Latest Bagle succeeds by sheer numbers - News - ZDNet:
"Bagle.AF arrives in e-mail as an attached file and infects computers running the Windows operating system if the user opens the file. The program attempts to halt more than 250 security applications from running on the computer, mails itself to any e-mail address it can find on the computer, and contacts one of 141 German Web sites, twice the number that a previous version of the virus contacted. The diverse Web sites have likely been compromised by online vandals, leaving behind software to record which computers have been infected by the Bagle worm.
With that information, the vandals can use the compromised computers to spread spam, or sell the information to spammers, Friedrichs said. The virus leaves open a backdoor specifically for that purpose."
http://zdnet.com.com/2100-1105_2-5271930.html
Saturday, July 17, 2004
Spam grows as spammers mature - News - ZDNet
Spam grows as spammers mature - News - ZDNet:
"It's been 12 months since spam really burst into the public consciousness. Before then it had certainly been a well-publicized problem, but often only with the more tech-savvy while the wider public had far more questions than answers about strange mail appearing in their inbox.
Then last summer the level of spam passed the important watershed of the 50 percent mark--meaning more e-mail traffic was unsolicited than not. For every 100 e-mails the average user was receiving more than 50 that were offering everything from pornographic content to college diplomas.
Since shattering that 50 percent mark the level of global spam e-mail has continued to skyrocket. By most measures that figure is now somewhere around 75 percent. "
But perhaps the biggest change in the spam world has been in the types of e-mails users are seeing. According to the latest figures from Clearswift, the traditional mainstays of the inbox menace--namely pornography and more frivolous offers--are being replaced by financial services, scams and pharmaceuticals which despite the best advice of the 'don't buy from spammers' lobby still seem to have some traction in the marketplace.…
http://zdnet.com.com/2100-1105_2-5270764.html?tag=adnews
"It's been 12 months since spam really burst into the public consciousness. Before then it had certainly been a well-publicized problem, but often only with the more tech-savvy while the wider public had far more questions than answers about strange mail appearing in their inbox.
Then last summer the level of spam passed the important watershed of the 50 percent mark--meaning more e-mail traffic was unsolicited than not. For every 100 e-mails the average user was receiving more than 50 that were offering everything from pornographic content to college diplomas.
Since shattering that 50 percent mark the level of global spam e-mail has continued to skyrocket. By most measures that figure is now somewhere around 75 percent. "
But perhaps the biggest change in the spam world has been in the types of e-mails users are seeing. According to the latest figures from Clearswift, the traditional mainstays of the inbox menace--namely pornography and more frivolous offers--are being replaced by financial services, scams and pharmaceuticals which despite the best advice of the 'don't buy from spammers' lobby still seem to have some traction in the marketplace.…
http://zdnet.com.com/2100-1105_2-5270764.html?tag=adnews
Friday, July 16, 2004
Google Toolbar Can Browse By Name
Google Toolbar Can Browse By Name:
"The Google Toolbar's new Browse by Name feature, introduced on Wednesday, takes the concept of searching from the browser address bar and kicks it up a notch. Now, to search, you simply type the name or description of the site you're looking for. If there's a strong match, Google will go straight to that page. For example, 'new york times', 'ben and jerry', 'john kerry' and 'strong bad' all zoom directly to the appropriate page. "
When there's no single obvious match, you haven't lost anything—you still get a standard Google search results page. Browse by Name is especially useful when the URL you're searching for is not obvious. For example, Browse by Name on "Muir Woods" brings up the National Park Service's site, www.nps.gov/muwo.…
http://www.eweek.com/article2/0,1759,1623934,00.asp?kc=ewnws071504dtx1k0000599
"The Google Toolbar's new Browse by Name feature, introduced on Wednesday, takes the concept of searching from the browser address bar and kicks it up a notch. Now, to search, you simply type the name or description of the site you're looking for. If there's a strong match, Google will go straight to that page. For example, 'new york times', 'ben and jerry', 'john kerry' and 'strong bad' all zoom directly to the appropriate page. "
When there's no single obvious match, you haven't lost anything—you still get a standard Google search results page. Browse by Name is especially useful when the URL you're searching for is not obvious. For example, Browse by Name on "Muir Woods" brings up the National Park Service's site, www.nps.gov/muwo.…
http://www.eweek.com/article2/0,1759,1623934,00.asp?kc=ewnws071504dtx1k0000599
'Important' Windows flaw could turn critical - News - ZDNet
'Important' Windows flaw could turn critical - News - ZDNet:
"Security experts are bracing themselves for a spate of new worms and viruses designed to exploit of the seven new vulnerabilities announced by Microsoft on Tuesday as part of its monthly patch cycle.
Of the new vulnerabilities, Windows Shell (MS04-024)--has been picked out by security experts as a potential target for future worms and viruses.
Ben Nagy, senior security engineer at security researcher firm eEye, said he expects the Windows Shell bug to be the most serious threat--despite Microsoft rating the problem as 'important' rather than 'critical'."
According to Microsoft, if a user is vulnerable to MS04-024 and has administrator privileges, an attacker could "take complete control of the affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges."
However, the flaw is not rated as critical because it would require "significant user interaction" to work. This means that a user would need to open an e-mail attachment, or download a file from a malicious Web site.
Richard Starnes, president of security industry group ISSA UK, said that malware writers usually reverse-engineer Microsoft's patches in order to produce exploits. Based on his on experience of previous threats, he expects the first batch of new exploit codes to be available as early as next week. These would probably be used to create a worm delivered as an email attachment.…
http://www.microsoft.com/technet/security/bulletin/MS04-024.mspx
http://zdnet.com.com/2100-1105-5268989.html
"Security experts are bracing themselves for a spate of new worms and viruses designed to exploit of the seven new vulnerabilities announced by Microsoft on Tuesday as part of its monthly patch cycle.
Of the new vulnerabilities, Windows Shell (MS04-024)--has been picked out by security experts as a potential target for future worms and viruses.
Ben Nagy, senior security engineer at security researcher firm eEye, said he expects the Windows Shell bug to be the most serious threat--despite Microsoft rating the problem as 'important' rather than 'critical'."
According to Microsoft, if a user is vulnerable to MS04-024 and has administrator privileges, an attacker could "take complete control of the affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges."
However, the flaw is not rated as critical because it would require "significant user interaction" to work. This means that a user would need to open an e-mail attachment, or download a file from a malicious Web site.
Richard Starnes, president of security industry group ISSA UK, said that malware writers usually reverse-engineer Microsoft's patches in order to produce exploits. Based on his on experience of previous threats, he expects the first batch of new exploit codes to be available as early as next week. These would probably be used to create a worm delivered as an email attachment.…
http://www.microsoft.com/technet/security/bulletin/MS04-024.mspx
http://zdnet.com.com/2100-1105-5268989.html
Wednesday, July 14, 2004
MS Security Bulletin MS04-022: Vulnerability in Task Scheduler Could Allow Code Execution
Microsoft Security Bulletin MS04-022: Vulnerability in Task Scheduler Could Allow Code Execution (841873):
"This update resolves a newly-discovered, privately reported vulnerability. A remote code execution vulnerability exists in the Task Scheduler because of an unchecked buffer. The vulnerability is documented in the Vulnerability Details section of this bulletin.
If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. However, user interaction is required to exploit this vulnerability. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-022.mspx
"This update resolves a newly-discovered, privately reported vulnerability. A remote code execution vulnerability exists in the Task Scheduler because of an unchecked buffer. The vulnerability is documented in the Vulnerability Details section of this bulletin.
If a user is logged on with administrative privileges, an attacker who successfully exploited this vulnerability could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts with full privileges. However, user interaction is required to exploit this vulnerability. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-022.mspx
MS Security Bulletin MS04-023: Vulnerability in HTML Help Could Allow Code Execution
Microsoft Security Bulletin MS04-023: Vulnerability in HTML Help Could Allow Code Execution (840315):
"This update resolves two newly-discovered vulnerabilities. The HTML Help vulnerability was privately reported and the showHelp vulnerability is public. Each vulnerability is documented in this bulletin in its own Vulnerability Details section.
If a user is logged on with administrative privileges, an attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-023.mspx
"This update resolves two newly-discovered vulnerabilities. The HTML Help vulnerability was privately reported and the showHelp vulnerability is public. Each vulnerability is documented in this bulletin in its own Vulnerability Details section.
If a user is logged on with administrative privileges, an attacker who successfully exploited the most severe of these vulnerabilities could take complete control of an affected system, including installing programs; viewing, changing, or deleting data; or creating new accounts that have full privileges. Users whose accounts are configured to have fewer privileges on the system would be at less risk than users who operate with administrative privileges.…"
http://www.microsoft.com/technet/security/bulletin/MS04-023.mspx
Defensive Perimeter, The Top 10 Best Security Tools:
Defensive Perimeter:
"You may not don battle gear, but switch on an Internet-connected PC, and you've stepped into a war zone where countless insurgents relentlessly pound your system, looking for ways in. 'Keep Your PC Safe', part of the comprehensive new Security Special on our Security Watch page, provides the Special Forces training you need to prevail. As backup, in this roundup we've stockpiled reviews of the products recommended in that PC combat manual."
http://www.pcmag.com/article2/0,1759,1618645,00.asp
http://www.pcmag.com/category2/0,1738,12,00.asp
http://www.pcmag.com/article2/0,1759,1621759,00.asp
"You may not don battle gear, but switch on an Internet-connected PC, and you've stepped into a war zone where countless insurgents relentlessly pound your system, looking for ways in. 'Keep Your PC Safe', part of the comprehensive new Security Special on our Security Watch page, provides the Special Forces training you need to prevail. As backup, in this roundup we've stockpiled reviews of the products recommended in that PC combat manual."
http://www.pcmag.com/article2/0,1759,1618645,00.asp
http://www.pcmag.com/category2/0,1738,12,00.asp
http://www.pcmag.com/article2/0,1759,1621759,00.asp
Tuesday, July 13, 2004
Troubleshooting Windows XP, Tweaks and Fixes for Windows XP
Troubleshooting Windows XP, Tweaks and Fixes for Windows XP:
"To use the Regedits: Save the REG File to your hard disk. Double click it and answer yes to the import prompt. REG files can be viewed in Notepad by right clicking on the file and selecting Edit.…"
http://www.kellys-korner-xp.com/xp_tweaks.htm
"To use the Regedits: Save the REG File to your hard disk. Double click it and answer yes to the import prompt. REG files can be viewed in Notepad by right clicking on the file and selecting Edit.…"
http://www.kellys-korner-xp.com/xp_tweaks.htm
Anti-Phishing Working Group
Anti-Phishing Working Group:
"What is Phishing?
Phishing attacks use 'spoofed' e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers and credit card companies, phishers are able to convince up to 5% of recipients to respond to them."
http://www.antiphishing.org/
"What is Phishing?
Phishing attacks use 'spoofed' e-mails and fraudulent websites designed to fool recipients into divulging personal financial data such as credit card numbers, account usernames and passwords, social security numbers, etc. By hijacking the trusted brands of well-known banks, online retailers and credit card companies, phishers are able to convince up to 5% of recipients to respond to them."
http://www.antiphishing.org/
Atak, The latest mass-mailing Worm sleeps to avoid detection - News - ZDNet
Worm sleeps to avoid detection - News - ZDNet:
"The latest mass-mailing worm, Atak, hides by going to sleep when it suspects that antivirus software is trying to detect it.
Atak was first discovered Monday. Although antivirus companies do not expect it to cause much damage, they say it will be a nuisance because it can generate a large amount of spam.…"
"Atak tries to tell when someone is stepping through the code to analyze whether it is a virus or not. Often, a virus will contain lots of code that is designed to make it more complicated for (antivirus) companies to write the detections,"Graham Cluley, senior technology consultant for antivirus company Sophos said.…
http://zdnet.com.com/2100-1105-5267258.html
"The latest mass-mailing worm, Atak, hides by going to sleep when it suspects that antivirus software is trying to detect it.
Atak was first discovered Monday. Although antivirus companies do not expect it to cause much damage, they say it will be a nuisance because it can generate a large amount of spam.…"
"Atak tries to tell when someone is stepping through the code to analyze whether it is a virus or not. Often, a virus will contain lots of code that is designed to make it more complicated for (antivirus) companies to write the detections,"Graham Cluley, senior technology consultant for antivirus company Sophos said.…
http://zdnet.com.com/2100-1105-5267258.html
Lovgate.ad prevention and cure - ZDNet: Reviews
Lovgate.ad prevention and cure - ZDNet: Reviews:
"Lovgate.ad is the latest variation of a known mass-mailing worm family that includes a backdoor Trojan horse and, this time, overwrites several key Windows files, including executables files ending with .exe. While Lovgate.ad (w32.Lovgate.ad@mm, also known by some antivirus software vendors as Lovgate.ab, Lovgate.ae, Lovgate.ah, Lovgate.ao) doesn't destroy personal data, it will destroy access to the applications that run the data. Restoration from a backup utility after removal of the worm is required. Mac, Linux, and Unix users are not affected. At this time, Lovgate.ad is spreading slowly via e-mail, network-shared files, and network connections still vulnerable to the flaw that allowed the MSBlast worm to spread last summer. Because Lovgate.ad contains a variety of ways in which to spread and could damage system files, this worm rates a 6 on the CNET/ZDNet Virus Meter.…"
http://reviews-zdnet.com.com/4520-6600_16-5143031.html
"Lovgate.ad is the latest variation of a known mass-mailing worm family that includes a backdoor Trojan horse and, this time, overwrites several key Windows files, including executables files ending with .exe. While Lovgate.ad (w32.Lovgate.ad@mm, also known by some antivirus software vendors as Lovgate.ab, Lovgate.ae, Lovgate.ah, Lovgate.ao) doesn't destroy personal data, it will destroy access to the applications that run the data. Restoration from a backup utility after removal of the worm is required. Mac, Linux, and Unix users are not affected. At this time, Lovgate.ad is spreading slowly via e-mail, network-shared files, and network connections still vulnerable to the flaw that allowed the MSBlast worm to spread last summer. Because Lovgate.ad contains a variety of ways in which to spread and could damage system files, this worm rates a 6 on the CNET/ZDNet Virus Meter.…"
http://reviews-zdnet.com.com/4520-6600_16-5143031.html
FCC chief blogs to tech industry - News - ZDNet
FCC chief blogs to tech industry - News - ZDNet:
"WASHINGTON--U.S. Federal Communications Commission Chairman Michael Powell has started his own Web log, or blog, to reach out to the high-tech community and bypass the scores of Washington lobbyists who typically skulk around his office.
Powell, who wants to avoid regulating new technologies like Web-based telephone service for fear of stifling innovation, said he started the blog to encourage the high-tech industry to get involved because its past practice of flying under the radar to avoid regulations would no longer work.
'Regulated interests have about an 80-year head start on the entrepreneurial tech community when it comes to informing regulators what they want and need, but if anyone can make up for that, Silicon Valley can,' he said in his first blog comments posted Thursday morning.…"
http://www.alwayson-network.com/comments.php?id=4860_0_3_0_C
http://zdnet.com.com/2100-1103_2-5264405.html
"WASHINGTON--U.S. Federal Communications Commission Chairman Michael Powell has started his own Web log, or blog, to reach out to the high-tech community and bypass the scores of Washington lobbyists who typically skulk around his office.
Powell, who wants to avoid regulating new technologies like Web-based telephone service for fear of stifling innovation, said he started the blog to encourage the high-tech industry to get involved because its past practice of flying under the radar to avoid regulations would no longer work.
'Regulated interests have about an 80-year head start on the entrepreneurial tech community when it comes to informing regulators what they want and need, but if anyone can make up for that, Silicon Valley can,' he said in his first blog comments posted Thursday morning.…"
http://www.alwayson-network.com/comments.php?id=4860_0_3_0_C
http://zdnet.com.com/2100-1103_2-5264405.html
Saturday, July 10, 2004
Mozilla Flaw Lets Links Run Arbitrary Programs
Mozilla Flaw Lets Links Run Arbitrary Programs:
"The Mozilla Foundation has confirmed findings that its Mozilla and Firefox browsers are vulnerable to attacks using the 'shell:' scheme, which execute arbitrary code under Windows without the user having to click a link."
Security researchers are reporting another security issue in Web browsing under Windows, but this time Internet Explorer is not the culprit. The Mozilla Foundation's Mozilla and Firefox are reported as vulnerable.
The Mozilla Foundation has confirmed the problem and issued a fix, which is available here.
http://update.mozilla.org/extensions/moreinfo.php?id=154
http://www.eweek.com/article2/0,1759,1621451,00.asp?kc=ewnws070904dtx1k0300599
"The Mozilla Foundation has confirmed findings that its Mozilla and Firefox browsers are vulnerable to attacks using the 'shell:' scheme, which execute arbitrary code under Windows without the user having to click a link."
Security researchers are reporting another security issue in Web browsing under Windows, but this time Internet Explorer is not the culprit. The Mozilla Foundation's Mozilla and Firefox are reported as vulnerable.
The Mozilla Foundation has confirmed the problem and issued a fix, which is available here.
http://update.mozilla.org/extensions/moreinfo.php?id=154
http://www.eweek.com/article2/0,1759,1621451,00.asp?kc=ewnws070904dtx1k0300599
Article compilation: You've been hacked - TechRepublic
Article compilation: You've been hacked - TechRepublic:
"You'll want to download this collection of articles and keep them handy. They detail what to do in the first five minutes and first few hours of an attack on your network and provide help for preventing future attacks."
requires free registration
http://techrepublic.com.com/5138-6288-729430.html?tag=e601
"You'll want to download this collection of articles and keep them handy. They detail what to do in the first five minutes and first few hours of an attack on your network and provide help for preventing future attacks."
requires free registration
http://techrepublic.com.com/5138-6288-729430.html?tag=e601
IE Exploit Attacks Another Piece of ActiveX
IE Exploit Attacks Another Piece of ActiveX:
"Using Internet Explorer hasn't gotten any safer in the past few days as a Dutch security hacker, Jelmer Kuperus, pointed out yet another unblocked security problem in the popular Web browser.
The latest exploit, an attack on a Windows ActiveX component called Shell.Application, is similar to the Download.Ject attack, also called JS.Scob.Trojan. In that exploit, crackers broke into IIS servers on several popular but still unnamed sites and used them to spread keyboard loggers, proxy servers and other malware through IE's ActiveX scripting technology."
Indeed, attackers used the spyware technique of installing a pop-up ad program, except this one silently installed a Trojan and a BHO (Browser Help Object) designed to swipe login information from several dozen financial sites.
The sites that spread the malware have since been fixed, but there has been no master shipping solution for the underlying IE vulnerabilities. Disabling Active scripting and ActiveX controls in the Internet Zone and Local Machine Zone will prevent exploitation of these holes, but at the cost of seriously affecting IE's functionality.
Microsoft shipped a "patch" Friday that addressed part of this security problem by disabling the Windows component called ADODB.Stream.…
http://www.eweek.com/article2/0,1759,1620855,00.asp?kc=ewnws070804dtx1k0000599
"Using Internet Explorer hasn't gotten any safer in the past few days as a Dutch security hacker, Jelmer Kuperus, pointed out yet another unblocked security problem in the popular Web browser.
The latest exploit, an attack on a Windows ActiveX component called Shell.Application, is similar to the Download.Ject attack, also called JS.Scob.Trojan. In that exploit, crackers broke into IIS servers on several popular but still unnamed sites and used them to spread keyboard loggers, proxy servers and other malware through IE's ActiveX scripting technology."
Indeed, attackers used the spyware technique of installing a pop-up ad program, except this one silently installed a Trojan and a BHO (Browser Help Object) designed to swipe login information from several dozen financial sites.
The sites that spread the malware have since been fixed, but there has been no master shipping solution for the underlying IE vulnerabilities. Disabling Active scripting and ActiveX controls in the Internet Zone and Local Machine Zone will prevent exploitation of these holes, but at the cost of seriously affecting IE's functionality.
Microsoft shipped a "patch" Friday that addressed part of this security problem by disabling the Windows component called ADODB.Stream.…
http://www.eweek.com/article2/0,1759,1620855,00.asp?kc=ewnws070804dtx1k0000599
Wednesday, July 07, 2004
The Builder.com guide to SpamAssassin
The Builder.com guide to SpamAssassin:
"Spam is one of the most serious problems plaguing Internet users today. There's nothing quite as frustrating as arriving at work each morning to a mailbox full of unwanted ads. Sorry, there is one thing more frustrating...wasting the next hour deleting those ads for drugs and refinancing and other junk you don't want or need.
Fortunately there is a cure for the spam blues. It's called SpamAssassin, and it's possibly the best tool out there to combat spam. In this guide we'll show you how it works, and then how to install and configure it for your server.…"
http://builder.com.com/5100-6372_14-5247932.html?tag=e601
"Spam is one of the most serious problems plaguing Internet users today. There's nothing quite as frustrating as arriving at work each morning to a mailbox full of unwanted ads. Sorry, there is one thing more frustrating...wasting the next hour deleting those ads for drugs and refinancing and other junk you don't want or need.
Fortunately there is a cure for the spam blues. It's called SpamAssassin, and it's possibly the best tool out there to combat spam. In this guide we'll show you how it works, and then how to install and configure it for your server.…"
http://builder.com.com/5100-6372_14-5247932.html?tag=e601
The New York Times > Technology > You've Got Mail (and Court Says Others Can Read It)
The New York Times > Technology > You've Got Mail (and Court Says Others Can Read It):
"When everything is working right, an e-mail message appears to zip instantaneously from the sender to the recipient's inbox. But in reality, most messages make several momentary stops as they are processed by various computers en route to their destination.
Those short stops may make no difference to the users, but they make an enormous difference to the privacy that e-mail is accorded under federal law.…"
http://www.nytimes.com/2004/07/06/technology/06net.html?pagewanted=all&position=
"When everything is working right, an e-mail message appears to zip instantaneously from the sender to the recipient's inbox. But in reality, most messages make several momentary stops as they are processed by various computers en route to their destination.
Those short stops may make no difference to the users, but they make an enormous difference to the privacy that e-mail is accorded under federal law.…"
http://www.nytimes.com/2004/07/06/technology/06net.html?pagewanted=all&position=
Another summer of misery for Windows users? | CNET News.com
Reheated Bagle comes with side of source code | CNET News.com:
"The author of mass-mailing worm Bagle began distributing its source code and two new variants on Sunday, which could trigger another summer of misery for Windows users. "
http://news.com.com/Reheated Bagle comes with side of source code/2100-7349_3-5258179.html?tag=adnews
"The author of mass-mailing worm Bagle began distributing its source code and two new variants on Sunday, which could trigger another summer of misery for Windows users. "
http://news.com.com/Reheated Bagle comes with side of source code/2100-7349_3-5258179.html?tag=adnews
Subscribe to:
Posts (Atom)
Posts
