Security Response

Old school virus methods appear to be invogue at the moment! Hot on the heels of Trojan.Mebroot, whichoverwrote the MBR, we have discovered a new worm that is revivinganother old school trick in order to hide itself. At first glance itappears to be a regular worm, but there is more going on here thanmeets the eye.

The worm in question is called W32.Joydotto and it initiallyappeared to be just another worm that spreads by copying itself and anautorun.inf file to all removable devices. However, upon closerexamination it was seen that the worm copies itself to removabledevices without using a file name for itself. By doing this the wormcannot be seen using any file-listing tools since there is no filenameto find. In addition to this the worm ensures its longevity by markingpart of the disk as being corrupted. In this way it will not beoverwritten because that part of the disk is thought to be corrupt. Infact the only way to find the worm on the disk is to...

Today, Adobe officially launched their newinfrastructure for delivering rich Internet applications to yourdesktop- Adobe Integrated Runtime, or "AIR" for short. At first glance,Adobe AIR looks like a mash up of many of the existing Web and Adobetechnologies such as HTML, AJAX, ActionScript, Flash, and Flex. Bycombining rich media and user interface features, and leveraging theexisting expertise in these technologies, Adobe hopes to bring highlyinteractive and engaging Web applications to the desktop.

Technologies provided by Adobe, such as Flash, enable a multimediadeveloper to easily create fantastic-looking and engaging applicationsand deploy them across various platforms by operating within a browserenvironment. Adobe AIR takes it a step further by liberating thesetechnologies and placing them within their own desktop-basedenvironment in a similar fashion to Java or .NET. Using this approach,it can achieve a number of aims:

• Impose its own...

How many of us click on the links sent tous by trusted friends? Does the trust implicitly extend to the linksthey are sending? This trust is precisely what phishers take advantageof. Traditionally phishers have mainly used instant messaging (IM) andemail to take advantage of the average user. However, with the rise insocial networking sites the phishers have bought themselves a brand newplaying field.

Symantec has recently observed millions of user profiles of acertain social networking site carrying malicious links. Here is anexample of one of them:

The interesting thing here is that the malicious link appears to bea comment from a trusted friend. In most cases the trusted friend isnot the perpetrator behind these attacks. The most likely scenario isthat the trusted friend’s social networking...

Social networking Web sites have become apopular pastime and are a means of staying in touch with friends formany people. Yesterday, Websensereported on a Trojan keylogger aimed at users of Habbo, a popularsocial networking site for teenagers. This is not the first timeteenagers and children have been targeted. One of the first instanceswas a worm called W32.Pokey that used the Pikachu character from Pokemon as a social engineering tactic.

In the Habbo case, users are duped into believing they are gettingtools that will give them the opportunity to make a name for themselvesin Habbo without having to fork out the costs. In fact what they aregetting is a malicious Trojan horse program that logs keystrokes on thecompromised computer and sends the logs to...