Category: Computer Security

Posted on
by

Here’s another one. First the notice they sent me:

Subject: VIRUS (Worm.SomeFool.P) IN MAIL FROM YOU

VIRUS ALERT

Our content checker found
    virus: Worm.SomeFool.P
in your email to the following recipient:
-> ADDRESS REMOVED

Please check your system for viruses,
or ask your system administrator to do so.

Delivery of the email was stopped!

And now my response:

Subject: BOGUS ALERT (sent to wrong address) IN MAIL FROM YOU

BOGUS WARNING ALERT

My BS checker found
    bogus warning: notice sent to known-forged sender
in your email to the following recipient:
-> MY ADDRESS

Please check your virus scanner for better notification options,
or ask your system administrator to do so.

All modern email-based viruses forge the sender address. Additionally, since your virus scanner was able to identify the specific virus, it can determine on its own that this virus always uses a forged address.

By notifying the supposed sender of a message when you know that sender is forged, you are knowingly sending virus warnings to people who are, in all likelihood, not using an infected computer. Messages like these are just noise, and the more of them that are sent, the less attention people will pay to *real* warnings. Additionally, it also runs the risk of causing unnecessary concern among the less tech-savvy (and extra calls to tech support about the nonexistant virus they fear they have).

(Feel free to re-use my response. I partially quoted myself anyway.)

I’m contemplating building a “hall of shame” and actually posting the sources of some of these. Any thoughts?

Posted on
by

Just what we need. Netcraft reports a worm that installs a network sniffer.

What’s that? It’s a program that listens in on traffic going across your network, looking for things like, oh, login names and passwords, credit card numbers, etc. They’re the reason online commerce requires SSL encryption.

Sniffers work because of the way ethernet is designed. Basically your local network is like holding a conversation in a crowded room. You focus on the people you’re talking with, and you tune out other people as best as you can. (In this case there’s also someone at the door who can relay your words to someone in another room, and relay back their responses.) To hold a private conversation you have to go somewhere else or talk in code. A traffic sniffer just doesn’t tune anyone out, so it picks up on everything in your local network.

So now, no matter how well you guard your own computer, if some moron on your network manages to get infected by Worm.SDBot (which thankfully hasn’t been spotted “in the wild” yet), you could still be handing out your email login/password when you log onto Yahoo/Hotmail/Outlook/etc.

You just might want to use that “secure login” option. Assuming, of course, that you have one.

Posted on
by

Via Email Battles: First ‘warspamming’ case reaches court.

Basically the guy (allegedly) drove around LA with a laptop looking for insecure wireless networks, then connected to them and sent spam using people’s home accounts.

The term comes from wardriving — driving around looking for unsecured networks — and warchalking — marking walls or sidewalks to indicate the presence, type and speed of the networks found. Early wardrivers discovered that Pringles cans make good amplifiers.

Further etymology: according to the Jargon File, war-driving is a play on war dialer. War dialers were programs that would call up a series of phone numbers looking for modems, faxes, or other phone-based systems it might be able to crack into. And that term started out as wargames dialer, a reference to the film War Games. (Whew!)

It turns out that warspamming is older than I thought: the term was coined two years ago, though this is the first case to go to trial. The defendant is being tried under CAN-SPAM, which went into effect this past January.

An interesting statement from the article:

If Tombros is convicted or pleads guilty then warspamming — also known as drive-by spamming — will move from being just a theoretical possibility to a genuine threat.

What, so in the two years since someone came up with the idea, no one has ever seen it done? And we have to wait for a conviction to determine whether it’s happened now? We don’t need to wait for a trial to know that spammers — an annoyingly resourceful lot — are using thousands of virus- and spyware-infested home computers as zombies. Warspamming doesn’t even require programming skills (or ties to virus writers — although I understand access to already-compromised networks has become a brisk business on the black market.) Surely someone has logs to show that it’s been done.

Update October 4: The defendant was convicted. Apparently, this is the first conviction obtained under CAN-SPAM. (via The War on Spam)

Posted on
by

Via The War on Spam and The Spam Weblog:

Hackers hijack federal computers. Apparently the DOJ discovered, during their crackdown on cybercrime, that hundreds of Department of Defense and Senate computers had been turned into zombies.

Nice.

Can we really be sure they were only used to send spam? After all, zombies are generally the result of viruses, worms or trojans that install backdoors, so that the attacker can run anything on the system. Setting up a distributed and disguised spam-sending network just happens to be the most profitable application right now, but you can bet there are a lot of people out there who would love to take over — or just look through — US military computers.

I don’t know about you, but I find this really disturbing.

“Would you like to play a game?”

Posted on
by

When I worked at a computer lab in college, the main security focus was preventing lab visitors from screwing around too much with the computers. We just ran Windows NT and locked it down as hard as possible. The worst network-based threat I remember facing was WinNuke, and that was just as likely to be another lab tech. Some of the early email viruses started circulating while I was there, but since it was a public lab, we didn’t provide any email programs; people would telnet into the mail server and use Pine. (This was pre-Hotmail, too.)

In my wired-for-ethernet campus housing, however, all bets were off. I watched people remotely controlling each others’ computers as pranks, or discovering hackers had gotten onto their systems from halfway across the planet, and figured it was safer to use Linux most of the time. This actually got me in trouble with the network admin at one point, who decided I must be running a server and shut off my port. It did at least teach me to disable services that were turned on by default, though I saw no indication that anything on there was actually being abused.*

Firewalled

Then there were firewalled environments. Still back in college, we rigged up my parents’ house for a home network. My brother put together a Linux box to dial into the Internet and act as a gateway, and effectively everything inside the network was safe from direct attacks. No point in internal firewalls, and since everyone was savvy enough to avoid the really nasty stuff (which was easier at the time), virus scanners were only a precaution, rather than a necessity.

For the past few years I’ve mainly worked with Continue reading →