Spyware News: Apple’s AV non-announcement

I was traveling the eastern seaboard all of last week, visiting family, friends, and old work colleagues in Philadelphia, New York, and Boston, so I didn’t have much opportunity to provide feedback to what had become the most heavily discussed blog post I have yet generated.

Two weeks ago, people got all hot and bothered because Apple appeared to have posted and retracted a recommendation that people run anti-virus software on their Mac. Several bloggers felt it necessary to either bash Apple, or praise their amazing architecture, or rip into the market share argument. I felt it necessary to weigh in with my support of the market share argument, based upon my game theory work in the area. I received several comments that I wanted to directly address.

Timiteh believes that people write malware for Windows because they hate Microsoft and love other platforms. In general, modern malware writers write attacks purely to make money. They will write attacks for Windows systems before they will do so for Macs because there are far more Windows systems and therefore a greater return on investment of time. It has nothing to do with emotions.

Many people, including Akulkis, believe that the privilege separation between root and user accounts on Unix systems is a large factor in preventing malware on Macs. Privilege separation, as it is implemented today, can easily be defeated using a little social engineering. If a malware writer were to target a Mac, they could claim that a video on a website cannot be viewed unless the user applies their update to Adobe Flash that also requires the administrator password for the upgrade to occur. This is already a standard technique on the Windows side of the world.

Alaniane writes that Unix systems have had malware, like simple fork bombs, for a long time, and that the claim that Macs don’t have malware is disingenuous. He is correct in that there have been plenty of proof of concept attacks created for the Mac. It is just so unbelievably rare that from a statistical standpoint it does not exist in the wild.

Spyware News: McAfee SiteAdvisor Offers Good Advice

McAfee's SiteAdvisor (available in Firefox and Internet Explorer versions) has always alerted you when Web search results list potentially risky sites. The latest version, with a new feature called Secure Search, is designed to make searching the Web even safer. But to do that, it places some restrictions on your surfing-and those restrictions may be too severe for some users.

The update SiteAdvisor plug-in acts much like the older versions did: It puts colored icons next to your search results so you know the status of the site before you click on the link. Sites that are considered safe get a small green icon, sites that may be unsafe are labeled with a yellow icon to indicate caution, and sites known to be risky are marked with a red label. McAfee tests the sites for spyware, drive-by downloads, spam, scams, phishing, and other risks to determine their security rating.

SiteAdvisor's new feature adds a Secure Search box to your browser toolbar. Its settings allow you to customize the results that you see from the searches you conduct with it. You can choose to block any red sites from your search results, and can have SiteAdvisor show alerts only for potentially harmful sites. The Secure Search box only works with Yahoo's search engine; it also can be installed as a part of a customizable McAfee/Yahoo toolbar. (SiteAdvisor's ties with Yahoo don't end there: When you install the app, it asks you if you want to change your browser's default search provider to Yahoo--and the default selection is yes.)

You can still use SiteAdvisor when you search with other search engines--like Google--but you lose the ability to customize your search results. Still, omitting some of your search results isn't for everyone, anyway. While it may be a good idea to block risky sites from your children or some novice computer users, other Web surfers will want to see all their search results, and have the option of deciding for themselves which sites they'd like to visit. (You can set a list of approved sites that will always appear in search results, even if they're labeled risky. But you may not know these sites exist unless you can find them in your search results.)

In addition to the green, yellow, and red icons that appear next to your search results, McAfee now labels some sites as "McAfee SECURE." This means they have been more thoroughly tested and are branded as safe shopping destinations. The updated version of SiteAdvisor lets you see whether the site you're visiting is "McAfee SECURE," too-not just when it appears in your search results. A small icon in your browser toolbar changes its text from "McAfee SiteAdvisor" to "McAfee SECURE" when a site meets that criteria.

If you choose to stick with Google for searching, SiteAdvisor's new Secure Search feature will have little benefit for you. But you will still have access to SiteAdvisor's excellent site ratings-and you'll have the ability to decide which sites you'd like to visit, risky or not. Whether or not you choose to use the Secure Search bar, SiteAdvisor is worth installing.

Spyware News: PC Tools secure Westpac customers

Australian financial institution, Westpac, is providing its online banking customers with PC Tools’ Internet Security 2009.

The program is designed to help keep banking customers secure online and provides PC Tools’ security package with browser protection.

Rafal Potega, vice president of sales APAC of PC Tools Business Unit said it was delighted to be working with Westpac again in 2009 to ensure that online banking customers have superior protection when banking online.

“Internet security software is essential to the safety and security of your computer as well as your personal and financial information and PC Tools’ products are reputed for their powerful protection and innovative techniques,” he said.

Our partnership with Westpac is testament to that.”

Potega said under the agreement Westpac will offer its online banking customers 12 months access to Internet Security 2009, a security suite featuring award-winning anti-spyware, anti-virus, firewall and spam protection.

PC Tools Internet Security is built on Spyware Doctor, also featuring exclusive behaviour-based protection which ensures constant protection from the latest malware outbreaks.

“Westpac customers will also have access to PC Tools’ free customer support for the life of their subscription to the software,” he said.

Spyware News: Wire transfer biz dogged by malware, security threats

New information suggests that a high number of wire-transfer businesses may be infected with security-compromising viruses, despite the sensitive nature of the transactions they handle. Wire transfers are a common way for immigrants working in the United States to send money home to relatives in need.

These payments are oftentimes an extremely important source of revenue for both the individuals in question and the nations in which they live and, in some nations, account for a substantial percentage of cash inflows. In 2007, Mexican immigrants sent some $24 billion in remittances back to their home country. That's just three percent of Mexico's GDP, but it represents the country's second-largest source of foreign currency behind oil revenues. It's unclear how much money flows from developed nations into the third world from these unofficial channels, but 2006 estimates put the total somewhere between $250 billion-400 billion.

According to security firm Panda Security, however, the wire shops many of these transactions flow through are handling the cash flow on systems that are infected with the nastiest kinds of spyware. Panda's results indicate that out of the 300 businesses it evaluated, 60 percent of the 1,500 computers on-site were infested with some sort of spyware. Interestingly, Panda notes that just 30 percent of these systems were running an outdated antivirus solution, which implies that a substantial (though unknown) proportion of those 1,500 systems were both infected and running an up-to-date AV product. This is either a depressing take on the efficacy of current antimalware software, or a not-so-subtle jab at Panda's various competitors—take your pick.

The potential for data theft reportedly went far beyond the theoretical; the company found that certain systems (mainly those with keyloggers installed) had illicitly recorded Social Security numbers and other financial information on certain wire transfer customers. The security problems were often exacerbated in stores where the computers were used for multiple purposes. Shops that only handled wire transfers or check cashing were less likely to have exposed customer data, since these transactions are primarily cash-based, but pawn shops or those companies handling a wire business on the side often processed all customer data in one location.

"The danger with these computers is that, unsafe as they are, they are very frequently used to conduct bank transactions. The risk is enormous as we are talking about very sensitive information being stored on infected, vulnerable computers," says Dominic Hoskins, Country Manager, Panda Security UK. "This combination of lack of maintenance, low security consciousness and inappropriate end user behaviour results in highly vulnerable systems that are very easy for cyber-criminals to infiltrate."

Hoskins is right, insofar as these systems are vulnerable, and vulnerabilities are bad, but there's a practical rebuttal to the idea that these vulnerabilities represent a major threat. The shops in question are small, local businesses, heavily concentrated in certain urban areas. The financial value of any one store's customer lists and data is quite low by black hat standards, and while infiltrating all of the stores in an area could potentially be quite profitable, it represents quite a lot of work for a very low reward. Keep in mind that Panda Security focused on small wire transfer companies here, not large organizations—Western Union and its competitors are, as far as we know, a safe bet.

Spyware News: Google sponsored links caught punting malware

Researchers from Websense have caught Google carrying ads punting rogue software that secretly installs malware on the PCs of its users.

Recent Google searches for Winrar turned up sponsored links that offer a "spyware free" copy of the widely used data-compression application. Google users unfortunate enough to download and install that software are soon exposed to a program that makes changes to their PC's hosts file. From then on, every time the users try to visit Google, Yahoo, and other popular sites, they are instead sent to an impostor site under the control of the attackers.

The operation is another testament to the resourcefulness of those running rogue software scams. Rather than relying on zero-day vulnerabilities or hard-to-execute website hijackings, they often find it easier to snare their victims through legitimate ads placed on Google or elsewhere.

"This raises some questions," Websense researcher Elad Sharf writes. "Is this problem Google's fault for not checking whether advertised links actually serve malware? Is it the miseducated user's fault for getting infected?"

Probably a little of both, but are we the only ones who find it ironic that Google's own anti-malware initiative imposes draconian punishments on smaller websites when they're caught doing the same thing? Websense, which first witnessed the scam last week, said the malicious Google links were still available when it posted this report on Sunday.

A Google spokesman said the company is in the process of removing the offending sites from its ad network. "Google is committed to ensuring the safety and security of our users and our advertisers," he said.

As a recent complaint filed by Federal Trade Commission shows, purveyors of rogue anti-virus and other software spend millions of dollars per year advertising their wares on legitimate sites - and go to great lengths to conceal their behavior. No doubt, Google isn't the only advertiser to be tricked into running malevolent ads, but as the do-no-evil company that's steam-rolling its competition in the ad industry, it's hard to believe these kind of links are still being sponsored.

Spyware News: Applications We Love

VirusTotal
Virus scanning service
Developer: Hispasec Sistemas
OS: Web-based
Price: Free
Site: http://www.virustotal.com

Though anti-virus vendors argue over which offers the best virus and malware protection, no anti-virus scanner is perfect—and it only takes one undetected virus to ruin your week. Less harmful but more prevalent are files your scanner flags as virus-ridden, but come from a trusted source, such as a download site you frequent or a friend. Deciding which of the two is more trustworthy can be a hard decision. If only you could get a second opinion.

Generally it's inadvisable to run more than one anti-virus program on your own system at a time, since multiple scanners may interfere with each other's real-time and scheduled scans. That's where VirusTotal comes in. The online service is an on-demand scanner that can take a file you upload and submit it to several anti-virus scanners at once. VirusTotal's arsenal of scanners includes popular packages such as Symantec's Norton Antivirus, Kapersky Labs' AVP, AVG, and a host of others.

The results are broken down by scanner, so you can find out exactly which scanners gave your file a clean bill of health and which ones found something suspicious. You can then Google the virus names VirusTotal returns to find more information on what you may be dealing with. The service isn't a substitute for a desktop virus scanner, as it can only scan individual uploaded files, but it's a great way to determine just how much of a threat a received file poses to your system.

Inquisitor (tested v1.0.2 Firefox, v3.2 v58 Safari Mac)
Search auto-complete and suggestion plugin
Developer: David Watanabe / Yahoo
OS: Windows/Mac, Firefox/Internet Explorer (IE7 and above)/Safari (Mac only)
Price: Free
Site: http://www.inquisitorx.com

Search engines have subtly grown more intelligent over the years, and though you may not notice at first glance, many of the features available from search engines like Google and Yahoo are relatively recent innovations. It wasn't so long ago that features like auto-completion of search terms, or suggested phrases that refine your search, became available to the masses.

The in-browser search bar is another such innovation. But in many ways, those search bars act very much like the search engines of old—if you're lucky, you're using a browser that offers search auto-completion, but even this basic feature may not be available. Inquisitor puts your search engine bar on steroids by adding several neat features you've come to expect from search engines.

The most obvious addition is the drop-down menu that appears in your search bar after you've installed Inquisitor. As you type in a search phrase, Inquisitor finds and displays summaries of the first few search results from either Google or Yahoo. It also shows you suggested phrases based on what you've already typed, and even offers the option to search other sites like Flickr or Amazon.com simply by pressing the displayed hotkey. Inquisitor even takes advantage of your browsing history, marking sites that you've visited in the past.

The plugin isn't a complete replacement for the full search results you get from going to Google or Yahoo normally—the find-as-you-type summaries may be a little too short for your liking. But for the vast majority of searches, Inquisitor can help you find what you're looking for faster and with less effort.

AutoLyrix (tested v0.5.1 Windows)
Lyrics auto-downloader and viewer
Developer: Alex A. dos Santos
OS: Windows/Mac/Linux
Price: Free
Site: http://autolyrix.com/

The digital realm can't recreate the ambience of a movie theatre (for better or worse), nor can it give you the physical sensation of turning the pages of a good novel. But for many people, digital music files have all but supplanted CDs and vinyl. You can download high-quality audio files that sound great to all but the most discerning listeners, and high-resolution cover art is in some ways a step up from tiny CD booklets. But though text is the easiest thing of all to distribute on the Internet, it's proper lyrics that end up being the most difficult to find.

To make finding and reading lyrics a friendlier experience, you need a program like AutoLyrix. As the name suggests, it automatically searches for lyrics, album art and karaoke-style synchronized lyrics, and displays them beside the media player of your choice. Able to automatically detect the presence of most popular music players, you don't even need to invoke AutoLyrix to find lyrics; it will automatically start searching as soon as you play a song.

As with anything that relies mostly on Google searches for data, AutoLyrix's ability to find the proper lyrics is somewhat limited, though better than many other lyrics-finding programs. Generally speaking, the more popular an artist is, the more likely you'll find lyrics. AutoLyrix does offer several options for refining your search, and you can submit lyrics to an online library for others to find. These fallback options, in addition to its already decent hit rate, makes AutoLyrix one of the most accurate lyric hunters around.

Spyware News: Symantec security update

A flawed driver in Symantec's anti-virus products can be exploited to crash a PC. According to Symantec, the affected SPBBCDRV.SYS driver stumbles when flawed arguments are submitted to the NtCreateMutant and NtOpenEvent functions. While the flaw can only be exploited by users who are logged into a system, even users with restricted access rights are able to exercise the bug. In principle, the flaw could also be exploited to launch a DoS attack via injected malware.

According to Symantec, the problem mainly affects old products like Norton 360 1.x, Norton AntiSpam 2004 and 2005, Norton AntiVirus 2004 to 2008, Norton Internet Security 2004 to 2008, Norton Personal Firewall 2004, 2005, 2006, Norton System Works 2004, 2005, 2006, Symantec AntiVirus Corporate Edition 10.0.x and 10.1.x as well as Symantec Client Security 3.0.x. The vendor has released updates and is distributing them to end users through it's LiveUpdate service. Enterprise customers will need to download the updates manually, so they can distribute and install them as appropriate.

According to the advisory on SecurityFocus, the vulnerability appears to have been known since April 2007. David Matousek initially discovered the flaw and reported it in Norton Personal Firewall and Norton Internet Security. Why it took Symantec so long to fix the issue in its other products remains unclear.

Spyware News: Lavasoft releases Anti-Virus Helix

Lavasoft unveiled Anti-Virus Helix, a stand-alone security tool designed to address the rapidly changing malware landscape. This new product delivers comprehensive protection and high performance with low impact on system resources.

Lavasoft Anti-Virus Helix features advanced heuristics technology to detect and guard against unknown or rapidly changing attackers. The heuristics looks at the characteristics and the code sequences of the file to determine whether or not the file is malicious, giving computer users protection against both known threats, as well as against emerging and unknown threats.

Lavasoft Anti-Virus Helix also includes comprehensive protection against e-mail borne threats – one of the most common methods of infection – with an integrated e-mail scanner supporting both POP3 and SMTP. It is available with 1, 3, or 5 user license packs, and includes free technical support and software updates throughout the license period. Prices begin at $23.95, with aggressive discounts for multi-user licenses.

Spyware News: Zero day exploit for Internet Explorer is spreading

According to observations made by the security firms, the zero day exploit for Internet Explorer is spreading rapidly across the net. It targets a particularly dangerous hole in all versions of the Microsoft browser. There is no patch: a Windows PC can become infected with malicious software through the simple act of opening a web page. Unlike most other attacks, this exploit does not require careless users to click on something.

More and more harmless servers are currently being manipulated via SQL injection to deliver the zero day exploit to requesting computers. It is, therefore, possible to get infected by visiting a trustworthy site.

Anti-virus software only offers limited protection against web pages that contain this kind of exploit for infecting computers with malicious software. For one thing, not all anti-virus solutions monitor internet traffic; many are limited to inspecting files. Once a web page has been saved in the cache, however, it is usually already too late, and the malicious code has already been injected and launched. In addition, not all anti-virus vendors have managed to create suitable signatures. A live exploit that reached heise Security on Tuesday still remained undetected by solutions like CA, Kaspersky, Trend Micro, NOD32, Panda and F-Secure on Saturday.

Microsoft has released an extensive list of workarounds that explain how to configure Internet Explorer in a way that renders the exploit ineffective. For example, they suggest disabling scripting, which is not very practical as it may cause problems on many web pages that use scripting to operate.

Until Microsoft provides a patch, users are advised to switch to an alternative browser that doesn't access the vulnerable Microsoft libraries such as Firefox, Opera and Safari.