Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.
Security Response
Showing posts in English
Elia Florio | 18 May 2007 07:00:00 GMT | 0 comments

“Whenever I post my computer putssomething on the end of my post that I didn't type. Just look, it'sthat link and the text know will appear when I post this.P.S.Look,Super sreensaver! :)) …”

I wanted to start this blog by quoting a post picked up from one ofthe many forums contaminated by Mespam to show exactly what infectedusers experience without having a clue of what’s going on with theircomputer. If your friends are complaining that your e-mails, blog postsand chat sessions show a suspicious URL linking to photos, jokes orscreensavers that you hadn’t sent them, you’re probably another victimof this Trojan.

Trojan.Mespam was originally spotted in February and we described herethe new spreading technique, which uses an LSP component to attach textand malicious links to the outgoing HTTP traffic. In the Web 2.0...

Ron Bowes | 18 May 2007 07:00:00 GMT | 0 comments

These days, awareness about identity theftis increasing. More and more people understand that they aren'tsupposed to give out personal information unless they know who they'retalking to. But no matter how much you protect yourself, you still haveto rely on others to do the same. That leads to an important question:who knows who I am?

My first thought is my family. If somebody called my mom and askedquestions about me, would she answer? What about my dad, or mygrandparents? While I may know enough to protect my own personalinformation, they may not be aware. This is even more likely if theperson digging up information pretends to be a friend or employer, orif my family thinks that I'm somehow threatened ("We need your son'ssocial security number immediately, or he's going to lose his job").

Speaking of employers, how many job applications have you filledout? And how many required your social security number? Personally, Ican think of a dozen employers in a wide...

Zulfikar Ramzan | 17 May 2007 07:00:00 GMT | 0 comments

A while back, I blogged about the role of two-factor authentication tokens in protecting against phishing scams.Since then, the issue has come up again, and has recently has attractedmore attention, so I thought I’d spend some time here revisiting it.

First, let’s recall what two-factor authentication means. There arethree mechanisms we can use to prove to someone else that we are who wesay we are:
(1) something we have - a driver’s license, access card, or key
(2) something we are - a biometric like a fingerprint
(3) something we know - a password, or other common information aboutourselves (like a social security number, mailing address, or ourmother’s maiden name.)

Two-factor authentication simply refers to the idea ofauthenticating yourself using two of the above. Note that having twodifferent passwords is not...

Paul Mangan | 16 May 2007 07:00:00 GMT | 0 comments

The use of self-propagating programs for legitimate purposes is one of those ideas that just refuses to die.

In the 1978, researchers at Xerox Palo Alto Research Center (PARC)created worms that performed tasks that included system monitoring andwake up calls. However, in one case, the Xerox PARC ‘good’ worms thatwere supposed to run on a small set of machines, instead replicateduncontrollably across the network and started crashing machines.Fortunately, the Xerox PARC researchers had an independent terminationmechanism in the worm that enabled them to kill all copies of the wormon the network. Unfortunately, they still had 100 dead machines.

Since then, others have proposed using ‘good’ worms for purposessuch as compressing all files on a network, battling against ‘evil’worms, patching vulnerabilities, and looking for ways around Internetcensorship systems.

Unfortunately, people occasionally put these theories into practice.

Recently, we added...

Dave Cole | 16 May 2007 07:00:00 GMT | 0 comments

For those of us who are not hardcore gamers (yours truly included),but have fond memories of playing Pitfall on the Atari 2600 or Pirateson an old Apple, the world of online gaming has been experiencing aperiod of explosive growth in recent years. The rapid increases inplayers and dollars flowing into the gaming industry go well beyond theconsole-based games such as Sony’s PS3 and Nintendo’s Wii and extend toPC-based games such as the hugely popular World of Warcraft (WoW) whichenjoys a thriving online population that recently reached over 6 million users worldwide.WoW is a massively multiplayer online game (MMOG) that allows playersfrom across the globe to interact socially in a persistent world wherethe player is represented by their in-game avatar who increases inskills, gains possessions and presumably builds relationships overtime. The MMOG market...

Ron Bowes | 15 May 2007 07:00:00 GMT | 0 comments

For those of you who don't know orremember, a "companion virus" is a type of computer virus that tookadvantage of MS-DOS's filename matching. The companion virus wouldcreate a program with the same name as the "infected" file, but with adifferent extension, such as .com. For example, to infect a programcalled "innocent.exe," the virus could create one called "innocent.com"that would be, ironically, malicious rather than innocent. Once thevirus had infected innocent.exe, typing "innocent" into the commandline would invoke the first program found alphabetically,"innocent.com." Typically, the virus would execute the real program inaddition to running its payload, so as long as the virus was quickenough, the user wouldn't even know what had happened.

A similar concept is creating a program called "c:\program.exe." Ifthe user executed "c:\program files\innocent\innocent.exe," the program"c:\program.exe" could be run with "files\innocent\innocent.exe" as aparameter. This...

Kaoru Hayashi | 15 May 2007 07:00:00 GMT | 0 comments

Recently we found a new malware called Infostealer.Snifula.C. Themain purpose of malware is to steal confidential information from acompromised computer and send it to a certain web site. The author ofthe malware can obtain the information from the site and make moneywith it. To make matters worse, the web site has no access control andanyone can access the information there.

1%20Infostealer%20sm.jpg

As I'm writing this, more than 300MB logs are at the site and we cansee a huge collection of confidential information such as names,addresses, phone and credit card numbers, and login information foremail, online banking, MySpace, or eBay. And all of this informationcan be accessed through search engines.


...

Aaron Adams | 14 May 2007 07:00:00 GMT | 0 comments

The DeepSight Threat Analyst Team is constantly monitoring honeypotstermed “crawlers”, which are designed to crawl the Internet looking formaliciously-crafted web pages. These crawlers emulate users surfing theInternet with various browsers that may be susceptible to client-sideexploits hosted on Webpages. With the crawlers, we capture a lot of therun-of-the-mill malicious code using legacy web vulnerabilities.Malware authors especially like to spread using the (Microsoft MDAC RDS.Dataspace ActiveX Control Remote Code Execution Vulnerability BID 17462).

But among the legacy attacks, we run into much more interestingcompromises that ironically still install some of the same old malwarevariants. One of these interesting compromises was encountered on May8, 2007. A URL was distributed that was designed to look like itbelonged to the Halifax Online financial institute. However, theresulting site...

Symantec Security Response | 14 May 2007 07:00:00 GMT | 0 comments

In my last blog entry, Pre-Phishing Recon for Context Aware Attacks,I talked about how generic phishing messages can be used to collectcontextual information for more advanced phishing attacks. In thisblog, I will describe two such types of advanced phishing attacks.

First, I must note that a pre-phishing recon attack is not the only waythat attackers can get their hands on contextual information about aperson. Attackers can also search the internet for public documentscontaining personally-identifying information. They can buy informationabout a person on an underground economy server, and they can get theinformation through a corporate data breach. In any case, if anattacker gets access to some personal information about someone, he orshe can attempt what is called a context-aware phishing attack.

A context-aware phishing attack...

Gary Sabala | 11 May 2007 07:00:00 GMT | 0 comments

A quick Google search on the term “virtualization” returns nearly 19million results. The subject has graced the cover of nearly every majorIT trade publication in the past year in probably the past six months.In contrast, search the term “virtual security,” and you’ll be lucky tosee a meager 150,000 hits. Mark my words though—that limited attentionis about to change. As virtualization technology continues to emerge asa viable option for moving from development to production environments,the focus on the security implications of this new IT frontier willreach a tipping point.

With the security threat landscape in an enterprise changing on adaily basis, IT requires more innovative ways to protect desktopendpoints. Evolutionary security enhancements have just managed to keeppace with threats, but it is clear that more revolutionary securitymodels will be needed to protect the desktop in the future.Virtualization may hold the key.

Virtualization changes how IT thinks...