Security Response

We’ve been seeing Fake AV programs getting more convincing for a while now. Some of the tricks employed by the guys behind these rogue programs include Windows-7-style fake scanners, in-browser “scanners”, and program features that ape other aspects of the operating system.

Yesterday, though, we came across a misleading application called AntiVirusDemoFraud that is—how to say?—possibly a little less sophisticated than some in terms of user interface design.

...

Ahoy there ye landlubbers! The high seas of wireless security appear to have gone commercial with the introduction of a paid service that means it just got a whole lot easier for a casual attacker to break into your wireless network. Before going on to talk about how this attack vector can be used, though, we'll quickly cover off some terminology; Wi-Fi standards can be an acronym minefield.

Many moons ago—more than ten years ago, in fact—a move was made to devise a method of securing wireless networks that would provide a level of confidentiality equivalent to that of traditional wired networks. The name Wired Equivalent Privacy (WEP) was given to the system. Unfortunately flaws emerged and it turned out to be trivial to circumvent. WEP is still built in to most Wi-Fi products on the market, but security-wise it was blown out of the water long ago and as such its use is now heavily deprecated. Roll out the successors!

Wi-Fi Protected Access (WPA)...

“Just when you thought it was safe to go back in the water…”

Over the past week, Symantec has been observing an increasing number of computers affected by Trojan.Brisv.A. This particular Trojan infects .asf, .mp2, .mp3, .wma, and .wmv movie and music files with malicious code that causes Microsoft Windows Media Player to access a malicious URL when the files are played, which results in more malware being downloaded on to the compromised computer.

In a further twist to the Trojan’s payload, all .mp2 and .mp3 files found on the computer are converted to the Windows Media Audio (WMA) format. This creates problems for security researchers writing software to remove the infected code from the files and restore them to their previous states. It is difficult to ascertain which files contain legitimate Digital Rights Management code and which...