Wiz's Computer and Website Security Blog

Spoofed 'Bill Me Later' email has links to 20 Blackhole exploit websites

2012-05-17T02:23:27Z

May 16, 2012

This article is about cybercriminals taking email exploit attacks to a new level. Tonight, I processed an email scam (to SpamCop) that claimed to come from a service known as 'Bill Me Later' - detailing an online payment I was supposed to have made over the phone. Except, my name is not Dr. Mary Olsen, MD!

The message, which was carbon copied (CC) to dozens of other recipients (whose email addresses were viewable in plain text), started off with the following totally fake text:

"Thank you for making a payment over the phone! We've received your
Bill Me Later® payment of $60.12 and have
applied it to your account."

The scam goes on to list various account numbers and (fake) payment details. It was also loaded with images and clickable links (20) to view many details, including:

Manage your account, Make a payment, View statements, Account Summary, Home, Make a Payment, About Bill Me Later, Offer, Directory, View Statements, Merchant Sign Up, Store, View Account, Summary, FAQs, Register Account
and 4 image links.

What is astoundingly different about this scam is not just the unusually high number of links leading to an exploit kit, but the fact that they all led to different domains. Normally, I see one or two domains used in hostile link scams. Twenty different compromised domain links is a new record for me.

Each one of these 20 links (see compromised website list) leads to a different website, to a sub-directory (folder) containing 8 mixed case alphanumeric characters, then, /index.html. Here is one sample URL (deactivated for your safety): ~~h**p://webprof.ro~~/Tv2YU8u6/index.html

]]> The 20 domains used in this attack were all compromised by means of out-dated, or unsecured plug-ins to web software they were running, like WordPress, Joomla, the TimThumb image viewer/uploader, or some other exploitable software the Webmasters installed but failed to update.

The payload is the BlackHole Exploit Kit, which in this scam run is hosted on a compromised server belonging to Directspace Networks (AS46816), in the USA. I have notified them about the IP and file details where the exploit kit is housed. The exploit is delivered by a Russian designed Nginx web server.

The BlackHole Exploit Kit (Wikipedia article) originates and is updated in Russia. It targets vulnerable versions of Java, Flash and Adobe Reader, with Java exploits coming first. If you click on a link that redirects your browser to this exploit kit, and you have JavaScript enabled, and you have an out-dated, or unpatched version of the Java Virtual Machine installed on your computer, it will probably be taken over by the malware delivered by the BlackHole Kit. This usually means that, 1: your computer joins a botnet; 2: it becomes infected with a dangerous Trojan* that does whatever the criminals delivering it want it to do, and 3: a rootkit is installed to protect it against your trying to remove it.

Hopefully, you read this before you receive the fake Bill Me Later email message. Hovering (without clicking) over the links and clickable images will reveal the actual URLs in a status bar. Every one of the links in all of the current BlackHole scams lead to various unremarkable domain names (but not related to the domain mentioned in the email subject or body text), some with country code domain extensions, all having a forward slash, then a folder name with 8 mixed case alphanumeric characters, followed by a forward slash and a file named index.html.

If you receive this scam, delete it. Do not click on any links after hovering over them.

If you have clicked on any links in one of these scams, you need to run a scan with legitimate anti-malware programs, which are up to date. I use and recommend Trend Micro Internet Security as my anti virus program and also use a registered version of Malwarebytes Anti-Malware. To add another layer of protection, I operate from a "Standard User" account, not an Administrator account. While I could conceivably be tricked into installing a Trojan, it is much harder for a silent, drive-by exploit to hack my PC without my direct interaction.

^* The Trojan delivered by the BlackHole Exploit Kit varies, from the ZeuS bank account stealer, to other sensitive information harvesters, to fake security programs, to ransomware that cripples your PC, or hides important files until you pay a ransom for an unlock code.

My spam analysis for May 6 - 13, 2012

2012-05-13T17:23:52Z

After taking a month off from publishing my spam statistics, I am resuming it today. I have been watching spam trends during my quiet month and found that the volume of spam is increasing. This, after a year of declining spam volumes.

I have added up all my incoming email and counted those classified as spam, and found that in the last week, my percentage of spam has been almost 40%. During the same period last year, it measured just 30%. This is a 10% increase.

I measure the amounts and types of spam with MailWasher Pro (2012), which compiles very good statistics for its users. If you don't already know about this program, it is a spam filter and email classifier, which sits between your email servers and your email client. It receives either POP3 or IMAP email from your mail servers and applies any filter or blacklist rules you define. I write and publish spam filters for MailWasher Pro and most of them are so reliable that I set them to automatically delete known spam. In case the filters are in error, I am able to restore the wrongly deleted messages from the MailWasher Recycle Bin.

While the volume and percentage of spam has increased over the last 7 days, an interesting development occurred: there was no spam with either malware links or attachments! In the previous weeks there were many such hostile messages, spoofing all manner of known websites and banks. Make no mistake, the malware scams will resume soon. Stay alert, especially if you have Java, Flash, or Adobe Reader installed on your computers or smart phones/tablets.

I always advise my readers to hover over links before clicking on them. Doing this causes the actual URL (web address) to be displayed on the bottom of your browser (Web-mail) or email client (desktop email program). This gives the savvy user a chance to see if the link claiming to lead to Intuit actually goes to a website that has nothing to do with intuit.com, or facebook.com, paypal.com, linkedin.com, etc, etc.

On the other hand, clicking (without hovering first to check it out) on a poisoned link takes you to a compromised website, which uses JavaScript and iframes to redirect you to a Russian malware server, where your computer is attacked for any vulnerable software. If you have any exploitable, unpatched software installed, your computer may be taken over by criminals and drafted into a spam and attack botnet, and have malware installed which steals money from your financial accounts, or extorts money from you to fix non-existent problems.

Let's move on to the spam analysis for the week...

]]> Statistics Overview

Total incoming email: 531
Classified as spam: 210
Percentage classified as spam: ~40%; 30% this time last year
Number of messages classified as spam by my custom filters: 201
Number auto-deleted by my custom blacklist: 7
Number classified as spam by the Bayesian Learning filter: 2

The order of spam categories, according to the highest percentages, is as follows:

Male Enhancement: 55
Fake Pharmacies: 31
Counterfeit Cialis: 18
Counterfeit Watches: 18
Money Mule & work at home scams: 17
Fake Diplomas: 16
Weight Loss scams: 10
Blacklisted: 7
Russian and Ukrainian spam domain links: 6
Fake online Casinos: 5
Russian Dating scams: 2
Nigerian 419 & Lottery scams: 6
Miscellaneous spam: 19

Updates and/or additions to my custom spam filters:

Known Spam Subjects #4,
Male Enhancement [S] (twice),
Money Mule Scam #2 (twice).
Updated and renamed ".RU .UA" Domain Link to "Russian" Domain Link

Additions to my MailWasher Pro Blacklist:

+@chinesegamer.net

There was 1 false positive last week, which I corrected in my published filters. All other filters behaved as intended. Note, that I now publish three types of spam filters for MailWasher Pro. One type is for the latest 2012 series, in xml format, and two are for the previous series 6.x. One of those filters is set for manual deletions and the other for automatic deletions. You can read all about MailWasher Pro and the filters I write for it, on my MailWasher Pro Custom Filters page.

If you are having trouble caused by excess volumes of spam email, and are not using an effective filter, why not try out MailWasher Pro? It sure works for me!

Really lame and blatant Nigerian 419 scam

2012-05-07T15:59:54Z

Today, I received an email containing a Nigerian 419 scam that while laughable for its horrible spelling and punctuation, makes an upfront demand for payment. Normally, these scams hide the fact that victims are asked to pay in advance before the (fake) hundreds of thousands of dollars will be released to the beneficiary (victim).

Let's take a look at this scam from a curiosity point of view.

First of all, the sender has covered his tracks by using compromised email relaying PCs in a botnet. Two computers were used, both belonging to US residents. One belongs to an organization named "Secured Private Network" - which is obviously not so well secured! The second relay occurred via an open relay in a mail server belonging to CrystalTech Web Hosting.

The return path was interesting. It used a (possibly spoofed) account on a Ukrainian domain: terence_m@e-mail.ua. However, the From address shows test@milkom.net, which is obviously spoofed.

The message body claims to be from the "United states ambassador to nigeria
Ambassador terence mccauley" - yet it is filled with incorrect grammer, bad spelling and letter cases. I have to believe that any school kid in the USA knows that titles, countries and personal names always have the first letter capitalized.

The scammer claims to have plans to be: "coming to your country for an official meeting and i will be bringing your funds of ($500,000:00) FIVE HUNDRED THOUSAND UNITED STATES DOLLARS {bank draft} along with me." He goes on to demand an up front payment of $250 processing fee! "the cost of registering it is $250 USD the fee must be paid in the next 48 hours via western union."

Finally, to add insult to injury, the scam contains this outrageous statement:

Please, if you know you will not or can not send the requested $250 USD, please, dont bother replying this mail.

You can read the full text of this 419 scam on my SpamCop report

It is the up front, advance fee demands that gave these scams the name 419 scam. You see, section 419 of the Nigerian Penal Code makes it a serious offense to commit financial fraud involving advance fees. Yet, Nigerians go to Internet Cafes every day and mail out thousands of such scams to people in all parts of the World, but especially English speaking people in North America, the United Kingdom and the lands down under.

Never reply to a Nigerian scammer and never give them your phone number! There is no 500 Gs waiting for you, and you are not the beneficiary of anybody who died and left millions in a Nigerian bank. They will bleed you out of all your money with new fees and bribes and never send you the promised funds (because they do not exist). This has happened over and over to greedy people who fall for such scams. W.C. Fields once said "Never wisen up a chump or give a sucker an even break." That is exactly how Nigerian 419 scammers behave. They target the elderly as well as business owners and town clerks.

How to prevent unauthorized people or vehicles from intercepting your wireless data

2012-05-06T15:39:30Z

Lately, much ado has been made about the Google Street View vehicles doing more than photographing houses and businesses. Apparently, the Google vans have also been intercepting and storing wireless data from *unsecured* wireless routers, as they drive along the streets of our great nation.

Does this worry you? It should if you are one of the people operating an unsecured wireless router. Not because of what Google was doing with this openly transmitted data, but because if a Google van can read your unencrypted data, so can a neighbor's hacker kid, or somebody with bad intentions driving down your street, looking for wireless connections to piggyback on, or data to steal (a.k.a: War-driving).

Here is what the FCC determined about Google Street View vans intercepting wireless data as they dove down streets:

The FCC has been investigating, and recently fined Google $25,000 [details] for the incident. In its report, the FCC concludes, "For more than two years, Google's Street View cars collected names, addresses, telephone numbers, URLs, passwords, e-mail, text messages, medical records, video and audio files, and other information from Internet users in the United States."

In its findings, the FCC has concluded that Google's wireless data collection was not illegal because the information the company gleaned was not encrypted. The $25,000 fine against Google was actually for interfering with the investigation by stonewalling at searching employee records to find out why this happened and what was done with the purloined data. It turned out to be an experiment by what Google referred to as a rogue employee.

So, how can you make sure that something like this doesn't happen to your wireless connections? Secure your wireless routers, or hotspots! Here's how...

]]> While I cannot give you instructions for your particular wireless router or hotspot, you can get them from the installation instructions that shipped with the device, or by going to the manufacturer's website and downloading a manual. However, I can tell you a few things to do to secure that device against casual drive-by, or next door snoopers.

First and foremost, no matter what brand or type of wireless router, modem/router, access point, or hotspot you employ, change the default administrator password to something not easily guessed, or found in a common dictionary. This won't stop unencrypted data from being intercepted but will definitely make it much harder for a hacker, or malicious script to take over control of critical router/hotspot functions. If your router's password can be guessed, the DNS [1] settings can be changed without your knowledge, to point to rogue DNS servers, which will re-route every Internet based request to hostile territory, for nefarious purposes [2].

The next item you should take care of is to apply the best level of wireless "encryption" [3] that your wireless device is capable of using. This is what will stop almost all War-drivers and nearby snoops from intercepting anything they can make sense of. Right now, WPA2 [4]is the strongest security available in home routers, using a 256 bit key code. Don't even think for one minute that applying the ancient WEP [5] security protocol is going to keep even script kiddies out of your router!

Wireless hackers would have to run a super heavy duty encryption cracking program, over a long period of time, to decipher 256 bit security keys. If somebody is willing to go to that much trouble and resides next door to, or within signal acquisition distance of your location, you'll need to apply the strongest encryption possible, plus some extra measures to lock out unknown devices.

Some of these additional measures include allowing only specified MAC addresses to connect (although these can be spoofed by hackers), or only as many IP addresses to be assigned as required by the wireless devices in your location [6]. For instance, if you have a wireless laptop and wireless hand-held smart device, with your desktop PC hard-wired with a network cable, you only need to assign three wireless IP addresses. There will be a section in the "web" configuration screens of your router that allow you to set how many IP addresses can be assigned to any devices requesting a connection. If you can limit the connections to only what you need for your own internal use, a snooper will not be able to obtain the IP address required to join your network.

There is a new feature showing up on N protocol wireless routers called WIPS [7] which establishes an additional layer of security between a wireless router and the devices known to it. In particular, WIPS detects and takes action against rogue access points, or man-in-the-middle router attacks.This is not an end-all protocol and can be cracked by determined hackers with plenty of time on their hands and gear to do the dirty deed.

Once again, many of the attacks aimed at wireless routers (including breaking WIPS, WEP and WPA) can be thwarted by changing the default login password to the router to a strong code, not easily guessed, or found in a common dictionary.

You can learn more about wireless security development on this Wiki-pedia page. Remember, it takes a combination of techniques to keep determined crackers out of your wireless network. Make it as difficult as possible for unauthorized devices to connect to your network. This way, both your data, including logins and passwords, and your connection itself will remain under your control, as pertains to the wireless network. Protecting your individual devices from attacks from the Internet, via exploits, trickery and social engineering tactics is another matter, beyond the scope of this article.

Stay safe and practice safe Hex!

New social engineering tricks used in email malware scams

2012-04-23T21:04:52Z

It appears that no matter how many cyber criminals get busted, or botnet command and control servers are taken offline, there is always another scam waiting to take their place. So it is in the case of email scams leading to malware attack kits.

The words and phrases in the subjects and message bodies used by scammers over the last few years has been morphing. We still see some of the old topics being used; recycled is a better word. But, new subjects and message bodies are being developed by clever copy writers who are employed by malware distributors. I want to share some of the recent social engineering topics and hook lines that I have seen in spam/scam emails that are detected by MailWasher Pro and subsequently reported to SpamCop.

The most recent scam is one I don't recall ever seeing before. It seems to target business owners who might hire accounting firms to take care of their books and taxes. It is a very clever scam, leading to huge exploit kit, containing over 18,000 bytes of JavaScript codes. Included are over 2 dozen script tags, most of which probe your browser and computer for exploitable plug-ins, like Java, Flash, Adobe Reader and Internet Explorer's ActiveX. If the victim's browser has any of the vulnerable versions of these plug-ins installed, silent exploits take place, resulting in the PC becoming a zombie in a spam and attack botnet. They are also treated to a free installation of a bank account stealing Trojan and maybe even a free scan from a fake anti-virus scanner that demands money to remove the fake detections and the barrage of warnings it fires at you.

Here then are the subjects and message contents of some email scams I analyzed today.

]]> Scam #1:

Received: from [86.98.158.206] (helo=bba81994.alshamil.net.ae)
Date: Tue, 24 Apr 2012 05:31:55 +0400
From: "Adonia Fitzgerald"
Subject: Are you tired of severe taxes?

We can help you optimize your accounting so that your expenditures on taxes reduce by two times minimum. Our professional employees will attach best efforts so that no legal expert could find a fault. Furthermore, we undertake to submit your paperwork to the Tax Service. Due to our broad experience in this field and large turnover, we have our own contacts in this institution which makes it easier for us to submit statements and brings their review to naught. Please, find attached the list of our services and the price list.We will be glad to cooperate with you! our services.doc 726kb Best regards Adonia Fitzgerald Fingerprint: c3e1de1d-4b650000

I have deactivated the link above, for your safety. Trust me when I tell you that the link led to a compromised website, into which a folder named ZD7NERn1 was injected, along with a single file in that folder, named index.html. The contents of that index file consisted of two JavaScript "includes," both of which contained the same JavaScript code to redirect the victim's browser to another intermediate server, which passes the request to the actual malware server hosting the exploit kit.

Scam #2:

Received: from [189.31.234.75] (helo=brasiltelecom.net.br)
Date: Mon, 23 Apr 2012 11:50:59 -0300
From: "American Express"
Subject: Fraud Protection Alert

Fraud Protection Alert Fraud Protection Alert.Cardholder, For your security, we regularly monitor accounts for possible fraudulent activity. Please review the attempted charge below which occurred within minutes of the timestamp of this message.
Transaction Date: 04/23/12
Merchant: TIGERDIRECT
Amount: 5153.88 Currency: USD
Case Number: 13680
Please verify these attempted charges using our Secure Online Chat or please log in to www.americanexpress.com/case/ to dispute it.
If we've already spoken to you about this matter, please disregard this message. No further action is required.Thank you for your Cardmembership. Sincerely, American Express Account Security Fraud Prevention Network For your security:
...snip...

This scam leads to the same exploit kit as the previous one.

As an email recipient, you can protect your computer from being exploited by such attack kits by combining user smarts with computer security programs. Do not allow the weakest link to reside between the keyboard and chair! Smarten up Trainee! Learn how to spot fake links in email or website messages. The simplest way to do this is by hovering your pointer, without clicking, over any links in an email that has you concerned. All email clients (desktop email program, or browser based email reader/composer) have a means of showing or hiding what is known as a "Status Bar." Use you email client's View options to display a Status Bar. If you do email with your main web browser, it will either have a View option for a Status Bar, or will automatically create one when you hover over any link.

Once you figure out how to see the Status Bar, hovering over links will reveal the actual URL (usually a domain name or IP address) to which the coding points. If you see links such as thee above examples, while the text I highlighted in bold says something else (e.g. "our services.doc" or "www.americanexpress.com"), do not click on the link!

All email clients and browser based email systems will have some way of displaying the complete incoming "headers." The Headers reveal the actual sending domains. Note the headers in my second example. The Received from line shows that the message was sent from brasiltelecom.net.br (Brazil). It would make no sense for the US based American Express company to use a home telecom service in Brazil to send important announcements to their customers. They own their own servers and email systems, located in the good old US of A! That's where Internet Street Smarts comes into play. Learn to display and review your incoming email headers! Find your email display options and activate the one to show the complete headers.

In closing, I use and recommend MailWasher Pro to detect and delete spam and scams, before they are downloaded to my Windows Live Mail desktop email client. Some scams contain active scripting which could be triggered by opening a rigged email message in your reader. MailWasher protects you from this by displaying the contents in safe, plain text. I also write custom spam filters for use with MailWasher Pro. Feel free to use them with your paid copy of MailWasher Pro. I update the filters every week, and sometimes on a daily basis.

One final thought: You must keep a legitimate anti-malware program operating and updated on all of your computers! This includes Macs, which were recently targeted by the Java exploiting Flashback Trojan, which is still infecting over 600,000 Mac computers. I use and recommend Trend Micro security programs. They all come with the Trend Smart Protection Network, which blocks access to infected pages and malware servers.

End of support for Windows XP w/Service Pack 3 on April 8, 2014

2012-04-14T04:18:30Z

Beginning on April 10, 2012, Microsoft has posted a notice on various knowledge base articles for Windows XP and on their lifecycle fact sheet, that all support for Windows XP will terminate on April 8, 2014. Effective that day there will be no further updates, upgrades, or patches issued for any computer running Windows XP. Right now, one must have XP with Service Pack 3 in order to receive any patches from Windows Updates.

On the same date, all support and patches for Microsoft Office 2003 will also come to an end.

Windows XP has enjoyed a long life since its official release to retail date of October 25, 2001. It has been the most popular version of Windows since Windows 95 was released with parties and huge fanfare on August 24, 1995. XP has received three service pack upgrades since 2002, ending with SP 3, which was issued on April 21, 2008. Windows XP market share peaked at 76.1% in January 2007. But, with the introduction of Windows 7, there has been a steady decline in the number of XP users online. As of today, the market share for XP is only about 29%.

If you are reading this from an XP computer you need to begin planning to upgrade before all support for your aged operating system ends on April 8, 2014. Since there won't be anymore patches, you will be left unprotected by Microsoft against any vulnerabilities that may be discovered running in the wild after that date. History teaches us that as soon as support is dropped for one of the versions of Windows, cyber criminals ramp up their attacks to try to draft as many of the unpatched machines as possible into spam and DDoS attack botnets.

Another fact we have seen play out is that security software vendors begin to drop support for any version of Windows that has been end-of-lifed by Microsoft. So, people hanging onto XP after April 2014 will not only be left out in the cold by MS, but will soon see an end of support from anti-malware companies as well. Without virus and malware protection or Windows Updates, those computers will become cannon fodder for exploit kit writers.

I have already upgraded to Windows 7 and love it! My XP desktop computer is only turned on once a month, on Patch Tuesdays, to download any available Windows Updates. That machine is only here as a backup unit in case my main Win 7 computer hard drive crashes. It would only be used until I could restore a saved Acronis image of the operating system to the new hard drive. I save a complete image of the hard drive once a week, but backup my documents and libraries every night.

If you have programs that are only written for Windows XP, without newer versions that work under Windows 7, even in Compatibility Mode, you should consider buying a copy of Windows 7 Professional. It allows you to download a free, fully licensed copy of XP Pro, with SP 3, which you install into a virtual machine that runs inside Windows 7, as an application. You can run any Windows XP based program inside that Window, as though you had booted into XP. Of course, it takes away a gig of your RAM to run XP in the virtual machine, but, be happy if it runs at all.

Note: Your computer must have a CPU that supports running Virtual Technology (VT) in order to use the XP Mode in Windows 7 Professional. Learn more about the hardware requirements for running XP as a Virtual Machine in this article.

Apple releases third patch for Java exploits, plus Flashback removal tool

2012-04-13T15:34:28Z

I, among many other security bloggers, have recently posted articles regarding Java vulnerabilities and patches and how crimeware exploit kits target Java before any other commonly installed software. In fact, I published an article last night, April 12, 2012 about security patches that have been released so far this year, in which I mentioned that Apple had lagged way behind in patching the version of Java used on Mac computers.

Well, it may have taken Apple 2 months to issue "a" patch, but they enjoyed doing that so much that they have now released their third patch in 7 days! Yes Mac owners, you have three critical patches to download and apply, including the latest one issued late yesterday (April 12, 2012).

You see, Apple has a policy of discontinuing support for certain third party software for various reasons. They decided about a year ago to drop support for Adobe Flash. Not too long ago they also decided to drop support for Oracle Java and removed it from the list of applications that are installed or updated by Apple Software Updates.

This decision to stop deploying Java with Apple/Mac updates was a tactical error in my opinion. It was well intentioned, but short sighted. Java exploits are absolutely the number one infection vector used by perpetrators of the ZeuS Trojan and various botnet installers. Java is cross-platform, and has been described by its original maker Sun Corporation as "write once, run anywhere" technology. Java is not a scripted language, but is deployed as compiled mini-programs, known as Applets, using what are known as .JAR files to distribute these programs and their supporting files.

Run Anywhere includes Mac OS computers, as well as smartphones, tablets, ATMs, on and on. Even though the user base for Mac computers is relatively small, compared to Windows, they have now become targets of Java exploit kits, due to the erroneous attitude of many Mac users that they are immune to malware sneak attacks. This has been proven to be wrong thinking.

]]> Enter the Flashback backdoor botnet installer for Macs

It was not too complicated for the authors of the Flashback backdoor Trojan to update their exploit kit to detect if the computer being attacked was a Mac. If yes to is Mac, the machine is probed to see if a vulnerable version of Java is installed (whether or not the owner is using Java or even aware of it), then if certain security programs are also installed. If Java is installed, and these particular effective anti-malware programs, the Trojan installer bails out and deletes itself, knowing it has no chance of success.

Due to the viruses don't infect us attitude of many Mac owners who also had Java installed and were lured to compromised websites, or served malicious advertisements on legitimate websites, over 600,000 of them were infected with the Flashback backdoor, which drafts the computer into the Flashback Botnet. The Trojan also steals login credentials and other personal information from those computers.

Here is how a CNET security blogger described the new Mac Flashback infection routine:

Simply visiting a malicious Web site containing Flashback on an OS X system with Java installed will result in one of two installation routes. The malware will request an administrator password, and if one is supplied, it will install its package of code into the Applications folder. If a password is not offered, the malware will install to the user accounts where it can run in a more global manner.

Once installed, the Flashback will inject code into Web browsers and other applications like Skype to harvest passwords and other information from those program's users.

Apple has finally responded to this threat that has affected so many of its trusting Mac OS X users. The third update, issued on April 12, 2012, includes a removal tool for the Flashback Trojan itself. The previous updates included the latest version of Java, for those computers that had a previous version installed, as well as a code patch that will make it much more difficult for silent infections to occur in user space.

Mac users still need to be aware that malware is targeting them and even if this one is being dealt with, others are certain to come along, exploiting a to be discovered weakness in the operating system. Then, there is always social trickery that fools people into supplying their administrator password for a malware Trojan, disguised as some desirable utility program.

Finally, only Macs running OS X Lion, or 10.6 are patched by the Apple Java updates. If your Mac runs on Snow Leopard or earlier, you remain totally vulnerable to the Flashback Trojan, if you have Java installed and it it not at least patched version Java 1.6.0_31. Your only protections are to disable Java from running in your browsers, or uninstall it completely from your computer.

There are many anti-virus programs available for Mac computers, including Smart Surfing for Mac from Trend Micro, which detects, blocks and removes Mac viruses and content stealing Trojans.

Security threats and program patches for 1st quarter of 2012

2012-04-13T02:10:36Z

We are just 1/3 month into the second quarter of 2012 and we have had a lot of security vulnerabilities, threats attacking them and program patches released by major software companies. These patches include Windows Updates, Mac (Apple) Updates, Adobe Flash, Air and Reader, Oracle's Java Virtual Machine, Internet Explorer, Firefox, Safari and Chrome browsers, Real Player and iTunes.

All of the software updated by these companies, over the past three months has suffered from highly critical security vulnerabilities, many of which are now being actively exploited by cyber crime gangs who publish exploit attack kits. Java exploits are almost always the first types of exploits targeted by crimeware kits, like the Russian Blackhole kit.

Some of you may be wondering how these exploits are delivered to your computer in the first place. The most common method of luring potential victims to scripted exploit kits is via cleverly crafted, hostile email spam messages. These hostile spam messages differ from standard commercial spam in that they aren't trying to sell you counterfeit pills, watches, or pirated software. Rather, they use well constructed come-ons to con or panic recipients into either opening attached files containing Trojans or JavaScript codes redirecting your browser to a malware server, or clicking on obscured links to compromised websites.

After one clicks upon such a link, the scripts on the compromised landing page usually redirect you to other compromised websites and scripts, until you ultimately arrive at a distant server owned by cyber criminals, often in Eastern Europe. These servers use domains registered in places like Russia and the Ukraine to launch exploit kit attacks on your web browser and its add-ons and plug-ins, with Java plug-ins leading the pack. Adobe Reader (PDF files) and Flash are major secondary targets, followed by iTunes and Quicktime, Microsoft Word and just about any popular software that can be used to gain access to the operating system.

This is why reputable software companies release security updates on a more or less regular basis. Microsoft releases Windows Updates almost every month, on the second Tuesday of the month. Adobe has agreed to also release any critical patches on the same Tuesday. This has become known as Patch Tuesday. Make a note of this and if you have a Windows computer running XP with Service Pack 3, or Vista, or Windows 7, or Windows Server 2003 or newer, set your Automatic Windows Updates to check for updates at least every Tuesday, at the equivalent of 2 PM Eastern time for your time zone. Accept all updates rated Important or Critical. Reboot after all updates are installed and log back into an administrator level account to ensure that any further processing takes place, before logging into a less privileged account.

Note: There have now been four Patch Tuesdays so far in 2012, with the most recent being April 10, 2012. If you have not run Windows Updates this week, do so now. Two very serious vulnerabilities were patched this week. One is for Internet Explorer and the other for Microsoft Word. Exploits are now in the wild for both vulnerabilities.

]]> What types of subjects are being used in hostile spam messages?

Hostile spam emails frequently pretend to be invoices from well known online businesses, like Intuit, NewEgg, Amazon, etc, or as account activity alerts spoofing PayPal, or your bank, NACHA, ACH, BBB, or fake Wire Transfer and transaction cancelled/pending notices, or fake Facebook Friend Requests, or spoofed LinkedIn updates. This week has seen a lot of fake Wire Transfer Transaction scams, several fake Facebook Friend Requests, a few fake Intuit invoices and a bunch of money mule scams disguised as Work At Home schemes.

The payload delivered by most of these email scams is the Zeus bank account stealing Trojan, plus a botnet backdoor remote control installer. Others download fake anti-virus alerts to your computer, holding it hostage until you either pay to "activate" the fake virus remover, or hire a computer troubleshooter to remove the infection, or disinfect it yourself. Some malware even encrypts all of your files until you pay a ransom to crooks in the Ukraine.

Most of this misery can be avoided by keeping up with when updates and patches are released for your operating system, plus any third party software that runs in a web browser as a plug-in, add-on or extension, or which opens another application when you click on a link in a web page (e.g. Adobe Reader for PDF files, Quicktime, iTunes, etc.). This used to be a monumental task, as until recently most companies producing such software and apps required users to manually check for updates.

Some 3rd party software, like old versions of Java issued by Sun (before they were acquired by Oracle), didn't even remove previously installed versions when you installed a newer version, in fear of breaking some feature being used in those versions. This "feature" caught the attention of the code writers employed by Russian malware companies. They began writing attack scripts that targeted old vulnerable versions of Java by the default installation locations on hard disks.

Nowadays, most reputable software companies have an automatic update checking module included when you update to a current version. Adobe Flash is the latest to join the big dogs with automatic updates. Still, every one of these applications makes the user decide what type of automatic updates they want to receive. This ranges from full automatic, to notify only. I prefer fully automatic updates, downloaded and installed. Let me know that an update occurred and tell me if it needs to close my browser or restart Windows, or Mac computers. Show me a signed certificate so I know its from the actual company, then finish the patching. My work can be saved and reopened after the computer reboots, or the browser closes and opens again.

Above all, make sure that if you have Java installed, you use the Java icon in Control Panel to set the automatic update checker for every day, at a time when the computer is normally on. They have no timetable or schedule for patches, so I have it check every single day. Next, if you have Adobe Reader (and/or Acrobat) installed, first go to Adobe.com and download the latest secure version. Then, open Reader, click on the "Edit" menu item, mouse down to "Preferences" and click on that. At the bottom of Preferences click on Updater. Select the top option: Automatically install updates and apply it. Close the preferences.

The latest version of Adobe Flash now offers automatic updating. I strongly recommend that you accept this option! Go through any other common third party software, like iTunes, Quicktime, Safari, or anything from Apple (like the Mac OS) and find an option to automatically check for and apply updates. You won't be sorry.

Sometimes, even when a third party software producer issues an update to plug a security vulnerability, other companies that use a custom version of that program may lag behind in issuing their updates. This applies to Google Chrome browsers and most irritatingly, to Mac computers. In February 2012, Oracle released their most recent patched version of Java. It took Apple until last week to issue a patch for only the most recent versions of OSX. They left 600,000 loyal Mac users out in the cold, as they became infected with the Flashback Trojan. Adobe has yet to issue a remover for this Trojan, which installed with or without user passwords. Fortunately, some security firms have stepped up and offer their own Mac Flashback Trojan removers. ARS Technica published a list of some of them this week.

I use two online scanning services to check computers for missing patches and updates to popular browser plug-ins and the operating system you use. One is from Secunia, which uses of all things, Java, to poll for what is installed and if an update is available and the other is from Qualys, which checks you browser plug-ins to see if they are current or need updating. I prefer the Qualys Browser Guard because it doesn't use Java at all, yet checks for it. Both provide links to the legitimate companies download pages for the out-dated software they detect.

Fake Facebook Friend Requests with huge links lead to malware exploit kit

2012-04-06T05:03:12Z

There is an ongoing spam campaign that I have been following since August 24 2011, pretending to be Facebook Friend Requests. However, all of the links contained in these scams lead to compromised websites, where your browser is attacked by criminal exploit kits, like the "Blackhole" or the "Nuclear" exploit kits.

If you are a member of Facebook and receive Friend Requests from senders with odd sounding names, you need to do something proactive before clicking on any links in those emails. You need to hover your mouse pointer over all buttons, images and text links, without pressing any mouse buttons (do not click!). Then, with your pointer over these links, look down at the "Status Bar" on the browser, or message window, or preview pane in the email client you are using, and look carefully at the URL being displayed.

The links and buttons in the Facebook Friend Request scams look like any other Facebook request, with a few exceptions. The photo of the alleged requester is missing, showing an outline of a shadowy head. When you hover over the picture, or name, or the Confirm Request buttons, or the Unsubscribe link, all of the links will be obviously fake, leading to anything other than facebook.com. Furthermore, for the last couple of months, the links are unbelievably huge, occupying multiple lines of codes. Herein lies the weakness in the scam.

Furthermore, Most of the scams spoofing facebook Friend Requests lack the line under their name, showing the person's statistics. E.g. 37 friends · 29 photos · 13 Wall posts. A real Friend Request contains these stats.

Making sense of what appears senseless
I am going to impart some WIZdom to you to bring you up to speed on the nature of the hostile links in the current (April 2012) fake email Facebook Friend Requests.

]]> A real Facebook Friend Request always shows facebook.com in the first portion of the URL, just before the first single forward slash. Here is an altered example of an authentic "See All Requests" button link:

http://www.facebook.com/n/?reqs.php&mid=5c61e5akjdfhg7G5af367fd4722Gca22faG2&bcode=7p7rlcv0318MU&n_m=email-prefix%40email-suffix.com&type=1

Below, is an actual hostile link, extracted from a fake friend request, with the primary link codes replaced with asterisks (h**p) for your safety (this domain is still infected as of this posting):

h**p://torontoweddingphotographers.net/blog/index-include.htm?NA7=67W5O91L6NRW9KNO406DBNEB&G7F=98X0O929MQE303XCB8ETVA71&6F6=BXQ58NDOHTAAIMT&43O95=2VA7V50NDLL1UT0K&3547=JX6J2JL4EQ&

Compare just the URL sections which I have made bold:
Real: http://www.facebook.com/n/?reqs.php&
Fake: h**p://torontoweddingphotographers.net/blog/index-include.htm?

It is obvious when you read the actual URL to which the links and buttons lead which one goes to Facebook.com and which one goes to somewhere completely different. The second giveaway is the file type used before any of the long character strings. The authentic Facebook link uses a file named reqs.php, which is a .php file type; an active server content file. The faked URL uses a .htm file type, which is a flat html file.

Next, compare the items that follow those two different files. In the actual Facebook link, the first character following the file extension (.php) is the & symbol. In the faked URL, it is a ? symbol. In URLspeak, the question mark signifies a "query string." I have traced a lot of these URLs in scam emails and can tell you for a certainty that all of the ones spoofing Facebook requests, using a .htm file, followed by a question mark (...htm?...), are totally fake query strings. They do nothing on the destination server, because the .htm files on the compromised sites are just flat files, containing only html code and JavaScript exploit attacks. These flat .htm files, simply put, cannot parse a query string. The strings are octopus ink, meant to fool the unwary.

So, if you hover over a link in a Facebook Friend Request and see a huge readout that first of all does not have facebook.com/ and which has a file with a .htm extension, followed by a ? and a long string of characters, it is a hostile link. Do not click on these links!

In the case of the message I analyzed tonight, at the destination domain, there were a series of 5 different JavaScript exploit scripts, each targeting different commonly installed and equally commonly out-dated browser plug-ins, beginning with Java. Chances are fairly high that if the washin' don't get ya, the rinsin' will! Java is the number one exploited browser plug-in, for several years running. Try to make sure that if you have Java installed on your computer, that you have set it up for automatically checking for and downloading updates.

If you don't even know you have Java installed, find out by going to http://www.java.com and use the link labeled: "Do I have Java?" It will scan your PC and tell you if Java is installed and if so, which version is currently active on your computer. If Java is installed and it is not the latest version, it is definitely vulnerable to exploitation by these scripted attack kits. Either download the current patched version, or uninstall any versions of Java you find on your computer.

If you have clicked on such a link, you probably saw a line of text in your browser's title bar stating words like: "Please wait till page loads" - which masks the attacks being carried out against your browser and its plug-ins. You need to update your anti-malware protection and scan for threats you may have acquired. That may not be enough though, as some of the bad guys install a bootkit or rootkit that is insidious to remove. You might need professional help to remove some of these infections. Many install the Zeus, or SpyEye banking Trojans, along with Botnet executables that use your computer as a spam and attack zombie.

Trend Micro, Kaspersky, Symantec and other security websites provide free online malware scanners. If a Trojan has disabled your anti-virus program, those scans may be all you have before you need to reinstall the operating system, or restore it to a previous state (system restore, or a saved backup image). It's better to have excellent, commercial security installed, up-to-date and protecting you in real time, than to risk getting infected due to free security software not being updated as often as the malware is updated and repacked.

I use and recommend Trend Micro Internet security, along with Malwarebytes Anti-Malware.

Stay safe online. Avoid clicking on links before you hover and read the URL in a Status bar. Spoofed URLs are everywhere and most lead to malware exploit kits. If you have unpatched software installed that can be accessed through your browser, your computer will almost certainly become infected. Your only hope is to operate with limited user privileges, rather than as a Power, or Standard user or administrator.

Fake change of email address notice from American Express is Malware

2012-04-05T21:26:08Z

Right now, the first week of April, 2012, there is a spam run hitting our inboxes spoofing American Express, with fake change of email address notices. These messages are convincing, having stolen images from the actual American Express website.

Here is an excerpt from one which I received a couple of minutes ago:

From: "American Express"
Subject: Confirmation of email address change

Thanks for updating your email address

We changed your e-mail address in our files to {spoofed or harvested email account}. If the new e-mail address is not correct or you did not request this change, please click here,..{spoofed link leads to malware}

If you, or someone you know was unlucky enough to click on one of these links, their PC will have been attacked by a browser exploit kit. You, or they need to run a full scan for malware with up-dated definitions in your installed security program. If you have not rebooted the computer since you clicked on the hostile link, run System Restore to a previous time or day, on your Windows computer.

If you lack any installed computer security, here are some options for you to try:

Trend Micro security programs (I use this)

Malwarebytes Anti-Malware (I use this)

Kaspersky Lab's Products - Try out a free 30-day trial!

]]> About the exploit kits

These attack kits are mostly made in Russia and all target vulnerable flaws in Java, which used to belong to Sun Corp, but now is owned by Oracle. Don't confuse Java and JavaScript; they are horses of a different color. JavaScript is an interpreted code that runs in your browser to do special feature things. Java is a compiled executable program that runs on any device (over 3 billion devices according to Oracle!). While JavaScript is used on hostile websites to probe your browser for any vulnerabilities, the actual payload it delivers is usually a Java Applet, or .JAR file. If you have an exploitable version of Java, chances are strong that your computer will become botted and have a bank account stealing Trojan installed by the hostile Java Applet.

Do I have Java?

You really need to know the answer to this, no matter what operating system your computers run on. This is serious sh_t. Go to Java.com and click on the link labeled "Do I have Java." If you do have Java installed the version will be displayed on the results page. If it is not the current version, you are exploitable and should either download the latest version and uninstall all previous versions, or just uninstall all versions of Java and be done with it. Fewer and fewer pages demand that you have Java to function. It is most often used in online games. Unless you must use Java, the safest course is to not have any version of it installed at all!

In Windows, you can uninstall Java via your Windows Control Panel, using the Add/Remove or the Programs and Features icon. Mac owners must download the patched version from Apple, using the built in Apple software updater.

The latest version of Java is Java 6 update 31.

Trend Micro Titanium security products on sale at 30% off, through April 2012

2012-04-05T19:45:34Z

I am an affiliate for Trend Micro home security products. I am also a current Trend Micro customer, so I can speak from experience. I have tried a lot of both free and commercial computer security programs and I highly recommend the current offerings from Trend. Right now, through April 30, 2012, the most popular home security programs from Trend Micro are on sale, through my affiliate links, at 30% off.

This discount is an affiliate offer, not offered to the general public arriving at their website via normal methods. No coupon codes are needed to get the discounts. I never cared for those codes anyway. Too much room for typos.

Here is a breakdown of the programs being discounted, along with their list and discounted prices.

Trend Micro Maximum Internet Security for 2012
This includes the whole ball of wax. All of the protections offered by the other Trend Titanium programs, plus additional protections against phishing and man in the middle attacks, computer and identity theft, both at home and when you're on the road using a wireless connection at a hotel, motel, coffee shop or fast food restaurant. It even includes a security app for Android Smartphones. Also included is Smart Surfing for Mac.

Regular price: $79.95 Sale price: $55.95. Learn more or Buy it now

Read the details about this program and find my yellow highlighted discount links on my Trend Micro web page.

Trend Micro Titanium Internet Security 2012
This is the most popular security program from Trend Micro, best suited to computer towers that stay in one location. Some of the key features are Enhanced Behavior Monitoring/Proactive Intrusion Blocking, Antivirus Security, Spyware Protection, Detect and Block Image Spam, Personal Firewall, Fraud Defense, Data Theft Protection, Wireless Network Monitoring, Network Control, and, coolest of all, you get all this protection for up to 3 home or mobile computers with just one license fee.

Regular price: $69.95 Sale price: $48.95. Learn more or Buy it now

Read the details about this program and find my yellow highlighted discount links on my Trend Micro web page.

Trend Micro Titanium™ Antivirus Plus Anti-Spyware
Trend Micro Titanium Antivirus + is very light on computer resources, because it uses a set of fairly small on-disk definitions that get loaded at startup, covering the most prevelant known threats. Additional real-time threat protection comes from Trend's in-the-cloud† security technology which is constantly updated as new malware is identfied and definitons are written.

Regular price: $39.95 Sale price: $27.95. Learn more or Buy it now

Subscribers to any of these Titanium programs are protected against hostile and compromised web pages by the Trend Micro Web Threat technology, which blocks access to bad websites before they can exploit your computer.

This 30% off sale ends on April 30, 2011. If you were waiting for a great discount before buying commercial security for your computers, now is the time you've been waiting for! Furthermore, because we are currently into a model year and subscriptions run 365 days, you would be entitled to a free upgrade to version 2013 of the same program.

I know this because I purchased a one year subscription to Trend Micro 2011 and received a free upgrade to version 2012. I'll be renewing it for another year next month. Having tried many other security programs I see no reason to change. Trend Micro does what it's supposed to do, without slowing me down or annoying me with a lot of pop-ups, like some other security programs did. The web threat protection blocks dangerous web pages from loading, preventing their exploit kits from attacking my defenses.

Read the rest of the details and find my highlighted discount links on my Trend Micro web page.

Wiz's email spam & threat analysis for the week ending March 11, 2012

2012-03-12T05:29:40Z

This past week I saw a significant drop in the amount of spam I received and a shift in the top category. For the first time in probably a year or more, Nigerian 419 scams topped the list for most spams received. Gone completely was any spam for fake casinos!

Second place went to replicas Chinese watches that rip off legitimate name brands, like Breitling. This was closely followed by spam for fake pharmacies and bogus diplomas. Drugs bought from fake pharmacies, if they ever arrive, will do you no good and may actually harm you. Buying fake diplomas won't necessarily get you hired, but they will get you fired, once your deception is discovered during routine background checks.

Runners up in spam were Russian domains pushing counterfeit goods and drugs, work at home scams, weight loss pills, male enhancement, Cialis and Viagra and three malware link scams.

The malware threats from last week were all fake Intuit invoices, with links to read invoices online. Those links all led to exploit attacks against browsers and their add-ons and plug-ins. If you clicked on a link in an email claiming to come from Intuit, scan your computer for malware Trojans and Bots. You can use a free 30 day trial copy of Trend Micro™ Titanium™ Internet Security, if you have nothing else that is current for virus detection.

The following represents my email totals and spam percentages by category. All results were obtained from MailWasher Pro, which I use to filter out spam before I download any incoming email to Windows Live Mail.

]]> These spam statistics are derived from MailWasher Pro, which is a POP3 email filtering program that runs on a Windows desktop. It intercepts all incoming email and analyzes it, based upon several factors, the most prominent of which are my own custom spam filters.

Overview
Total incoming email: 450 (10 more than last week)
Good mail: 367 (340 last week)
Classified as spam: 83 (100 last week)
Percentage rated spam: 18% (22.7% last week)

Breakdown by category of spam
Nigerian 419 scams: 19% (4% last week) Watches: 18% (13% last week) Fake pharmacies: 17% (17% last week) Diploma scams: 12% (17% last week) Russian domain links: 9.6% (2% last week) Cialis & Viagra: 7.3% (9% last week) Work at home scams: 6% (5% last week) Weight Loss HCG scams: 3.7% (4% last week) Male Enhancement scams: 3.7% (1% last week) Intuit fraud exploit links: 3.7%
I made the following additions or updates to my custom MailWasher spam filters
No Additions last week
The following (single or wildcard) email addresses were added to my MailWasher Blacklist:
None added

About MailWasher Pro
I publish filters for both the old and new versions of MailWasher Pro. However, the new version allows for more lines of conditions than the previous ones. If you use a desktop application to send and receive POP3 email, MailWasher can act as a spam filter before you download email to your email client. You can learn more about the program, download a trial version, or purchase a subscription, at the MailWasher Pro website.

News: MailWasher Pro is once again offering lifetime licenses, covering three computers. You should try it out and see how it works for you in reducing spam in your desktop email client's inbox.

Parallels 7 for Mac (run Windows inside Mac) 25% off through 3/13/2012

2012-03-10T17:40:53Z

I am a Windows user, but have friends who prefer a Mac. Still, some of those folks also have a Windows PC or laptop, to run apps that are not compatible with the Mac operating system. With Parallels, a Mac owner can run Windows inside their Mac desktop, as an application. Parallels 7 does this even better than previous editions.

The caveat is that the Mac must contain an Intel processor and a decent amount of RAM. The full requirements are as follows:

A Mac computer with an Intel Core 2 Duo, Core i3, Core i5, Core i7, or Xeon processor.

Minimum 2 GB of memory (4 GB of memory is recommended to run Windows 7 in a virtual machine or if your host OS is Lion)

About 500 MB of disk space on the boot volume (Macintosh HD) for Parallels Desktop installation.

About 15 GB of disk space for each virtual machine.

Mac OS X Lion 10.7

Mac OS X Snow Leopard 10.6.3 or later

Mac OS X Leopard v10.5.8 or later

A valid license for the version of Windows you intend to install with Parallels.

For those who want to install Windows 7 into their Mac, you can buy a copy from Tiger Direct or NewEgg.

Parallels Desktop for Mac allows you to install Windows, or any other supported operating system - like Linux, into a virtual machine (VM), then install applications compatible with that operating system and run them as if you were using a Windows or Linux computer. This means that if you have a Mac that meets the requirements to run Parallels, you an install a valid copy of Windows 7 into it, then install Windows only software and run it as an application inside the Mac desktop. You can maximize the Parallels windows to be full screen if you need all of the monitor for your Windows applications,

Parallels 7 is currently on sale for 25% off the regular price, but only through March 13, 2012. You can learn more about Parallels here, or here.

If you have an older version of Parallels you may be entitled to a greatly reduced upgrade license for the current version.

Deadline for cutoff of DNS Changer infected PCs extended until July 9, 2012

2012-03-06T17:37:13Z

On February 14, 2012, I wrote a blog article alerting my readers about the pending cutoff date of March 8, 2012, for Internet access for computers infected with the DNSChanger malware. The title told it all: "PCs infected with DNS Changer to lose Internet connections on March 8, 2012." I learned today (March 6) that a Federal Court has granted the FBI's request to extend the cutoff date until July 9, 2012 (Read PDF of Court Order).

When I published my article there were still an estimated 400,000 PCs in the USA infected with this malware. Many of these infected PCs belong to Fortune 500 companies and even parts of the US Federal Government, Millions more are still infected around the World. This extension of the cutoff date is to allow more time for the large entities in business and Government circles to search for and disinfect their compromised computers. It is a monumental task and many companies have already stretched the IT personnel and budgets to the limit, sniffing out any infected machines on their premises.

It was back in early November, 2011, that the FBI filed an indictment against an Estonian crime gang whose members were accused of creating and operating the "DNS Changer" malware and botnet. Search and seize warrants were obtained and the servers being used by the criminals running this enterprise were seized and taken offline. The named suspects have been arrested and are awaiting extradition, or have already been extradited to the USA, to face charges in a US Federal Court.

But, there was a downside to this victory. Innocent victims were unknowingly having all of their Internet connectivity routed though those "rogue" DNS servers that were taken down by the FBI and DOJ.

]]> The computers and routers that had been infected with the DNS Changer malware were instructed by the Trojan to obtain all of their Internet access by going through one of the command and control servers that were taken down by the FBI. When the servers were disconnected, so was Internet access for all infected machines!

In order to minimize damage to those machines, a Judge ordered a New York hosting company to take over supplying IP connectivity to those infected PCs and routers. All requests from the "infectees" were rerouted to these interim servers, allowing the owners of the infected machines to happily go about their web browsing, online banking, auctioning, emailing, FTP-ing an IM-ing. Further, the Court set a cutoff date of March 8, 2012 for the company assigned to act as go-between for the infected machines.

In the meantime, ISPs and IP connectivity providers were notified about the IP addresses found in the log files of the seized malware servers. Owners of infected machines and routers were and still are being identified and being contacted by their ISPs or connectivity providers. It has been discovered that this process is taking much longer than anticipated when a Federal Court assigned a March 8, 2012 cutoff date for the handling of requests from the infected machines.

You can get more details in my previous blog article about the DNS Changer malware, how it affects computers and routers and links you can use to check if your systems have become compromised by this malware.

One final word: Now that we have been granted another 4 months to discover infected computers and routers, let's get to work doing so. I have checked my DNS servers and found them to be correct and clean. You can check your DNS servers here, if you are English speaking. There are equivalent DNS checking services in other languages, like http://dns-ok.de/ for German speaking Netizens.

Keep your Windows PCs patched via Windows Updates and your anti-virus software up to date with daily definitions updates. Scan for threats every night, before shutting down your PC, or yourself ;-). One of the symptoms of a DNS Changer infection is that Windows Updates and anti-virus programs get turned off. If you find that you cannot access Windows Updates or update your security programs, contact a competent computer technician or computer troubleshooter.

Adobe quick-releases a critical Flash Player update on March 5, 2012

2012-03-06T04:16:10Z

It was just 20 days ago, on Feb 14, 2012, that Adobe Systems released a critical update for their Flash Player, which I blogged about here. That version was 11.1.102.62, for Windows, Mac, Linux and Solaris operating systems. Today, March 5, 2012, they released another unexpected critical patch, version 11.1.102.63, for the same systems.

Android smartphone users who have Flash installed also have upgrades waiting, to version 11.1.111.7 (Android 2x, 3x) or 11.1.115.7 (Android 4x) respectively.

The previous patch fixed 7 security vulnerabilities, one of which was being exploited in the wild in February. This latest update patches 2 more newly discovered vulnerabilities (CVE-2012-0768 and CVE-2012-0769), which they claim are not yet being exploited by web browser attack kits. That is bound to change in a few days.

The first newly announced vulnerability allows an attacker to take over control of a user's computer or smartphone via a memory corruption attack against a component of Flash known as Matrix 3D. The second vulnerability in Flash Player allows a hacker to steal sensitive information from a victim's computer or smartphone.

While the Adobe Priority table says users should apply the new patches within 30 days, I recommend you do it as soon as you read this. Exploit kit writers are not going to wait 30 days to go after unpatched computers or smartphones. If you have Flash on a computer, visit the Adobe Flash Download page and download one version of Flash for Internet Explorer and another if you use Firefox or Safari browsers.

Mac users should visit the Adobe Flash download page for other systems and browsers. Apple itself does not support Adobe Flash.

Google Chrome has released a new version of the Chrome browser, which has an embedded version of Flash. To upgrade, open Chrome, then click on the Settings wrench icon on the upper right of the browser, then on "About Google Chrome." If the update has not already been installed it will begin downloading as you open the About Chrome box.

You will have to restart your browsers for the upgrades to take effect. This goes for most plug-ins like Flash. After restarting them, go to the About Flash page and verify that you have the most current version for your browser and operating system. Your installed version is displayed above a table on the page, which lists all current versions of Flash, by operating system.

]]> Android smartphone users must use their Android phones to browse to the Android Marketplace where they can get the new version of Flash installed.

I cannot stress enough the importance of keeping your software which is used by your browsers updated. Criminals pay talented, but unscrupulous programmers to research published vulnerabilities and write codes to attack browsers that are lured to attack servers by spam links. Victims get drafted in criminal and spam botnets and very often have bank account stealing Trojans installed as well. Further, their infected devices are used in distributed denial of service (DDoS) attacks on targets who have incurred the wrath of the criminal elements renting those botnets.

With so many threats in the wild and new ones being discovered every month, or less, it is hard to keep up with all of the updates to the various software applications that connect to the Internet via a browser, email client, instant messenger, Facebook, whatever. You need to remain concerned and stay aware of threats that are either loose in the wwild, or are about to be exploited. When you learn that Adobe has released a new version of something, check your computers to see if you have a previous version installed. If so, update everything out-dated to the latest versions.

Maintain a good line of self defense for your computers and smart devices, by installing automatically updated security software. I use and recommend Trend Micro and Malwarebytes Anti-Malware. Whatever brand you choose, make sure that if it has an annual subscription, that you keep your subscription active. An expired security program is like a sleeping doorman. No protection to mention.