Microsoft to patch new DirectX hole

Microsoft on Thursday said it is working on a security patch for a vulnerability in its DirectX streaming media technology in Windows that could allow someone to take complete control of a computer using a maliciously crafted QuickTime file.

The remote code execution vulnerability exists in the way Microsoft DirectShow, audio and video sourcing and rendering software, handles supported QuickTime format files, the company said.
"Microsoft is aware of limited, active attacks that use this exploit code," Microsoft's security advisory said. "If a user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights."

Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are vulnerable but all versions of Windows Vista and Windows Server 2008 are not vulnerable, according to the advisory.
For the attack to work an attacker would have to lure the victim to visit a malicious Web site that hosts the exploit. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user.

Microsoft said it would release a patch to fix the hole as soon as it is ready for broad distribution. In the meantime, details on a workaround are available here, as well a "fix it" button.

US President on cybersecurity: We're not that prepared

US as it should be to respond to disruptions caused by computer or Internet attacks and announced that a new cybersecurity coordinator position would be created inside the White House staff.


The still-to-be-named coordinator will oversee a new bureaucracy tasked with digital infrastructure protection, which had previously been handled by the Department of Homeland Security. "We will ensure that these networks are secure, trustworthy and resilient," Obama said. "We will deter, prevent, detect, and defend against attacks and recover quickly from any disruptions or damage."
Obama's announcement came as the president released the outcome of a 60-day review that sought to rethink how the federal government should address cybersecurity. Business groups had sought to raise cybersecurity's profile in the administration but remained wary about regulatory mandates from Washington; security hawks would prefer the new bureaucracy to have more authority over the private sector.

The final report represents a political compromise. It suggests "intrusion detection and prevention systems" and "warning of cyber intrusions and attacks," while stressing that collaboration with privacy groups and industry is vital. New laws compelling companies to share more information with the federal government about intrusions may be necessary, it says, but only "as a last resort".

During his remarks in the White House's East Room on Friday, Obama also seemed to seek a balance between warning of the dangers of terrorists or other miscreants using the Internet and saying the government will not go too far. "Our pursuit of cybersecurity will not--I repeat, will not include--monitoring private sector networks or Internet traffic," he said.

The report also goes out of its way to recognize the civil liberties concerns that could arise by a greater focus on private networks: the word "privacy" appears no fewer than 69 times in the document.

In a cybersecurity "crisis", the plan is for the coordinator to become the "White House action officer for cyber incident response". That's a similar role to the White House officials who help to monitor terrorist attacks or natural disasters. (The new coordinator's fiefdom will be shared between the National Economic Council and the National Security Council.)

While there has been some private grumbling that the new coordinator will not report directly to the president--a prized symbol of access in Washington circles--reaction to the administration's announcement was generally positive.

Senators John Rockefeller and Olympia Snowe, members of the Commerce and Intelligence committees, said in a statement that "no other president in American history has elevated this issue to that level and we thank (Obama) for his leadership". The Center for Democracy and Technology said it "is evident that the report's authors listened to the concerns of privacy and civil liberties groups".
Cybersecurity headaches
The origin of many of the feds' cybersecurity headaches can be traced back to the process that led to the creation of the Department of Homeland Security nearly seven years ago. Politicians in Washington, D.C. decided to glue together a medley of federal agencies to create a massive bureaucracy that would, as one of its new goals, provide a better focus on cybersecurity.

"The department will gather and focus all our efforts to face the challenge of cyberterrorism," President Bush said when signing the 500-or-so-page bill into law in November 2002. "This department will be charged with encouraging research on new technologies that can detect these threats in time to prevent an attack."

Some tasks might benefit from centralization in one of the world's largest bureaucracies. But it soon became evident that cybersecurity was not one of them. By 2005, government auditors concluded that the department failed to live up to its cybersecurity responsibilities and may be "unprepared" for emergencies; as recently as last fall, DHS Secretary Michael Chertoff said his agency needed to develop a plan to respond to a "cybercrisis".

That led some outside groups to argue that cybersecurity efforts should be taken over by the National Security Agency, which already is responsible for protecting government computers through its "information assurance" arm, or perhaps the White House staff.

Lending an unusual spice to what would normally be a quiet, internecine power struggle was March's resignation of Rod Beckström, director of Homeland Security's National Cybersecurity Center. In his farewell letter, Beckström blasted what he said was an NSA power grab, saying the secretive military agency "effectively controls DHS cyber efforts through detailees, technology insertions".

The week before Beckström's resignation, Director of National Intelligence Admiral Dennis Blair suggested to a House committee that the NSA was ready for the job, saying "there are some wizards out there at Fort Meade." But a few weeks later, after a congressional hearing that was hardly enthusiastic about the idea, NSA director Keith Alexander denied his agency had any interest in the job.

In February, Obama ordered a 60-day review of the federal government's cybersecurity efforts, and appointed Hathaway--who had worked for the director of national intelligence in the Bush administration--to lead it.

In addition, The New York Times reported on Friday that the Pentagon is preparing a new military command for cyberspace that would operate in parallel with the civilian effort that Obama is expected to announce. He is "expected to sign a classified order in coming weeks that will create the military cybercommand" and recognize "that the United States already has a growing number of computer weapons in its arsenal and must prepare strategies for their use," the newspaper said.

During Friday's remarks, Obama noted that his campaign had been the subject of a cyber intrusion in which hackers accessed policy papers and travel plans but not fundraising data.

Spam techniques now 'triple threat'

Spammers are combining their circumvention techniques into a "triple threat" to increase the efficacy of their attacks, according to Symantec.
Paul Wood, MessageLabs intelligence senior analyst, Symantec, said in a statement spammers are combining three more established spam techniques--Captcha-breaking, social networking spam and using Web mail--in an attempt to fool spam filters.

Spam levels of economies in the Asia-Pacific region (%)
Hong Kong	92.3
China	91.1
Malaysia	89
Vietnam	88.7
Singapore	88.4
The Philippines	88.3
India	88
Indonesia	87.1
Total	91.4

Spammers have for the past few years used sophisticated character recognition software to break the Captcha system. Captcha is a verification system commonly found on e-mail account sign-up pages, which displays a set of graphically-distorted numbers and alphabets, meant to be readable to a human but harder for automatic software to recognize and register for an account.
The use of Web mail also shows that cybercriminals are using more reputable Web sites which are less likely to get blocked, debunking a "common misconception that [spammers] are more likely to use less-reputable Web sites...to hide malware," noted MessageLabs.
The antispam company said the number of new sites hosting malware was slashed from 3,561 in April to 1,149 in May, showing that more established-domains were being used to host malicious content. Furthermore, a huge 84.6 percent of domains blocked for hosting malware had been established for over a year.
Wood explained that newer domains tend to get flagged as suspicious because they are typically temporary sites set up just to host spam and malware, and also get shut down faster. Trustworthy older domains can be compromised through SQL injection attacks, he said.
The trend of abusing trust also extends to the proliferation of social networking spam, said Wood. Social networking sites pose a number of varying threats to users, from the availability of personal data on these sites increasing the likelihood of phishing, to the higher chances of users clicking on spam links because they trust friends who "send" it to them.
According to MessageLab, the month of May saw the global ratio of spam rise by 5.1 percent over April to hit 90.4 percent. Hong Kong was the most-spammed economy at 92.3 percent.

Long live the Sneakernet: Computing's most resilient network

When Amazon Web Services' latest--and arguably most valuable--service is a system that allows you to ship terabytes of data to the cloud via snail mail you just have to chuckle. Yes folks, for all the fancy talk of cloud computing, terabytes--not to mention petabytes--of data and technological advancement the Sneakernet is alive and kicking.
The Sneakernet, where someone puts data on a disk, flash drive etc.  and runs it to another computer, is arguably one of our most enduring networks. I still use it all the time. I’m sure I could network my home devices together, but the Sneakernet works just fine.
Multiply the Sneakernet on a grand scale and you understand why Amazon is launching a service called Import/Export. There's too much data to move to the cloud and not enough bandwidth to get it there quickly. Why take five days to move data--and hog up all your bandwidth--when you can toss it on a storage brick of some sort and just overnight it?
Amazon CTO Werner Vogels explained:

In some ways the computing world has changed dramatically; networks have become ubiquitous and the latency and bandwidth capabilities have improved immensely. Next to this growth in network capabilities we have been able to grow something else to even bigger proportions, namely our datasets. Gigabyte data sets are considered small, terabyte sets are common place, and we see several customers working with petabyte size datasets. No matter how much we have improved our network throughput in the past 10 years, our datasets have grown faster, and this is likely to be a pattern that will only accelerate in the coming years. While network may improve another other of magnitude in throughput, it is certain that datasets will grow two or more orders of magnitude in the same period of time.

Simply put, if you wanted to move a terabyte data set to EC2 it will take you a while. On an enterprise scale, this data-moving problem is yet another hindrance to cloud computing adoption.
Microsoft Research notes that you still have to maintain that network. And there’s labor and support.
Microsoft Research’s Jim Gray concluded that Sneakernets are the answer to the above conundrum:

What is the best way to move a terabyte from place to place? The Next Generation Internet (NGI) promised gigabit per second bandwidth desktop-to-desktop by the year 2000. So, if you have the Next Generation Internet, then this transfer is just 8 trillion bits, or about 8,000 Seconds--a few hours wait. Unfortunately, most of us are still waiting for the Next Generation Internet--we measure bandwidth among our colleagues at between 1 megabits per second (mbps) and 100 mbps. So, it is takes us days or months to move a terabyte from place to place using the Last Generation Internet.

That passage was written in 2002. And guess what? We’re still waiting. Simply put, the Sneakernet is the most efficient means of moving a terabyte of data around.
Given that fact, Amazon’s Sneakernet, the Import/Export service, may become its most appreciated if not technologically advanced feature. Go figure. In a nutshell, Import/Export allows you to ship data on storage devices with a manifest that explains how and where to load the data and map it to Amazon's storage system.
Now there are costs. Amazon will charge you US$80 per storage device handled and US$2.49 per data loading hour. And then there’s the usual storage pricing. But add it up and it’s cheaper per terabyte than waiting a week for a dataset to move.
Will the Sneakernet ever go away? Nope. Gray sums it up:

Until we all have inexpensive end-to-end gigabit speed networks, terascale datasets will have to move over some form of sneaker net. We suspect that by the time the promised end-to-end gigabit (next generation Internet) arrives, we will be moving petabyte scale datasets and so will still need a Sneakernet solution.

Clickjacking: Hijacking clicks on the Internet

What if you reached to grab a newspaper out of a news stand and you found a rock in your hand instead? How about opening the front door to a grocery store and ending up on a boat?
This sounds like a Matrix movie, but the virtual equivalent of this is real and poses one of the most serious new risks on the Internet, according to Jeremiah Grossman, chief technology officer and co-founder of Whitehat Security.
"Most exploits (like worms and attacks that take advantage of holes in software) can be patched, but clickjacking is a design flaw in the way the Web is supposed to work," Grossman said. "The bad guy is superimposing an invisible button over something the user wants to click on...It can be any button on any Web page on any Web site."
The technique was used in a series of prank attacks launched on Twitter in February. In that case, users clicked on links next to tweets that said "Don't Click" and then clicked on a button that said "Don't Click" on a separate Web page. That second click distributed the original tweet to all of the Twitter user's followers, thus propagating itself rather quickly.
At the time, Grossman called it a "harmless experiment", but the potential for harm by an attacker who isn't just having fun is huge.
In a demo at the offices of ZDNet Asia's sister site CNET News.com on Thursday, Grossman showed how someone could launch a clickjacking attack using Flash to spy on someone by getting them to turn on their computer Web cam without knowing it.
Like the name suggests, clickjacking is the hijacking of your click, unbeknownst to you. A victim may not even know that the click has been redirected, which means there could be clickjacking attacks going on that no one knows about yet.
Clickjacking attacks are accomplished by creating something called an iFrame that allows a browser window to be split into segments so that different items can be shown on each. This code is inserted into the target Web page and is invisible to the end user. When the end user's cursor clicks on the section of the page where the malicious iFrame is hiding, the attack is launched to do whatever the attacker desires.
An attacker could hide an iFrame under any innocent link on any Web page--a headline on the New York Times or a "digg this" button on Digg, for instance--and when the victim clicks on the link, the cursor is actually clicking on the hidden iFrame.
In the Web cam demo, the iFrame created contains a Flash pop-up window that asks the user to grant permission to have the Web cam turned on. When the victim clicks the link, the Web cam is turned on and secretly begins recording everything the user does in front of the computer.
One of the scariest things about clickjacking is the potential for abuse. An attacker could spy on you by turning on your Web cam or microphone, direct you to a Web page with malicious content that is downloaded onto your computer, or even rig it up so you end up clicking "buy" instead of "cancel" on an e-commerce site.
Another thing that makes clickjacking so serious is that there really is very little that end users can do to protect themselves, Grossman said.
In the Web cam scenario, the best defense is probably to put a post-it note or other item over the Web cam lens and to disable the microphone in the software, he said. Flash Player 10 provides some protection by preventing anything from obscuring the security permissions dialogue box, he said.
Web site owners optimizing their sites for Internet Explorer 8 have the ability to prevent pages from being framed in, which means visitors to their site will be safe, only on that site and only if they are using IE8, Grossman said.
People using Windows and IE should disable JavaScript to help protect against clickjacking, he said. Firefox is safer; the NoScript add-on for Firefox not only lets people selectively block scripts, but it has a ClearClick feature designed specifically to protect against clickjacking, he added.
People should also log out of Web sites, like Facebook and Twitter, when they are done using them for the time being. "You can't be forced to do something on the site if you are not logged in," Grossman said.
More details are in a white paper on the technique, written by Grossman and Robert Hansen of SecTheory and published in September 2008. Grossman and Hansen coined the term in that document.
The authors cancelled their talk on the subject at the OWASP (Open Web Application Security Project) conference that month at Adobe's request because their proof of concept revealed a bug in Adobe's software, according to IDG News Service.

Deja vu: New scams hit Facebook and Twitter

Phishers were having a field day with Facebook and Twitter on Thursday.
A new phishing scam hit Facebook users that, like others in recent weeks, sends them to a Web site which steals their log-in information and also secretly downloads malware onto computers when they visit the malicious Web site in what is known as a "drive-by download".
Meanwhile, Twitter users were getting messages from new followers that were posting links to a fake Twitter site with "tvvitter" in the tiny URL, Graham Cluley of Sophos wrote in his blog. His blog has a video of the phishing attack in action. Twitter representatives did not immediately respond to e-mails seeking comment.
In the Facebook attack, messages circulated with a subject line of "Hello" and a prompt to check out "areps.at" or other URLs ending in ".at".
The URLS, before being blocked, directed the visitor to a fake Facebook page. If you logged in to the site, it would steal your e-mail and password, log you into Facebook, automatically change your password, and send the same message to all your Facebook friends, according to the All Facebook blog.
The malicious Web sites also spread the Koobface worm and install the Trojan.BHO, among other malware, onto unsuspecting computers, according to a CNET News test using Internet Explorer. But the URLs were blocked by Firefox and flagged as a "Web Forgery" as of 9:50 a.m. PDT.
"Whoever is behind the scam has been steadily amassing a large number of e-mail addresses and passwords over the past few weeks," the blog says. "Some days as much as three scams will spread throughout the site (possibly even more). Facebook rapidly shuts down all references to the site but by then the scam has spread to thousands of users."
Facebook spokesman Barry Schnitt said: "The impact of this attack or the previous ones are not widespread and only impacted a tiny fraction of a percent of users. We've been updating our monitoring systems with information gleaned from the previous attacks so that each new attack is detected more quickly."
The site has blocked links to the new phishing sites from being shared on Facebook, added them to the block lists of the major browsers, and is working with partners to have the sites taken down completely, he said. Facebook also is cleaning up phony messages and wall posts and resetting the passwords of affected users.
Other safe computing tips from Facebook:
--Use an up-to-date browser that features an anti-phishing black list. Some examples include Internet Explorer 8 or Firefox 3.0.10.
--Use unique logins and passwords for each of the Web sites you use.
--Check to see that you're logging in from a legitimate Facebook page with the facebook.com domain.
--Be cautious of any message, post, or link you find on Facebook that looks suspicious or requires an additional login.
--It is important that impacted users reset all accounts (not just Facebook) that use the same credentials. We believe the bad guys here are phishing an account and then trying those credentials on webmail providers. So, for example, if a user is compromised on Facebook and has the same login and password for their Gmail, the attacker may be able to intercept the Facebook password reset and compromise the account again in the future. This is one of the reasons why people need unique passwords for their online accounts.
--Become a fan of the Facebook Security Page (www.facebook.com/security) for more updates on new threats as well as helpful information on how to protect yourself online.
Separately, some Facebook users reported difficulty accessing the site on Thursday morning. It was unclear whether the connectivity issues were related to the phishing scam.

Protecting yourself from vishing attacks

You might have heard about online "phishing" scams designed to steal money from unsuspecting Web users, but now criminals are using another type of scam called "vishing" to commit the same crimes.
Last week, the U.S. Federal Trade Commission filed lawsuits against two telemarketing firms in Florida and a company claiming to sell extended automobile warranties for violating the Do Not Call registry and fraud for selling bogus warranties for between US$2,000 and US$3,000 a pop. Since 2007, the companies supposedly made 1 billion calls and generated more than US$10 billion.
These companies likely used spoofed caller ID numbers to hide their identities from consumers and law enforcement authorities.
The case is the latest example in what is known as "vishing" attacks, which use the phone network to swindle people out of money. To help readers understand what these scams are, how they work and how they can protect themselves. ZDNet Asia's sister site CNET News has put together this FAQ.
What is vishing? The term "vishing" is a socially engineered technique for stealing information or money from consumers using the telephone network. The term comes from combining "voice" with "phishing", which are online scams that get people to give up personal information.
How does it work? Typically attackers use a technique called caller ID spoofing to make it look like calls are coming from a legitimate or known phone number. It's a very similar technique to email spoofing, which makes e-mail addresses look like they are coming from a trusted source. But because people typically trust the phone service and caller ID, spoofing phone numbers can be particularly damaging.
And just like with online phishing attacks, which direct consumers to phony Web sites, vishing attacks usually have a recorded message that tells users to call a toll-free number. The caller is then typically asked to punch in a credit card number or other personal information. In the case of the warranty scams, users are asked to buy a bogus extended warranty for their car, which can cost anywhere between US$2,000 and US$3,000.
How easy is it to spoof a phone number? With voice over IP phone technology, caller ID spoofing is very easy to do. The traditional phone network works by connecting one circuit to another. Each circuit on either end of the call is assigned a phone number by the phone company. So changing the phone number of a caller was more difficult. Of course, there were people who had figured out ways to hack into the old phone network to do this, but it wasn't as easy as it is today with voice over IP technology. With VoIP services, there is no circuit. These services use the Internet, which assigns different devices on the network IP addresses instead of actual phone numbers. Phone numbers are actually assigned by the users themselves.
There are several companies offering commercial spoofing services, such as SpoofCard. And even VoIP services, such as Skype, allow people to pick an area code and even the prefix number they want when they set up a new phone number. These numbers can be used to disguise where calls originate. Of course, Skype is built for individual use, but other services like Flowroute provide VoIP services for businesses using PBXs. A PBX, or private branch exchange system, makes connections among the internal telephones of a private organization, such as a business, and it also connects them to the public switched telephone network (PSTN). These services allow companies to pick any phone number for caller ID they want. And some telemarketers use the service to spoof telephone numbers.
The practice of caller ID spoofing is so widespread and common that one of the telemarketers accused in the FTC lawsuit supposedly bragged to a prospective client that he could call the entire United States in just a few hours and would not get caught calling people on the Do Not Call List.
Is caller ID spoofing illegal? No it's not. But there is proposed legislation that could make manipulating a phone number to look like it's coming from someone else illegal.
Are there legitimate uses for caller ID spoofing? Yes, there are some legitimate uses for spoofing. Voice over IP providers by definition must use spoofing, or some kind of number manipulation, to create phone numbers. But there are other legitimate uses. For example, doctors who might want to call back patients from their home may use spoofing to conceal their their home numbers. Some online dating services use spoofing to let people talk to potential matches without revealing their real phone numbers. And some lawyers involved in domestic violence cases may use caller ID spoofing to protect the whereabouts of abused clients.
Even though there are some legitimate uses for caller ID spoofing, Lance James, co-founder of Secure Science, which specializes in fraud protection, says 75 percent of all caller ID spoofing is likely for illegitimate purposes. Still, he believes that any new laws written that make caller ID spoofing illegal, should distinguish between people using spoofing for legitimate purposes and those looking to harm or scam people out of money.
Who typically uses caller ID spoofing and vishing scams? Most of the vishing attacks have been from nefarious individuals or crime rings who are stealing credit card numbers or other personal information in identity theft. But telemarketers are also using the technique to get people to buy bogus products. Because the costs are so low for to spoof caller ID numbers using a voice over IP service, it means that companies using the technique only have to get a few people to buy a phony product or hand over personal or financial information to make the efforts profitable.
How do the scams usually work? Scammers often use either a war dialer, which is software that identifies numbers that can be used to make calls, to call phone numbers in a given region, or they access a legitimate voice messaging company with a list of phone numbers stolen from a financial institution. Usually they set up an automated recording to call individuals telling them that their credit cards have been flagged for fraudulent activity. Then they either ask people to provide credit card numbers, PIN codes, and/or Social Security numbers to verify their account or they provide another number where the consumer is to call to provide account details.
Some sophisticated attacks combine vishing and phishing. These scams typically start with a phishing e-mail that says there has been a problem with an online account from a known Web site, such as a bank, credit card company, or online retailer, and it directs users to call a number and enter information to verify their account.
Is it hard for authorities to catch vishers? Yes and no. Because all calls originate and terminate somewhere, there are billing records that law enforcement officials can use to trace calls to their sources. But this often takes several subpoenas to get access to the right information, which takes time and costs money.
Are there any technologies that can be used to identify vishing attacks? The biggest vulnerabilities in the communications network occur where older technologies meet new technologies, according to Secure Science's James. As a result, he believes that a coordinated effort by traditional phone companies and newer VoIP companies can help stop many attacks. Essentially, traditional phone companies and VoIP providers can verify and authenticate calls to ensure people making calls are who they say they are. This practice should cut down on much of the illegal activity that is done by spoofing caller ID numbers, James said.
Carriers could also add clauses to their terms of use that would prohibit customers from using spoofed IDs to commit fraudulent acts. And if these users are caught doing something illegal, they could have their service terminated.
Some companies are offering blacklist software that blocks certain caller ID phone numbers. Of course, blacklisting can be tricky since scammers and telemarketers can numbers can change the pool of numbers they use to conceal their identities. For example, Google will offer a feature in its Google Voice product that will allow phone calls to be filtered like email so that users can block calls or send some calls from certain phone numbers to a "spam" folder.
And finally caller ID spoof providers like SpoofCard, which handles the large majority of spoofed numbers on the market, can work with service providers and law enforcement to flag suspicious spoofers.
What can consumers do to protect themselves? Here is some advice from security experts:
• Be aware. Consumers need to know that these scams exist. For more information, go to the FTC Website.
• Be suspicious of all unknown callers. People should be just as suspicious of phone calls as they are of e-mail messages asking for personal information. And some experts suggest letting all calls from unknown callers go to voicemail.
• Don't trust caller ID. Just because your caller ID displays a phone number or name of a legitimate company you might recognize, it doesn't guarantee the call is really coming from that number or company. As explained earlier, caller ID spoofing is easy.
• Ask questions. If someone is trying to sell you something or asking for your personal or financial information, ask them to identify who they work for, and then check them out to see if they are legitimate.
• Call them back. Again if someone is selling you something or asking for information, tell them you will call them back and then either verify the company is legitimate, or if it's a bank or credit card company, call them back using a number from your bill or your card. Never provide credit card information or other private information to anyone who calls you.
• Register your number with the National Do Not Call registry at donotcall.gov. Even though criminals and unscrupulous telemarketers may ignore the list, if you are on the list and get a call from a supposed telemarketer, that could be a tip that the offer is bogus. Most legitimate telemarketers obey the rules and laws about contacting consumers. Also, the Website provides a place where complaints can be filed.
• Report incidents. Report vishing calls to www.ftc.gov. The FTC wants the number and name that appeared on the caller ID as well as the time of day and the information talked about or heard in a recorded message. If you think you've been a victim of a vishing attack you can also contact, the Internet Crime Complaint Center.

There's a Hole in IIS

Internet Information Services (IIS) has a big hole, and so far there's no fix -- just a warning. Versions 5 through 6 are vulnerable to an "elevation of privilege" attack.


So far no one has been struck, as far as we know, and there are some things you can do.

Make sure your access control lists are disciplined and that those who don't need access don't have it. You can also set up fake admin accounts that don't actually have admin rights.

This way an intruder may think he's cracked your system, but can't actually do anything. Pretty clever.

Gumblar: Biggest Threat on the Web Today?

A new trojan has grown quickly, and experts aren't mincing words in describing the danger.

A new worm is propagating across the Web, and a growing chorus security experts are warning that the Gumblar worm might be the biggest danger now facing the Net.

US-CERT yesterday issued an alert that the worm is propagating, joining warnings from other Internet security watchers like Sophos' Graham Cluley, who last week blogged that his company's figures indicate that the malware is currently the Web's dominant threat.

Last Wednesday, Sophos researcher Onur Komili reported that Gumblar, also known as Troj/JSRedir-R, had roared to the No. 1 spot among the Web's most common infections -- noting that it's six times more prevalent than the next closest threat, at around 42 percent of all of Sophos' detections.

The Gumblar attack compromises Web sites through the use of stolen FTP credentials, which is one of the targets of the legendary Sinowal Trojan. The compromised sites then infect users by means of a drive-by download attack that infects via unpatched Adobe PDF and Flash Player vulnerabilities.

Once a PC is successfully infected, the malware attempts to redirect Google (NASDAQ: GOOG) search engine results to point to malware-laden and phishing Web sites.

The malware "also steals FTP credentials (if found) from the victims' computers," Mary Landesman, a senior security researcher at ScanSafe, reported last week. "These stolen FTP credentials are then used to further compromise any websites owned or operated by the victim."

"As a result, there is exponential growth of these compromises -- as more victims are infected by encountering a compromised site, the number of compromised sites also increases and thus more visitors are exposed," Landesman wrote.

Despite its rapid spread, fighting back against the malware could be relatively straightforward.

"US-CERT encourages users and administrators to apply software updates in a timely manner and use up-to-date antivirus software to help mitigate the risks," the group said in its advisory.

Microsoft warns of new server vulnerability

A new, unpatched vulnerability exists in one of Microsoft's server products, the company warned late Monday.


In a technical bulletin, the company said it is looking into "public reports of a possible vulnerability in Microsoft Internet Information Services (IIS)."

The company said that a flaw exists in a certain type of Web-serving operation.

"An elevation of privilege vulnerability exists in the way that the WebDAV extension for IIS handles HTTP requests," Microsoft said. "An attacker could exploit this vulnerability by creating a specially crafted anonymous HTTP request to gain access to a location that typically requires authentication."

Microsoft said it is not aware of attacks using the vulnerability. The company said it may provide an update as part of its monthly Patch Tuesday or, depending on the severity, could provide a fix outside of its monthly patching schedule.

In the meantime, the company listed on its Web site certain configuration settings that can help mitigate the impact of the flaw.

Improve Windows systems performance by enabling TCP Offload engine

 Using the TCP offload engine can greatly improve performance for Windows systems. Here are some pointers to make sure your configuration is ready for TOE.


The TCP offload engine (TOE) allows for higher performance on systems where a large amount of network traffic will take place.

Basically, TOE-supporting systems shift the processing requirements on the network transport to the interface. This can make a significant difference on systems where near line speed traffic occurs.

For many Windows-based systems, TOE is not enabled by default. Enabling TOE is not as easy as it may seem, however. There are no consistent requirements to get a system supporting TOE up to speed.

The process to enable TOE can touch the Windows operating system, the NIC driver, and possibly the NIC BIOS. Here are some points to get TOE running in your environment.

To get started with TOE on Windows 2003 or XP, the Windows Scalable Network Pack is required to enable support. This download Windows Server 2003 Service Pack 1 or higher and Windows XP x64 edition. Windows Server 2008 systems do not have to download a similar update, but it is not enabled by default.
To enable TOE on a Windows Server 2008 system, use the following netsh command to enable it quickly:

netsh interface tcp set global chimney=enabled


For those waiting for Windows Server 2008’s highly anticipated R2 release, TOE is supported by default and no intervention is required on the operating system.

Beyond the operating system there may be additional steps required on the properties of the network adapter, the network driver tools (Intel PROSet or Broadcom BASP), or possibly in the BIOS of the NIC.

This practice should be done only on physical servers. Operating systems like VMware’s ESX and Hyper-V for Windows Server 2008 should have it enabled. Virtual Machines should use the default configuration unless the synthetic driver installation (VMware Tools, Integration Services, etc.) configures otherwise.

Pirated Windows 7 RC builds botnet

A pirated version of Windows 7 Release Candidate (RC) infected with a Trojan horse has created a botnet with tens of thousands of bots under its control, according to researchers at security firm Damballa.
The software, which first appeared on 24 April, spread as quickly as several hundred new bots per hour, and controlled roughly 27,000 bots by the time Damballa took over the network's command and control server on 10 May, the firm said on Tuesday.
The pirated software was spread via popular piracy sites and online forums, Damballa said.
The software is primarily designed to download and install other malicious packages under a 'pay-per-install' scheme, under which the botmasters are paid based on the number of other pieces of malware they cause to be installed, Damballa said.
Infected installations are continuing to appear at a rapid rate, according to the company.
"We continue to see new installs happening at a rate of about 1,600 per day with broad geographic distribution," said Tripp Cox, Damballa's vice president of engineering, in a statement. "Since our takedown (of the command and control server), any new installs of this pirated distribution of Windows 7 RC are inaccessible by the botmaster."
However, the botmaster still controls the existing installations, Damballa said. The infected systems are mainly concentrated in the United States, with 10 percent, and the Netherlands and Italy, with 7 percent each.
Windows 7 RC has been used as a lure by other malware distributors since its launch on 5 May, according to security experts. On Monday, Trend Micro said it found the Trojan horse TROJ_DROPPER.SPX masquerading as a copy of the release candidate.
Botnets are one of the most serious threats on the internet, according to security experts, and are typically used to carry out denial-of-service attacks or phishing schemes or to send junk mail. Last month, SecureWorks researcher Joe Stewart suggested that technology was not enough to stop botnets, arguing the IT industry should look to new law-enforcement measures.
The legitimate version of Windows 7 RC is available from Microsoft's Web site.

Hackers taking advantage of Windows 7

A Netbook with the new Windows 7.

Microsoft said on Thursday that cybercriminals are already hawking booby-trapped versions of just-released Windows 7 operating system software.

"It's so important for customers to get their copies of Windows from a trusted source," Joe Williams, general manager, Worldwide Genuine Windows at Microsoft, said in an interview posted at the company's official website.

"In the last few days we've seen reports of illegitimate distributions of the release candidate of our latest Windows operating system, Windows 7, being offered in a way that is designed to infect a customer's PC with malware."

A nearly-final version of Windows 7 made its world debut on Tuesday, giving people a chance to tell Microsoft what they love or hate about the new-generation operating system.

Microsoft is making Windows 7 Release Candidate (RC) available as it puts finishing touches on the operating system that will replace Vista.

The US software colossus has touted anti-piracy protections it built into Windows 7 to thwart the spread of illegal copies of the operating system.

Windows 7 anti-piracy guards build on technology built into Vista, according to Williams. For example, pop-up boxes will warn people when unauthorized copies of software are spied on computers.

"With Windows Vista, we made significant strides in reducing the threat pirated copies posed to customers, our partners and Microsoft software, and we anticipate we'll do even better with Windows 7," Williams said.

Microsoft decried software piracy as a pervasive problem that costs the world economy more than $45 billion annually and exposes users to risks of identity theft, system crashes, and data loss.

Williams said Microsoft research shows that as many as a third of the company's customers worldwide may be running counterfeit copies of Windows.

"We see many cases of customers who wanted to buy genuine software and believed they did, only to find out later that they were victims of software piracy," Williams said.

Windows operating systems are used in about 90 percent of the world's computers, according to industry figures.

US threatens military force against hackers

Cyber espionage and attacks from well-funded nations or terror groups are the biggest threats to the military’s computer networks, a top US officer said.

Gen Kevin Chilton, who heads US Strategic Command, said he worries that foes will learn to disable or distort battlefield communications.

Chilton said even as the Pentagon improves its network defences against hackers, he needs more people, training and resources to hone offensive cyber war capacity. At the same time, he asserted that the US would consider using military force against an enemy who attacks and disrupts the nation’s critical networks.

“Our job would be to present options. I don’t think you take anything off the table when you provide options” to the president, in the wake of an attack, whether the weapon is a missile or a computer program, he said.

Chilton’s comments shed the most light to date on the Pentagon’s ongoing debate over how to beef up its abilities to wage and defend against cyber warfare. And they came as the military is planning to set up a new cyber command at Fort Meade not far from Washington that would report to Strategic Command.

Chilton said that his biggest fear is that enemies hack into military battlefield systems, and when an American commander sends out an order that says forces should go left, it is changed to say forces should go right. While most systems are classified and walled off, he said there are often ways to cross into those networks.

The other worry is more internal. When a soldier or sailor sits down at a computer, Chilton said “it’s like he’s stepping to the guard gate at his base,” and can open the digital gate and let adversaries in.

Researchers hijack botnet, score 56,000 passwords in an hour

The Torpig botnet was hijacked by the good guys for ten days earlier this year before its controllers issued an update and took the botnet back. During that time, however, researchers were able to gain a glimpse into the kind of information the botnet gathers as well as the behavior of Internet users who are prone to malware infections.

Researchers at the University of California Santa Barbara have published a paper (PDF) detailing their findings after hijacking a botnet for ten days earlier this year. Among other things, the researchers were able to collect 70GB of data that the bots stole from users, including 56,000 passwords gathered within a single hour. The information not only gave them a look at the inner workings of the botnet, they also got to see how secure users really are when it comes to online activities. (Hint: they aren't.)

The botnet in question is controlled by Torpig (also known as Sinowal), a malware program that aims to gather personal and financial information from Windows users. The researchers gained control of the Torpig botnet by exploiting a weakness in the way the bots try to locate their commands and control servers—the bots would generate a list of domains that they planned to contact next, but not all of those domains were registered yet. The researchers then registered the domains that the bots would resolve, and then set up servers where the bots could connect to find their commands. This method lasted for a full ten days before the botnet's controllers updated the system and cut the observation short.

During that time, however, UCSB's researchers were able to gather massive amounts of information on how the botnet functions as well as what kind of information it's gathering. Almost 300,000 unique login credentials were gathered over the time the researchers controlled the botnet, including 56,000 passwords gathered in a single hour using "simple replacement rules" and a password cracker. They found that 28 percent of victims reused their credentials for accessing 368,501 websites, making it an easy task for scammers to gather further personal information. The researchers noted that they were able to read through hundreds of e-mail, forum, and chat messages gathered by Torpig that "often contain detailed (and private) descriptions of the lives of their authors."

(Comically, the report notes that 0.1 percent of Torpig victims love "exchanging insults" online, with another four percent spending their time looking for sex online. The rest are doing relatively mundane things like worrying about grades, looking for advice from doctors and lawyers, looking for jobs, and playing video games.)

Of course, the primary goal of Torpig is to steal financial information like credit card numbers and bank logins. In just ten days, Torpig apparently obtained credentials of 8,310 accounts at 410 financial institutions, including PayPal, Capital One, E*Trade, and Chase. The researchers noted, too, that nearly 40 percent of the credentials stolen by Torpig were from browser password managers, and not actual login sessions, and that the Torpig controllers may have exploited these credentials for between $83,000 and $8.3 million during that time period.

Interestingly, a large number of the financial institutions that had been breached required "monumental effort" in order to notify the victims, according to the report. In fact, financial institutions weren't the only ones—interacting with registrars, hosting facilities, and law enforcement were all "rather complicated," indicating that there's a long way to go in order to make notifying botnet victims easier.

Not becoming a victim in the first place is the most ideal situation, however. The researchers concluded that victims of botnets are usually those with poorly maintained machines and who choose "easily guessable" passwords. " This is evidence that the malware problem is fundamentally a cultural problem," reads the report. "Even though people are educated and understand well concepts such as the physical security and the necessary maintenance of a car, they do not understand the consequences of irresponsible behavior when using a computer."

Attacker reportedly holds US state's patient data hostage

An attacker tried to extort US$10 million after breaking into a Virginia state Web site used to track prescription drug abuse and allegedly holding the data hostage, according to a posting on the Wikileaks Web site.


The ransom message on the Virginia Prescription Monitoring Program site read:

"I have your [expletive]! In *my* possession, right now, are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh :(For US$10 million, I will gladly send along the password."

The site, which was broken into late last week, was not accessible late on Monday.
Sandra Whitley Ryals, director of Virginia's Department of Health Professions, told The Washington Post that a criminal investigation is under way by federal and state authorities. An FBI spokesman declined to comment.