Browsing Posts tagged Worm

Twitter worm underscores social-networking vulnerabilities

April 16, 2009 at 12:08 pm Brett A. Scudder No comments

Twitter worm underscores social-networking vulnerabilities

Chuck Miller | http://www.scmagazineus.com/Twitter-worm-underscores-social-networking-vulnerabilities/article/130562/

April 13 2009

Twitter was struck by a particularly nasty cross-site scripting worm over the weekend, again bringing to light the threat of client-side attacks across social networking sites.

Four variants of the worm hit Twitter, bringing back memories of the infamous — and groundbreaking — Samy worm that snaked through MySpace several years ago.

The Twitter worm spread links to a supposed Twitter copycat site called StalkDaily[dot]com by exploiting a cross-site scripting (XSS) vulnerability and infecting an unknown number of Twitter profiles. Each wave of the worm attacks was more intense than its predecessor, according to a post on the official Twitter blog.

“We secured the accounts that had been compromised and removed any content that might help spread the worm,” Twitter co-founder Biz Stone wrote on the blog. “All told, we identified and deleted almost 10,000 ‘tweets’ [messages] that could have continued to spread the worm.”

The worm’s activity seems to have been contained, but there is little guarantee that no threats remain, experts said.

“This may be an open-ended problem,” Andy Hayter, Anti-Malcode program manager at security solutions tester ICSA Labs, told SCMagazineUS.com on Monday. “I don’t think we’ve seen the end of it.”

But overall, the damage so far has been minimal, Stone said in his blog post. No personal information was compromised.

“All the attacks are JavaScript-based, so turn off JavaScript in your browser if you are worried,” Hayter said.

Richard Wang, manager of Sophos Labs U.S., recommended Twitter users avoid clicking on untrusted links. He also told SCMagazineUS.com that Twitter can modify its platform so it cannot support malicious code such as this.

Stone wrote: “We are still reviewing all the details, cleaning up, and we remain on alert.”

According to published reports, a 17-year-old Brooklyn, N.Y. boy has taken responsibility for the attack. Michael “Mikeyy” Mooney said he devised the malware out of boredom and to prove how vulnerable Twitter is.

Stone likened the attack to one perpetrated by Samy Kamkar, who, in 2005 when he was 19, unleashed a similar self-replicating, XSS worm across MySpace that was believed to be the first of its kind. The worm was benign but enabled Kamkar to attain more than one million “friends” in 24 hours. He later was sentenced to three years probation and ordered to serve 90 days of community service.

IT News Articles of Interest Biz Stone, Compromised, ICSA Labs, MySpace JavaScript, Samy, security, Social Networks, StalkDaily, Twitter, Worm

Conficker wakes up, updates, drops payload

April 9, 2009 at 8:08 am Brett A. Scudder No comments

April 9th, 2009

Conficker wakes up, updates, drops payload

Posted by Andrew Nusca @ 4:09 am | http://blogs.zdnet.com/BTL/?p=16082&tag=nl.e019

Categories: Security

The Conficker worm is finally active, updating via peer-to-peer between infected computers and dropping a mystery payload on infected computers, Trend Micro said on Wednesday.

CNET’s Elinor Mills reports that researchers are analyzing the code of the software that is being dropped onto infected computers and suspect that it is a keystroke logger or some other program designed to steal data from the machine.

The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said.

Just yesterday, Zero Day blogger Dancho Danchev noted that a Conficker copycat was already making its rounds.

According to a post on the TrendLabs Malware blog, the awakened worm tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity. It then deletes all traces of itself in the host machine, and is scheduled to shut down on May 3.

Mills reports:

Because infected computers are receiving the new component in a staggered manner rather than all at once there should be no disruption to the Web sites the computers visit, said Paul Ferguson, advanced threats researcher for Trend Micro.

“After May 3, it shuts down and won’t do any replication,” Perry said. However, infected computers could still be remotely controlled to do something else, he added.

The development was found when Trend Micro researchers noticed a new file in the Windows Temp folder and a large encrypted TCP response from a known Conficker P2P IP node hosted in Korea:

Two things can be summed up from the events that transpired:

1. As expected, the P2P communications of the Downad/Conficker botnet may have just been used to serve an update, and not via HTTP. The Conficker/Downad P2P communications is now running in full swing!

2. Conficker-Waledac connection? Possible, but we still have to dig deeper into this…

As for the second point, researchers said the worm tries to access a known Waledac domain and download another encrypted file, but they’re still trying to examine the connection.

More Conficker news on ZDNet:

· Dancho Danchev: Conficker worm’s copycat Neeris spreading over IM

· Adrian Kingsley-Hughes: Friday Rant – Conficker worm hype

· Ryan Naraine: Eyeballing Conficker with eye-charts and maps

· Tom Espiner: Conficker an April Fool’s joke? Maybe not

Andrew J. Nusca is an assistant editor for ZDNet.com. See his full profile and disclosure of his industry affiliations.

IT News Articles of Interest, IT Security Alerts, Notices and Advisories AOL, CNET, CNN, Conficker, Dancho Danchev, eBay, MSN, MySpace, Payload, Rootkit, security, Trend Micro, Worm

This is amazing, it’s as if Conficker is a new threat. Guess what, it isn’t, it’s just a more serious one. You’ve been activated.

March 31, 2009 at 4:33 am Brett A. Scudder 1 comment

Over the past week I have had so many requests to talk about this worm and why it is so bad and what it really means that I almost convinced myself that it was a brand new threat. Most people are so caught up on it as if it is a new threat but it really isn’t. It’s just a new level of sophistication that warrants the time and attention from the security professionals and vendors to stop whatever possibilities it may bring come April 1^st and beyond and for the general public to be aware that these are real life issues here. As I say every day, IT Security is a people problem, not an industry one because the impact and effects are felt in every area of our society and daily lives.

When CBS’s 60 minutes ran the story on Sunday March 29^th at 7pm, it’s as if the world woke up to the realization that this is serious. The very same words and things I have been telling people didn’t resonate until they heard and saw it on 60 minutes. Wow, and you wonder why the state of our security is so weak and poor, people don’t know who to listen to nor trust in these matters. So now I am talking to the same people who I talked o a year ago about the importance of properly protecting themselves from these risks and why it is needed today.

One person call me and was saying, “hey Brett, did you watch 60 minutes and see that new worm they are talking about. Man that’s serious isn’t it?”

So now i’m sitting on the other end of the line going, huh, are you serious, this is the same thing I have been talking about for years and trying to get you to understand, this is just a named threat but a threat none the less with a more sophisticated architecture and attack vector. It’s amazing.

I had more people asking which anti-virus software can stop this threat than what is this threat really about. This is one of the issues I have with a scenario like this because people need to take the time to learn and understand more about the threat and how it proliferates so they can better help to prevent the infection or spread even if they have security installed and running on their systems. We need more educated people to help maintain a strong wall of protection against the spread of these threats/risk via the internet today and tomorrow. Learn, get the facts, understand the need and activate the common sense.

Guess what, you’ve been activated. You’re now more alert, more intrigued, more prone to fighting these issues because it is in your backyard and you MUST DEAL WITH IT. How you decide to handle yourself is another issue.

I hosted an IT Security Webcast on March 22^nd and 5 people who declined to attend the session via the event invite on Facebook ended up with some form of infection two days later.

When asked how they got it, I was told,

I’m not sure or I don’t know.

The reason for declining my invite was that they have anti-virus on their system to protect them so they are ok and good to go.

What can I say?

Many will fall under these kinds of issues because they think they are good to go and not needing to learn or know more about how to protect themselves online. While they rest assured that they are protected by their AV client they still practice bad browsing, file sharing, file cracking, key generation and illegal software downloads everyday which gives systems access to these hackers via backdoors.

The next time you decide to download a keygen, password generator, cracked file, music from unknown people/sites or browse a website from an IM someone may have sent you, think twice about what you’re doing to your system, yourself and those you share and converse with. Support the developers and buy the apps. Get the real code.

The next time you decide to click ok on that pop up window without reading what it says while browsing, think again and take a minute to read it.

The next time you decide to open that chain mail and click on the link, hey, hey, hey, watch out now. You may know and trust the sender but do you know if he/she really sent it?

When in doubt, reach out.

And so we wait for April 1^st to see what Conf*ker will do to those systems already under its control.

What are you doing about it?

The IT Security Attaché

IT Security Alerts, Notices and Advisories, IT Security Programs and Initiatives, My Writings, The Attaché, Work Activated, Conficker, Presentations, Risks, Threats, Webcasts, Worm

State Security Breach Notification Laws as of December 16, 2008 and the Conficker worm

March 29, 2009 at 11:38 am Brett A. Scudder 1 comment

This is from an email I sent out to my network distribution list today at 12 noon.

Good day to you,

This is a critical issue that has been highly overlooked and is a bigger problem than most people care to think. For those of us consultants who are responsible for our client’s infrastructure, please help them to understand where these laws apply and how it affects them. I’m bringing in someone from the attorney general’s office to do a presentation on this for us in the coming month. I’m trying to work with their schedule so stay tuned for the date of the meeting.

There are some serious new threats on the loose and the more I look at them is the easier i’m seeing the rate of success in their deliverables. Our organization speaks to these issues and we must understand what they mean for those we’re helping to understand. This new variant of the Conficker worm has some nasty new tricks to it and while following its development and path, i’m more convinced that this is a new level of sophistication way above the rogue Anti-Virus/Anti-Spyware 2008/2009 threat we encountered last year that is still being a major pain point for IT today. Whether this is an April fools days joke or not, as you can see, the financial ramifications of negligence will be heavy.

Get those system (OS, applications, devices) patches updated and current. Most people tend to patch the OS and leave vulnerable applications running with system access to the OS that even fully patched is still vulnerable. Patching is an all round process that applies to the OS, applications running on it and the devices being connected to it. Even the device drivers are a point of entry to a system today so patch them if needed. Check on those security policies and rules and ensure they are up and running. We have a few days before April 1^st so talk with your people about this and let them understand the need for being prudent about it.

Make no mistake people, this is a new age where technology rules and the threats are more real than ever before. This is not someone physically walking in and taking your data, this is someone sitting anywhere in the world and having access to it (if allowed).

I posted this on LinkedIn here http://www.linkedin.com/answers/using-linkedIn/ULI/447971-3071950 for a broader visibility from the business professional’s community. More feedback and input will be found there as well. Spread the word.

Thank you and have a great day,

~Brett A. Scudder~

State Security Breach Notification Laws

As of December 16, 2008

http://www.ncsl.org/programs/lis/cip/priv/breachlaws.htm