doctorinternet.es
Letâs Do the Time Warp!
29 Jun
Posted by CANAL INFORMACION CASTELLANO DOCTORINTERNET VIRUS as Uncategorized
Nothing could be more fitting to recap the colorful history of information security than the wonderfully off-kilter theatre of The Rocky Horror Picture Show. What a ride itâs been! The story of our craft now spans at least four decades (depending on how you count it), each one with its own hallmark events and memorable characters.
In order to commemorate Symantecâs 25th year of business, we thought weâd invite you to do the time warp with us. This is the first of a series of blogs that will go back and review the history of Internet security, stretching back to the 70s and all the way up the current age of rampant phishing, rootkits, splogs and SPIT.
The 70s
The deepest definition of youth is life as yet untouched by tragedy. ~ Alfred North Whitehead
Indeed, the 70s were a time in information security largely untouched by digital calamity but marked by exploration of emerging telecommunications technology. Outside of blowing a vacuum tube or spilling your coffee on a stack of punch cards, the battle back in the days of Nixon had a lot more to do with making things work than thwarting the wily hacker. Nonetheless, hacking the phone system took center stage during this time as phreaking (phone hacking) hit the scene courtesy of the first modern hackers and the folks who set about trying to keep them from making free calls to Guam and other shenanigans. John Draper, a.k.a. Captain Crunch, is credited with the inception of the phreaking era. You might be surprised that a very mainstream duo is a part of our fairly esoteric history: none other than Appleâs Jobs and Wozniak made and sold âblue boxâ devices for tweaking the nose of telcos by scoring free payphone services.
The 80s
We live in a Newtonian world of Einsteinian physics ruled by Frankenstein logic. ~ David Russell
Enter the 80s: a patchwork quilt of events marked by technological advancement that Newton and Einstein would no doubt have been proud of, but an odd menagerie of happenings more suitable for Frankensteinâs cobbled-together persona. For starters, computer clubs were forming, one of the most notable being Germanyâs Chaos Computer Club. Not to be outdone in the realm of adolescently ominous names, the pimply-faced âLegion of Doomâ stepped into the fray, as well as the outlandish âCult of the Dead Cowâ. This decade ushered in the era of malware, marking the first virus, named âBrainâ, in â86 as well as the infamous Morris Worm in â88. Importantly, the Computer Fraud & Abuse Act was instituted in 1986 and Kevin Poulsen brought hacking into mainstream public consciousness as he scored pole position on an episode of Americaâs Most Wanted.
The 90s
My favorite thing about the Internet is that you get to go into the private world of real creeps without having to smell them. ~ Penn Jillette
The 90s were a decade where the real creeps joined us on the Internet and resulted in the dawn of the modern information security industry. Notable threats of the 90s included the Michelangelo virus, Melissa, and MyDoom. Distributed denial of service attacks and the bots that made them possible were also born in the 90s, with names like Trin00, Tribal Flood network, and Stacheldracht. Beyond malware, AOL suffered through the first real phishing attacks as fraudsters aimed at nabbing userâs credentials. Privacy watchdogs called out in concern as tracking cookies were born, allowing ad networks to monitor user surfing behaviors in a rudimentary fashion. Big personalities and tall-tales marked the 90s, from the L0pht crew and Masters of Deception to hacker anti-hero Kevin Mitnick.
The 00s
I don’t have a bank account, because I don’t know my mother’s maiden name. ~ Paula Poundstone
The creeps of the 90s turned into criminals of the 00s, with only hardcore Luddites like Paula Poundstone safely able to ignore the onslaught of money-motivated online attacks. Adware and spyware kicked off the decade with their rogue marketeering and digital shoulder-surfing. Programs such as Conducent TimeSink, Aureate/Radiate and Comet Cursor were early players in the adware/spyware games that marked the first half of the decade and simmer on across the globe.
Perhaps even more visible than adware and spyware were the aggressively self-propagating malware that the 00s have brought us. Big name threats such as Code Red, Nimda, Welchia, and Slammer all showed us that unpatched machines and weak firewall policies were no match for rapid-fire vulnerability exploitation from self-replicating malware. While we were busy cleaning up from the mess left behind by those worms, phishers were busily preparing their onslaught on trusted brands in the United States and well beyond.
Conventional wisdom dictated that you shouldnât be quick to click on email attachments, but it soon came to include a healthy suspicion of any email message purporting to be from an online service with embedded URLs. The era of phishing and malicious Web sites was upon us. And this is the decade where our time warp steps up to warp speedâzero day attacks, rootkits, rogue antispyware, SPIM, clickfraud and other attacks all made their mainstream debut in the current decade.
Step Right Up…
So come aboard our time machine and sit back for the next several weeks, as this blog series maps out the personalities and events of the last 30 years over the weeks that come. Enjoy the ride!
For more on Symantec’s 25th anniversary, click here
Virus en MySpace
29 Jun
Posted by CANAL INFORMACION CASTELLANO DOCTORINTERNET VIRUS as Uncategorized
La red social internética MySpace se encuentra pasando por un momento complicado en cuanto a la cantidad de virus informáticos que circulan por sus servicios. En general, se trata de virus troyanos, es decir de código maligno que viene …
This worm spreads by e-mail as an attachment or as a hyperlink in ICQ message. On the infected computer virus harvests e-mail addresses or ICQ contacts to which it sends its copies. Virus can download and install other unwanted programs from the Internet. More information can be found in the Virus Encyclopedia.
Dialing for Trojans
25 Jun
Posted by CANAL INFORMACION CASTELLANO DOCTORINTERNET VIRUS as Uncategorized
Many people have said that the lack of attacks upon Appleâs operating systems and devices can be attributed to a lower market share than Microsoft Windows-based PCs. With the shift towards malicious code being written for financial gain, it makes more economic sense. (I know that there are other arguments to be made, but bear with me.) Why write a Trojan that only runs on about 10% of computers when you can write one that is capable of affecting closer to 90% of them? Far more bang for the buck.
At the same time, there havenât been many attacks on cellular phones and mobile devices. There have been several proof of concept Trojans, worms, and viruses for Symbian Smart Phones as well as a few for the Windows Mobile platform. Some of these have even resulted in small, localized outbreaks. Again, the lack of attacks on these devices has been attributed to a smaller user base.
On June 29th, however, these two platforms will converge when Appleâs iPhone is released in the US. The release will potentially make writing malicious code for both an Apple product and a mobile device irresistible to some attackers. The iPhone will represent a robust mobile device platform based on OS X that allows users to send and receive HTML email and surf the Net with the Safari Web browser.
Projections made by various analysts suggest that iPhone adoption will be quite high. This allows attackers to target a larger audience with malicious code designed to run on the devices. The Safari browser and HTML email capabilities of the device could present an ideal attack vector. As recently demonstrated, Safari can be affected by vulnerabilities just as easily as other browsers on the market. While Apple may patch these holes on both the desktop and mobile platforms, the question is will users who have to pay for data transfers be willing to download large security updates on a regular basis?
I doubt that anyone will read this and decide against their iPhone purchase (in fact Iâll probably look into getting one myself). Just remember to keep the same best security practices you would use on any other computer in mind.
DeepSight HoneyNet Detects Obfuscated Attacks for MS07-033 and Xunlei WebThunder
22 Jun
Posted by CANAL INFORMACION CASTELLANO DOCTORINTERNET VIRUS as Uncategorized
Recently, a DeepSight honeypot was compromised by a rogue website that served a variety of malicious scripts to users. From the dozens of Web sites that we investigate everyday, what makes this case special is the fact that this is the first detected instance of in-the-wild exploitation of Microsoft Internet Explorer Speech API 4 COM Object Instantiation Buffer Overflow Vulnerability (BID 24426). This exploit appears to be a derivation of the publicly available exploit released at milw0rm.com. The vulnerability lies in the way two COM objects in the Speech API 4, namely Windows DirectSpeechSynthesis Module (XVoice.dll, EEE78591-FE22-11D0-8BEF-0060081841DE ) and DirectSpeechRecognition Module (XListen.dll, 4E3D9D1F-0C63-11D1-8BFB-0060081841DE), handle certain user input. The malicious attacker can instantiate these COM objects via Internet Explorer, and pass overly long arguments to certain routines. In this case, the exploit passes a maliciously crafted argument (ModeName) to the DirectSS.FindEngine function. The overflowed buffer is then populated with attacker-supplied shellcode over-writing the Structured Exception Handler, thus resulting in the execution of arbitrary code. This exploit is being detected as Bloodhound Exploit.150 by Norton AntiVirus.
Upon further investigation we found that this Web site was also serving an exploit that leveraged an unpatched vulnerability in a very popular Chinese peer-to-peer file sharing application called Xunlei (Thunderbolt in English). Xunlei has an estimated user base of around 80 million, which makes it a very lucrative target to exploit. The vulnerability lies in the Xunlei WebThunder, which can be used as a Web-based alternative for the original application accessible through browsers like the Microsoft Internet Explorer. However, the COM control âThunderServer.webThunder.1â (03507A1A-E0C5-4404-AA26-205385C0892D) fails to properly validate the supplied user-input. The attackers abused a certain sequence of routines supplied by this COM control in order to download arbitrary files on the userâs system. This exploit is being detected as Downloader by Norton AntiVirus.
Both of these client side exploits deliver the same malicious payload, which is being detected as W32.Looked.BK.
Another interesting aspect of this attack is the clever JavaScript obfuscation techniques that are used to hide these attacks. At first glance, what appeared to be a garbled Web page turns out to be an obfuscated JavaScript exploit using up to six levels of obfuscation (see image). This is primarily used to evade security products like Web applications that implement on-the-fly script parsers. This is how the exploit is obfuscated:
1. For the original exploit, all the variable names are randomized and the string values are replaced by their hexadecimal counterparts.
2. It is then encoded using a wrapper function which performs mathematical substitution operations on the code.
3. The wrapper function is further encoded using the JavaScript escape() function.
4. All the new-line characters in the resulting code are then escaped.
5. It is then packed with a routine which performs another set of substitution operations on the code.
Client-side attacks have become the most prominent vector in the ever-evolving threat landscape. With their increased reach, ease, and effectiveness, such attacks have become the bread and butter of cyber-criminals. Almost every other day we hear of anothe legitimate Web site being compromised to enable such attacks, with innocuous users bearing the brunt of them. We anticipate that the frequency and the complexity of such attacks will increase in the near future. To avoid falling victim to such an attack, users should patch their system regularly, update their antivirus definitions, and browse only trusted Web sites.
Virus Top 20 for May 2007
01 Jun
Posted by CANAL INFORMACION CASTELLANO DOCTORINTERNET VIRUS as Uncategorized
May brought a few surprises, with old email worms climbing to the top of the rankings, and a warning of more to come. This month’s Top Twenty also features two classic file viruses.
Online Scanner Top 20 for May 2007
01 Jun
Posted by CANAL INFORMACION CASTELLANO DOCTORINTERNET VIRUS as Uncategorized
It’s interesting that the virus writers who are creating Trojan downloaders are actively varying the type of files downloaded, ranging from obviously malicious programs to adware.
Patrocinadores
