malware

Spylogic pointed me to this interesting challenge.

It turns out that the Ohio information Security Summit is hosting (and dishing out prizes too) to people who try to analyze malware and document their findings. The contest is open Oct. 1 to Oct 26, and I just love it!

Howow - hold yer horses. Malware, you said? So this gotta be dangerous? Yes? Ok. Let us check their FAQ:


Ah, so I need to use my lab for this.

Seriously, I think this may be a nice way to create awareness and interest for malware out in the jungle. Unfortunately for me, I will be nowhere near Ohio in October, but I will give it my best shot anyway. First, let me find an old, battered computer I can use for this test...

malware, spylogic

According to Fortinet, a new dialer malware is on the spread. Their researchers claim that the threat was mainly reported in Mexico and the US, and that the malware uses the analogue modem to call long-distance calls.

In their newsletter, they make this comment:

Somehow website owners believe that phishing is only targeting banks. Here is some news for you - when security tightens in one area, attachers are quick to find other sites and technologies to exploit. 

In March, a phishing attack targeted MySpace. It was clever, and used CSS to harvest user names and passwords from MySpace accounts. According to Google Security Blog, 95% of all new phishing traffic went to MySpace. 

The Register brought forward this story about a "new" phishing tool. A file downloaded and installed on your computer gives the phisher full access to intervene your Internet banking, PayPal, eBay and so forth.

What is new with this? Spyware, greyware, trojans and virus has been installed on your computer for a long time. Bots have been controlled from the outside for years. The fact that the tool is able to access your information, tap into your communication and present to you what looks like ordinary PayPal, banking or eBay sites is nothing new. What I find disturbing is the that the anti-phishing tools do not detect the hijacking, and thus are not able to prevent it. As a matter of fact, Norton 360 clears the page you are viewing.

You have a successful blog or a company website. You serve your visitors well, and provide good quality information that attracts a high number of visitors. Your website is hosted on one of the many ISPs, and you are confident that they have taken care of all the security for you. No need to worry about a crook hijacking your website, nor a spammer using you as a relay.

You get a complaint from one of your visitors that there are strange things going on when they visit your website, but as you never heard this before, you decide it is the visitor at fault, not the website. A few weeks go by; you see on the stats that the number of visitors decreases. One day when updating your website, you get a window popup you never saw before, and suddenly your antivirus client starts screaming and kicking. You do have an updated anti-virus client, right?