasty worm naed “Sober” to thousands of computers worldwide.
Evidently some zombie computers are blasting out thousands of emails that purport to come from the FBI, of all places.
Have you received one these emails from the FBI or CIA recently? It should have looked something like this:
Of course the attached file wasn’t a list of questions from your local G-man but a file infected with a new strain of the Sober worm.
The worm was being sent out via zombie machines infected with earlier versions of the worm. E-mail security vendor MessageLabs said it blocked more than 2.7 million e-mails in the first 24 hours of the outbreak. Man those zombies are working overtime!
ZoneAlarm Security Suite picked up the worm on my machine and removed it before it did any damage. Do you have an updated anti-virus running on your machine? If not, you could be one of those zombies pumping out thousands of worm-ridden emails without even knowing it.
Special Offers
Connect With Us
We invite you to become a fan of Fight Identity Theft or just join in the discussion.
Subscribe to Breaking News
Subscribe to Fight Identity Theft and receive top stories and breaking news via email.
Recent Blog Entries
Blog Archives
- November, 2009 (1)
- October, 2009 (6)
- September, 2009 (2)
- August, 2009 (3)
- April, 2009 (2)
- February, 2009 (3)
- January, 2009 (8)
- December, 2008 (8)
- March, 2008 (1)
- January, 2008 (1)
- December, 2007 (3)
- November, 2007 (2)
- October, 2007 (3)
- May, 2006 (1)
- March, 2006 (4)
- February, 2006 (4)
- January, 2006 (10)
- December, 2005 (7)
- July, 2005 (3)
- June, 2005 (4)
- May, 2005 (5)
- March, 2005 (1)
- Credit (12)
- Fraud (36)
- Government (20)
- Identity Theft (36)
- Junk Mail (5)
- Phishing (10)
- Privacy (18)
- Scam (29)
- Technology (47)
- Telemarketing (2)
- Viruses (10)
- Visitor Stories (1)
- Worms (10)
