(Updated 1/21/2010)
January 2010
National Cyber Alert System
Technical Cyber Security Alert TA10-021A
Microsoft Internet Explorer Vulnerabilities
Original release date:
Last revised: --
Source: US-CERT
Systems Affected
* Microsoft Internet Explorer
Overview
Microsoft has released out-of-band updates to address critical
vulnerabilities in Internet Explorer.
I. Description
Microsoft has released updates for multiple vulnerabilities in
Internet Explorer, including the vulnerability detailed in
Microsoft Security Advisory 979352 and US-CERT Vulnerability Note
VU#49251.
II. Impact
By convincing a user to view a specially crafted HTML document or
Microsoft Office document, an attacker may be able to execute
arbitrary code with the privileges of the user.
III. Solution
Apply updates
Microsoft has released updates to address these vulnerabilities.
Please see Microsoft Security Bulletin MS10-002 for more
information.
Apply workarounds
Microsoft has provided workarounds for some of the vulnerabilities
in MS10-002.
IV. References
* Microsoft Security Bulletin MS10-002 -
<http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx>
* Microsoft Security Advisory 979352 -
<http://www.microsoft.com/technet/security/advisory/979352.mspx>
* US-CERT Vulnerability Note VU#49251 -
<http://www.kb.cert.org/vuls/id/492515>
____________________________________________________________________
The most recent version of this document can be found at:
<http://www.us-cert.gov/cas/techalerts/TA10-021A.html>
____________________________________________________________________
Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA10-021A Feedback VU#49251" in
the subject.
____________________________________________________________________
For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________
Produced 2010 by US-CERT, a government organization.
Terms of use:
<http://www.us-cert.gov/legal.html>
(Updated Dec 11, 2009)
Rogue Anti-Virus Scareware on the Rise
Date: Fri, 11 Dec 2009 04:19:40 -0600 (CST)
From: InfoSec News <alerts@infosecnews.org>
Subject: [ISN] Rogue anti-virus takes off
To: isn@infosecnews.org
Message-ID:
<Pine.LNX.4.61.0912110419200.32436@conundrum.infosecnews.org>
Content-Type: TEXT/PLAIN; charset=US-ASCII
Forwarded from:
http://www.itweb.co.za/index.php?option=com_content&view=article&id=28736
By Kirsten Doyle
ITWeb portals editor
8 Dec 2009
Scareware, fake anti-virus (AV) programs alarming users into thinking their machines are infected, is on the rise.
So says Sergey Golovanov, senior malware analyst, non-Intel research group manager at Kaspersky Lab, during an interview at the company's New Horizons media tour. These programs are widespread and are being used by cyber criminals more and more. To date, the company has seen around 320 families of fake AV.
The security giant discovered around 3 000 rogue AV programs in the first half of last year. The same period of 2009 saw over 20 000 samples being identified. Kaspersky Lab discovers between 10 and 20 new programs of this kind every day. A few years ago, a new program of this type only appeared once every two days.
Distribution techniques
Golovanov says scareware ends up on victims' machines, much in the same way as malware. A Trojan-downloader can covertly download such programs, or vulnerabilities in compromised or infected sites can be exploited to perform a drive-by download.
He says, however, that these programs are usually downloaded by users themselves, as cyber criminals use dedicated programs or adverts to con users into doing this.
Internet advertising and spam are other methods used by criminals to distribute scareware. Many sites, even legitimate sites, host banners advertising a product that claims to solve all sorts of malware issues.
In addition, when surfing the Internet, a user may also find pop-ups appearing in the browser window offering a free anti-virus download.
Clever imitations
According to Golovanov, rogue AV carefully mimics genuine programs. The programs will scan, and then display a sequence of messages, notifications of an error, followed by a message claiming that malware has been found on the system. Following this, it will pop up a message offering the user the opportunity to install an anti-virus program to deal with the malware, at a price of course.
Once a free trial version that allegedly detects, but does not fix the malware problem, has been downloaded, a message is displayed saying the full version should be activated at a cost. These programs often appear very genuine, as the more people are conned, the more money ends up in the pockets of cyber criminals.
According to Kaspersky Lab, programs often use the same mechanisms as polymorphic worms and viruses to combat AV solutions. The main body of the program is encrypted to conceal strings and links. To ensure the program runs correctly, dynamic code within the file decrypts the body of the malware prior to the payload being delivered.
How to protect
Although fake infections do not damage the victims' machines, cyber criminals are using these programs to extort money from novice users. He advises that legitimate programs designed to combat malware will never first scan a computer and then demand money for activation. Be aware that you should never pay for a product which does this.
He urges users to click only on messages from a legitimate AV solution installed on the PC, and ignore any warning messages that pop up randomly while surfing the Internet.
<And it's true... In the last month I've had to save 3 PCs from this type scareware, one PC twice within 2 weeks.. Notice the comment that most of the time the user themselves download the malware!! Exercise Caution!!>
>>>>>><<<<<<>>>>><<<<
Check out these sites for an easy way to test if you have been infected by the Conficker worm...
www.confickerworkinggroup.org/infection_test/cfeyechart.html
or
iv.cs.uni-bonn.de/fileadmin/user_upload/werner/cfdetector/
(March 30, 2009)
CERT Advisory -----
National Cyber Alert System
Technical Cyber Security Alert TA09-088A
Conficker Worm Targets Microsoft Windows Systems Set to Activate April 1, 2009
Original release date: March 29, 2009
Last revised: March 30, 2009
Source: US-CERT
Systems Affected
* Microsoft Windows
Overview
US-CERT is aware of public reports indicating a widespread infection of the Conficker/Downadup worm, which can infect a Microsoft Windows system from a thumb drive, a network share, or directly across a corporate network, if the network servers are not patched with the MS08-067 patch from Microsoft.
I. Description
Home users can apply a simple test for the presence of a Conficker/Downadup infection on their home computers. The presence of a Conficker/Downadup infection may be detected if a user is unable to surf to their security solution website or if they are unable to connect to the websites, by downloading detection/removal
tools available free from those sites:
(copy any of these below these into your browser.)
* http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm&inid=us_ghp_link_conficker_worm
* http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
* http://www.mcafee.com
If a user is unable to reach any of these websites, it may indicate a Conficker/Downadup infection. The most recent variant of Conficker/Downadup interferes with queries for these sites, preventing a user from visiting them. If a Conficker/Downadup infection is suspected, the system or computer should be removed from the network or unplugged from the Internet - in the case for home users.
II. Impact
A remote, unauthenticated attacker could execute arbitrary code on a vulnerable system.
III. Solution
Instructions, support and more information on how to manually remove a Conficker/Downadup infection from a system have been published by major security vendors. Please see below for a few of those sites. Each of these vendors offers free tools that can verify the presence of a Conficker/Downadup infection and remove the worm:
Symantec:
http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-011316-0247-99
Microsoft:
http://support.microsoft.com/kb/962007
http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
Microsoft PC Safety hotline at 1-866-PCSAFETY, for assistance.
US-CERT encourages users to prevent a Conficker/Downadup infection by ensuring all systems have the MS08-067 patch (see http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx), disabling AutoRun functionality (see http://www.us-cert.gov/cas/techalerts/TA09-020A.html), and maintaining up-to-date anti-virus software.
From Slashdot 3/14/2009
+--------------------------------------------------------------------+
| Romanians Find Cure For Conficker |
| from the cheer-goes-up dept. |
| posted by timothy on Friday March 13, @02:11 (Worms) |
| http://it.slashdot.org/article.pl?sid=09/03/13/0234213 |
+--------------------------------------------------------------------+
[0]mask.of.sanity writes "BitDefender has released what it claims is the [1]first vaccination tool to remove the notorious Conficker virus that infected [2]some 9 million Windows machines in about three months. The worm, also known as Downadup, exploits a bug in the Windows Server service used by Windows 2000, XP, Vista, Server 2003 and Server 2008. It spreads primarily through a buffer overflow vulnerability in Windows Server Service where it disables the operating system update service, security center, including Windows Defender, and error reporting. The Romanian security vendor said its [3]removal tool will delete all versions of Downadup and will not be detected by the virus."
Discuss this story at:
http://it.slashdot.org/comments.pl?sid=09/03/13/0234213
Links:
0. mailto:darren_pauli@idg.com.au
1. http://www.computerworld.com.au/article/279991/romanians_find_cure_conficker
2. http://www.computerworld.com.au/article/273431/amazing_worm_attack_infects_9_million_pcs
3. http://bdtools.net/
(copy these links into your browser)
Biggest Worm Attack in Years!
The Downadup worm is now estimated to infect 1 in 16 PCs! Find out how to protect yourself... Check out these articles, and UPDATE your computers!!
www.networkworld.com/news/2009/012009-faq-how-to-protect-your.html
www.networkworld.com/news/2009/012109-panda-security-downadup-worm-now.html
and apparently Microsoft's published "solutions" will not entirely resolve the problem -
www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9126478
==================================================
Got one for Christmas or a Birthday??
Message: 1
Date: Mon, 5 Jan 2009 02:00:20 -0600 (CST)
From: InfoSec News <alerts@infosecnews.org>
Subject: [ISN] Popular photo frames carry risk of infection
To: isn@infosecnews.org
Message-ID:
<Pine.LNX.4.61.0901050200100.18377@conundrum.infosecnews.org>
Content-Type: TEXT/PLAIN; charset=US-ASCII
http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2009/01/01/BUV9150IH8.DTL
By Deborah Gage
Chronicle Staff Writer
January 2, 2009
Digital photo frames were one of the best-selling consumer electronics products this holiday season, but some of them carried a nasty surprise
- malicious software code that tried to hop onto personal computers when the frames were plugged in.
These popular devices are now so powerful that they've become computers in themselves, although people who buy them don't always realize that.
And like computers, the frames are capable of carrying code that logs keystrokes, steals data and calls out to other malicious code once it's installed itself on a PC.
"Users don't realize that bad guys can make use of each and every computer they can control, even if you don't do Internet banking or have any sensitive information," said Karel Obluk, the chief technology officer of AVG, a security vendor with offices in the United States and Europe. "They can profit by spam or other illegal activities and make
(your) PC part of an illegal network. It's something that users should always be reminded of."
No one knows how many infected digital photo frames are out there. But the Consumer Electronics Association estimated that 7.4 million such frames were sold in 2008 - up 41 percent from 2007 - and projected that sales would jump again this year by 33 percent to more than 9.8 million frames.
Among the frames reported to be infected this holiday season were a Samsung 8-inch frame sold by Amazon.com, an Element 9-inch frame sold by Circuit City and a Mercury 1.5-inch frame sold by Wal-Mart.
Amazon.com has e-mailed warnings to its customers about the Samsung frame, but a Circuit City spokesman said the retailer wasn't aware of any infections. After being contacted by The Chronicle, a Wal-Mart spokeswoman said the company would remove the Mercury frames from its Web site.
In 2007, Sam's Club - owned by Wal-Mart - also sold infected frames over the holidays, according to customers who bought them, as did Best Buy, Target and Costco.
American consumers shopped hard for bargains this year, and digital photo frames have been good deals. Wholesale prices continue to drop - Wal-Mart has been selling the Mercury frame, which comes embedded in a key chain, for $24.
But the infected frames also show how risky it is to live with a global supply chain where the cost of buying products at the lowest price means those products can vary widely in quality.
[...]
==========================================================
Recent Microsoft Internet Explorer Problem:
A new zero-day Internet Explorer 7 exploit is now out in the wild. It's a drive-by dropper that resides on malicious Web sites. This exploit has already been incorporated into Chinese exploit toolkits and is actively being used to install information stealing Trojans that target online games. Microsoft has finally acknowledged the problem in Security Advisory (961051):
For those looking for more info on the Internet Explorer problem, check http://blogs.technet.com/swi/archive/2008/12/12/Clarification-on-the-various-workarounds-from-the-recent-IE-advisory.aspx
Nutshell: There are nine different workarounds, but none of them are complete. Best solution is not use IE if you can avoid doing so.
The explot compromises almost all versions of Internet Explorer, from version 5.01 even up the latest beta of the next version of Internet Explorer, v8.
UPDATE: Microsoft has said they will issue a separate "out of cycle" security patch on December 17 to supposedly fix this issue. Stay tuned for more info...
UPDATE 2: Microsoft is now saying that the Remote Execution bug was patched on Dec 17, so make sure you update your systems ASAP, but another XML bug won't be fixed until early 2009.....
HOTMAIL Spam
Hotmail seems to be the latest e-mail domain from which spammers are spewing out their tons of junkmail. I receive over 100 a day from Hotmail. The only reason I receiive these is a couple of my friends and family members use Hotmial for their free e-mail service. I'm tired of having to go through all these messages to sort the wheat from the chaff.
I have advised my family and friends to stop using Hotmail, at least until this latest spam attack subsides. I am setting my e-mail filter to trash all e-mails from Hotmail.
If you need a free e-mail service, try using G-mail (www.gmail.com) or Yahoo (www,yahoo.com), or one of the several other free services.