Farrah Fawcett and Michael Jackson, Malware Distribution

by Andy on June 26th, 2009 in Security Alert.

The trend of exploiting current news events to deliver malware continues to push the boundaries of decency. Its not very often we are taken aback by malware distribution methods, but the recent vulture-like exploitation of the Air France disaster and deaths of Michael Jackson and Farrah Fawcett really is plumbing the depths of social engineering techniques.

Making Sense Of Cross-Site Scripting

by Andy on April 20th, 2009 in Industry and Security News, Security Tips.

You may have seen the headlines last week about a series of worm attacks on Twitter. As we know that many of you use the site (and maybe even follow the team here at Lavasoft on it) we’d like to take a moment to clarify what it was and how you can stay safe.

 

Weighing in on Conficker

by Andy on March 26th, 2009 in Industry and Security News, Researcher Comments, Security Tips.

If you follow online security news, there’s little chance that you haven’t heard about Conficker – a new worm that has received extensive media coverage in the past weeks, due in part to Microsoft’s offer of a $250,000 bounty in return for information leading to the arrest of the malware’s perpetrators.

Potentially Unwanted Programs

by Andy on January 19th, 2009 in Researcher Comments.

With the new version of Ad-Aware, comes a new classification: Potentially Unwanted Program, or "PUP". Why classify something as a "potentially unwanted application"?

Storm Botnet News

by Andy on January 19th, 2009 in Industry and Security News, Researcher Comments.

In case you missed this bit of security news last week, according to Heise Security -

"A team of researchers from Bonn University and RWTH Aachen University have analysed the notorious Storm Worm botnet, and concluded it certainly isn't as invulnerable as it once seemed."

Analysts attempting to traverse the Storm botnet without being detected has proven it to be complex - discovery usually leads to a DDOS attack on the researcher. Having carried out such research covertly and claiming that the botnet can be rapidly taken down is highly significant in terms of the resultant reduction in spam levels and ability to carry out DDOS attacks.

Microsoft's attempts to disrupt the botnet with the Malicious Software Removal Tool, while not definitive, are proving successful. Malware analysts and observers far and wide welcome the news that these researchers have gone one step further by announcing it is theoretically possible to fatally damage the Storm botnet with a single strike.

But, the researchers have noted that there are legal concerns involved in the solution. It's ironic that a single strike that has the potential to take the Storm botnet down from the inside is punishable under German law (and the same may be true in other parts of the world, as well). The Storm botnet is so significant that most people would agree that, when it comes to permanently disrupting it, the end justifies the means. This particular situation gives rise to an ethical dilemma but, ultimately, using illegal methods is not acceptable, however frustrating it may be. Still, even if the researchers are not able to deploy this solution, the data gathered from this research will take us a significant step towards combating and defeating Storm.

Malware Targets LinkedIn Users

by Andy on January 9th, 2009 in Researcher Comments, Security Alerts.

The business-oriented social networking site, LinkedIn, has had a recent bout with malware, as you may have seen by all of the buzz this week in the news headlines. As most of you who use them know, social networking sites, while having many advantages to users, have long been targeted by socially engineered scams - meaning you need to take care when roaming around on these types of sites.

In terms of the issues seen lately on LinkedIn - profiles on the site were created to act as a staging point for the distribution of 'FakeAlert' software. This malware serves typical scareware messages claiming that your machine is infected and that you should install the rogue anti-malware application that the warning message is peddling. Despite the FTCs recent efforts in tackling the scourge of rogueware, the fact that these applications continue to proliferate proves they still provide a significant return of investment for malware authors.

The LinkedIn profiles themselves consisted of links that claimed to lead to pornographic images/video content of various celebrities. Upon landing at these sites, victims were invited to install a codec to allow them to view the (non-existent) video; the file was not a video codec, but malware. This method of attack continues to prove to be extremely effective. The social engineering technique being applied is, sociologically, extremely interesting; despite users increasing awareness of Internet safety (i.e. maintaining download discipline, avoiding untrustworthy sites, and generally being aware of the pitfalls when navigating the seedier side of the 'net), using a combination of celebrity and sex to entice continues to be effective.

On the plus side, LinkedIn.com has worked very quickly to deal with this threat - it's encouraging to observe the site's administrators' rapid response time. When the scam first became apparent, many profiles were removed immediately. Currently, all of the malicious profiles that we located have now been cleaned up.

Scam Alert: UPS Delivery Failure

by Andy on December 3rd, 2008 in Security Alerts, Security Tips.

Have you made any recent purchases to be delivered by the postal service? With the holiday season upon us, chances are good that you have. If so, there's a common spam scam that may try to catch you off guard in order to infect your system with malware. Here's an example of a subject line and e-mail message to be on the lookout for this holiday shopping season, and beyond -

Subject: [NO-REPLY] UPS Tracking Number 21263130

Live OneCare and Morro

by Andy on November 25th, 2008 in Industry and Security News, Researcher Comments.

You've probably heard the news on Microsofts plan to discontinue its Windows Live OneCare and roll out "Morro", a free anti-malware application.

Incremental Updates

by Andy on November 21st, 2008 in Lavasoft Products, Researcher Comments.

As the volume of malware increases, the more signatures we add into Ad-Aware's Detection Database. Naturally, with the huge increase in bad stuff out there, the size of definition files will increase in line with the amount of malware detections we add.

© 2009 Lavasoft. All rights reserved.