An Interview with former 180solutions employee

Jimmy Daniels has done an interview with a former 180solutions employee. Everyone should check it out. click here

Jimmy: Being on the technical side of it, I would imagine you've had to uninstall 180 many times from family and friends pc's, as I have. Got any good stories there?


ex180: Uninstalls? Yeah. I've taken it off my neighbors computer a couple times He has three girls and it finally got so bad that I rebuilt his laptop and installed vmware, then decreed that he was the only person in the house allowed to use the computer without starting vmware first and surfing from it. He backed it up and has been happy ever since. I remember my first embarrassing experience was my fifth day at the company... I got a call from a non-technical co-worker at my previous job to help her uninstall n-case. She knew who I went to work for and it was before the uninstallation stuff was so widely available on the web. That was humiliating... I was like, "wow... people warned me about this place before I came and here's so-and-so needing help to get this crap off her machine". Ouch.

Eric Sites
VP of Research & Development
Sunbelt Software

What do the bad guys know about your bank?

Here at Sunbelt we come across a lot of personal information stolen by keyloggers, trojans that go after your protected storage data, and phishing scams. So what do the bad guys do and know about your bank account when they have that information?

Here is a conversation we came across while doing malware research that everyone should know about:

Barclays Question

I have some questions regarding Barclays bank drop cashing, hope everyone can help.

1. Is it true that it requires one business day(next day)to complete the transfer if I do online transfer to another Barclays drop? Or will it do instantly like Boa and Wells Fargo?

2. Is it ok if I use a personal Barclays drop and cashout 10k+ balance from a business login? Or do I need business Barclays drop in this case?

3. In term of risk, is there any different between cashing 2k and 10k from the bank? I mean is there any requirement if I cash large sum of money compare with small amount cashing?

Thanks in advance.

Yep it takes 1 Working Day for the Transfer to be Cleared. if you do it befor 6pm on a working day it will be in the account nextday. if you do the transfer after 6pm it will take 2days to clear. hope that helps

You need to know barclays limit is xxxxxxx[amount removed] pounds.

if you go over this amount the bank will phone and u must have full info of login to cash it and answer the bank.

xxxxxx[amount removed] limit is for personal account if I'm not mistaken, what if I use business account and transfer more than xxxxxx[amount removed], will they still call for verification?

yes they will call even if its business and if you go over the limit.

you need a full info login

yes they will call even if its business and if you go over the limit.

U mean xxxxxx[amount removed] limit? Even I use business and transfer more than xxxxxx[amount removed] they still call? Do I need to change the phone number since they'll call the phone number registered on the file?

Of course, we wouldn't want the account holder verifying shit now do we

xxxxxx[amount removed] is limit do about xxxxxx[amount removed] change the phone on the login what i do is change the mobile to my mobile and the house or landline i delete 2 number and add 2 so the number is invalid so bank calls mobile.

thanks

I think what u're trying to say is that cash it b4 12.00pm second day so even they call later and the money has already been cashout. But aren't that they won't add the transfer to your drop before the any verification is confirmed?

-------------------

Eric Sites
VP of Research & Development
Sunbelt Software

eEye issues temporary fix for IE Exploit

eEye has released a patch for the active IE zero day exploit:

Organizations that choose to employ this workaround should take the steps required to uninstall it once the official Microsoft patch is released. This workaround is not meant to replace the forthcoming Microsoft patch, rather it is intended as a temporary protection against this flaw. Organizations should only install this patch if they are not able to disable Active Scripting as a means of mitigation [my emphasis].

Link here.

Yup, I agree. Don't bother using this patch -- turning off Active Scripting in IE is a valid mitigator. Microsoft will have this patched on (or possibly before) April 11.


Alex Eckelberry
(Hat tip to Andreas)

Become a phishing terminator

CastleCops and Sunbelt Software are announcing a new anti-phishing community, the Phishing Incident Reporting and Termination (PIRT) Squad. This will be a community at CastleCops solely dedicated to taking down phishing sites. It’s the first public takedown community that I know of, and we are going to start nailing these sites. You can read the press release here. Zdnet article here. You can register to help us here.

The PIRT Squad works as a complement to existing organizations such as the Anti-Phishing Working Group (APWG). The primary difference between PIRT and other organizations is that PIRT is focused solely on aggressively terminating phishing sites. PIRT will work with other security organizations and, if necessary, law enforcement, to provide information for security and forensic analysis.

With this new service, you can report a phish via email or through a web tool. And we’re recruting volunteers to help, too.

But here’s a little background: A while back, Paul Laudanski and I worked together to shut down a phishing site on a financial services company. What did we do? We called them aggressively by phone. We contacted their ISP. We contacted the brokerage firm they used to clear their orders. In just a few hours, the thing was shut down.

This got us talking about the problem of phishing. Very few people report these phishing sites immediately and get them shut down. There’s a lot of experts involved in phish fighting, but they’re primarily dealing with the important security research and forensics angle of the business.

There are companies like Cyota, who contract with financial institutions to protect them from phishing, and they do takedown. Maybe their clients’ sites get taken down. But those who aren’t their clients? What happens?

This situation brings to mind those old TV shows, where a camera crew would have someone pretend to break into a car on a busy street, and no one around would call the cops. It’s not because no one cared, it’s because all the neighbors assumed someone else must be calling. So, no cops were called.

Well, it’s a relevant analogy for phishing. There’s an obvious solution to shutting down a phishing site that many people don’t realize they can do: Contact the site or the ISP or the compromised siteowner In my experience, by aggressively going after phishing sites, you can shut down a significant portion of these sites — perhaps 40% or more — by simply taking action. This may not seem like a large number, but it’s pretty significant if you realize how many people you can help.

I’ve been testing this over the last couple of months: From time to time, I’ll contact someone related to the site to let them know that their site is being used for a phishing scam. In a fairly significant number of cases, I’ve been the first and possibly only one who ever contacted these people. It’s usually something that only takes me a few minutes, but it is effective in a large number of instances.

You see, most phishing operations run off of an innocent compromised site. Phishers, for obvious reasons, don’t want to let the world know who they are, so they find sites with poor security (almost always Apache-based sites that have poor configurations or old Apache versions), hack in, set up shop and do as much business as they can before they are shut down.

This even occurs with keylogging operations. Recently, we came upon an elderly lady running a site about flowers who had a full keylogging operation running off her site. Sending her emails was ineffective, so I simply looked up her name using whitepages.com, called her personally and told her what was going on. We helped her through the process of shutting down the compromised portion of her site, getting things back in place, and now a few less people will be affected by this keylogger. And just this past weekend, I worked on a takedown of a real-estate site with the zero day exploit. I was the first person to contact the realtor, and she took fast action to fix it. So one person can make a difference.

And that’s why Paul and Robin Laudanski and I decided to start PIRT. And we’re recruiting volunteers. Paul has even created a tool, Fried Phish(tm), which you can use to make phishing reports. Join here. An introductory Wiki (a work in progress) is here.

You can help fight phishers as well, with just a basic knowledge of how the Internet works. If only 10% of the people who read this blog reported one phishing site a day, it would actually make a dramatic impact.

So join Paul and me and become a Phishing Terminator. Click here.

Alex Eckelberry

Digg this story.

Getting Spyware Quake off your system

You can try using CounterSpy to remove Spyware Quake (free trial). We have also posted a manual removal process here (thanks to Sunbelt security researcher Adam Thomas for his work on this).

Also, there's various user comments here and here, and SpywareWarrior is always a good place to go for discussion on these types of things.

Alex Eckelberry

IAC launches new shopping service

IAC (the company behind Ask.com, etc.) has launched a new shopping service.

Now Barry Diller's company, IAC/InterActiveCorp, among several others, is giving this kind of shopping software a revival. The company recently introduced Pronto, a software application that a user downloads at Pronto.com. Once a user clicks on one of the 50,000 merchants in its database, Pronto silently monitors all of a user's activity on a product page, then shows deals from other merchants on the same items, or similar ones, until it finds a better deal. Then it sends a message prompting the user to click away.

NY Times link here.  

Alex Eckelberry

Email a potential attack vector for zero-day exploit

WebSense has provided an updated list of exploited sites.  It’s growing.

SANs just reported

Just for the sake of clarity, there is an email attachment vector for this exploit that's not widely reported. I have not seen any reports of it being used at this time. MS's bulletin, in the FAQ's, in "Could this vulnerability be exploited through e-mail?", says it can be exploited if one "open(s) an attachment that could exploit the vulnerability." ISS obliquely says attacks may occur by "...simply embedding the required logic in specially crafted HTML emails.".

The full extent of email as an attack vector is not fully known.  Best thing you can do is turn off Active Scripting in IE (IE 7 beta preview 2 is not affected by this exploit), as according to SANS, this may be a “global” workaround. 

Alex Eckelberry

How to turn off Active Scripting

The currently active IE zero-day exploit can be avoided by turning off Active Scripting (among other solutions).  However, not everyone may know how to do this.  George Ou has done the dirty work and posted a step-by-step instruction on what to do.  Link here.

Alex Eckelberry

Seen in the wild: Spyware Quake

Updated info with fix here.

There is a new rogue Anti-Spyware application out there serving as a replacement for Spy Falcon and SpyAxe.

Spyware Quake is installed through the infamous VCodec trojan as well as various exploits.

WHOIS Information:

Domain Name: SPYWAREQUAKE.COM

Registrant:
SafeSurf LLC
Kevin Gerad (Whois Privacy and Spam Prevention by Whois Source)
U-12 Gamma Commercial Complex # 47 Rizal Highway cor. Manila
Olongapo City
null,98101
PH
Tel. +201.6753332

In addition to just a stealth install of Spyware Quake, an infected machine will exhibit other unwanted symptoms such as Internet Explorer browser hijacks, a stealth installed “Security Toolbar”, and pop-up advertising that is often adult in nature. Also commonly seen is pop-up advertising for WinFixer.

Adam Thomas
Spyware Research

Exploit sites inching near 100

Update: Email may be an attack vector.

From WebSense:

As reported we are actively researching the newest IE zero-day exploits that are surfacing (s: http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=449). To date we have discovered nearly 100 unique URL's that are all attempting to run malicious code on the users machine without user-intervention.

One interesting aspect we are researching is the number of machines that appear to have been compromised here. The sheer percentage of sites that are compromised versus owned by the attacker is higher than usual. In particular we have noticed several travel related websites that are hosted on different networks.

Link here.

I don’t want to spread undue panic. This is not like the WMF exploit, which had the cruel aspect of using a graphic file to execute a payload. This fact broadened the attack vectors to graphics embedded in emails, graphics being viewed through Google Desktop, etc. This is not the same type of exploit.

However, we concur with the good folks over at WebSense — a lot of sites that we examined with this vulnerability are legitimate sites that have been compromised. It’s not just the usual porn and crack sites that some users go to.

There is no patch available for this exploit. The only way to avoid it is a) turn off Active Scripting or b) use a non-IE browser (although the latest version of IE 7, the March 20 beta 2 preview, is not affected). Your standard protections should be in place — antivirus, firewall, antispyware. Your antivirus program may catch it, but don’t count on it in the near future, as AV vendors themselves are in the process of getting out new definitions.

Alex Eckelberry

Well, this is how they handle software piracy in Russia

Beat ‘em up.

Manager of the company’s software department, Andrei Smirnov, offered to fight the dealer in a fitness center. He defeated the computer pirate 24-16 in three rounds, lasting three minutes each. The dealer’s name was not revealed, News.Ru web edition on high technologies reported on Thursday.

Link here.

Alex Eckelberry
(Thanks John)

Pamela Parker muses about adware

Pamela Parker at ClickZ muses about adware:

Let me start by saying I don't think adware is a bad thing. Definitions differ, but I've always used the word adware to mean ad-supported software, which includes things like AOL's AIM and WeatherBug. As far as I'm concerned, so long as users understand they're seeing ads in exchange for getting free software, that's just fine. Transparency is key.

That said, the word adware has long some sinister connotations, and for good reason. Even some of the more upstanding of adware companies have somewhat shady pasts -- pasts full of questionable distribution methods, associations with disreputable software providers, a lack of disclosure and much consumer ill-will. A history like that can be very hard to leave behind.

Putting WeatherBug, AIM and (ostensibly) Eudora’s free ad-supported version in the category of adware is actually incorrect.  Ad-supported software is different that adware.  Adware exists with the primary purpose of providing advertising.  Ad-supported software (like Eudora) exists for the purpose of supporting the vendor, but the primary purpose of the application is not advertising.  Eudora is an email program.  It has banner ads.  It is not WhenU SaveNow, 180Solutions Zango, Direct Revenue BestOffersNetwork, etc.  (Getting definitions on adware is also interesting).

You can read Pamela’s article here.

Alex Eckelberry

It's in the wild

19 confirmed sites now using the IE vulnerability, as reported on security lists by Dan Hubbard (alert) at WebSense and Joe Stewart at Lurhq.

These can be very nasty. Our analysis of one site, www(dot)textrum(dot)se (since shutdown):

The exploit calls a file, updater.exe

Norman sandbox report:

Found Sandbox: W32/Backdoor; [ General information ]

* Anti debug/emulation code present.
* Creating several executable files on hard-drive.
* File length: 46644 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM32\Updater.exe.
* Creates directory C:\WINDOWS\SYSTEM32\kazaabackupfiles.
* Creates file C:\WINDOWS\SYSTEM32\kazaabackupfiles\download_me.exe.

[ Changes to registry ]
* Creates value "Windsupdate"="Updater.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce".
* Creates value "Windsupdate"="Updater.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
* Modifies value "Dir0"="012345:C:\WINDOWS\SYSTEM32\kazaabackupfiles\" in key "HKCU\Software\Kazaa\LocalContent".

[ Network services ]
* Connects to "[redacted].com" on port 6667 (IP).
* Connects to IRC server.
* IRC: Uses nickname [redacted]
* IRC: Uses username [redacted].

[ Security issues ]
* Possible backdoor functionality [Authenticate] port 113.

[ Process/window information ]
* Enumerates running processes.
* Will automatically restart after boot (I'll be back...).
* Attemps to open C:\WINDOWS\SYSTEM32\Updater.exe NULL.
* Enumerates running processes several parses....
* Creates a mutex coolbot1.c4.

Logs information to: C:\WINDOWS\system32\sys.ini

More work going on… may post more later.

Based on what we’re seeing in the wild right now, we hope that Microsoft will patch this new IE exploit prior to April 11 (the next scheduled update).

Keep your AV and antispyware updated and run your software firewall (free suggestions here). The only valid workaround for this patch is to turn off Active Scripting in IE, or use another browser. Your AV may very well catch these nasties, but don’t count on it in the immediate future.

Alex Eckelberry

Kerio deal expires soon

Shameless salesmanship, but I figure it has to be said:

When we launched the Kerio Firewall under our own name, we put in place an intro price of $14.95, a ridiculously cheap deal for a full-featured firewall.  The offer ends on the 31st, at which point it goes up to $19.95 (still a great deal), so if you want it, grab a free download, do your eval and pick it up before the end of the month.  Link to download page here.

Alex Eckelberry

CDT: xxx domains are stupid. Throw the idea out.

From the CDT:

CDT is urging Sens. Max Baucus (D-Mont.) and Mark Pryor (D-Ark.) to withdraw a bill that would force Internet authorities to create a ".xxx" domain for adult content. In a letter sent this week to the Senators, who co-sponsored S. 2426, the Cyber Safety for Kids Act of 2006, CDT warns that the bill will provide ammunition for those seeking to bring the Internet under the control of a multi-governmental bureaucracy. If passed, the bill would also violate the First Amendment rights of Web site operators and would do little to protect children from harmful material online, CDT wrote. March 24, 2006

Link here.

Alex Eckelberry

Free web content filtering

At the ASC workshop back in February, I met with one of the folks at Blue Coat, and found out that they are providing a free web filtering product for home use.  I tested it, and it’s not bad (considering the price).  The version I tested doesn’t compare to more advanced products like CyberPatrol and Cybersitter, but considering the price, it’s not a bad deal   Note that Microsoft has announced plans for free web content filtering.

The link for the free K9 version is here.

Alex Eckelberry

IE POC code in the wild

As many of you know, there is proof of concept code for a recently published IE vulnerability in the wild. 

From SANS:

Folks, as Lorna predicted yesterday, it didn't take long for the exploits to appear for that IE vulnerability.  One has been making the rounds that pops the calculator up (no, I'm not going to point you to the PoC code, it is easy enough to find if you read any of the standard mailing lists), but it is a relatively trivial mod to turn that into something more destructive (in fact one of our readers, Matt Davis, has provided us with a version that he created that is more destructive).  For that reason, we're raising Infocon to yellow for the next 24 hours. 

As SANs says, Microsoft recommends turning off Active Scripting.  You can also switch to Firefox or Opera.

We are watching very carefully out there for any sites using this exploit.

Alex Eckelberry

Communities for IT managers

One of the free services we’ve been offering IT professionals for years is our user forums.  Focused on IT issues, they are valuable if you’re job is running a network, or if you’re involved in network security.   We have a lot of professional on these forums and some of these lists are very active.  

The most active lists are the NTSYSADMIN list and MS Exchange Management Issues.  These are a good starting point for someone who wants to get into communication on general IT issues.

NTSYSADMIN Subscribe Read Charter/Login	5,100+ Members - Sunbelt Software hosts this list to invite the free and open discussion of Windows NT System Administration Issues. This list is intended to be a forum to discuss how to keep NT Servers up and running in a production environment. NOTE: High Traffic
MS Exchange Management Issues Subscribe Read Charter/Login	3,600+ Members - Sunbelt Software hosts this list to invite the free and open discussion of Microsoft Exchange Administration Issues. This list is intended to be a forum to discuss how to keep Exchange up & running in a production environment, and as help to pass the Exchange Certification Exams. NOTE: High Traffic

Feel free to join one of our lists.  A full description of all the lists is here.

Alex Eckelberry

Bill Day at WhenU: "Hold the phone people, advertising in adware isn't necessarily bad"

Bill Day, CEO of WhenU, wants ad buyers to be intelligent about their media buys — not just walk away from adware completely. 

So what's a buyer to do? You could simply abstain from all adware (and to be consistent, maybe abstain from working with all behavioral targeting or even all advertising networks whose analytics and third-party tracking cookies raise concerns while you're at it). As thought leaders, we can't operate successfully by making simplistic decisions; successful online marketing involves a certain amount of pioneering. But how do you strike the right balance?

Now, realize that the media buying side of the ad business dominated by harassed and overworked 20–somethings.  It is a lot to ask of anyone in that position to make a decision with any granularity (“let’s see, this one adware company has a long writeup from Ben Edelman and has practiced a number of illegal drive- installs, while this one is different, because they have full disclosure and consent, however Eric Howes wrote a whitepaper which criticized several aspects of their business…”). 

So ad buyers need a simple solution, which is why the ad business loves the TRUSTe Trusted Download Program.  It makes buying a simple binary decision for ad buyers — “oh, it’s certified?  Then I can place ads in it”.  Of course, in the end, it is a validation of the adware business model…  (see a recent Sunbelt posting about TRUSTe here).

But here’s a direct reference to an adware company (We All Know of Whom He Is Speaking):

Be especially wary of those who defend themselves by accusing the anti-spyware community of being a bunch of ad-hating "zealots" and "fanatics"--most security advocates leading the charge to accountability are thoughtful, dedicated and discriminating professionals who are able to see the difference between hot air and meaningful moves. If hardcore anti-spyware watchdogs can be discriminating, media buyers can be, too.

Link here.

Alex Eckelberry

Two advertisers pull out of 180Solutions

Must be because Sean Sundwall left.

Altrec, an online store selling outdoor clothing and gear, has "discontinued its experiement with 180solutions indefinitely," the company said in an email to vnunet.com. The company stressed that the test had been limited in its scope, with Altrec spending no more than $440.

Online mobile phone store Letstalk.com too has cut all ties with the adware maker, chief executive Delly Tamer said in an emailed statement.

And GreetingCards.com had an epiphany:

Lastly GreetingCards.com said that it was unaware of 180solutions' history of unfair and deceptive practices and has cancelled its contracts with the firm.

Link here with gracious thanks to Ferg.

One assumes this is as the result of the good work on the part of the CDT, who published the dirty details earlier this week.

Alex Eckelberry

There is no free lunch

Get a free iPod!

In a civil complaint (click here for PDF) released Thursday, New York Attorney General Eliot Spitzer accused Washington D.C.-based Gratis Internet of deceptive business practices. The suit requests monetary penalties and an injunction against the activity in question.

The suit, filed in the state's supreme court in Manhattan, marks the latest chapter in Spitzer's charge against what he has labeled the largest deliberate breaches of privacy in Internet history. Earlier this month, the attorney general announced a $1.1 million settlement with Datran Media. The e-mail marketer had been accused of buying at least 6 million files from Gratis, despite knowing that the transaction ran contrary to the seller's privacy policy.

Link here.

Alex Eckelberry

New York heading for Big Brudduh

Not Good.  505 cameras to be installed in NYC.

The NYPD is installing 505 surveillance cameras around the city - and pushing to safeguard lower Manhattan with a "ring of steel" that could track hundreds of thousands of people and cars a day, authorities revealed yesterday.

NYCLU is battling back:

But don't expect the NYPD to install its cameras without battling the New York Civil Liberties Union. The watchdog group's associate legal director, Chris Dunn, questioned the plan.

"Commissioner Kelly may be ready to launch us all into a surveillance society, but we believe cameras are not a cure-all for crime and terrorism," Dunn said. "It is far from clear that cameras deter crime."

Link here.

Alex

 

Seen in the wild: eBay accounts for sale

This site in Russian is offering eBay accounts for sale.

While it’s in Russian, the basics of the text in the website are that:

• They sell e-Bay and PayPal (rarely) accounts.
• They have a Trojan that steals account info from e-Bay logs and prefer to steal accounts with minimal seller/buyer activities.
• The better feedback on given account the more expensive it is. Real account holder e-mails are available as well.

They even have a list of users to buy:

As is our normal practice, we have reported this to our security contacts at eBay. 

Alex Eckelberry
(Thanks Sunbelters Adam Thomas for the site and Olexiy for the translation)

 

 

Sunbelt TechTips for the week of March 20

How to Delete Files with Illegal or Reserved Names
Sometimes an application will create a file that has an "illegal" file name (that is, a name that's reserved by the operating system, such as LPT1 or PRN). If this happens, you may not be able to delete these files using the graphical interface. Here's how to delete them:

1. If the partition on which the files reside is formatted in FAT, at the MS-DOS prompt, type DEL and then the file name with wildcard characters, such as DEL LPT?.*
2. If the partition is NTFS, you'll need to use a syntax that bypasses the normal reserved word checks: DEL \\.\(drive letter):\(path)\(file name) (for example: DEL \\.\c:\myfolder\lpt

How to Add the Comment Pane in Word
You can add a comment pane feature in Word 2002 or 2003 by creating a macro and running it in a Word document that contains comments. Instructions and code for the macro are shown in KB article 913759 here.

How to Edit the Registry to Replace In-use Files at Windows Startup
There are several ways to replace a file that's in use by Windows at startup. One way is to edit the Registry. Always back up the registry before editing it.

1. Start your favorite registry editor.
2. Navigate to the following key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ControlSession Manager
3. Create a new value of the type REG_MULTI_SZ and name it PendingFileRenameOperations.
4. In the value data field, type the following on two separate lines: \??\c:\temp\win32k.sys !\??\c:\winnt\system32\win32k.s
5. Close the registry editor.

Direct Hosting of SMB over TCP/IP
Windows 2000/XP/2003 supports file and printer sharing traffic by using Server Message Block (SMB) directly hosted on TCP, unlike earlier versions of Windows that required NetBIOS over TCP (NetBT). Disabling NetBIOS has several advantages. KB article 204279 includes instructions for disabling NetBIOS over TCP/IP here.

How to Configure the Popup Blocker in XP SP2
When you install Service Pack 2 for Windows XP, it adds a popup blocker to Internet Explorer, which is turned on by default. You can configure its settings to allow popups on certain web sites or block all popup windows. You can also configure IE to play a sound to notify you when a popup window is blocked. KB article 843016 tells you how to configure the popup blocker to suit your needs here.

No Results Returned when you Search for Files or Folders
Sometimes if you run a search for files or folders over a slow network link, you Windows XP computer may give you a message that says "Search is complete. There are no results to display" even though the files or folders you're searching for exist. It happens because Windows mistakenly determines that the files or folders are offline and excludes them from the search. To find out what to do about the problem, see KB article 885843 here.

Deb Shinder

Sunbelt TechTip: Clear my tracks

Make IE 6 a Little More Like IE 7: One of IE 7's new features is a "clear my tracks" option that lets you delete all temporary Internet files (browser cache), cookies and web browsing history.

That's especially useful when you share a computer with others and don't want them snooping in your web browsing habits. If you're not ready to install IE 7 but you'd like to be able to do the same thing with IE 6, you can download this little free program from Microsoft or run it from the web site.

Deb Shinder

Don't expect to see Vista until Q1 2007

According to a subscriber email we just received from Client Server News, the consumer version of Vista won’t ship until January. 

According to Client Server News, “the delay it being done in the name of quality, according to Vista boss Jim Allchin.”

Commercial volume licensees will see it in November.

 

Alex Eckelberry

Can You Trust Online Services with your Data?

I often warn computer users about the importance of backing up all your important data. Whether it's the first few chapters of your Great American Novel, the outline for your ten-year career plan, all that financial information you painstakingly entered into a spreadsheet or tax program, digital photos and home videos, or just a huge collection of (legally downloaded, we hope) MP3s, it represents time, effort and sometimes a lot of money.

Yet a week doesn't go by that we don't hear someone lament that "my computer crashed and I lost everything." A lot of people seem to regard hard disk failure in much the same way they look at plane crashes or tornadoes or fatal diseases - as things that happen to "other people." Until it happens to them. The good news is that unlike those much more horrific disasters, a computer disaster is something that you can prepare for and recover from with a minimum amount of loss - if you take the time and plan properly.

There are lots of ways to back up your data. You can copy it to a second hard disk (internal or removable), write it to a CD or DVD, copy your files to another computer on your home network, or even invest in a tape backup system. Any of those options is a start, but it's not enough. Unfortunately, when it comes to their personal data, most folks stop there. But what happens if your computer is stolen (along with its second hard disk and the DVD that you left in the tray of the writer)? What if a flood or fire destroys your computer room, along with the removable disk or tape backup in the desk drawer? What if a tornado wipes out the whole house, including the second computer upstairs to which you copied your data?

That's why an effective backup plan has to include some sort of off-site storage. A number of online services have popped up, offering a way for you to upload your data to their servers (which may be in another state or even another country - about as off-site as you can get). Some offer a limited amount of free storage, others charge a fee ranging from a few dollars per year to much more for professional level "electronic vaults" that automatically back up your data continually and store it in redundant locations with a high degree of physical security.

Most home users aren't interested in paying hundreds or thousands of dollars for that level of protection, but you might very well be tempted by some of the free services such as Xdrive or Streamload. The price is certainly right - but you may find that the free plans aren't really as useful (or as free) as the ads make them sound.

For instance, Xdrive's front page touts "5GB to unlimited gigabytes of online storage." Unfortunately, it's only the 5 GB that's free. Once upon a time, 5 GB of data was an almost unimaginable amount (a mere ten years ago, in 1996, my computer had a total of 3 GB of hard disk space - two 1.5 GB drives - and I was wondering how I'd ever fill up all that space). Today, with high quality digital photo files that are 100MB or more in size and the ability to record TV shows on your Media Center PC (at about 1.5 GB per half hour program), 5 GB isn't much space at all. It's likely it won't be enough to back up all your data files. To get more space, you have to pay for it. And you have to provide credit card information even to sign up for the free trial. In addition, the service doesn't support FTP access or allow versioning of your documents, even with the paid plan. On the positive side, they do offer automated backup of selected folders so you don't have to remember to manually back them up each time.

Streamload, at first glance, looks a lot better. They offer 25 GB of free storage. And they don't ask for a credit card to set up a free account. However, there is a catch: Although you can upload 25 GB to the site, you're limited to downloading 100 MB per month. Paid plans range from $4.85 per month (unlimited storage, download up to 1 GB) to $39.95 per month (unlimited storage, download up to 60 GB). This means if you store your 20 GB of data on Streamload and then you need to restore it all at once, you'll have to upgrade your account to the $19.95 per month plan (allows up to 25 GB download). Of course, you might never need to download the whole thing at once, and if you do, that means all your on-site backups are gone and you probably would be willing to pay to get your data back.

These are just a few examples of consumer-level online storage services. There are many others: IBackup , Online Storage Solutions, My Net Storage. Companies better known for other products also offer online storage options; an example is Apple's iDisk.

One question you have to consider before signing up with any of these services: how secure is your data on their servers? Remember that anyone who gets your username and password can access your data from anywhere in the world. If you only have music, videos and low-security documents that you want to back up, this probably isn't an issue. If you have highly confidential information, you might not want to upload it to an online service, or you might want to pay more for a business-grade service that guarantees a higher level of security.

What about reliability? Web businesses come and go, and if you upload your data to one that subsequently goes out of business, you may never see that data again. That's why I'd recommended using the services as one part of a backup plan - not as the whole plan. Put your non-sensitive data there for convenience, but also make a DVD or tape and take it to work with you and store it in your desk there, or keep it at a friend's or relative's house or even in a bank safe deposit box.

There are other options for storing your backup files online, too. Many ISPs give their customers a certain amount of Web space free with an Internet account. If you don't have a Web site, you can still FTP copies of your data files to the Web server to store them. Note that this isn't a particular secure option, so only use it for non-sensitive files.

If you have a friend who has a network with extra server space, the two of you could upload files to one another's servers. This is a good plan if your friend is technically savvy and trustworthy, and you will probably have more control than with a service run by people you don't know personally.

Tell us your opinions on the backup dilemma. Do you keep copies of your important data off-site? Do you use an online service or do it another way? Have you had good or bad experiences with the services? Comment away.

Deb Shinder

Claria: We're through.

Claria, which had tried to go public a couple of years ago, is claiming that they are exiting the adware business. 

Earlier this year, Claria retained Deutsche Bank Securities, Inc. to handle the sale of the company's adware assets, and Claria is in active discussions with a number of interested buyers. A condition of any sale of Claria's consumer software applications, however, will be the requirement that any purchaser agrees to adhere to emerging industry standards outlined by TRUSTe and other industry coalitions.

Link here.

Alex Eckelberry
(Another thanks to Amanda)

Online travel industry: Adware is ok

The Interactive Travel Services Association (ITSA), an industry trade group whose members include Expedia, Orbitz, Hotwire, Hotels.com and others, has made an announcement: 

Advertising in adware is ok, as long as it’s not spyware.  ITSA believes adware “can be useful to many consumers because it provides timely, relevant and money-saving information, or it helps defray the cost of free linked software programs” (link).

According to their press release:

The ITSA best practices document encourages adware companies to: 1) obtain "affirmative consent," or prior approval from consumers for downloading adware, while simply explaining what the adware will do; 2) for consumers who already have downloads, go back and obtain their approval now; 3) provide an easy to find, understand and use method of uninstalling the adware; and 4) identify who has created or is providing the adware in any download offers or any other promotions, such as pop-ups or pop-unders. In addition, 5) advertisers should require their adware companies and any marketing groups they work with to abide by these practices.

Link here.

Alex Eckelberry
(Thanks Amanda)

Man, what is up with Starforce?

From cdfreaks.com (thanks Jarrett):

Now, Futuremark has uncovered a very dangerous anti-piracy system Starforce is now using.  This copy protection system installs a driver that runs at the highest level of access on the system, which gives it low level access to the PCs hardware and any drivers and processes.  This driver runs regardless of whether the game runs; keeping an eye out for any suspicious activity such as attempting to copy a protected disc.  If something suspicious is detected, it forces the PC to make an immediate reboot, regardless of any other applications running and whether or not the user has any unsaved work.

Link here.

(The validity of this report is still uncertain).

Alex Eckelberry

180Solutions and Sean Sundwall part ways

180Solutions director of corporate communications Sean Sundwall has left 180Solutions.   According to sources close the company, Sean resigned on March 1st.

Sean started in June of last year and was the spokesperson for 180 during a time of change for the company.

Sources close to the company indicate that Sean's departure was due to the fact that he felt many more changes to the business were needed and that he was not going to be able to make those changes happen.

 

Alex Eckelberry

Come see us at InfoSec

A bunch of Sunbelters are going to InfoSec Orlando (April 3–5).  I’ll be there, along with our VP of R&D, Eric Sites, and a number of other Sunbelt staff.  We’re going to be showing our new Ninja Messaging Security suite for Microsoft Exchange as well as our CounterSpy product line. 

Alex Eckelberry

 

IE 7 beta refresh now available

A new version of the IE 7 beta 2 preview is available.

According to Paul Thurrott at Windows IT Pro, it’s to be announced today at the MIX 06 conference today, and that Microsoft is describing this release as “feature complete”. 

You can download it here.

Alex Eckelberry

 

Coolwebsearch.info

This site is an affiliate of Coolwebsearch.com that installs a toolbar which hijacks the home page without a EULA.

Run by our Best Friend Ever, Vadmim Praha

Whois Data:
Fedorov Vadim   Praha    CZ         hali @ volny.cz
Fedorov Vadim   Praha    CZ         sp @ prague-sex.com
Fedorov Vadim   Prtaha 5 CZ     sovsem @ nevest.net
Fedorov Vadim   Praha    CZ         radmin @ radmin.kirov.ru

And he’s got lots more sites under the IP 194.187.96.195, which you are welcome to put into your blocklists.

Mirotino.com	Domainname4you.com
Shopknights.com	Fukingmachines.info
Adult-friends-finder.net	Girls-porn-life.com
nevest.net	Hogtied.info
Best-porn.biz	Machinesboys.com
Analmaids.com	Meninpain.biz
Boyknights.com	Mirotino.com
Ultimatesurrender.biz	pansion.cz
Mirotino.com	Pereulok.net
coolsearcher.info	Pornfree.info
Coolwebsearch.info	Pornosaity.com
coolwebsearch.org	Pornpic.org
Domainname4you.com	Porn-sex-free.biz
Fukingmachines.info	Prague-porn.biz
Girls-porn-life.com	prague-sex.com
Hogtied.info	rape-cool-video.com
Machinesboys.com	Salabon.com
Meninpain.biz	Sebastacz.com
Onlyfuck.com	Sex-prague.com
pansion.cz	Shopknights.com
Pavlovbooks.com	Spviphost.com
Peniscontent.com	Ultimatesurrender.biz
Pereulok.net	Waterbondage.biz
Pornfree.info	Zaseyan.com
Pornosaity.com	Adultdvdlist.com
Pornpic.org	Analmaids.com
Prague-porn.biz	Boyknights.com
prague-sex.com	nevest.net
rape-cool-video.com	Onlyfuck.com
Sebastacz.com	Zaseyan.com
Waterbondage.biz	Adult-friends-finder.net
Zaseyan.com	100pantyhose.com
100pantyhose.com	Pavlovbooks.com
Best-porn.biz	jonnylinks.com
coolsearcher.info	beesearch.info
Coolwebsearch.info	Pantyhose-bangs.com
coolwebsearch.org	planet-high-heels.com

 

Alex Eckelberry
(Thanks to Sr. Researcher Patrick Jordan)

CDT Report is up

Just follow the money.  It’s all you need to do. 

Large well-respected companies are helping to fund the virulent spread of unwanted and potentially harmful "adware" by paying for advertisements generated by those programs, a new report by CDT finds.

In "Following the Money: How Advertising Dollars Encourage Nuisance and Harmful Adware and What Can be Done to Reverse the Trend," CDT details how -- through a complicated network of intermediaries -- major advertisers pay to have their products and services advertised though pop-ups and other ads generated by unwanted advertising software or "adware."

The report dissects the financial relationships behind those arrangements and identifies a number of mainstream companies that advertise through one particularly unscrupulous adware distributor.

Link here.

Alex Eckelberry

Tough week ahead for 'badware' companies?

Well, this will be interesting:

The fight against invasive software will take a step forward this week as the Center for Democracy and Technology (CDT) and the Google-backed Stopbadware Coalition will release two separate reports that state the names of undesirable software programs and the advertisers who help fund them.

Link here.

Alex Eckelberry
(Thanks Amanda)

China loves IP6

IPv6 (Internet Protocol version 6) is an upgrade to the current version 4 which has the primary purpose of increasing the amount of Internet addresses available. While it’s been fairly slow to get adoption, it’s on track to become the standard over the coming years. 

IPv6 addresses are composed of two parts:  a 64–bit network prefix and a 64–bit host part.   In IPv6, the 64–bit host part is either “automatically generated from the interface's MAC address or assigned sequentially.”  

Well, IPv6 has at least one Chinese internet authority rubbing his hands in glee.

"There is now anonymity for criminals on the Internet in China," said Hu Qiheng, chair of the Internet Society of China, a public-private group founded five years ago to promote the Internet in China. "With the China Next Generation Internet project, we will give everyone a unique identity on the Internet."

Hu, who was interviewed on a visit to Paris this month for an Internet workshop organized by the Organization for Economic Cooperation and Development, does not represent the Chinese government, but she has long been prominent in the development of China's Internet and served as adviser to the Chinese government both domestically and at Internet policy meetings of the United Nations.

Link here via Funsec.

Alex Eckelberry

 

Search engine censorship watch

Slick.

This is a tool developed by Mark Meiss and Filippo Menczer at the Indiana University School of Informatics in March of 2006 to allow you to explore the differences in the results returned by different countries' versions of the major search engines. We currently work with the Web search and image search functions of four national versions of Google and Yahoo!: the United States, China, France, and Germany.

Link here via beSpacific. 

Alex Eckelberry
PS— In order to have the most accurate comparison, they turn off Safe Search, so be warned.

Yankee Group/Sunbelt 2006 Server Reliability Survey Results

Certainly off the subject of spyware, but we recently did a study with the Yankee Group on server reliability, with over 400 participants.

From Laura DiDio at Yankee:

All of the major server operating system platforms have achieved a high degree of reliability, though Unix-based servers still record the least amount of annual downtime. Microsoft’s Windows Server 2003 notched the biggest reliability gains over the past 3 years and the Microsoft server platform, along with some custom Linux distributions ranked close behind Unix for the most reliable server operating system platforms.

Those are the results of the latest independent Yankee Group/Sunbelt Software Web-based global survey of nearly 400 IT administrators worldwide. The survey also indicated that heterogeneity is the order of the day: a majority of respondents indicated they had an average of three server operating systems running in their environments.

And, in what can only be described as welcome news for corporate users, all of the major server operating system environments: Linux, Windows, Unix and open source environments exhibited a high degree of reliability -- with a surprising lack of disparity among the platforms.

Businesses reported that on average, their firms experienced fewer than two, Tier 2 reliability-related outages per server, per year and approximately one of the most severe Tier 3 outages per server, per year across all server OS platforms.

The survey also highlighted a number of crucial IT trends and revealed some surprising everyday administrator practices. Foremost among these is that a majority of IT administrators opt to manually apply patches and updates because they are not yet fully comfortable with automated patch rollouts. Perhaps the most surprising patch management statistic is that Unix administrators spend the most time patching their servers overall -- about 58 minutes and about 62 minutes for each server that they patch manually.

Microsoft IT administrators used automated patching far more than their Linux and Unix counterparts -- 32% of Windows 2000 Server IT managers and 38% of Windows Server 2003 managers use automated Group Policy to apply their patches. After Windows, automated patch management was most prevalent in the Novell SuSE environment where 28% of admins said they use Group Policy mechanisms to automatically update their systems. Red Hat and Unix administrators were least likely to deliver their updates automatically -- only 5% of Red Hat Enterprise Linux managers and 7% of Sun Solaris, HP/UX and IBM AIX Unix managers apply their patches manually. Other survey highlights include:

• Not surprisingly, the UNIX distributions – Solaris, AIX and HP UX took top reliability honors. Corporate UNIX users reported experiencing just under 600 minutes of per server, per year.
• Windows Server 2003 and Red Hat Linux with customizations and Novell SuSE Linux all reported roughly equivalent per server, per year outage times of just under 800 minutes. Surprisingly, Red Hat Enterprise Linux standard distribution users reported said they experienced 900 minutes of per server, per year.
• Windows 2000 Server and Windows Server 2003 recorded the greatest number of Tier 1 Reliability related incidents -- nearly 3 incidents per server, per year for Windows 2000 Server and 2.5 Tier 1 reliability incidents for each Windows Server 2003 system annually. Still, the actual number does not vary substantially from rival platforms.
• The Reliability and patch management of Windows servers has improved dramatically -- about 20% from Windows 2000 Server to Windows Server 2003.
• Custom SuSE Linux delivers the highest reliability and fewest minutes -- about 430 minutes of per server, per yearly outages. However, because so few of the respondents -- less than 2% of businesses -- use a customized implementation of Novell SuSE Linux, it is not a statistically valid response. Hence, among mainstream server OS platforms, Unix must still be considered the most reliable server environment.
• There were several write-ins for Novell’s legacy NetWare server OS platform -- seven to be exact -- taking us to task and asking why NetWare was left out of the survey. Overall, we included 11 different server OS configurations that represent the largest share of the current user base as well as the projected server OS environment going forward over the next three to five years. NetWare as a standalone server OS platform is rapidly disappearing. It currently accounts for approximately 3% of the installed base. However, for the record, the respondents still utilizing the legacy NetWare platform had high praise for its reliability and said they suffered little if any downtime.

Alex Eckelberry

Pet Peeves in the workplace: PDA's and cell phones offensive?

In a workplace etiquette-themed survey released by Randstad USA, a temp agency, they reported among the top pet peeves:

• Condescending tones (44%)
• Public reprimands (37%)
• Micromanaging (34%)
• Loud talkers (32%)
• Cell phones ringing at work (30%)
• Use of speakerphones in public areas (22%
• Colleagues engaged in personal conversations in the workplace (11%)
• The use of PDAs during meetings (9%)

Link here.  

Well, my two cents.  All of these are irritating to some degree to all of us.  I put cell phones and PDAs pretty high on my list of irritations, but it depends on the context.  For example, a while back we had a financial type come by the office for a briefing on our strategy.  Hours of careful planning were wasted as he constantly checked his Blackberry, nodding “uh huh, uh huh” as a weak indication that he was listening to our presentation. On the cell phone front, I had a friend who wanted to go out for a personal lunch.  He spent about 50% of the time on the cell phone (I’m not exaggerating), as I looked on, bored out of my mind.  When he asked me out to lunch again, I politely mentioned that I would — so long as he’d leave his cell phone back at the office.  He was surprised and hopefully got the message.

What are your workplace etiquette pet peeves? 

Alex Eckelberry

More tech tips

Sunbelt Tech Tips are a new feature of our blog.  We’ll going to start sharing with you technical tips on general Windows XP operation. 

Here are some to get you started for the weekend:

Add/Remove Programs displays installed programs incorrectly
If you find that your Add/Remove Programs applet in Control Panel is displaying the list of installed programs incorrectly, or showing no listed programs at all, it might be because an installer for some program removed some of the registry entries that are used by Windows. You may be able to fix the problem by editing the registry. There are step by step instructions in KB article 266668 here.

How to use the Pageheap.exe Tool
Pageheap.exe is a tool that can be used to detect leaks in programs running on Windows XP and 2000 systems and find heap-related corruption, which is a common problem in application development. Find out where to download the tool and how to use it from KB article 286470 here.

Administrator can't unlock a locked computer
If you restart a Windows XP computer and you aren't able to log on with a local or domain account, and you get a message that the computer has been locked and only an administrator can unlock it (but you aren't able to unlock it with an administrative account), it may be because the screensaver is set to use a non-existent .scr program or you're using a corrupted screensaver program that's password protected. What to do? You can edit the registry or use one of the workarounds described in KB article 242917 here.  

Deb Shinder

Tech tip: How to Change the Listening Port for Remote Desktop

By default, the Remote Desktop service in Windows XP uses port 3389. Because this is a known port, hackers could try to intercept packets going to that port. You can make Remote Desktop more secure by changing the port it uses, but be aware that Remote Assistance may not work correctly if you do this. Also, you can't use a different port to connect to Remote Desktop from a Macintosh computer, because the Macintosh RDC client only supports port 3389. If you do decide to change the port, here's how:

1. On the XP computer that you want to access via Remote Desktop, open your favorite registry editor.
2. Navigate to the following key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp
3. Double click the PortNumber subkey, click the Edit menu and select Modify.
4. Click Decimal.
5. In the value field, type the number of the port that you want to use instead of 3389.
6. Click OK.
7. Close the registry editor.

Now you'll need to configure the RDC client to use the new port. Here's how:

1. On the client computer, click Start | All Programs | Accessories | Communications | Remote Desktop Connection.
2. In the Computer field, type the name or IP address of the XP computer you configured above, then type a colon and the port number (for example, MyComputer:3390.
3. Click Connect.

Good luck!

Deb Shinder

 

Useful Firefox security extensions

If you’re a power Firefox user, you probably already know about this site run by CERIAS.  It’s a great listing of security extensions for Firefox.  Link here.

Alex Eckelberry
(Thanks Jarrett)

 

Free spyware seminar in DC

Spyware is a serious threat to your enterprise network, and the threat continues to grow. Awareness campaigns and user education are useful, but they're not enough. Legislation may deter some "legit" adware distributors, but many criminal spyware writers will continue to create and release malware that threatens the stability, security, and performance of your network. Not to mention your users' and organization's confidential data. In many cases spyware can also compromise federally mandated security compliance. Register for Sunbelt Software's free seminar "Winning the War on the Spyware Battlefield" and learn how to better protect your organization from spyware on Tuesday, April 25, 2006 in Washington, DC. This seminar will look at the current state of the spyware problem, addressing its effects on privacy, financial security, corporate responsibilities and productivity, as well as outline how CounterSpy Enterprise can help better protect your organization from spyware threats. Join renowned spyware researcher and Sunbelt's Director of Malware Research, Eric Howes, for an engaging discussion on the scope of the spyware problem. Widely regarded as one of the foremost experts on spyware and its malicious mechanisms, Howes has served as a panelist at the CNET Antispyware Workshop and is an active and well-known participant in many of the security forums dedicated to spyware research. The seminar will also include a live demonstration on how CounterSpy Enterprise can help you fight the battle against spyware. Why should you attend? Learn how spyware affects business productivity Understand the impact of spyware on network stability, security, and performance See how spyware can cause violations of federal regulations Discover how to better protect your network and users from spyware See CounterSpy Enterprise in action And more Date and Time: Tuesday, April 25, 2006 9:00 AM - 12:00 PM Location: Microsoft Corporation 5335 Wisconsin Ave. NW Suite 600 Washington, DC 20015 Driving Directions

Shop at Home Select: Our Report

The folks at Belarco Group recently approached Sunbelt about its handling of that company's rebates program, Shop at Home Select (otherwise known as SelectRebates or GoldenRetriever). We performed our standard software review in response. You can read our full report on SAHS here.

SAHS has a bad history of non-consensual installs, including installations through security exploits. To the company's credit, Belarco Group decided to end the use of third-party distributors in October 2005, not long after ShopAtHome was booted from Commission Junction. So far as we can tell, that commitment to end third-party installs has proven successful -- we haven't seen any unethical third-party installs nor have we received any reports of such installs since end the end of October.

That said, we still have a few complaints about the software, most importantly the failure to disclose the full range of potential privcy effects outside of the EULA.

Thus, we've decided to put SAHS on a probation period until May 1, at which point we will continue to detect the program but lower the program's risk level to "Low risk" and change the default action presented to users to "Ignore." If the company manages to address all of our remaining concerns, we will even consider de-listing the product. All of these potential changes are conditioned, of course, on the successful completion of the probation period -- Belarco must continue its recent history of good behavior, and it must resolve the remaining problems that we have identified with the software.

Sunbelt welcomes feedback from the anti-spyware community and the internet user community more generally. If you know of on-going third-party installs of Shop at Home Select, esp. those that might be performed in a less than up-front manner, please don't hesitate to let us know.

Eric L. Howes
Director of Malware Research
ehowes(at)sunbelt-software.com

Botnet story on Washington Post

Brian Krebs at the Washington Post has just released an outstanding look at keyloggers and botnets.  Sunbelt and other security companies worked with Brian on this in-depth story.  Great read.

Link here.

 

Alex Eckelberry

Ah well, that $20 bill/RFID thing looks like a hoax

Darn.  And I was getting all excited.

Nothing about the composition of these strips renders them detectable by scanner or satellite. In 2004, the false belief attaching to this security feature was enhanced by the claim of these bands containing RFID tags. As technology advanced, so did the rumor, leading many to microwave their $20 bills into ashen submission by falling for the canard that nuking their currency would disable these transmitters.

Link here.

Alex Eckelberry

RFID tags vulnerable to viruses

A group of European computer researchers have demonstrated that it is possible to insert a software virus into radio frequency identification tags, part of a microchip-based tracking technology in growing use in commercial and security applications.

NY Times link here (ComputerWorld here — thanks Jarrett).

Alex Eckelberry

Update: RFID $20 bills may not be all that exciting

Could just be a metal strip embedded to thwart counterfeiting.  More here.

Alex
(Thanks Guillermo)

RFID in the new $20 bill?

This hopefully (and very likely) goes into the category of entertainment — not reality.

Everybody loves a good conspiracy theory.  First, there was a crazy theory that the new $20 bill shows hidden pictures of the 9/11 attacks. Now, there’s speculation that the the new $20 bills have a little something extra besides the pretty colors. According to this site, they're embedded with Radio Frequency Identification (RFID) chips that can set off those monitoring devices at store exits designed to alert personnel that you're walking out with tagged merchandise.

The author claims that you can "fry" the RFID tag by putting your money in the microwave - but it may explode if you do (although apparently the results do vary depending on what microwave machine you’re using).   I would not test this at home — if there is an RFID tag in the money, microwaving an RFID tag will release some unpleasant chemicals that aren’t too healthy — and you’ll destroy your nice $20 bill in the process. 

If you don't want your money tracked, don't think you'll avoid it by leaving the country. A link from this site takes you to a story written way back in 2001 about how the European Central Bank was planning to embed RFID chips in all their euro notes by 2005. True or not?

(US Treasury site on this new bill here.)

Alex Eckelberry and Deb Shinder

 

Boys in the 'net hood

Street Gangs Online: We already knew terrorist groups like Al Quaida use the Internet to communicate with each other and plan their criminal activities. Now it looks like common street gangs are invading the 'Net, too. These new "netbangers" are hanging out in chat rooms instead of (or in addition to) street corners, even creating their own professional quality web sites. And the cops aren't far behind.

But it's not just kids searching for vicarious thrills. Active gang members use the Web sites to communicate with each other and sometimes to pick online fights with rival gangs. What starts on the Internet can quickly spill onto the streets. Cops in Boston and Texas who broke up gang brawls in the past few years found that the altercations had been scheduled on gang Web sites.

Read more about it here.

Deb Shinder

Is Transferring your Applications to a New Computer Going to Get Easier?

There are a number of companies out there that provide solutions for transferring your PC data to a new system — like Apptimum AlohaBob and Laplink’s PC Mover.  The breadth of the solutions vary — one may only transfer raw information in bulk from one machine to another, and another might attempt to intelligently migrate your applications over as well.

Last week, we got the announcement that Microsoft has acquired Apptimum (aka Eisenworld/AlohaBob), a company that makes software designed to help you automatically transfer your applications to new computers. At this point it's only speculation, but if such technology could be built into the operating system, it would make it far more convenient for home and business users to upgrade their hardware systems.

Read the announcement here.

Alex Eckelberry and Deb Shinder

Followup: Wireless Networking and the Law

Last week, we discussed some legal issues pertaining to wireless networking, including whether "hitching a ride" on an open wi-fi network is a crime and possible liability if someone else uses your wireless network to engage in illegal activity. Lots of you wrote to comment on the topic.

In emails directly to me, several of you said that you intentionally share your wireless network with your neighbors, or use a neighbor's network with their permission. John V. asked "If your PC found 10 wireless hotspots, how would you know which ones are free and which ones were left open by error?" The answer, of course, is that you don't - unless the network owner has advertised the availability of his network or named it in a way to make it obvious that outsiders are welcome to use it (for instance, an SSID of "FreeNet" or some such might indicate his intentions).

Steve R. recounted an experience where he left his car unlocked and his CD player was stolen, and the police officer who responded told him that by leaving the doors unlocked he "invited" the thief in. While I disagree with this "blame the victim" philosophy, I don't think the analogy carries over completely to the wi-fi situation, primarily because there are many people who leave their wireless networks open because they actually want others to use them. I doubt anyone leaves his car unlocked with the intention of having his CD player taken.

James P. argued that "The argument of using someone else's connection/bandwidth while not trying to access files is lame. That excuse is the same as throwing your trash into a neighbor's unlocked refuse bin but not searching through the neighbor's trash. The neighbor is paying for trash removal and that amounts to a "theft of service"- no ifs, ands, or buts about it!" Matt P. counters with "it's up to the person who owns the network to take steps ie. encryption, mac filter, etc to ensure only computers they desire are connecting to their network. It also seems clear that anything beyond your personal property ie. sidewalk, street, etc. is public space and cannot be claimed as private. Therefore, if I can detect the wifi signal on public property or from my own property; then I have every right to use that signal IF it is left unsecure. If the signal is secured and I attempt to connect then I am hacking and that would be illegal."

Bob G. said "attaching to [another person's] network is less like trespassing on their property than it is like eating the apples that fell off their tree into your yard." On the other hand, Douglas B. said "My demand, in my little realm of my life, is that you ask first and if permission given then usage is authorized." Terrance K. took a balanced approach: "it should be a crime that is treated like speeding on the highway. The crime itself is minor [even though the penalty in some jurisdictions is disproportionately high in order to generate revenue] and often overlooked [e.g. when the highway is empty, or ALL the traffic is speeding & you're just keeping up, or in an emergency], but it establishes responsibility for any consequences. Once responsibility is established, the miscreant can also be charged with any greater crimes, as appropriate."

About half of those who wrote that they have wireless networks said they use WEP or other encryption methods. Slightly more than half said you should be allowed to share your connection if you want to, since the ISP doesn't limit the number of internal devices that you can connect to your network.

Many of you asked for specific instructions on how to make a wireless network more secure. There are numerous resources out there that offer tips on different ways to do this. Tomorrow, I will post a step-by-step article covering different methods of securing wi-fi networks.

Deb Shinder

Your Opinion About Spyware In Small Business

Many of you are active in Small Business, and we'd like your input about spyware at your place of work. We have 6 very short questions for you, and would appreciate it if you would take one minute and answer these for us.  Link here.

Turn Down that Web Site! And other New Web Annoyances

Remember the olden days of the Internet, back when Web pages consisted of mostly text and a few photos, and those who wanted to get really fancy might include an animated .gif or two? That was when we painstakingly wrote HTML code in Notepad and uploaded individual files to our Web servers with an FTP program. Those were the days - and we've come a long way, baby (to kill two clichés with one sentence).

Many of today's Web sites are marvels of modern technology. With Java applets, Active X controls, Dynamic HTML (DHTML), cascading style sheets (CSS) and Web design and editing software that makes it twenty times quicker and easier to create a sophisticated page with audio, video and interactive elements, today's Web is a tangled one indeed.

But just because we can add all these neat features to our pages doesn't necessarily mean we should do it. I love an impressive Web page as much as the next guy - but only when all that flash serves a purpose. Lately I've begun to wish that Web designers, especially those putting up business or information oriented sites, would take a step back and simplify their lives (and mine, as a site visitor) just a little.

I suspect I'm not the only one who feels that way. One of the biggest pet peeves seems to be embedded audio, especially when it's unexpected. I've recently received requests from several readers to give them a warning when one of the favorite links contains embedded sound. You tell me that you often read the newsletter at work, and a sudden blast of music or other audio from your computer disrupts others around you in the office. That's why I've started including the "(sound)" notation after some of the links. That way you have a chance to turn the speakers down or off before you click.

If only all links contained such a warning. I often surf the Web while talking on the phone, so I tend to keep my speakers off by default, just turning them on when there's something on a site that I actually want to hear.

By no means am I suggesting that all sites should be silent. Sometimes sound is necessary or at least adds value, such as when the site contains a tutorial on how to do something. And some sites are meant to be pure entertainment, and background music is appropriate. On my personal family web site at www.shinder.net, I have an embedded music file called Picard's Flute, from one of my favorite Star Trek episodes. I've gotten tons of positive comments from visitors who recognized it. But on my business oriented sites, at www.debshinder.com and www.ms-security.org, I let the information speak for itself.

You know what they say: you can remain silent and let people think you're a fool, or you can speak up and remove all doubt. More Web designers should think about that old adage. Probably the best (and certainly the safest) policy is to give site visitors the option to play sound or not, rather than starting it automatically when the page loads.

Of course, sound files aren't the only elements that can make you want to flee from a page as quickly as possible. Here's one I encountered for the first time last week: I went to a page and liked it so much that I wanted to make it a favorite. So I tried to right click and got a message saying "Sorry, you do not have permission to right click." Now, I understand disabling right click for images so people can't easily save/steal them, but to disable right click functionality for the page as a whole - that's just an over controlling Web designer. Sure, I can always click the Favorites button in the toolbar and add the site that way - but I'm not sure it's a favorite anymore after that. For more examples of bad Web design, see Web Pages That Suck 2005 here.

What do you think? Do you love fancy, flashing, dancing Web pages that sing to you? Or would you prefer that Web designers tone it down a notch? How about cascading navigation menus? Do they make the page look cleaner or drive you crazy (or both)? What are the latest ways Web designers annoy you? 

Deb Shinder

Poor security practices lead financial services company to host a phishing site

Update:  I have redacted the company’s name at their request.  I spoke with a partner at the company.  They are pulling the site down, which is hosted at an outside hosting company.  The hosting company was running an old version of Apache and the financial services company is a small outfit which doesn’t have in-house IT.   They are taking care of the error.

From the Great Irony department.  A financial services company is hosting a phishing site. As of this afternoon, Paul Laudanski at CastleCops “was told the folks are in a conference meeting, she cannot interrupt. I strongly urged [her] to interrupt as this is very bad PR for the company, but [she] would not sway.”  I called as well and got the same run-around.  Absolutely refused to help in the matter, short of taking my number, insisted that the person responsible is off site in a meeting and cannot be reached.  Sad state of affairs.

So because she won’t “interrupt a conference meeting”, the site is live right now.

 

Why do I bother blogging this? I see sites constantly compromised for phishing scams and I guess I’m just going to start raising the volume a bit more on poor security practices that lead to these types of things. 

Alex Eckelberry

My, is this blog the new /.?

Biggest comment storm to date.  Here.

Alex Eckelberry

 

Direct Revenue settles class action lawsuit

Nothing major in this one.  No cash changd hands.

• DirectRevenue will destroy any personally identifiable information about computer users including Social Security Numbers, bank account information, email addresses, etc. and must no longer collect such information.
• DirectRevenue will force users to affirmatively accept installation of their software and disclose information about the functionality of the software separate from the EULA.
• DirectRevenue is prohibited from installing software by Active X, security exploits or any other method that does not require users' affirmative consent.
• DirectRevenue will not distribute software at sights targeted to children.

Link here with settlement docs.

Alex Eckelberry

Behold the power of botnets

(Adam Piggott of Proactive Services originally found this mess, contacted Suzi Turner at SpywareWarrior who got him in touch with one of our spyware researchers, Adam Thomas.)

Discussions about botnets in the security community are quite active these days. And there’s a reason: They’re out there and they’re very nasty. Here’s one in action that’s live today.

Take this innocent piece of spam (it looks better normally, but the website they are pulling the pictures from is down).

A spam like this will take you to a fake Windows update site:

If you visit the site, they will attempt to run a WMF exploit (video of a related site by Suzi Turner here). If you are patched with the January 5 security update from Microsoft (or have decent AV protection) but still fall for clicking on the “Start” link, you will download a trojan installer, wusetup.exe, which sets up the machine to be controlled in a botnet (virustotal.com results for this trojan here).

The wusetup.exe loads files that turn your machine into a proxy server – you are becoming a member of a bot-net. It brings down these files:

ieschedule.exe ib7.dll smss.exe harvest.exe ieserver.exe loader.exe

There’s also remote control and keylogging involved. You get a copy of Famatech’s Remote Server (part of Famatech Radmin) — r_server.exe. And last night, Adam Piggott tipped us off about an affiliate site which installs, through an old Windows help file exploit, a variant of the Winldra keylogger. And the site shown above is directly implicated.

What happens after this is all installed?

It all comes down to a botnet controller, which probably looks similiar to this one (this controller I’ve pictured is actually live right now so I’ve obscured sensitive information):

In this controller, you can access a person’s hard drive and perform other tasks.

And since apparently most, if not all, of these machines have Remote Server on them, you can access them through Radmin, which I tested just now against one of the infected systems. The “password” dialog box below means the system is running Remote Server.

Famatech Remote Administrator (Famatech Radmin) is also sold as an OEM version by Sunbelt as Sunbelt Remote Administrator (Sunbelt Radmin). It is a normal remote control program but used in the wrong hands can be quite nasty, because it has the unique property of being able to operate in “stealth” mode — the tray icon can be hidden. It’s one reason why we detect Radmin ourselves in CounterSpy as a potential risk.

Alex Eckelberry (Thanks to Sunbelt spyware researcher Adam Thomas and Adam Piggott for his diligent work and for providing us a copy of the spam message you see above)

Diary of a BraveSentry install

A fellow blogger by the name of Netsato dropped a comment on my blog about BraveSentry.  Curious, I checked out his blog and there’s a detailed writeup about an illegal BraveSentry force-install that probably occurred through the use of the infamous WMF exploit. Apparently his system was not updated with the latest MS security patches, but it was on a test system where nothing important was stored. 

Bravesentry is a malicious anti-spyware software that entered my computer via Trojan horse applications manifested in the files “t.inx” and/or “kernels8.exe”. My theory is that i.inx was passed to my computer by visiting a rouge website designed to exploit a pre service pack 2 Windows XP computer. Once inside, my software firewall detected t.inx was requesting access to the Internet which I promptly attempted to block. Apparently to no avail, “kernels8.exe” somehow slipped in to the computer which I also tried to block via my software firewall. After running a full virus scan (which found nothing), I rebooted the computer to be greeted by Bravesentry upon start up notifying me that my computer is infected by spyware and that it will proceed to scan my computer. Needless to say, Bravesentry was uninvited, and also not easy to uninstall. Rather than trying to “fix” this computer, I decided to document the problem as best as I could, and to simply wipe out the hard drive and rebuild the computer.

Link here.

Alex Eckelberry

 

Sunbelt's Eric Sites on eWeek podcast

Paul Roberts at eWeek has started a weekly podcast on security.

In this debut OnSecurity podcast, eWEEK Senior Writer Paul Roberts talks with Eric Sites, vice president of research and development for Sunbelt Software, about the malicious hacker program CoolWebSearch, and what IT managers and users can do about it.

Podcast link here.

Alex Eckelberry

If you like sci-fi

We do hire interesting people, and along those lines, Joe Wells, our chief scientist for security, has written a sci-fi book.  It’s a free download, along with maps to accompany the storyline.  There’s also a "Story Development Kit" that is planned for release allowing for other writers who might  want to use the world and it history.

The book is free, and you can download it here.

 

Alex Eckelberry

 

An easier way to make money selling antispyware applications: Bundle adware!

Oh boy, this takes the cake.  An antispyware application which bundles in adware.

In order to install Spy-Shield, you have agree to install BestOffersNetwork (formerly known as DirectRevenue) adware. The EULA for the BestOffersNetwork software is shown right after you start to run the installer for Spy-Shield. If you refuse the BestOffersNetwork installation, Spy-Shield will not install…

Absolutely unbelievable. Link here.

Alex Eckelberry

Borrow a wifi connection, go to jail?

A timely follow up to yesterday’s blog posting on other people’s wi-fi connections:

Ontario Provincial Police charged a 25-year-old man last week under Section 326 of the Criminal Code - "Theft of Communications."

The OPP allege the man was using his lap top computer to steal a wireless Internet connection in Morrisburg.

Link here via funsec.

Alex Eckelberry

iBill

Update from Wired: Editor's note: Since publication of this article, iBill has spoken with Wired News. The company now says that the purportedly stolen database did not originate with iBill, and only three of the more than 17 million entries match past iBill customers. Asked to respond, Secure Science says it no longer believes that iBill was the source of the data. Read the full story.

Wired just posted an article on some outstanding work that Lance James at Secure Science worked on with regard to porn payment processor iBill. We collaborated with him later on the project as well.

From the article:

Seventeen million customers of the online payment service iBill have had their personal information released onto the internet, where it's been bought and sold in a black market made up of fraud artists and spammers, security experts say.

…Secure Science found that data in February 2005, and reported it to the FBI's Miami field office, the company says. The FBI declined comment.

Last month, Sunbelt Software found an additional list of slightly over 1 million individual entries labeled Ibill_1m.txt on a spamming website. That list appeared to date from 2003.

Link here.

Alex Eckelberry

New rogue antispyware

There’s Raze, SpySheriff, PestTrap, SpyAxe and all the rest.  Now there’s BraveSentry.

Below is a screen shot of an infestation from Game4all(dot)biz that installed both BraveSentry and Alfacleaner:

Here is the desktop hijack associated with BraveSentry:

 

bravesentry.com           
Ocean Industries Daniel Ocean  
Amsterdam NL 
Email: ceo @ bravesentry.com

Other site in the IP:

anosurfer.com   
Pietro Miezani Privaweria Ltd     
Gua      EC       
anosurfer @ anosurfer.com

Our dear friend "anosurfer" is also apparently related to SpySheriff

 
Alex Eckelberry
(Thanks to Sunbelt researchers Patrick Jordan and Adam Thomas)

New digs

We’ve moved to new digs.  Basically, this is a consolidation of our operations that were previously in two buildings. 

Our new mailing address is:

33 N. Garden Avenue
Suite 1200
Clearwater, FL 33755

The view is beautiful (this image shows the view of the Gulf of Mexico) and the building is quite nice.

A side note:  I am so cheap that instead of buying nice new furniture, we simply bought furniture from the previous tenant and didn’t do any redecorating (I’d rather spend money on R&D than fancy furniture).  However, the previous tenant was some kind of financial services company, and all the furniture and decorations looks like something out of a bank lobby.  It’s very high quality, beautiful stuff, but it’s a bit funny to have a high tech company in offices which look like they should be on Wall Street. 

Oh, and did I mention that we’re hiring? ;-)

Alex Eckelberry

When third party ad networks place ads inappropriately

I’m sure you’ve seen this in the past — you’re looking at something online and right next to it is an inappropriate advertisement.

Such is what happened Monday in the New York Post.  The Post, which apparently contracts with aQuantive to sell its online advertising inventory, ran the story of the sexual assault and murder of college student Immette St. Guillen.  Unfortunately, in the story online was an advertisement for True.com, which according to Mediapost:

“…in an especially bizarre coincidence, the creative, which carried the tagline "Get Soaked By Love," featured a young dark-haired woman who physically resembled St. Guillen, staring suggestively at the camera.

…Not all visitors to the site Tuesday were shown the ad. DrivePM used its cookie-based behavioral targeting technology to display the ads to users who met certain criteria. The ad also appeared to be frequency capped, so that the same visitor didn't receive that ad every time the page loaded. By Tuesday evening, DrivePM had made arrangements to remove the ad from its rotation on the Post's site.”

True.com was not happy about this:

True.com, which bills itself as an especially safe dating service because it screens all members for a criminal history, said it would not have approved of having an ad accompany this particular story.

"If you're going to talk about online dating, you just wouldn't want to associate with someone being raped and murdered," said Cornell McGee, senior vice president, acquisition marketing at True.com. "You'd think that would be common sense."

True.com had only been using aQuantive's DrivePM to place ads for about three weeks, McGee said. He added that True.com would develop a policy to prevent ads from being displayed in stories it considers inappropriate.

MediaPost article link here.

It is a problem with third party ad networks — how do they screen sites and contents to match their advertising?  It’s easy in the print world, because when a newspaper or magazine goes for layout, the content can be made compatible with the advertising (and ad buyers can choose the actual vehicles to advertise in, so that they can match their audience to their product). 

Ben Edelman has written about this problem in the adware space, where children were being exposed to advertising for adware.    

This is a big reason why third party ad networks like tracking cookies — it gives them some way to infer demographics and tastes and hence, display advertising that attempts to match the behavioral characteristics of the viewer (for example, an advertisers can infer that someone who goes to a lot of NASCAR sites might be interested in Ford trucks or Budweiser beer).   However, it’s imperfect because a) many people hate cookies and b) there are privacy concerns and c) it is a actually a fairly sloppy way to gauge demographics.

Enter companies like Claria, who promise much better behavioral based advertising with BehaviorLink, a third party ad network that apparently melds adware with advertising on site pages.  That doesn’t seem to make much sense either from a privacy standoint.

In order to truly allay privacy concerns and insure compatibility of the advertising message with content, it’s going to require a lot of manual labor.  In this era of automation, that’s going to be a challenging task for ad networks who want to make automation work for them.

Comments?

 

Alex Eckelberry

 

Getting the Jump on TRUSTe

Back in November, we expressed concern over TRUSTe's plans for its "Trusted Download Program," which should be going into beta very soon.

At the heart of the "Trusted Download Program" will be a whitelist of adware vendors whose practices satisfy TRUSTe's requirements for notice, consent, distribution, and uninstallation. According to TRUSTe, this whitelist allows "market incentives" to "promote ethical behavior" among adware vendors seeking certification because the white list "will be used by companies beginning with program sponsors such as Yahoo!, AOL, Computer Associates, CNET Networks and Verizon as a tool to make business decisions about advertising, partnering or distributing software products." In short, the idea is to dangle economic carrots in front of misbehaving adware companies in order to coax them into improving their naughty practices.

We certainly don't doubt the attractiveness of this white list to adware vendors, many of whom have been scrambling for any scrap of legitimacy they can lay their hands on -- loading up their web sites with empty "privacy pledges" and "certified spyware free" logos while issuing endless self-congratulatory press releases in which they celebrate their own "consumer friendly" self-reforms. Not surprisingly, there are signs that adware vendors are already lining up at the door in order to get white-listed.

Some, it would seem, can't even wait for the door to open. Last week, UTcontextual, a British company that handles ad campaigns in Britain for a number of adware vendors, jumped the gun and issued a press release in which announced to the world that...

“the company confirms that all six contracted networks managed by UTcontextual, will strictly adhere to the TRUSTe download program.”

The press release even includes a laudatory quote from a certain "Tony Sullivan of Media Services" who remarked that

'"UTcontextual has always delivered ethical advertising opportunities, and it is no surprise that they are first in the UK to publicly back the TRUSTe initiative."

So just who are these upstanding partners of UTcontextual -- partners whose practices have been so sterling that UTcontextual itself has "always delivered ethical advertising opportunities"? They are...

• Best Offers (aka DirectRevenue)
• eXact Advertising
• Hotbar
• Claria
• WhenU
• MetricsDirect (aka 180solutions)
  

Hardly what one might consider a list of angels, in other words.

DirectRevenue: Although DR has taken substantial steps in the past few months to improve its distribution practices, the company had to be dragged kicking-and-screaming to the point it would even consider serious changes. The subject of a class action law suit and well known (in the past) for threatening critics with legal action, DR gained notoriety last year for carpet bombing the internet with its much-hated "Aurora" program (remember nail.exe?).

Exact Advertising: Another well known adware vendor (Bargain Buddy, CashBack Buddy, Navisearch, BullsEye Network), eXact is also the target of a civil lawsuit over its installation and distribution practices.

Hotbar: This company's poor practices were exposed last year by both Sunbelt and Ben Edelman..

Claria: Although improving its behavior over the past year or so, Claria's practices still leave much to be desired (link here and here).

WhenU: The same holds true for WhenU, which has implemented significant reforms over the past year and a half, but which still has nagging problems, including several recent documented force-installs (link here and here).

180solutions: 180 has had no end of problems with unethical and illegal installations over the last few years. 2005's list of bad installs and bad practices is staggering enough. But 180 has already seen several outbreaks of bad installs in 2006, the latest being through a security exploit. Ever optimistic, 180solutions has elsewhere expressed confidence that it will meet the Trusted Download Program's requirements.

Given the history of this collection of adware vendors, how is it that anyone can claim that UTcontextual has "always delivered ethical advertising opportunities" -- the kind of absolute statement which makes it sound like TRUSTe certification is an afterthought at best? And how can the company "confirm" with such certainty that all of its adware partners "will strictly adhere to the TRUSTe download program"? Not only is it TRUSTe's job to "confirm" that adware vendors adhere to its standards, but to our knowledge TRUSTe hasn't even initiated the application and certification process.

It's just this kind of effort to exploit the TRUSTe program for publicity that gives us pause. Certainly TRUSTe cannot itself completely control the PR departments of adware vendors, and we don't doubt that TRUSTe has anything but the most serious commitment to ensuring that vendors white-listed through the Trusted Download Program actually meet the program's requirements. (The practical matter of whether TRUSTe can conduct the kind of thorough investigations required to issue and stand behind white-list certifications for adware vendors is another problem that troubles us.)

This press release is evidence, though, that the program is already attracting adware vendors with a long history of poor practices, a legacy installed base in part derived from these poor practices, and a penchant for exploiting any perceived mark of legitimacy. No one should be surprised at that the companies most desirous of certification and white listing are those who in many respects least deserve it. A similar phenomenon has plagued TRUSTe's privacy seal program -- sites with TRUSTe privacy seals are more likely to be privacy invasive than those without, as it is the privacy invasive sites that most value the air of legitimacy and consumer friendliness that such a seal confers.

Although TRUSTe has insisted that the Trusted Download Program is not be a "consumer facing" seal program, we fully expect that any adware vendor white-listed by TRUSTe will wield that certification as a stick against anti-spyware companies such as Sunbelt -- an alleged "industry standard" certification with which Sunbelt is out of step should Sunbelt continue targeting that vendor's adware programs. Thus, it's worth reminding users, administrators, and adware vendors that even TRUSTe itself recognizes that anti-malware providers are not bound to respect TRUSTe's own whitelist. TRUSTe's "Program Requirements" document states:

“For example, TRUSTe understands that some potentially unwanted software applications may reach users' computers, and that antispyware software will continue to provide a means of detecting and removing software that fails to meet the standards of the anti-spyware industry or the interests of anti-spyware consumers. TRUSTe hopes that antispyware companies will consider the whitelisting of a company as a useful input into their research efforts, but recognizes that antispyware companies may have different valid methods of evaluating programs and may consider additional relevant factors important to their users.: ("Program Requirements," p. 2)

Moreover, the independence of Sunbelt's spyware review process is explicitly established within Sunbelt's Listing Criteria, which state:

"Although Sunbelt Software does consult and review the opinions and judgments of respected industry experts and leaders regarding the software it considers for detection by CounterSpy, Sunbelt is not obligated to agree with those other viewpoints, nor is Sunbelt obligated to recognize and respect third-party seals, logos, certifications, or classifications of any kind. As Sunbelt's primary obligation is to its own customers, Sunbelt is bound to make its own independent decisions about software detected by CounterSpy." (Link )

Put another way, despite what we anticipate adware vendors will be saying about the TRUSTe whitelist, Sunbelt will not be basing its targeting decisions on that white list but rather on its own Listing Critera. We would hope that adware vendors would recognize and respect the independence of Sunbelt's review process, but we wren't counting on it.

Eric Howes
Director of Malware Research

Note: this blog entry was updated on March 18 to include 180solutions (MetricsDirect) in the list of adware vendors mentioned in the UTcontextual press release.

Vista: Easier to Upgrade?

It looks as if upgrading from one edition of Windows Vista to another is going to be much easier than ever before, with Microsoft's Windows Anytime Upgrade feature. This appeared in the latest beta of Vista, and allows you to upgrade from Vista Home Basic to Vista Home Premium or Ultimate editions, to get more features and functionality. Read more about it here.

Is Your Wireless Web Surfing Breaking the Law?

You open up your laptop computer and see three wireless networks displayed as available. You pick one, click Connect, and a few minutes later you're surfing the Web - on somebody else's Internet connection. You might be sitting on your front porch, picking up a neighbor's wi-fi signal, or in a hotel room, connecting to the hotel's own wireless network or that of a law firm across the street. It's a common scenario that's happening all over the country every day.

Most new portable computers, PDAs and even Windows Mobile cell phones come with built in 802.11 wireless network adapters. They're handy for connecting to the many wireless hotspots that are springing up all over, in airports, restaurants and coffee shops, parks, etc., as well as for connecting to your own home wireless access point. Some of these hotspots are commercial and require you to pay a daily or hourly fee to connect. Some are free, operated by municipal governments and funded by taxpayers or established by businesses to draw in customers. And some aren't really hotspots at all - at least, not intentionally. They're private networks set up by companies and individuals who aren't well versed on computer security and don't realize they're leaving themselves open to connections from anyone within a several-hundred-foot range with a wireless-enabled computer.

"War drivers" make a pastime of hunting down unsecured wireless networks and hopping on, wherever they may be. They argue that they aren't doing anything wrong and aren't hurting anyone if they just use the bandwidth to Web surf or get their email, and don't try to access files on the other computers that may be connected to the network. Others disagree, pointing out that the owner of the network is paying for that Internet access and the "free rider" is in effect stealing bandwidth. Who's right?

We've had a lot of questions wanting to know whether connecting to a wireless network that you just "stumble across" is illegal. That's not an easy question to answer. Some point to federal law, specifically Title 18 of the U.S.Code (Chapter 47, Section 1030). At first glance, it would seem to address the situation by prohibiting unauthorized access to computers, but as you read further, you see that it really only pertains to certain types of networks - those that belong to federal government agencies and departments, financial institutions, or those involved in interstate commerce. While that last one might be interpreted broadly enough to cover connecting to that law firm if it has out-of-state clients, you may be hard pressed to find anything that applies to your next door neighbor's home network. You can read the federal law yourself here.  

State laws vary all across the board, and their language is often even more vague. Hwo do you define "unauthorized access," anyway? One could reasonably argue that by leaving a wireless network unsecured, you are in effect setting up a public hotspot and issuing an implied invitation to use it. Perhaps this analogy will help: in most jurisdictions you can't prosecute someone for trespassing if he simply walks across your yard, but if you put up a fence and "no trespassing" sign, then you can because you've taken steps to make people aware that you don't want them there.

Likewise, if you use encryption and require users to authenticate to connect to your network, you're giving notice that you don't want any and everyone to connect. But if you leave it open so that all anyone has to do is click the Connect button, you may seem to be saying "come on in."

Last summer, a man in Florida was arrested on felony charges of unauthorized use of a wireless network when he sat in a parked car and connected to a WAP in another man's house. The story made big news when it happened but we've been trying to find out, with little luck, what the disposition was.

Of course, stealing bandwidth isn't the only (or biggest) concern. If someone uses your network to commit illegal acts, such as downloading child porn or sending threatening emails or conspiring to commit terrorist acts, you could find yourself the object of police investigations or worse.

What if, despite that risk, you want to share all you have with the world, and choose to deliberately leave your wireless network open so others can share your DSL or cable connection to the Internet? No problem, right? Well, actually, your ISP may not appreciate your generous spirit. While it's not a criminal offense for you to share, it may very well be a breach of your contract with your ISP for which you could have your service terminated or even be sued. Check the Terms of Service (TOS) before you share. Some providers are okay with sharing.

For example, see Speakeasy's Wireless Sharing Policy here.

What do you think? Should connecting to a wireless network without permission be a crime, even if it's left unsecured? After all, you wouldn't just walk into a stranger's house just because it was left unlocked.

Or should the responsibility be on network owners to put up a virtual "fence" if they want to keep others out? Do you ever connect to available but "unknown" wireless networks just for fun, or when you can't get a connection any other way? What about voluntarily sharing your bandwidth? Should that be your right since you pay for the service, or should your ISP have the right to tell you "no?"

Deb Shinder

I wonder if it makes people look better after a few drinks?

There’s this new thing called “BioBouncer”, a facial recognition system for bars.  The whole idea behind it is bars can start to maintain a database of troublemakers, which can be shared with other bars.

Well, this is all rather interesting, isn’t it?  It’s one thing to have a CCTV inside of a bar.  It’s another to start maintaining digital data that is shared with other businesses on their own customers.

In a Wired article, EFF’s Lee Tien makes one point:

Lee Tien, a staff attorney with the Electronic Frontier Foundation, said people may find BioBouncer insulting or invasive. Facial recognition software is notoriously inaccurate, he said, and he is concerned that data-sharing could be used to blackball innocent partiers.

"Think about it: Someone doesn't like you, your photo gets in there, you walk in someplace and they're telling you, 'You're a troublemaker, you got bounced from that other bar.'"

Bruce Schneier blogs about the subject and has this to say, more related to the creeping aspect of these types of applications:

Anyone want to guess how long that "automatically flushed at the end of each night" will last? This data has enormous value. Insurance companies will want to know if someone was in a bar before a car accident. Employers will want to know if their employees were drinking before work -- think airplane pilots. Private investigators will want to know who walked into a bar with whom. The police will want to know all sorts of things. Lots of people will want this data -- and they'll all be willing to pay for it.

And the data will be owned by the bars that collect it. They can choose to erase it, or they can choose to sell it to data aggregators like Acxiom.

It's rarely the initial application that's the problem. It's the follow-on applications. It's the function creep. Before you know it, everyone will know that they are identified the moment they walk into a commercial building. We will all lose privacy, and liberty, and freedom as a result.

The company is requiring bars that use the service to have a conspicuous sign which includes the following

• Presence of BioBouncer
• Purpose of BioBouncer
• Patron Consent Agreement
• Image Collection & Storage Procedures
• Instructions for Protest
• Location of Further Information: http://www.biobouncer.com/

Wired article here via Bruce Schneier.

Needless to say, I’m sure you can imagine my feelings about this thing.  I don’t like it one bit.  The signs may go up, people will notice for a while and then forget it’s there.  And you’ve just lost one more part of your freedom.

Alex Eckelberry

(From BioBouncer’s website)

Whitepaper on the security considerations of Google Desktop

The IT Security Services crew at the University of Michigan have written a fairly extensive whitepaper on security considerations for Google Desktop.

Unfortunately, it only covers version 2.0, not the new 3.0 — the one which has a number of people quite concerned. (It is important to remember that the feature that’s most disconcerting to folks is Search Across Computers, which is not enabled by default.)

Nevertheless, it’s still a good read and I look forward to an updated version with their comments on 3.0.    

From the whitepaper: 

            1. Google Desktop should not be deployed

            a. As part of a “standard build” that is available to all users

            b. On workstations that process sensitive (per SPG 601.12) data

            c. In Terminal Server environments

            d. On workstations that do not follow common security best-practices such as automatic OS updates and automatic AV updates

            e. On workstations that leverage external (non-UM) email or IM services

            2. Instead, Google Desktop should only be deployed to individual users on an “as-needed” basis in accordance with the following deployment guidelines:

            a. Disable Google Integration

            b. Disable Network Drive Indexing

            c. Disable Indexing of secure web pages

            d. Disable Indexing of Instant Messages

            3. In managed Windows environments

            a. Use the Enterprise version of Google Desktop so that the recommended configuration settings (above) can be enforced via Group Policy.

            b. Be prepared for “zero-days” in the indexer by ensuring that you can centrally disable it.

            4. Finally, make user’s aware of

            a. Google Desktop’s privacy policies and, in particular,

            b. Privacy concerns with Google Desktop Advanced Features

 

Link here (via Martin McKeay).

As always, your comments are welcome.

Alex Eckelberry

 

Using Process Explorer to run as a Limited User

Process Explorer is one of several extremely cool tools made by Windows uber-guru Mark Russinovich. 

In a recent blog posting, he explains how you can use Process Explorer to run specific applications as a Limited User, without the attendent hassles of actually running the entire user session as in Limited User mode.

An alternative to running as limited user is to instead run only specific Internet-facing applications as a limited user that are at greater risk of compromise, such as IE and Outlook. Microsoft promises this capability in Windows Vista with Protected-Mode IE and User Account Control (UAC), but you can achieve a form of this today on Windows 2000 and higher with the new limited user execution features of Process Explorer and PsExec.

Process Explorer’s Run as Limited User menu item in the File menu opens a dialog that looks like and acts like the standard Windows Run dialog, but that runs the target process without administrative privileges:

Link here.

Alex Eckelberry

 

Paint that blocks cell phones: Is this a good idea?

There’s this new paint that’s been developed that can dynamically shut off cell phone reception:

"You could use this in a concert hall, allowing cell phones to work before the concert and during breaks, but shutting them down during the performance," said Michael Riedlinger, president of NaturalNano.

The cell phone guys hate it.  But they have a point:

"We oppose any kind of blocking technology," said Joe Farren, spokesman for The Wireless Association, the leading cell phone trade group. "What about the young parents whose baby-sitter is trying to call them, or the brain surgeon who needs notification of emergency surgery? These calls need to get through."

Link here (via Catherine).

Blocking RF as a general practice may have practical uses.  But in the way this is marketed, do you agree with the cell companies or the paint maker?

Alex Eckelberry

Corrected link -- Hotbar

My earlier blog story on Hotbar apparently not being happy with the Symantec settlement had a broken link.  In the interest of fairness, I am publishing this new blog entry with the correct link, here.

Alex Eckelberry

Move it offshore -- good

Google is moving Google.cn offshore. 

The Mountain View, Calif., company has decided to store search records from the site outside of China in order to prevent that government from being able to access the data without Google's consent, said Peter Norvig, Google's director of research, speaking Monday at a panel discussion at Santa Clara University.

All similar types of Internet companies doing business in China should follow the same move. 

Link here via /.

 

Alex Eckelberry

NOTICE:  This Blog contains information that may be indirectly or directly critical to the Chinese Government and hence may be in violation of Chinese Government Law.  If you reside in mainland China, do not read or even allow this blog to enter your thoughts.    

Famous psychiatrist bilked by Nigerian scammers

His son is suing to have his Dad removed from managing the family’s trust.

“A renowned psychiatrist from UC Irvine was duped into squandering at least $1.3 million of his family's fortune on a Nigeria Internet scam, according to a lawsuit recently filed by his son.

The son, also an Orange County doctor, said his father — Dr. Louis A. Gottschalk — gave as much as $3 million over a 10-year period in response to an Internet plea that promised the doctor a generous cut of a huge sum of cash trapped in African bank accounts in exchange for money advances.”

Link here.

Alex Eckelberry

Italy to censor gambling sites

Only regulated gaming houses will be allowed online. The state is losing too much money in tax revenue.

A few hours ago the recently approved measure forcing Italian internet service providers to block unlicensed online gaming websites entered into force. The censoring method recommended by the [Italian] Amministrazione Autonoma Monopoli di Stato – the State Monopoly Agency - is based upon the redirection of queries to unauthorized websites to a dedicated website by using the ISP DNS systems.

So a country is censoring all traffic to a particular segment of the Internet.  Nuts.

Link here, with a hat tip to Ferg.

Alex Eckelberry

Hotbar ain't happy

Hotbar founder Oren Dovronsky apparently doesn’t like the company’s settlement with Symantec:

"We don't understand why they're vilifying us; it's just not fair," said Hotbar founder Oren Dovronsky via the Hebrew news Web site Ynet. "There is no adware company in the market so upstanding as Hotbar.

"Indeed, there is a great confusion of concepts. It's not at all clear what adware is. If it's a program that presents advertisements, then there are a lot of programs that need to be included in that category, including MSN Messenger," Dovronsky said.

Link here.

Alex Eckelberry
(Hat tip to Richard)

 

When it all falls apart, they'll know who their friends were

Interesting article in The Nation about censorship and technology in China.

This opening paragraph says it all:

Back in the late 1990s, when I was working as a journalist in China, I happened to read Timothy Garton Ash's The File. It's a personal account about what happened in East Germany soon after the Berlin Wall fell, when East Germans were suddenly able to access their Stasi police files. As it turned out, secret police informants included neighbors, lovers, spouses and in some cases even people's own children. One evening over dinner with some Chinese friends, I described the book and asked how they thought things might play out in a post-Communist China. One friend replied: "That day will come in China too. Then I'll know who my real friends are." The table fell silent.

Link here via beSpacific.

Alex Eckelberry

NOTICE:  This Blog contains information that may be indirectly or directly critical to the Chinese Government and hence may be in violation of Chinese Government Law.  If you reside in mainland China, do not read or even allow this blog to enter your thoughts!

Two services to deliver RSS feeds to your inbox

In my mind, there’s no better way to read RSS feeds than through your email program.  That’s why I’m a big fan of RSS Popper.  However, it only supports Outlook and Outlook Express.

Steve Bass over at PC World wrote recently about Squeet  — a service which delivers RSS feeds to any email.  If you want to sign up for this blog through Squeet, just click here and enter your email address.

He also mentions another service, Blogarithm, which one of his readers likes because "they will e-mail you daily with a list of what has changed on your favorite blogs, if anything. They give you the top couple of lines, so you can determine if you want to click through and read the rest."

Sounds like a matter of personal preference. 

A side note:  On this blog are two RSS feeds: FeedBurner and Atom.  You can use either one. 

Alex Eckelberry 

Something free

You can get a free USB drive from Microsoft for answering a few simple questions.

Such a deal.

Link here (hint: the answers to the questions are also on this page).

Alex Eckelberry
(Hat tip to Steve Bass)