ZdNet Whiteboard Video: Beware of ungracious hosts

“Hackers can attack your host's file, rewriting the file to send you to a fraudulent site. Virus writers also use the host's file to block access to anti-virus companies. CNET’s Rob Vamosi says ‘beware.’ ”

Most home users don't even know there is a host file.

AOL and other net access programs tend to drop them in without so much as a mention. Virus scanners may not (usually do not look for changes other than a virus signature.

This short video tells you what you need to know, but assumes you'll know what to do.

http://news.zdnet.com/1607-2-5718931-2.asx?PSDir=ad_msnlivemeeting&videoName=5w0518ungracioushosts&NumClips=1

http://news.zdnet.com/2036-2_22-5718931.html

Stealth virus warning

By Munir Kotadia, ZDNet Australia

Organized criminals are advertising networks of zombie computers for rent on underground newsgroups and Web pages. When they receive an order for a botnet of a certain size, they set about trying to infect computers using infected email attachments or socially-engineered spam with links to malicious Web pages. As soon as they infect enough computers to fulfill the order, they stop using that particular piece of malware.

“Virus authors are choosing not to create global epidemics--such as Melissa or Blaster--because that distracts them from their core business of creating and selling botnets, according to antivirus experts.

Botnets are groups of computers that have been infected by malware that allows the author to control the infected PCs, and then typically use them to send spam or launch DDoS attacks.

Speaking at the AusCERT conference on Australia's Gold Coast on Tuesday, Eugene Kaspersky, founder of Kaspersky Labs, said that the influence of organised crime on the malware industry has led to a change of tactics, echoing comments made in March of this year by Mikko Hyppönen of F-Secure. Instead of trying to create viruses and worms that infect as many computers as possible, malware authors are instead trying to infect 5,000 or 10,000 computers at a time to create personalized zombie armies.

"Do I need a million computers to send spam? No. To do a DDoS attack, 5,000 or 10,000 PCs is more than enough. That is why virus writers and hackers have changed their tactics of infection--they don't need a global epidemic," said Kaspersky.…”

http://news.zdnet.com/2100-1009_22-5719765.html?tag=nl.e589

Microsoft security guru: Jot down your passwords

By Munir Kotadia, ZDNet Australia

“Companies should not ban employees from writing down their passwords because such bans force people to use the same weak term on many systems, according to a Microsoft security guru.

Speaking on the opening day of a conference hosted by Australia's national Computer Emergency Response Team, or AusCERT, Microsoft's Jesper Johansson said that the security industry has been giving out the wrong advice to users by telling them not to write down their passwords. Johansson is senior program manager for security policy at Microsoft.

"How many have (a) password policy that says under penalty of death you shall not write down your password?" asked Johansson, to which the majority of attendees raised their hands in agreement. "I claim that is absolutely wrong. I claim that password policy should say you should write down your password. I have 68 different passwords. If I am not allowed to write any of them down, guess what I am going to do? I am going to use the same password on every one of them."

According to Johansson, use of the same password reduces overall security.

"Since not all systems allow good passwords, I am going to pick a really crappy one, use it everywhere and never change it," Johansson said. "If I write them down and then protect the piece of paper--or whatever it is I wrote them down on--there is nothing wrong with that. That allows us to remember more passwords and better passwords."

Johansson said the security industry had been giving out the wrong advice about passwords for 20 years.…”

Microsoft security guru wants you to jot down your passwords? by ZDNet's George Ou -- http://blogs.zdnet.com/Ou/wp-trackback.php?p=63

http://news.zdnet.com/2100-1009_22-5716590.html

Windows XP Video Decoder Checkup Utility

“The Windows XP Video Decoder Checkup Utility helps you determine if an MPEG-2 video decoder (also called a DVD decoder) is installed on your Windows XP computer and whether or not the decoder is compatible with Windows Media Player 10 and Windows XP Media Center Edition.

An MPEG-2 decoder is software that allows you to play DVDs and files that contain video content that was encoded in the MPEG-2 format (such as DVR-MS files, MPG files, and some AVI files).

If you encounter a problem while using Windows Media Player 10 to synchronize (copy) recorded TV shows to a Portable Media Center or other device, use this utility to verify that you have a compatible MPEG-2 decoder installed on your computer.

Note: This utility only indicates whether an MPEG-2 decoder is compatible with the synchronization feature of Windows Media Player 10 or whether an MPEG-2 decoder is compatible with the recorded TV playback feature of Windows XP Media Center Edition.

This utility:
• Lists all the MPEG-2 video decoders that appear in your Windows registry (a database that contains information about the hardware and software installed in your computer).
• Indicates whether each decoder listed in the registry is marked as compatible with Windows XP Media Center Edition and whether any decoder listed in the registry is marked as the preferred video decoder.
• Indicates whether each decoder listed in the registry is marked as compatible with the synchronization feature of Windows Media Player 10.
• Lets you designate which installed decoder that you want Windows Media Player 10 to use when synchronizing DVR-MS files to a portable device. This is known as the preferred video decoder.
• Lets you undo any changes the utility makes to your Windows registry.”

http://www.microsoft.com/downloads/details.aspx?FamilyID=de1491ac-0ab6-4990-943d-627e6ade9fcb&displaylang=en

The Characteristics of Spam Email

By Bryan Costales, Marcia Flynt.
“The first step to fighting spam is knowing how to recognize it and, by extension, write code that recognizes it. Unfortunately, spammers realize this and work hard to circumvent detection. This chapter details the many ways that spam filters recognize spam, as well as the ways spammers have gotten around these filters.

It is easy for a person to look at a piece of email and say, "This isn't something I asked for. It looks like an advertisement, and I don't want it, so it must be spam." But although it is easy for humans to recognize spam, it is much harder for software to recognize it. And, after all, the point of spam-blocking software is to eliminate the need for humans to recognize spam.…”

1. Connection Behavior
2. Relaying through MX Servers
3. Falsifying the Envelope Sender Address
4. Disguising the Subject: Header
5. Camouflaging the HTML Body
6. Attempting to Fool Signature Detectors
7. Unnecessary Encoding
8. Grokking the Site
9. Loose Ends
10. Think Like a Spammer

http://www.informit.com/articles/article.asp?p=376874