Spyware News: Cloud-based malware looms large on the horizon

The cloud will increasingly be used for malicious purposes in 2009, as malware writers look for more efficient ways to send spam and launch attacks, according to content security vendor Websense.

The firm's Security Labs argued in its predictions for 2009 that the cloud offers malware writers the same benefits as businesses in being easy-to-use, rent-as-you-go and highly scalable.

In this way, it could be used by hackers for sending spam or to launch more sophisticated attacks including hosting malicious code for downloads and testing malicious code, said Websense.

The firm also predicted a rise in the use of rich internet applications (RIAs) for malicious purposes as hackers exploit vulnerabilities in apps such as Google Docs.

"Malicious attackers are always looking for new ways to penetrate systems defences and they will inevitably see RIAs as a potential attack surface," argued Websense chief technology officer Dan Hubbard.

"For IT security personnel that means more applications and technologies to keep updated with patches and workarounds, and new policies to consider."

Hubbard also suggested 2009 will see hackers moving to a distributed model of controlling botnets and hosting malcode in an attempt to evade capture.

"Malware authors are looking for sustained uptime as much as anyone else and to avoid the reliance on a smaller number of providers who provide the hosting servers/capacity and who, if successfully shut down, could negatively impact the malware author's activities," he explained.

"By spreading their command and control servers and moving to a distributed model we could see attacks sustained for longer, with detection and shut down needing to overcome greater barriers and becoming more time consuming."

In related news, security vendor Trend Micro has released new statistics highlighting the flourishing illegal trade in compromised information and other items on the black market.

Log in details for Skype accounts sell at just €1.50 each, while stolen card details start at €28. Malware kits can be sourced for around €780, with advanced packages worth twice that, according to the vendor.

Spyware News: Malware targets immigrants

More than half of the businesses offering banking services commonly used by immigrants are actively infected with malware, according to a new study.

Approximately 60 percent of computers at businesses providing money transfers, income tax payment, check cashing, bill payment and auto insurance were found to be putting their customers at risk for identity theft because of vulnerable network and internet security, InformationWeek.com reports.

The study investigated about 1,500 PCs in predominately Latino neighborhoods in the Los Angeles and Las Vegas areas, according to the website.

Employees of these businesses were found to be working for minimum wage and "spent time chatting, using peer-to-peer networks and visiting chat sites on the very same computers sending sensitive data," stated the report. The situation was described as a "disaster waiting to happen."

Though there have been no reports of any actual identity thefts, the potential is still extremely high, InformationWeek states. One key-logging Trojan was found on a PC that was used for money transfers that could have provided a cybercriminal with sensitive information.

SMBs have long been a target for cybercriminals because many of them fail to have adequate online security or a 24-hour security team watching their website.

ScanSafe 2009 Predictions: Password Stealers Maximize Efforts to Access Online Banking

LONDON & SAN FRANCISCO, Dec 15, 2008 (BUSINESS WIRE) -- ScanSafe, the pioneer and leading provider of SaaS Web Security, today issued its 2009 predictions for the threat landscape. Not only does ScanSafe expect Rate of Exposure to Web-delivered malware to increase, it also predicts that publicly traded companies will be targeted and Internet advertising revenues will be adversely impacted.

"2008 has proven that we are not taking enough action against online criminal activity, hence the huge surge in online attacks," comments Mary Landesman, senior security researcher at ScanSafe. "I believe that 2009 will send a stern message to online criminals and we will see a push for tighter enforcement over domain registrations and hosting."

"Attackers often instigate these attacks for financial gain and given the current economy I suspect this motivation will only increase," adds Landesman. "In an 'always on' world and with increasingly sophisticated attacking techniques, it is only a matter of time before these criminals maximize attempts to directly access online banking accounts potentially leading to a loss in customer confidence."

ScanSafe processes more than 20 billion Web requests and 200 million blocks each month for customers in over 80 countries.

-- Internet advertising revenues will begin to be affected

As a direct result of continued website compromises and increased RoE, it is likely that more and more Web surfers will adopt technologies that block third party content. It is believed that this wider adoption will adversely impact Internet advertising in 2009, currently estimated as a 21.2 billion (USD) industry.

-- Web-enabled credit card scams may decrease, but sophistication of phishing is likely to increase

As a result of global economic financial "belt-tightening," financial institutions are likely to better enforce policies regarding online billing practices. This should translate into a reduction in (or elimination of) rogue billing agencies, thereby leading to fewer instances of credit card fraud facilitated through online transactions. As credit card billing fraud becomes a less viable revenue stream for online attackers, attempts to directly access online banking accounts may increase. In addition to the obvious loss of revenue this presents for victims of such crimes, any trending up in this area could lead to loss of consumer confidence in the safety and integrity of online banking.

-- Targeted attacks on publicly traded companies prone to rise

Global economics may lead to heightened competition, particularly among publicly traded companies. Sensitive information related to patentable R&D efforts may be particularly vulnerable. It is believed that the use of the Web to facilitate these attacks will continue to increase, as will the volume of malware (exploits, rootkits, backdoors, password stealers) used to facilitate these types of attacks.

-- Concerted efforts to regulate website registrations/hosting

Domain registrars and hosting providers have played a pivotal role in the ongoing website compromises. A lack of controls or poor implementation of existing controls provide attackers with the ability to register and host malicious domains with ease. In some cases, hosting providers re-release suspended domains back to the attackers, thus exacerbating the problem by causing previously compromised sites which have not yet been cleaned to once again become active malware distributors. 2009 should witness a push for tighter controls over domain registrations and hosting.

-- Rate of Exposure (RoE) to Web-delivered malware will continue to increase

The volume of Web-delivered malware is increasing at a rate of approximately 6% per month. The actual Rate of Exposure (RoE) is increasing at a rate of approximately 16% per month. The Rate of Exposure is how often a single user is exposed to malware. The higher RoE compared to volume growth is believed to be directly a result of the ongoing compromises of legitimate websites which have occurred en masse throughout 2008. In 2009, it is likely that the growth volume of Web-delivered malware will flatten but the RoE to Web-delivered malware will continue to increase, possibly at an even higher rate than observed in 2008.

About ScanSafe

ScanSafe is the largest global provider of SaaS Web Security, ensuring a safe and productive Internet environment for businesses. ScanSafe solutions keep viruses and spyware off corporate networks and allow businesses to control and secure the use of the Web and instant messaging. As a fully managed service, ScanSafe's solutions require no hardware, upfront capital costs or maintenance and provide unparalleled real-time threat protection. Powered by its proactive, multilayered Outbreak Intelligence(TM) threat detection technology, ScanSafe processes more than 20 billion Web requests and 200 million blocks each month for customers in over 80 countries.

With offices in London and San Francisco, California, ScanSafe is privately owned and financed by Benchmark Capital and Scale Venture Partners. The company received the CNET Networks award for Security Product of the Year 2008, a 2007 CODiE award for Best Software as a Service Solution, the 2008 and 2007 SC Magazine Europe Award for Best Content Security Solution and was named one of Red Herring's Top 100 Technology companies. For more information, visit www.scansafe.com.

SOURCE: ScanSafe

Spyware News: This malware should be monitored, despite its minimal threat

Though not entirely successful, a DNS-changing malware has raised some eyebrows with its ability to install a rogue DHCP server and may have the potential to cover its digital tracks.

Various blog postings wrote on the malware last week and said while it isn't an immediate threat, its ability to potentially steal users' personal information was an innovative approach, SCMagazineus.com reports.

Infected systems are turned into DHCP servers, which reply to request packets containing malicious DNS servers, according to the website. Users who receive the "malicious packets" will be redirected to websites controlled by the cybercriminal.

Through their research, SANS Internet Storm Center told the website the malware does not have a 100 percent success rate, though it was "very interesting."

"First, it's about a race between the rogue DHCP server and the legitimate one. Second, once a machine has been poisoned it is impossible to detect how it actually got poisoned in the first place," wrote Bojan Zdrnja, SANS handler on the organization's blog. In the post, Zdrnja confirmed the malware was in the wild.

This may be a preview of the cybercrime innovation to come next year as multiple reports have stated the rise in creative cyberattacks.

Spyware News: Oz government told to block malware

Security services provider Finjan has endorsed plans by the Australian government that will see blocks put on websites which contain illegal content.

The nationwide web filtration system will force Internet service providers (ISPs) to block thousands of sites on the world-wide web.

“The game plan is for Australian ISPs to be mandated to block access to websites containing illegal content such as child pornography or terrorist materials,” said Finjan CTO Yuval Ben-Itzhak.

Online advocacy groups in Australia have branded the $82 million ‘cyber-safety plan’ as a way of getting web censorship in through the backdoor.

Finjan, on the other hand, contends that the plans don’t go far enough.

“I would also recommend the Australian government includes in this plan actions against ISPs and other Web hosting companies that allow cybercriminals to host their command and control servers and distribute malware,” said Ben-Itzhak.

Ben-Itzhak’s argument is backed up by the success of a similar scheme in the US.

Global spam dropped by as much as 75% recently following the US government’s decision to shut down a web host which provided services to the majority of the world’s spammers.

Finjan wants to see a similar attack on malware distributors. Malware is a form of virus software that steals user’s data.

Finjan’s research and quarterly trends reports reveal that the volume and variety of malware on the Internet continues to climb steadily.

Trusteer Security Researcher Exposes New Three Tier DNS Attack Behind CheckFree.Com Breach

Amit Klein is a noted internet security researcher and CTO of Trusteer. He is an expert on DNS, browser, and endpoint security. Mr. Klein has discovered and reported several high profile DNS vulnerabilities. Prior to Trusteer he was Chief Scientist at Cyota, Inc. (now part of RSA Security) a leading provider of layered authentication solutions.

WHAT: The recent hijacking of the nation's largest e-bill payment system, CheckFree.com, provides a window into a sophisticated new attack method that is likely to become more common in 2009. This new approach, which combines the coordinated and sequenced execution of phishing, pharming, and malware attacks, was used in the CheckFree.com breach. It can bypass sophisticated network perimeter, strong authentication, and endpoint security mechanisms. Mr. Klein can deconstruct how this attack was carried out against Checkfree.com, how it works, and what organizations, especially online financial services providers, can do to protect their customers.

WHERE: Via conference call.

WHEN: Mr. Klein is available immediately for interviews. Please contact Marc Gendron at 781-237-0341, or marc@mgpr.net.

HOW: The Trusteer Security Research Group, led by Mr. Klein, investigates malware attack techniques as well as browser, operating system, and DNS vulnerabilities. The group works closely with security vendors, researchers, and Trusteer's customers to address, remediate, and protect against new vulnerabilities and attacks. For more information visit: http://www.trusteer.com/research.

About Trusteer

Trusteer enables online businesses to establish a secure communication tunnel with their customers over the Internet that stretches from user's keyboard into the company's website. Trusteer's flagship product, Rapport, allows online banks, brokerages, healthcare organizations, and retailers to protect their customers from identity theft and financial fraud. Unlike conventional approaches to Web security, Rapport protects users' confidential information even if their computer is infected with malware including Trojans and keyloggers, or is victimized by pharming, phishing attacks. Trusteer is a privately held corporation led by former executives from Cyota/RSA Security, Imperva, and NetScreen/Juniper. For more information visit www.trusteer.com.

SOURCE: Trusteer

International Herald Tribune Selects Mazu Networks to Ensure the Performance and Availability of Applications across its Complex IT Infrastructure

CAMBRIDGE, Mass., Dec 15, 2008 /PRNewswire via COMTEX/ -- Mazu Networks, the leading provider of behaviour-based, enterprise-class performance and availability solutions, today announced that The International Herald Tribune (IHT), the most widely read international newspaper, selected Mazu Profiler to manage, optimise and secure its complex WAN. Through Mazu Profiler, a leading application performance management solution based on Network Behaviour Analysis (NBA), the IHT gains the visibility needed to ensure uninterrupted service between key news hubs in Paris, Hong Kong and London, in addition to the extended bureau network.

The IHT combines news generated from its headquarters in Paris with input from correspondents operating out of 37 regional bureaus including its parent company, The New York Times, in New York City. Having constant and uninterrupted network access is critical to the paper's success in delivering timely news to its international subscription base, spanning more than 180 countries and comprising 241,625 readers (Source: OJD 2007). With critical applications and communications linked through a Wide Area MPLS Network, IHT needed a solution that could give them visibility into all WAN traffic - whether it passed through headquarters or not.

"Within two weeks of deploying Mazu Profiler, we were able to get an accurate picture of network usage patterns for every location," said Christophe Duprat, IT director, The International Herald Tribune. "We were able to reduce telecom costs, develop an effective capacity plan going forward and even provide input to developers to help them optimise their applications for our WAN environment."

Through Mazu Profiler, the IHT team gains visibility into the interactions between users, applications, network elements and systems. With this comprehensive understanding of their application delivery infrastructure, they were able to show developers how their applications were behaving on the network, which allowed them to make changes that greatly improved performance.

IHT was also concerned with understanding Internet usage and defining acceptable usage policies. With Mazu Profiler's ability to go beyond port level identification of network traffic, they were able to identify undesirable applications encapsulated within their HTTP traffic (a common trait of modern day spyware). Mazu Profiler is unique in its ability to help customers like the IHT develop more effective security policies and prevent bandwidth consumption by unauthorised applications.

"In a deadline-driven industry like the newspaper business, it is critical for all the correspondents, regardless of location, to be able to deliver the time-sensitive daily news needed to fill the pages of the IHT," said Paul Brady, chief executive officer, Mazu Networks, Inc. "Mazu Profiler allows network and security to provide proactive service assurance, faster problem resolution and more effective WAN management to improve the performance and availability of business services."

Mazu Networks worked with Nomios, a leading solutions provider, to integrate Mazu Profiler into the IHT IT infrastructure. Nomios, based in France, specialises in the study, selection, installation, operation and development of optimisation solutions for telecom networks and infrastructure. This translates into expertise in management solutions and content access, continuity of service as well as filtering and application protection. Nomios was instrumental in helping Mazu Networks bring the value of NBA to the IHT. Mazu Profiler enables IT organisations to manage, secure and optimise the performance and availability of business applications. Through Mazu Profiler, IT teams can accelerate initiatives including: application performance management; security and compliance; WAN management; CMDB-discovery; and data centre consolidation and migration. For more information on the ways Mazu Profiler can resolve today's most pressing network operations and security challenges, please visit: http://www.mazunetworks.com/it-initiatives.

About The International Herald Tribune

The International Herald Tribune creates, collects and distributes world news, information, entertainment and opinion of the highest journalistic integrity. Its balanced perspective addresses all areas of human interest and is trusted and enjoyed by people in all corners of the globe. Established in Paris in 1887, today the IHT is owned by The New York Times Company and continues to expand the reach of its authoritative journalism through the newspaper which is sold in 180 countries and via computers and mobile devices at IHT.com. The New York Times Company (NYT:

New York Times Company

News, chart, profile, more

Last: 7.06-0.35-4.72%
1:51pm 12/15/2008
Delayed quote data

Add to portfolio
Analyst
Create alert

Insider
Discuss
Financials

Sponsored by:

NYT 7.06, -0.35, -4.7%) , a leading media company with 2007 revenues of $3.2 billion, includes The New York Times, the International Herald Tribune, The Boston Globe, 15 other daily newspapers, WQXR-FM and more than 50 web sites, including NYTimes.com, Boston.com and About.com. The Company's core purpose is to enhance society by creating, collecting and distributing high-quality news, information and entertainment. Over the years, The Times Company's properties have been awarded many journalism awards, including a total of 117 Pulitzer prizes, more than any other news organization. For more information about The New York Times Company visit: http://www.nytco.com.

About Mazu Networks, Inc.

Mazu Networks offers solutions that enable IT organizations to manage, secure and optimise the availability and performance of business services. Mazu Profiler uses Network Behaviour Analysis (NBA) to provide a new way of managing application performance and security by analysing the interactions of users with the applications, systems and network devices that comprise the application delivery infrastructure. Mazu Profiler delivers a management solution that spans network, security and data centre operations groups and provides a broad range of capabilities including improved application performance management, threat management, CMDB discovery and regulatory compliance. Only Mazu Profiler offers behavioural analytics, dependency mapping, user-defined policies, application and user identification, enhanced workflow and an application delivery perspective. With Mazu Profiler, hundreds of customers are able to ensure the availability, performance, and security of business services as well as to reduce costs and satisfy regulatory requirements. For more information, please visit www.mazunetworks.co.uk.

About Nomios

Nomios is a leading solutions provider that specializes in network and security products from leading vendors including: Mazu Networks, F5 Networks, Blue Coat Systems, Juniper Networks, IronPort, Fortinet, among others. Nomios brings their technology expertise and these vendors' leading solutions to large enterprise companies in France. Nomios meets operational targets and provides highly skilled human resources.

Spyware News: Virgin Media Launches the UK's Fastest Broadband

UK's First Next Generation Network Brings Ultrafast 50Mb to Over 12 Million Homes and Transforms the UK's Broadband Market

 * Huge investment to triple the capacity of the original cable
  network
* Next-generation broadband nearly nine times the average UK speed
* Premium launch offering includes unlimited downloads, no traffic
  management, plus the UK's fastest wireless offer

LONDON, Dec. 15, 2008 (GLOBE NEWSWIRE) -- Virgin Media (Nasdaq:VMED), the UK's leading broadband provider, today launched its much anticipated ultrafast 50Mb broadband service. Giving customers nearly nine times(1) the average headline broadband speed in the UK, the launch of the 50Mb service is a seismic leap forward for broadband access in the UK and the coming of age of Virgin Media's unique fibre optic cable network.

Neil Berkett, Virgin Media's CEO, said, "Today marks a historic moment, for both Virgin Media and the UK. As the first ISP to roll out next-generation broadband access, our 50Mb service represents the dawning of a new era of high-speed services in the UK and is just the beginning of what we hope to offer our customers over the coming years. This service will transform the way people interact and entertain themselves online and will provide a broadband experience that is truly world class."

With the massive take-up of video-rich entertainment and social networking websites, the new 50Mb service is expected to meet the rapidly growing consumer demand for faster broadband speeds and greater bandwidth. Research conducted by YouGov(2) for Virgin Media found that in the last year more than half (53 per cent) of Brits had started watching TV programmes or clips online. The research also found internet use is at an all-time high with 88 per cent of Brits going online every day. The average amount of data consumed by Virgin Media customers has nearly doubled in the last 18 months and is predicted to quadruple by 2011(3).

The 50Mb service will allow users to download(4) an entire music album in as little as 11 seconds, a TV show in around one minute, a high quality movie in as little as 3 1/2 minutes and a high definition movie in around 15 minutes. The increased bandwidth also means that multiple users can be on the internet at the same time without it affecting the quality or speed of their service. This makes 50Mb ideal for families, people in shared households, such as students and couples, or anyone needing to share a broadband connection. YouGov's research found 71 per cent of UK homes now have two or more computers/laptops or games consoles connecting to the internet. In addition 78 per cent of homes share broadband access as there are two or more people within the home.

The launch of 50Mb is part of a massive investment in Virgin Media's network and more than doubles the capacity of the original build of the UK cable network, creating the potential for speeds of 200Mb. The upgraded network means significant improvements to the service received by all of Virgin Media's broadband customers, with current 10Mb and 20Mb users being moved onto the new "DOCSIS3" network(5), freeing up capacity for increased traffic on the existing DOCSIS 1.0 network. In time, the upgrade to DOCSIS 3.0 means Virgin Media will be able to handle more than three times the data currently handled by the cable network.

Using the latest state of the art hardware, the 50Mb package comes with a new DOCSIS3.0 modem, a wireless 'N' router offering the UK's fastest wireless connection, plus free anti-virus and anti-spyware software as well as unlimited downloads(6). A typical family will be able to get the new ultrafast service for as little as GBP35 a month(7).

By the end of 2008, Virgin Media will have completed deployment of its next generation infrastructure to 40% of the network. This will include areas in Scotland, the Midlands and South London. Roll-out to the rest of the 12.6 million homes covered by Virgin Media's fibre optic network is expected to be complete during the Summer of 2009.

To find out more about Virgin Media's 50Mb service, visit www.virginmedia.com/50

 Notes to editors
* (1) Ofcom Communications Market Report (August 2008) reports
      average UK headline broadband speeds at 5.9Mb as at Q1 2008.
* (2) YouGov surveyed 1,128 people across the UK between 13-15
      October, 2008.  Please see separate document for more research
      findings.
* (3) Virgin Media's average customer data consumption is up 81%
      from 4.7 GB to 8.6 GB per month over the last 18 months.
      Consumer IP traffic will quadruple in four years driven by
      video (Cisco; 2008)
* (4) Download times are calculated based on full-rate downloads on
      a wired connection, with 10% allowance for Internet Protocol
      transfer and connection overheads. The sizes used for
      calculation are a music album at 60Mb, a TV show at 350Mb, a
      high quality movie at 1.1 GB (e.g. from LOVEFiLM) and an HD
      movie at 5 GB (e.g. HD movies from Xbox Live marketplace).
* (5) Network: The new 50Mb service runs over a new next-generation
      core network based on the EuroDOCSIS3 standard which gives
      Virgin Media a significant increase in capacity to cope with
      higher speeds (in excess of 200Mb) as well as more data. In
      parallel with our existing core network (based on EuroDOCSIS1)
      Virgin Media's new network will have over three times the
      data-carrying capacity, and is the UK's first next generation
      network.
* (6) Package: The 50Mb service includes a new EuroDOCSIS3-
      compatible modem, an unlimited service with no traffic
      management at launch (acceptable use policy still applies),
      and a complete wireless kit to make the most of 50Mb speeds
      (including 802.11n router and 802.11n USB dongle), PCguard
      Total anti-virus and anti-spyware protection. Virgin Media
      uses traffic management on its network to ensure the vast
      majority of customers receive the high quality of service they
      expect.  Virgin Media will be trialling a variety of different
      approaches to traffic management and upstream speeds, to
      improve the unique performance of this service.
* (7) Pricing: Virgin Media's 50Mb broadband service will cost GBP51
      per month as a stand-alone service or just GBP35 when taken
      with a phone line (GBP11). Customers with additional Virgin
      Media services will benefit from bundle discounts, meaning a
      typical family can get a complete home entertainment package
      including phone, digital TV with over 165 channels including
      HD, our V+ HD Box including Virgin Media's pioneering TV on
      demand service, as well as 50Mb broadband from just GBP66 a
      month. Prices include e-billing discount. Activation and
      installation charges apply.
*     Customer take-up and consumption: More than one million Virgin
      Media customers subscribe to a 10Mb or 20Mb broadband service.
      There has been a 78% year-on-year increase in customers taking
      higher tier packages.
*     Availability: The 50Mb service is available up and down the
      country from this month.  Customers can check availability at
      www.viriginmedia.com/50
*     Broadband: Virgin Media has a complete range of broadband
      solutions for every user -- The 'Mother of all Broadband'
      using fibre optic technology for ultrafast speeds up to 50Mb,
      Virgin Media National broadband using ADSL technology up to
      16Mb, and Virgin Media Mobile Broadband using the Virgin
      Mobile 3G/HSPA network at speeds up to 3.6Mbps.
*     Marketing: The launch of the 50Mb service will be supported by
      a multi-million pound campaign comprising of TV, outdoor,
      print and online.

About Virgin Media

Virgin Media is an innovative and pioneering UK entertainment and communications business. For the first time consumers can get everything they need from one company -- the UK's only quad-play of TV, broadband, phone and mobile, plus the most advanced TV on demand service, all delivered through its unique fibre-optic cable network. Virgin Media launched the UK's first high definition TV service, is the only TV platform to carry BBC iPlayer, and offers a high-specification, HD-ready V+ personal video recorder. Virgin Media is the UK's largest residential broadband provider, the largest virtual mobile network operator and the second-largest provider of pay TV and home phone.

Virgin Media owns two content businesses -- Virgin Media Television (VMTV) and sit-up. VMTV owns eight entertainment channels -- Virgin1, Living, Living 2, Bravo, Bravo 2, Challenge, Challenge Jackpot and Trouble -- and is a 50% partner in UKTV which consists of ten channels including Dave, G.O.L.D, Watch and Alibi. sit-up runs retail TV channels bid tv, price-drop tv and speed auction tv.

Virgin Media has been voted the sixth Most Loved Brand in Britain in a Marketing magazine poll, as well as having been voted the Most Trusted ISP Brand 2008 by Reader's Digest magazine. The Sunday Times also awarded Virgin Media its 2008 Best Buy awards for broadband and movies on demand.

Virgin Media is the largest Virgin company in the world and has almost 10 million customers. To find out more visit www.virginmedia.com/presscentre.

CONTACT:  Virgin Media
         Consumer Media Contacts:
         Asam Ahmad
           0207 909 2122
           asam.ahmad@virginmedia.co.uk
         Rebecca Burke
           0115 912 2385
           rebecca.burke@virginmedia.co.uk
         Corporate Media Contacts:
         Gareth Mead
           0207 909 2123
           gareth.mead@virginmedia.co.uk
         Emma Hutchinson
           0207 909 2022
           emma.hutchinson@virginmedia.co.uk

Spyware News: AdAware Developer Launches Avira-Based Antivirus

Swedish security firm Lavasoft pioneered spyware protection with their venerable Ad-Aware utility. On Monday, the company released a new standalone antivirus program, Lavasoft Anti-Virus Helix, priced at $23.95.

Based on technology from Avira, the product cleans up viruses and other malicious software and also includes real-time protection to prevent further infection.

Users can schedule standard or custom scans on a daily, weekly, or monthly basis. Helix can also schedule a scan for every login, or at any interval. The product's MailGuard feature scans incoming email and attachments and removes any viruses found. WebGuard prevents downloads of malicious files. According to Lavasoft, Helix protects against the worst threats – viruses, worms, Trojans, rootkits, bots, and more – without putting a drag on system performance.

While the product is too new to have certification from the major independent testing labs, the underlying Avira technology is well-regarded. It received the VB100% award from Virus Bulletin, and ICSA Labs certifies it for virus detection. AV-Comparatives rates it ADVANCED+ (the highest rating) for on-demand virus removal and ADVANCED for proactive non-signature-based detection. AV-Test calls it "very good" (the highest rating) for detection of malware and spyware, for fast scanning, and for fast response to new outbreaks. The product is currently under evaluation by PCMag, with a review to come.

Spyware News: Report: recession could trigger blackhat, crimeware surge

With the world's financial market in turmoil its been reported it could trigger a blackhat surge.

Read on....

As if the news coming out of Wall Street these days wasn't gloomy enough, various security solution providers and analyst firms are projecting that layoffs and cutbacks in the tech industry will lead to a spike in white collar crime. In its fourth quarter 2008 trend report (PDF), the security company Finjan is predicting a "sharp rise [in cybercrime] in 2009 due to the current economic downturn, which makes financial gain from stealing data and selling it online even more attractive."

That sounds dire, especially considering the bleak forecasts we've heard from the semiconductor industry, but dire is scarcely a synonym for accurate. Finjan links to a November 19 Forbes article within its PDF, citing it as evidence of "an early trend of unemployed IT personnel finding new and easy income by purchasing and using crimeware toolkits." The article in question, however, doesn't really provide a solid foundation for Finjan's statement. While the piece does take note of various trends, occurrences, and vibrations in the malware market, the author notes that the data "remains largely anecdotal."

The senior manager of forensic services for PricewaterhouseCoopers, Nick Ysart, believes there's historical evidence to support Finjan's claim, telling ZDNet: "There are certain types of fraud where an understanding of technology would make it easier to circumvent controls, and IT staff have the knowledge to do that... There was a range of very well-documented frauds that took place during the recession in the early 1990s," Ysart continued. "It does not take a great deal of insight to realize we will see an increase at a time like this."

The recession of 1990-1991 may not be as reliable a predictor of future white-collar criminal activity as Ysart implies. In 1990, computer security was still almost entirely understood as a physical challenge. The overwhelming majority of computers in both businesses and homes were not networked, Windows 3.0 was a brand-new product, and we transferred data from system to system either via floppy disks (1.25" or 1.44" flavors) or possibly through a serial/parallel cable (if you hated yourself).

The IT job market, the fundamentals of computer security, the threats to said security, and the degree to which the actions of individual users can be tracked) have all evolved over the past 17 years to the point where the two situations bear only a cursory resemblance to each other. The nature and degree of the two recessions are quite likely to be different (2008's is looking worse at this point), and an entirely new market for malware has evolved that didn't previously exist.

At first glance, a number of those factors sound like reasons to conclude that Finjan and Ysart are right, but related research suggests that both companies have oversimplified an extremely complex and nuanced series of relationships. Economists and social scientists have been conducting studies into the relationship between poverty, unemployment, recession, and crime for decades, the results of which resist being broken into a handful of sound bytes.

While there is a general positive correlation between unemployment and crime, the correlation between the two can vary considerably depending on geographic area, the type of crime being measured, the age of the individuals in question, per-capita alcohol consumption, the perceived effectiveness of law enforcement, the nature of the jobs that are lost, and the nature of the available alternative employment opportunities. State intervention in the form of additional unemployment or social benefits, including job retraining, can also meaningfully impact the relationship between these variables.

There are a number of factors that could work against Finjan's predicted black hat wave. IT workers in high positions, particularly positions they earned through education and/or substantial time on the job risk compromising their ability to ever use those skills again at some point in the future when the economy recovers. Employees with greater access to personal or secure data that a competitor or botnet master would find valuable may be more likely to turn rogue if fired, but that same group of people risks more if they do so.

The economic value of the data itself must also be considered. A sudden glut of data on the black market should ultimately drive price downwards, particularly if the trend is sustained over a period of time. We've already seen evidence this year that the malware industry is driven by many of the same market trends that affect other, legitimate businesses; there's no reason to suspect it would react differently to a mid-term increase in the supply of available personal information.

Businesses will have no choice but to continue to invest in security products and personnel—no company can risk the loss of face or potential data that would come with a major security breach—but there's no reason, at this point, to assume 2009 will be the topic of the 2010 blockbuster Fox special: "When Good IT Goes Bad." Will it happen? Sure. Will it happen in such numbers as to qualify as an "emerging trend?" I'm dubious.

Spyware News: Today's sneaky viruses require extra precautions

The malware assault on our PCs escalated in 2008, according to antivirus vendor F-Secure. The company's threat summary for the second half of 2008 reports that F-Secure added 1 million virus definitions to its database this year, a threefold increase from the number of viruses the Finnish security vendor detected in 2007.

Today's malware authors aren't just looking to cause trouble; they're after your money and personal information, which these days are synonymous. Attacks are only going to increase in number and sophistication. If you thought you could avoid an infection by staying away from questionable sites, downloads, and e-mail links, you're mistaken.

The only way to play it safe is to assume the worst. That's why I spent several hours last week disinfecting a notebook computer that probably wasn't infected in the first place.

It all started when I decided to run a free online virus scan on my notebook. I use a top-rated security suite that's set to update its virus definitions and other settings automatically, so I was confident that the scan would come up empty. (I'm not going to name either product because I don't want this post to be construed as a recommendation one way or the other.)

Unfortunately, after a complete system check, the online virus service told me it found two suspicious files on my notebook. The scanner's option to remove the files was grayed out, and the option to "skip" them was recommended.

It appears that the files were flagged as potential problems because they included the word "trojan" in their names. I acknowledge the "hide in plain sight" approach, but I doubt that many malware authors would be so kind as to identify their creation in the file name itself.

Still, the scan had introduced the possibility of an infection, so I immediately closed the notebook's Internet connection, updated the virus definition database of the antivirus software installed on the machine itself, and performed a full system scan using that program.

I wasn't surprised when the scan came up clean--several hours later--but I was relieved that I didn't have to go into full wipe-out mode, doing a complete system scrub and changing all my passwords. (Come to think of it, I should probably sanitize the system and refresh my passwords, anyway.)

Three years ago, I wrote a story called 10-Step Security that promised to lock down your PC in only an hour. The tips in that article are beginning to show their age, so this week, I'll be updating them here to reflect the new reality of computing in dangerous times.

Spyware News: Malware madness and spammers in the slammer: The year in cybercrime

One of the most disturbing cybercrime trends in 2008, many security analysts say, has been the emergence of a full-blown underground economy where credit card information, identity theft information, and spam and phishing software are all available for relatively low prices.

Security software company Symantec became the latest company to raise red flags about what it called the "underground server" economy last month, when it issued a report estimating that roughly $276 million worth of goods and information is available on online black markets. Credit card data accounted for 59% of the information available for sale on underground servers, Symantec reported, with identity theft information (16%), server accounts (10%), financial accounts (8%) and spam and phishing programs (6%) trailing far behind.

What's even more unnerving than the availability of this information is its low price. According to Symantec, bank account credentials are selling for $10 to $1,000, while information about financial Web sites' vulnerabilities sell for an average $740. If all the stolen information available on the servers were exploited successfully, it would bring in about $5 billion, Symantec estimates.

One big reason this data is more widely available is that writing malicious code has grown from a hobby for many hackers into a full-time job where code writers make a living stealing information and selling it over underground server systems, says Dave Marcus, security research and communications manager at McAfee Avert Labs.

"Malware used to be written for bragging rights," Marcus says. "It was about who could write the fastest worm or the biggest virus. Now it's about making money, what kind of data or payload you can get from a machine, and what you can do with it."

As malware has become more sophisticated, it has increased its reach throughout the Internet. According to a report issued by Google earlier this year, about 1.25% of all Internet search results in February 2008 contained at least one malicious URL, a large increase from the 0.25% of Internet search results in April 2007 that contained at least one malicious URL.

This dramatic jump in malicious search results has coincided with several security firms reporting enormous jumps in malware instances in recent years. Between 2006 and 2007, for instance, Symantec reported that it detected roughly 712,000 new malicious code threats, a 468% increase from the 125,000 threats detected the previous year. Spanish security company Panda Security, meanwhile, reported that malware increased by 800% between 2006 and 2007, as the company detected an average of more than 3,000 types of malware per day in 2007.

Spyware News: Internet banking clients must be alert

THE Ombudsman for Banking Services has warned bank clients using internet banking to be on the alert.

The warning stems from a recent incident in which R331000 was fraudulently transferred out of a Gauteng resident‘s current and credit card accounts.

According to former Port Elizabeth attorney Clive Pillay, who is the national Ombudsman for Banking Services, the complainant had fallen victim to a phishing scam, which sees fraudsters send large numbers of e-mails randomly that appear to have been sent legitimately from a financial institution.

Once the unsuspecting bank client enters the fraudulent site and divulges his or her personal internet banking details, the fraudsters use the information to access the bank‘s genuine internet banking website and the client‘s internet banking profile.

“It is possible then to harvest confidential client information such as cellphone numbers and e-mail addresses. Then the cellular service provider, where the client‘s SIM card is swopped for a new one, enables the scamsters to intercept passwords required for sensitive transactions,” Pillay said.

This information was used to transfer money from the client‘s bank accounts into a number of fraudulent beneficiary accounts.

Through the intervention of the ombudsman, R209000 was recovered for the complainant in this case, but only because of delays in the bank putting his account on hold, and the negligence of other banks, which opened beneficiary accounts for the fraudsters without the documentation required by legislation.

“Banks issue constant alerts about such schemes, so in assessing complaints we must assume that the client has received sufficient warning,” Pillay said.

He cautioned the public not to respond to e-mails or telephone requests for personal banking details, and not to complete transactions at internet cafes, whose computers may have spyware to capture login credentials.

“People should respond immediately to any notifications from their banks regarding activity on the internet banking profile.”

Pillay said a new scam had also emerged.

“The fraudsters no longer perform a SIM swop to log into an account. Once a password has been dispatched to the client, they will phone pretending to be a bank official and request confirmation of the password and other confidential information. At this stage, red flags should be waving furiously.”

Spyware News: Panda Security’s weekly report on viruses and intruders - Virus Alerts

We recently reported about the Mcdonalds email that is really a virus. Here is what you will actually find inside.

Read on...

This week’s PandaLabs report looks at the BankerFox banker Trojan, the Azero.B virus and the P2PShared.U worm, distributed through a fake
McDonald’s email message.

Banker.LAX is designed to steal bank details. To do this, it drops a library on targeted computers passing itself off as a legitimate Firefox plug-in. Then, if the user accesses the website of their bank, the malicious code will capture all the information entered. The malware creator will then use this information to empty the users’ accounts. This malware can steal passwords from more than one hundred banking institutions.

“Oddly enough, this Trojan affects Firefox only, whereas cyber-criminals
usually exploit Internet Explorer”, says Luis Corrons, technical director of PandaLabs. “The reason for this is the increasing number of people who are using this Internet browser. As always, cyber-crooks target the most popular tools to affect as many users as possible. It is very likely that we will see more attacks like this in the future.”

Azero.B is a virus designed to infect executable files by inserting malicious code at the beginning of their code. Also, it replaces the computer wallpaper with an image with the following text: “”Hello Administrator! If you have seen me you are same as a Fool guy” .

See an image of this wallpaper here:
http://www.flickr.com/photos/panda_security/3101557477/

Also this week PandaLabs has discovered a fake email message that pretends to be a special Christmas promotion from McDonald’s but really is a bait to spread the P2PShared.U worm.

The message subject is “Mcdonalds wishes you Merry Christmas!” and the
text body reads as follows:

“McDonald’s is proud to present our latest discount menu. Simply print
the coupon from this Email and head to your local McDonald’s for FREE
giveaways and AWESOME savings.”

Spyware News: RevenueWire Announces It Will Now Be Offering PC Tools Software Products On Its Network

I have always said PC Tools software is good. I personally use it and have done for a good while now. It does use a little more juice than other softwares but is well worth it.

Read on...

RevenueWire, the leaders in online digital product marketing, recently announced that software giant PC Tools and its popular downloadable products, such as Spyware Doctor and Registry Mechanic, are now available through its industry-leading affiliate network platform.

A comprehensive network for both affiliates and merchants, RevenueWire's expertise and unique features are ideally positioned for the successful marketing and sale of digital products such as those offered by PC Tools and other major software manufacturers. Boasting top-selling products from leading merchants in the online sphere, RevenueWire is delighted to include PC Tools' software as a major new offering to its affiliates. "PC Tools is an industry leader and its confidence in RevenueWire solidifies our position in the marketplace," remarked RevenueWire CEO, Havind Sehmi. "Partnering with PC Tools will allow us to showcase our capabilities and will prove advantageous and beneficial to both companies."

In addition to the award winning Registry Mechanic and Spyware Doctor software applications, other leading PC Tools software that will be available on the RevenueWire network include PC Tools' Spyware Doctor with AntiVirus, PC Tools' Internet Security, and Privacy Guardian. Troy Vertigan, Vice-President of Global Reseller Business for PC Tools, anticipates that the new partnership with RevenueWire will be a benefit to their customers, stating that "PC Tools is committed to ensuring that our customers have access to the software they need through the most reliable channels. RevenueWire fits the bill."

About RevenueWire
Founded in 2007, RevenueWire entered the growing affiliate-fuelled e-commerce arena as an exciting new platform for both digital product merchants and affiliate marketers. Through our unique and trusted environment, RevenueWire offers access to an incomparable match of affiliate-driven volume and fast-growing software and digital information products.

About PC Tools
PC Tools is a global software leader with a cache of security and utility products, including multi award-winning Software. PC Tools is an industry leader in real-time anti-spyware. The PC Tools Malware Research Centre monitors trends and emerging spyware issues and provides security solutions for the consumer and enterprise marketplace. The company is headquartered in Sydney, with offices in San Francisco, London, Shannon (Ireland), Melbourne, Kiev, and Boulder. PC Tools has a global network of distributors, resellers, and retailers.

You can see PC Tool's Spyware Doctor by clicking on the image below this article.

Spyware News: Microsoft Spyware

The New Spyware Removers from Microsoft

The spyware is a type of software that changes a computer performance or normal operation. In some cases, it partially controlled by someone who is not authorized user of that system. Usually a spyware is installed in your computer without you knowing about it. Sometimes it is part of software that is being downloaded in the internet and when you install it there is a spyware included in it.

Many internet users do not have knowledge in spyware thats why when there are instances that spyware tried to invade users computer it can easily pass on. Once infected the owner or author of the spyware will be able to track your online activity and send your information to their side.

Moreover, the threat that the spyware poses can weaken your computers resources. It causes instability, slow performance, hang programs, crash the system and eventually destroy your computer. Since we are all computer dependent or uses computer spyware might be able bring to productivity killer for your business.

Another threat of spyware is that it can monitor all your action in your computer like visiting websites, typing your account and password information and then send it back to a third party. The worst case is that the owner of spyware will use your account without your permission.

With the growing threats and impact that can have your system of spyware, it is now important that you have knowledge on this and start to protect your computer with this spyware. Look for the best spyware remover programs that can be use in conjunction with other anti-virus to completely protect your computer.

Now to be able to protect your PC, Microsoft has developed a spyware remover tool that can be used to detect and remove spyware to your PC using a windows operating system.

The Microsoft beta spyware tool is free to download if you are using genuine software of Microsoft XP operating system. Microsoft had implemented a validation test to check for illegal copies of Windows XP. So to be able to get a copy of Microsoft beta spyware tool for free, get first genuine Windows XP operating system.

Once you have downloaded and installed Microsoft spyware beta version on your computer, it immediately protect your PC against spyware invaders. The software is comprised of scanner that will detect, remove and fix files infected with spyware.

Scanning your system will just take for about 15-20 minutes depending on the size of your hard drive. After completing the scan it will show you the list of detected spyware.

Microsoft had also released the Beta 2 version of windows defender a Microsoft spyware remover tool. It easily and quickly finds spyware and other unwanted programs and eventually removes it. And if you accidentally uninstalled important program, you can easily restore it using this version. Beta 2 version runs in background so it would not distract you while youre working. And it has an automatic updates you can download to prevent your computer from new threats.

Microsoft spyware remover tool also restores the default settings of your Internet Explorer that may have been altered by spyware infections. If you do not have this spyware remover, it would be a problem to you to return the normal features of your Internet Explorer after spyware has infected it.

Spyware News: Online frauds: DANGEROUS CONVENIENCES

If doing anything online you need to watch out for the fraudsters. Always do your research before doing any kind of purchase. It could be the best research you ever did.

Booking tickets, trading in shares or even paying bills online? Watch out for fraudsters lurking on the World Wide Web

What is it?

A common form of phishing (pronounced “fishing”) is the email you would have received from a website that mimics, as precisely as possible, a genuine one belonging to a reputed establishment such as a bank. The difference could be very subtle—www.icic.com (the missing letter ‘i’ at the end) or www.paypa1.com (the numeral ‘1’ instead of the letter ‘l’).

What you need to be extremely careful about is that the sender will invariably ask you to verify your online password, credit card number, personal identification number, date of birth or other personal information to dupe you.

The danger

If you comply with the request, the information that you pass on could be used in some other part of the world to transact in your name.

Phishing attacks could also infect your system with malicious software such as a remote-access Trojan (RAT), spyware that records and transmits every transaction you execute on your computer to the cybercriminal.

There are other variants of phishing that essentially play on a range of emotion such as generosity, greed, fear and even lust to trap an unsuspecting user

Protection

As a thumb rule, never provide financial or personal information in response to unsolicited messages, says Bala Girisaballa, vice-president and head of marketing and product management at iViZ Techno Solutions, an information security company with its headquarters in Kolkata.

Keep in mind, he says, that your bank will never ask you for any such details. Girisaballa also offers the following tips:

1. Do not open attachments received from an unverified source.

2. Report suspicious emails as spam. Service providers such as Hotmail and Gmail offer a facility to report spam and phishing attacks.

3. If it has come to your company email id, inform your IT department.

4. Protect your computer with open-source anti-virus software such as Clam or free anti-virus software such as AVG or anti-spam software from organizations such as McAfee and Symantec.

Captain Raghu Raman, CEO, Mahindra Special Services Group, a firm that specializes in corporate security management, also advises net users to type in the desired URLs instead of clicking links, and cautions against transacting online at cybercafés.

But what about those who’ve been hit? Says Girisaballa: “You don’t have many redress options. However, if a bank’s credit card is involved, inform them of the transaction immediately. Often, credit card transactions can be waived and the card can also be blocked. Having said that, the best option is to ensure you are transacting only on legitimate websites.”