Security and Privacy

It was brought to my attention by sUBs, a malware researcher who developed Combofix ( a tool to help remove persistant malware threats & rogue scamware from infected computers) that a fake Microsoft malicious software removal tool is spreading
This total piece of scamware is designed to imitate the genuine MMSRT & has the usual fake detections & then entices you buy the latest rogue scamware Shield EC Antivirus which our good friends Sunbelt Software have blogged about.
The last screen clearly shows that they want you to buy this useless scamware

The installer for this piece of malware is detected by several Antiviruses currently as shown on this Virus Total report page

If you are unfortunate to be infected by this piece of scamware, it can be difficult to remove. Don’t fall for all the other scams on the net saying you need to buy other software to remove it. Ask for help on our malware cleaning forum http://thespykiller.co.uk

Many of us in the security community are concerned about misleading adverts. This one in particular has started to make waves within the wider Technical support community. It is frequently displayed on blogs & forums offering free technical support and appears designed to fool a user into thinking that they are getting Microsoft Technical Support, when in fact the link goes to a site that makes you pay for help and assistance  that has absolutely no connection to Microsoft as a company
The advert below is the one in question. Click on it to get a full size image

We all understand that adverts are a necessity in todays world to defray costs in running a website and an occasional rogue or misleading advert will slip through. I use Google adsense here on this blog and hope that all the adverts will be honest and above board. All webmasters, blog owners and Forums admins do need to keep an eye open for such adverts. Google must take a high degree of responsibility and start to police its advertising system more closely and weed out these deliberately misleading adverts.

The Company Justanswer.com who publish the adverts should be ashamed of themselves and I ask all readers to avoid that company and any others that use such underhand tactics to drive vulnerable visitors to their site.

The Microsoft Security Response Center (MSRC) : Investigating a new win32hlp and Internet Explorer issue:

http://blogs.technet.com/msrc/archive/2010/02/28/investigating-a-new-win32hlp-and-internet-explorer-issue.aspx

Hi everyone,
On Friday 2/26/2010, an issue was posted publicly that could allow an attacker to host a maliciously crafted web page and run arbitrary code if they could convince a user to visit the web page and then get them to press the F1 key in response to a pop up dialog box. We are not aware of any attacks seeking to exploit this issue at this time and in the current state of our investigation, we have determined that users running Windows 7, Windows Server 2008 R2, Windows Server 2008, and Windows Vista, are not affected by this issue. Continue reading…

Security Advisory 979682 Released

Today we released Security Advisory 979682 to address an Elevation of Privilege (EoP) vulnerability in the Windows kernel, affecting all currently supported versions of 32-bit Windows. 64-bit versions of Windows, including Windows Server 2008 R2, are not affected. The advisory provides customers with actionable guidance to help with protections against exploit of this vulnerability.

To exploit this vulnerability, an attacker must already have valid logon credentials and be able to log on to a system locally, meaning they must already have an account on the system. An attacker could then elevate their privileges to the administrative level and run programs of their choice on the system.

To help mitigate exploit of this vulnerability, customers who do not require NT Virtual DOS Mode (NTVDM) or support for 16-bit applications, can disable the NTVDM subsystem. Information on this workaround can be found in the Advisory.

We are not currently aware of any active attacks against this vulnerability and believe risk to customers, at this time, is limited. We continue to recommend customers review the mitigations and workarounds detailed in the Security Advisory.

We are also working with our Microsoft Active Protections Program (MAPP) partners to help provide broader protections for customers.

Our teams are continuing to work on an update and we will take appropriate action to protect customers when the update has met the quality bar for broad distribution. That may include releasing the update out-of-band.

The Security Advisory will be updated with any new developments so if you are not already subscribed to our comprehensive alerts, please do so in order to be alerted by email when new information is added.

We will also keep customers apprised of any additional details and updates through the MSRC Blog.

Thanks,

Jerry Bryant

via http://blogs.technet.com/msrc/archive/2010/01/20/security-advisory-979682-released.aspx

This is an advance notification of one out-of-band security bulletin that Microsoft is intending to release on January 21, 2010. The bulletin will be for Internet Explorer to address limited, targeted attacks against customers of Internet Explorer 6, as well as fixes for vulnerabilities rated Critical that are not currently under active attack.

The full version of the Microsoft Security Bulletin Advance Notification for this release can be found at  http://www.microsoft.com/technet/security/bulletin/ms10-jan.mspx.

http://siblog.mcafee.com/cto/operation-%E2%80%9Caurora%E2%80%9D-hit-google-others/

http://www.avertlabs.com/research/blog/index.php/2010/01/14/more-details-on-operation-aurora/

http://www.microsoft.com/technet/security/advisory/979352.mspx

I will  keep you posted when I hear more

best advice at this time is make sure antivirus is updated to protect, watch where you surf & consider an alternative browser or set IE protection to high

However bear in mind these have all been targeted attacks against specific companies & institutions so less likely to affect the average user, at least until the skiddies get their hands on the exploit

OK if you are still using IE 6 or 7 on any version of windows

use the fixit Microsoft have issued http://support.microsoft.com/kb/979352

You do not need this fix if you are using Internet Explorer 8 on Windows XP Service Pack 3 (SP3) or on Windows Vista SP1 or later versions ( including Windows 7 ) . This is because Internet Explorer 8 opts-in to DEP by default on these platforms.

Adobe released new versions of Flash and AIR today to address vulnerabilities in both products. Applying these updates as soon as practicable is a good idea, as Flash vulnerabilities are popular exploit vehicles in the wild.

Click here to install Flash 10.0.42.34.

Click here to install AIR 1.5.3.

The expanded security advisory explains that critical vulnerabilities could provoke crashes or remote code execution. Adobe Flash Player 10.0.32.18 and earlier versions and Adobe AIR 1.5.2 and earlier versions on all platforms are vulnerable.

7 new vulnerabilities are described cursorily. A patch to an eighth and older vulnerability is also updated. Adobe issues thanks to 6 different researchers for the help they provided with the vulnerabilities.

The advisory also adds that Flash Player version 10.1, which Adobe expects to release in the first half of 2010, will be the last to support PowerPC-based G3 Macs. They are discontinuing support, including security updates, past that version because they are implementing performance enhancements not supported in those processors.

With the seasonal shopping season well underway, watch out for fake shopping sites and phishing emails trying to get your identity & credit card details.

A slightly different approach came into my inbox today which asked me to confirm the item in my shopping basket. Now I haven’t shopped with Littlewoods online but you can be sure that thousands of people have and the same scam will be applied to just about every well known online shopping site this season.

The email looks quite believable

The website if you follow the link looks exactly like the real Littlwoods shopping site Account sign in page EXCEPT that the real Littlewwoods or ALL reputable shopping sites will have a Padlock icon and the  site address will start with HTTPS and the address bar will turn green to show that you are on a secure site

This screenshot shows the fake site and I have blanked out the address for safety reasons

These show how a genuine site will appear in Internet Explorer 8 on left and Firefox on right. Both show the padlock icon and a green safe address bar. A genuine shopping site will always start HTTPS to show a secure site when you are asked to put in any details. The front page of the site might be a normal http:
Unfortunately a lot of well known shopping sites haven’t yet signed up to the Extended Valuation green bar very secure system yet so watch for the closed padlock and HTTPS in the address bar to show a secure site. In Firefox browser the closed padlock is on the bottom right hand corner of the page, not in the browser address bar

I strongly recommend using ROBOFORM which keeps all passwords in a secure encrypted database that only you (not a keylogger or malware) can access and use it to create safe secure passwords

We seem to have a new batch of the Microsoft lottery spam emails again

These have a @live.com email address with what at first glance looks like it could be a proper microsoft or MSN email address ( they of course are not genuine Microsoft or associated with Microsoft in any way)

DO NOT fall for the scam & try to ring the 070240****** number . it is a premium rate number that will have along recorded message on it and cost you £0.50 per minute

You won’t get any money from these scammers but they will get money from you

I have blanked out the full email address and phone number from the image to save the unwary

Microsoft Security Advisory 977544 Released

Today Microsoft released Security Advisory 977544 to provide information, including customer guidance, on a publicly reported Denial-of-Service (DoS) vulnerability affecting Server Messaging Block (SMB) Protocol. This vulnerability, in SMBv1 and SMBv2, affects  Windows 7 and Windows Server 2008 R2. Windows Vista, Windows Server 2008, Windows XP, Windows Server 2003 and Windows 2000 are not affected.

It needs to be made  clear that this is a DoS vulnerability that is unrelated to Microsoft Security Bulletin MS09-050 which addressed a remote code execution vulnerability in the SMBv2 protocol. This vulnerability would not allow an attacker to take control or install malware on a user’s system, but could cause the affected system to stop responding until manually restarted.

http://blogs.technet.com/msrc/archive/2009/11/13/microsoft-security-advisory-977544-released.aspx