Malicious Software Features Usama bin Laden Links to Ensnare Unsuspecting Computer Users

The FBI today warns computer users to exercise caution when they receive e-mails that purport to show photos or videos of Usama bin Laden’s recent death. This content could be a virus that could damage your computer. This malicious software, or “malware,” can embed itself in computers and spread to users’ contact lists, thereby infecting the systems of associates, friends, and family members. These viruses are often programmed to steal your personally identifiable information.

The Internet Crime Complaint Center (IC3) urges computer users to not open unsolicited (spam) e-mails, including clicking links contained within those messages. Even if the sender is familiar, the public should exercise due diligence. Computer owners must ensure they have up-to-date firewall and anti-virus software running on their machines to detect and deflect malicious software.

The IC3 recommends the public do the following:

* Adjust the privacy settings on social networking sites you frequent to make it more difficult for people you know and do not know to post content to your page. Even a “friend” can unknowingly pass on multimedia that’s actually malicious software.
* Do not agree to download software to view videos. These applications can infect your computer.
* Read e-mails you receive carefully. Fraudulent messages often feature misspellings, poor grammar, and nonstandard English.
* Report e-mails you receive that purport to be from the FBI. Criminals often use the FBI’s name and seal to add legitimacy to their fraudulent schemes. In fact, the FBI does not send unsolicited e-mails to the public. Should you receive unsolicited messages that feature the FBI’s name, seal, or that reference a division or unit within the FBI or an individual employee, report it to the Internet Crime Complaint Center at www.ic3.gov.

-----

Community News You Can Use
Click to read MORE news:
www.GeorgiaFrontPage.com
Twitter: @gafrontpage & @TheGATable @HookedonHistory
www.ArtsAcrossGeorgia.com
Twitter: @artsacrossga, @softnblue, @RimbomboAAG @FayetteFP

E-mails Containing Malware Sent To Businesses Concerning Their Online Job Postings

Recent FBI analysis reveals that cyber criminals engaging in ACH/wire transfer fraud have targeted businesses by responding via e-mail to employment opportunities posted online.

Recently, more than $150,000 was stolen from a US business via unauthorized wire transfer as a result of an e-mail the business received that contained malware. The malware was embedded in an e-mail response to a job posting the business placed on an employment website and allowed the attacker to obtain the online banking credentials of the person who was authorized to conduct financial transactions within the company. The malicious actor changed the account settings to allow the sending of wire transfers, one to the Ukraine and two to domestic accounts. The malware was identified as a Bredolab variant, svrwsc.exe. This malware was connected to the ZeuS/Zbot Trojan,
which is commonly used by cyber criminals to defraud US businesses.

The FBI recommends that potential employers remain vigilant in opening the e-mails of perspective employees. Running a virus scan prior to opening any e-mail attachments may provide an added layer of security against this type of attack. The FBI also recommends that businesses use separate computer systems to conduct financial transactions.

For more information on this type of fraud and prevention tips, please refer to previous Public Service Announcements by clicking the links below:

* http://www.ic3.gov/media/2010/CorporateAccountTakeOver.pdf
* http://www.ic3.gov/media/2010/WorkAtHome.pdf
* http://www.ic3.gov/media/2009/091103.aspx

Anyone who believes they have been a target this type of attack should immediately contact their financial institutions and local FBI office, and promptly report it to the IC3's website at www.IC3.gov. The IC3's complaint database links complaints together to refer them to the appropriate law
enforcement agency for case consideration. The IC3 also uses complaint information to identify emerging trends and patterns.

Source:  IC3

-----
Community News You Can Use
Click to read MORE news:
www.GeorgiaFrontPage.com
Twitter: @gafrontpage & @TheGATable @HookedonHistory
www.ArtsAcrossGeorgia.com
Twitter: @artsacrossga, @softnblue, @RimbomboAAG @FayetteFP

Christmas and Holiday Sales Were Attack Targets According to December Top 10 Malware List

(BUSINESS WIRE)--GFI Software, a leading IT solutions provider for small and medium-sized enterprises, today revealed continuing high levels of Trojan and rogue malware circulating during December, with data revealing a surge in activity, boosted by themed activity around the Christmas and New Year holiday period. The top 10 data is compiled from monthly scans performed by GFI's award-winning anti-malware solution, VIPRE® Antivirus, and its antispyware tool, CounterSpy®, as a service of GFI Labs™.

Users were targeted with a variety of infected email, web links and other delivery mechanisms promising festive information, discount offers, Christmas e-cards and free software. The month also saw the big movie release of the season, Disney’s TRON Legacy, targeted by a wide array of SEO poisoned links, unwanted installs and other malware fakery, while a spate of fake iTunes emails caught several people off-guard, resulting in users running afoul of a malicious script that took advantage of a known Java exploit. GFI researchers also uncovered an Amazon receipt generator scam aimed at fooling retailers into honoring fraudulent receipts during the busy holiday shopping season.

December once again saw significant activity from Trojan threats, which continue to dominate the overall malware landscape. Seven of the top 10 malware detections were Trojans, with those seven accounting for almost 35% of all malware detections for the month. In addition to a range of Trojans, Worms also created major problems during December. Most significant was Worm.Win32.Downad.Gen (v), appearing at number seven in December's top 10, a detection for the Downadup worm, otherwise known as Conficker and Kido.

Taking advantage of a vulnerability in Windows Server service which allows remote code execution when file sharing is enabled, the Worm spreads across networks as well as removable drives, taking advantage of weak administrator passwords along the way. It commonly turns off some system services and anti-malcode protection, exposing infected systems to additional infection from other malware.

“Following on from the increased themed threat traffic we saw in November around Thanksgiving, Black Friday and Cyber Monday, criminals once again attempted to take advantage of Christmas and the holiday season with themed attacks designed to drive users towards infected sites and to trick them into opening infected email and executables. Themed attacks, along with themed SEO poisoning and fake application installs, are firmly established as a successful means for malware creators to distribute malcode and create disruption for organizations and families alike,” said Tom Kelchner, communications and research analyst for GFI Software.

“December is a challenging month for computing security, with many businesses shut for a prolonged period and consumers at home for the holidays. Casual computer use rises and vigilance can drop, creating opportunities for malware infection that would otherwise not happen the rest of the year. The top 10 serves as a stark reminder that IT security should not be taken for granted at any time,” Kelchner added.

The problem of fake software was highlighted by FraudTool.Win32.FakeVimes!delf (v), number nine on this month’s top 10. This is a heuristic detection for files associated with the FakeVimes family of rogue security products, illustrating the continued growth of fake and compromised security applications as a means to circulate and covertly install malware onto PCs.

ThreatNet is GFI Lab’s monitoring system that retrieves real-time data from VIPRE installations. Statistics come from tens of thousands of machines running VIPRE.

Top 10 detections for December

Detection

Type

Percent

Trojan.Win32.Generic!BT

Trojan

21.93

Trojan-Spy.Win32.Zbot.gen

Trojan

3.79

Trojan.Win32.Generic.pak!cobra

Trojan

3.14

Trojan.Win32.Generic!SB.0

Trojan

2.78

Exploit.PDF-JS.Gen (v)

PDF Exploit

1.79

INF.Autorun (v)

Trojan

1.63

Worm.Win32.Downad.Gen (v)

Worm

1.27

Trojan.ASF.Wimad (v)

Trojan

0.77

FraudTool.Win32.FakeVimes!delf (v)

Fake App 0.73

Trojan.Win32.Meredrop

Trojan

0.72

-----
Community News You Can Use
Click to read MORE news:
www.GeorgiaFrontPage.com
Twitter: @gafrontpage & @TheGATable @HookedonHistory
www.ArtsAcrossGeorgia.com
Twitter: @artsacrossga, @softnblue, @RimbomboAAG @FayetteFP

GFI Software Announces Top 10 Malware Threats for November

(BUSINESS WIRE)--GFI Software, a leading IT solutions provider for small and medium-sized enterprises, today announced the top 10 most prevalent malware threats for the month of November 2010. The report, compiled from monthly scans performed by GFI's award-winning anti-malware solution, VIPRE® Antivirus, and its antispyware tool, CounterSpy®, is a service of GFI Labs™.

As in recent months, Trojans dominated the threat landscape in November. ThreatNet data revealed that seven of the top 10 malware threats were classified as Trojans. The number-one detection, Trojan.Win32.Generic!BT, is a Trojan comprising over 20 percent of the ThreatNet detections.

Tom Kelchner, GFI Software communications and research analyst said, “There is another picture in the top-10 numbers. Three of them go after applications or server software that hasn’t been patched. The number six detection, Exploit.PDF-JS.Gen (v), tries to exploit a security flaw in PDF files with embedded JavaScript. That’s aiming at Adobe products. It often installs downloaders that pull down other malware from remote Web sites.”

Worm.Win32.Downad.Gen (v,) the Downadup worm (also called Conficker and Kido) in the number seven spot, is a worm that spreads across a network by taking advantage of a vulnerability in Windows Server service which allows remote code execution when file sharing is enabled. This vulnerability was patched some time ago.

Trojan.ASF.Wimad (v), in the number nine spot, is a VIPRE detection for a group of Trojanized Windows media files that exploit an old vulnerability in Windows Media Player. It redirects the victim’s browser to a web site to download malicious files. This is also is an old vulnerability that’s been fixed.

“If this malcode is still circulating, it means that the malcode writers are seeing a landscape with lots of unpatched and vulnerable machines. The conclusion is pretty clear for both enterprises and consumers: update Windows operating systems (including servers), browsers, Adobe products and media players and keep them updated,” said Kelchner.

ThreatNet is GFI Lab’s monitoring system that retrieves real-time data from VIPRE installations. Statistics come from tens of thousands of machines running VIPRE.

Top 10 detections for November
Detection				Type		Percent
1.		Trojan.Win32.Generic!BT		Trojan		22.44
2.		Trojan-Spy.Win32.Zbot.gen		Trojan		3.88
3.		Trojan.Win32.Generic.pak!cobra		Trojan		3.53
4.		Trojan.Win32.Generic!SB.0		Trojan		3.46
5.		INF.Autorun (v)		Trojan		1.83
6.		Exploit.PDF-JS.Gen (v)		Exploit		1.45
7.		Worm.Win32.Downad.Gen (v)		Worm.W32		1.42
8.		Trojan.Win32.Malware.a		Trojan		0.83
9.		Trojan.ASF.Wimad (v)		Trojan		0.76
10.		Trojan.Win32.Meredrop		Trojan Downloader		0.68

------
Community News You Can Use
Click to read MORE news:
www.GeorgiaFrontPage.com
Twitter: @gafrontpage & @TheGATable @HookedonHistory
www.ArtsAcrossGeorgia.com
Twitter: @artsacrossga, @softnblue, @RimbomboAAG
www.FayetteFrontPage.com
Twitter: @FayetteFP

Clayton State Student Help Desk Wins Video Contest at USG Computing Conference

Members of the Clayton State University’s IT student help desk, The HUB, have proven equally skilled in the video arena as they are in the information technology arena.

At the University System of Georgia’s recent 39th Annual Computing Conference at the Rock Eagle 4-H Center in Eatonton, Ga., the HUB won first place in the 2010 Video Contest with their LANDesk Man entry.

“LANDesk Man is our very own resident warrior against evil and viri!” exclaims Shannon Thomas, Clayton State director of Client Services. “LANDesk Man is capable of exterminating the nastiest, most frustrating forms of virtual infections with little effort nor stress to your computer's performance. LANDesk Man is as capable of vanquishing malicious programs within the blink of an eye.”

The HUB staff who created the winning video included Sherry Paul, Corey Wagner, Courtney Pipkins, Chris Baldwin, Simeon Payne, Ryan Belom, Daniel Stone and Broderick McNeal, along with help from the University’s Center for Instructional Development.

The Computing Conference provides the opportunity for technology professionals and technology users throughout the System to exchange information with their peers and gain an accurate picture of the current and future state of technology.

The HUB’s winning video can be seen at; http://thehub.clayton.edu/landesk/. For more HUB videos, visit their YouTube page at http://www.youtube.com/user/CSUTheHUB.

New Trojan Program Attacks Macintosh Computers

The following article is from Eastman's Online Genealogy Newsletter and is copyright by Richard W. Eastman. It is re-published here with the permission of the author. Information about the newsletter is available at http://www.eogn.com. 

Windows users have been plagued for years with viruses, keyloggers, Trojan horse programs, and other forms of malware (malevolent software). During this time, Macintosh users have simply smiled as their computers were safe and secure. Most Mac users don't even bother purchasing anti-virus programs as they have never had a need for such things. This complacency may be ending, however.

A newly discovered Trojan horse spreading through social networking sites, such as Facebook, MySpace and Twitter, targets Apple's Mac OS X operating system, including the latest version, 10.6 Snow Leopard, by baiting users into clicking a link. Computers become infected when someone visits a social networking site and sees a message that reads, "Is this you in this video?" Clicking the infected link loads an infected file into your computer.

Antivirus firm Intego issued a notice Wednesday suggesting that the Trojan, a Mac version of the "Koobface" worm, carries a "low risk." The security firm said that the current Mac OS X implementation is flawed, though it admitted the threat exists and is likely to become a more legitimate concern in the future. Apple is expected to soon release an operating system update that will block the new Trojan.

The program, called trojan.osx.boonana.a, runs a Java applet that attempts to download files to any Macintosh system. It then automatically launches an installer that modifies system files and allows remote access to all files on the system. It also checks in with control servers to report information from the infected system. The Trojan also automatically runs in the background at startup, and attempts to hide its activities across multiple files. The thieves who write this malware are then free to remotely connect to your computer and copy any files they wish.

If your computer becomes infected, it is easily cured. SecureMac has released a FREE removal tool to eliminate this threat, which can be downloaded by visiting http://www.securemac.com  or downloaded directly from http://macscan.securemac.com/files/BTRT.dmg

Intego's VirusBarrier X6 and X5 at http://www.intego.com/virusbarrier/ sells for $49.95 and will detect and remove the malware. It also offers ongoing protection to block future viruses and Trojans, unlike the free SecureMac program that only removes existing problems.

Luckily, the new Trojan is easily avoided. The safest course of action is to not use social networking sites (Facebook, MySpace and Twitter). However, if you insist on using such sites, never click on any messages or links, even if those messages and links that claim to be from people you know. Your friends' names and email addresses are easily forged by malware programs. The message "Is this you in this video?" is an obvious trap but future versions of this malware could easily use different messages.

Users can further protect themselves from infection by turning off Java in their web browser, although this will also block many legitimate web sites. Java can be turned off in Safari by clicking the Security tab under Safari Preferences, and making sure the "Enable Java" checkbox is unchecked. Firefox, Opera, Camino, and other web browsers also can run without Java.

Finally, use the security features built into OS X. Turn on the built-in firewall, especially when a computer is shared by multiple users. Instructions for turning it on may be found on a number of web sites, including at http://www.cmu.edu/computing/doc/security/mac/firewall.html

Again, the simplest and safest solution is to not visit web sites where viruses and Trojans are known to exist. At this time, the highest risk is on the social networking web sites.

Linux computers are not affected by the new Macintosh Trojan or by the various Windows viruses and Trojans.


-----
Community News You Can Use
Click to read MORE news:
www.GeorgiaFrontPage.com
Twitter: @gafrontpage & @TheGATable @HookedonHistory
www.ArtsAcrossGeorgia.com
Twitter: @artsacrossga, @softnblue, @RimbomboAAG
www.FayetteFrontPage.com
Twitter: @FayetteFP

GFI Software Announces Top 10 Malware Threats for August

(BUSINESS WIRE)--GFI Software, a leading IT solutions provider for small and medium-sized enterprises, today announced the top 10 most prevalent malware threats for the month of August 2010. The report, compiled from monthly scans performed by GFI's award-winning anti-malware solution, VIPRE® Antivirus, and its antispyware tool, CounterSpy®, is a service of GFI Labs™.

“Our research group is analyzing new rogues too, but what we’re seeing through ThreatNet indicates that VIPRE is preventing these rogue downloads.”

GFI VIPRE ThreatNet™ statistics for the month of August show that GFI customers were under attack throughout the month primarily by the same Trojan horse programs that have persisted for several months. In fact, the top four threats were unchanged in order from the month of July. Trojans detected as Trojan.Win32.Generic!BT were still the chief detection, slightly down to 25.11 percent of total detections. This particular Trojan detection has been in the top spot for some time: in July with 29.08 percent and in June with 27.16 percent of the total detections.

The number two detection, Trojan-Spy.Win32.Zbot.gen is a detection of password-stealing Trojans with many versions. The third largest detection, Trojan.Win32.Generic.pak!cobra, is a generic detection for a variety of malware that can infect 32- and 64-bit Windows installations.

“Detections of this malicious code indicate that botnet operators continue to try to infect machines and use them in their spamming networks,” said Francis Montesino, manager of the malware processing team, GFI Labs. “Our ThreatNet detections for the month also agree with other reports we’ve heard in the last few weeks that have found a high level of traffic in rogue security products. These are often referred to as scareware. We’re seeing a multitude of detections of the downloaders and installers that are associated with the rogues.

Montesino continued, “Our research group is analyzing new rogues too, but what we’re seeing through ThreatNet indicates that VIPRE is preventing these rogue downloads.”

The top 10 results represent the number of times a particular malware infection was detected during VIPRE and CounterSpy scans that report back to ThreatNet, GFI’s community of opt-in users. These threats are classified as moderate to severe based on method of installation among other criteria established by GFI Labs. The majority of these threats propagate through stealth installations or social engineering.

The top 10 most prevalent malware threats for the month of August are:
1. Trojan.Win32.Generic!BT 25.11%

2. Trojan-Spy.Win32.Zbot.gen 4.23%

3. Trojan.Win32.Generic.pak!cobra 3.61%

4. INF.Autorun (v) 3.27%

5. Trojan.Win32.Generic!SB.0 2.01%

6. BehavesLike.Win32.Malware (v) 1.04%

7. Worm.Win32.Downad.Gen (v) 0.96%

8. Trojan.Win32.Malware.a 0.93%

9. Trojan.Win32.Meredrop 0.92%

10. Exploit.PDF-JS.Gen (v) 0.84%

-----
Community News You Can Use
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page
Follow us on Twitter:  @GAFrontPage

FBI, Slovenian and Spanish Police Arrests Mariposa Botnet Creator, Operators

The FBI, in partnership with the Slovenian Criminal Police and the Spanish Guardia Civil, announced today significant developments in a two-year investigation of the creator and operators of the Mariposa Botnet. A botnet is a network of remote-controlled compromised computers.

The Mariposa Botnet was built with a computer virus known as “Butterfly Bot” and was used to steal passwords for websites and financial institutions. It stole computer users’ credit card and bank account information, launched denial of service attacks, and spread viruses. Industry experts estimated the Mariposa Botnet may have infected as many as 8 million to 12 million computers.

“In the last two years, the software used to create the Mariposa botnet was sold to hundreds of other criminals, making it one of the most notorious in the world,” said FBI Director Robert S. Mueller, III. “These cyber intrusions, thefts, and frauds undermine the integrity of the Internet and the businesses that rely on it; they also threaten the privacy and pocketbooks of all who use the Internet.”

In February, the Spanish Guardia Civil arrested three suspected Mariposa Botnet operators: “Netkairo,” “Jonyloleante,” and “Ostiator,” aka Florencio Carro Ruiz, Jonathan Pazos Rivera, and Juan Jose Bellido Rios. These individuals are being prosecuted in Spain for computer crimes.

Last week, the Slovenian Criminal Police identified and arrested the Mariposa Botnet’s suspected creator, a 23-year-old Slovenian citizen known as “Iserdo.” The work of the Slovenian and Spanish authorities was integral to this investigation.

FBI Cyber Division Assistant Director Gordon M. Snow said: “This case shows the value of strong partnerships among law enforcement agencies worldwide in the fight against cyber criminals. Cyber crime knows no boundaries, and without international collaboration, our efforts to dismantle these operations would be impossible. The FBI praises the work of our Slovenian and Spanish partners who worked closely with our agents in this case.”

In a statement, Slovenian Minister of the Interior Katarina Kresal and Director General Janko Gorsek, Slovenian Criminal Police, said: “We are glad to cooperate with the United States; the FBI’s assistance is invaluable and represents professional affirmation of our force. This case shows that cyber crime issues call for international police cooperation that shouldn’t be hindered by geographical borders. The FBI has demonstrated a high level of collaboration in which our countries were equal partners, which was crucial for the success of the investigation and reducing the threat on a global level. This partnership serves as a solid basis for future cooperation.”

Maj. Juan Salom, commander of the Guardia Civil’s Cyber Crime Division, noted: “The Mariposa case showed how the coordinated and joint actions of different international police forces, along with the efforts of the Internet security industry, have been able to face the global threat of cyber crime,” he said. “The cyber kingpins know that they are not invincible anymore because the global efforts of the FBI, Slovenian Criminal Police, and Spanish Guardia Civil have shown that it doesn’t matter where or how they try to hide, they will be located and prosecuted.”

From 2008 to 2010, the Slovenian citizen created “Butterfly Bot” and sold it to other criminals worldwide. In turn, these criminals developed networks of infected computers—botnets—and the Mariposa variety from Spain was the most notorious and largest. In addition to selling the Butterfly Bot program, the Slovenian citizen developed customized versions for certain customers and created and sold plug-ins (add-ons) to augment the botnet’s features and functionality.

This case is significant because it targeted not only the operators of the botnet but also the creator of the malicious software that was used to build and operate it. The success of this investigation was made possible because of the skill, professionalism, and commitment of the Slovenian Criminal Police’s Cyber Crime Division and the Spanish Guardia Civil’s Computer Crimes Group.

The FBI conducted this investigation with the assistance of the United States Attorney’s Office, District of Hawaii, and the Department of Justice’s Computer Crime and Intellectual Property Section, Office of International Affairs, and the Botnet Threat Focus Cell. The FBI also received invaluable assistance from the Mariposa Working Group.

------
Community News You Can Use
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page
Follow us on Twitter:  @GAFrontPage

Michael Jackson's Death, Swine Flu and Obama's Presidency Were Top Three Issues Used to Distribute Malware This Year, According to PandaLabs

/PRNewswire/ -- Panda Security, the Cloud Security Company, today announced that PandaLabs, the company's laboratory for detecting and analyzing malware, has published an analysis of major malware campaigns in 2009 and determined that cybercriminals are more frequently using current events as their primary vehicles for distributing malware.

Michael Jackson's death, swine flu and Barack Obama's political campaign and presidency have been the top issues used by hackers in the past year to distribute viruses via email or through social media such as Twitter or Facebook. By being aware of people's increasing use of the Internet to search for the latest news on social events, virus creators are relying upon highly trafficked terms and the latest news items as bait to spread viruses.

Issues involving applications for spying on partners when suspecting infidelity are also highly successful. For example, attackers have been offering applications that supposedly allow people to read the SMS messages sent or received on a specific cell phone via the Internet. Visual representations of these types of messages can be found here on Flickr:


http://farm4.static.flickr.com/3574/3788395766_453dee9d10_m.jpg
http://farm4.static.flickr.com/3458/3788395738_812abf7621_m.jpg


PandaLabs' study of the top issues cybercriminals used from January to July to distribute viruses resulted in the following breakdown:

Topic %
Michael Jackson's death 30%
H1N1 (swine flu) virus 27%
Obama's campaign and presidency 11%
Software to spy on partners' SMSs 9%
Independence Day 8%
Reuters agency news 5%
Online shopping discount vouchers 4%
Valentine's Day cards 2%
Farrah Fawcett's death 2%
Links to Pussycat Dolls videos 1%
Other 1%


One of the most active virus families as of late is Waledac. Waledac appeared two years ago and is still thriving, using topics like those above. For more information about these techniques, please visit: http://www.pandasecurity.com/img/enc/Boletines%20PandaLabs5_en.pdf.

Simple Tips to Avoid Falling Victim

Usually, once attackers have attracted attention, they redirect users to web pages to view or download something. However, YouTube's official website, for example, does not require users to download a codec to watch videos. If you are taken to a Web page that looks exactly the same as a legitimate one, such as YouTube, for example, make sure that the URL displayed in the address bar is the official one.

If you don't know what the official address is, find it by performing a search in any of the search engines that you normally use. Generally, the first result corresponds to the official site.

You can use security software to avoid carrying out these checks manually.

If you do not have a solution that provides this service and do not know whether the Web page accessed is dubious, you can still prevent your computer from being infected. Remember that you must agree to the file download for the malicious code to download and install on the system. Finally, scan every file with a security solution before running it.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Almost 30,000 Videos on YouTube Contain Comments with Links to a Malicious Web Page, Reports PandaLabs

/PRNewswire/ -- PandaLabs, Panda Security's malware analysis and detection laboratory, has approximately 30,000 videos on YouTube with comments containing links that point to a Web page designed to download malware. This is another example of how cyber-criminals are attacking popular Web 2.0 sites to distribute malware. Similar attacks have previously been seen, to a lesser extent, on sites including Digg.com and Facebook.

The comments are normally suggestive, claiming that the link will take users to a legal Web page with pornographic content. You can see an image here: http://www.flickr.com/photos/panda_security/3548358349/.

However, when users click the link, they are taken to a page that spoofs the original and which is really designed to download malware. On this page, users will be prompted to download a file in order to view the video. If they take the bait, users will really be downloading a copy of the PrivacyCenter fake antivirus.

This malware, when run on a computer, pretends to scan the system, supposedly detecting dozens of (non-existent) viruses. It then offers users the chance to buy the paid version of the antivirus to clean their computers. The ultimate aim of cyber-crooks is to profit from the sale of this 'Premium' version of the fake software.

"The technique of using malicious comments on YouTube is not new," explains Luis Corrons, technical director of PandaLabs. "What is alarming however, is the quantity of links we have detected pointing to the same Web page. This suggests that cyber-criminals are using automation tools to publish these comments."

-----
Community News You Can Use
www.fayettefrontpage.com
www.georgiafrontpage.com
www.politicalpotluck.com
Follow on Twitter @GAFrontPage

Is Your Computer Safe From the Swine Flu?

There have been numerous reports of scam artists attacking computers using the swine flu as bait. Below is the story released yesterday by the Consumer Affairs on the subject.


Watch Out For Swine Flu Scams
Con artists quick to exploit new situation
April 29, 2009

It didn’t take scammers long to latch on to the latest hot button topic to try and make a quick buck. Scams built around fears of swine flu are proliferating quickly across the Internet.

The U.S. Computer Emergency Readiness Team issued an alert this week, warning.....http://www.consumeraffairs.com/news04/2009/04/swineflu09.html

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page
Twitter @GAFrontPage

April Fools' Emails May Contain Not So Funny Virus

/PRNewswire / -- For the past two years, April Fools' Day has brought technology turmoil to millions of computer users across the globe. On April 1st, 2007, the ANI worm spread around the globe using an exploit found in Windows, while last year the Storm worm spread voraciously in email messages that were sent using an April Fools' theme. In a preemptive strike against any threats this April Fools' Day, network security provider Stonesoft advises computer users to be extra cautious when opening April Fools' messages.

April Fools' Day is known to be a time when new data security threats arise and old ones are reactivated. This year, there has been much discussion around the expected update of the Conficker network worm, which is said to be the worst in the virus history. However, it is yet to be seen what sort of damage an update would incur.

"The reason data security threats emerge around April Fools' Day is quite understandable," says Olli-Pekka Niemi, a vulnerability expert at Stonesoft. "The same thing happens around most public holidays or, for example, Valentine's Day. Even if people receive email messages from unknown addresses, they tend to open the greetings more easily in hope for a juicy April Fools' joke."

As it is impossible to forecast the timing or severity of network security threats, Niemi emphasizes the importance of prevention: "The most important thing is to remember the basics. Make sure all programs are up-to-date, especially your security programs. In addition, common sense takes you far. Avoid surfing unknown sites and opening messages or attachments from unknown addresses," Niemi reminds. "It may be common knowledge to most Internet users, but as we've seen over the years, people need to be reminded about the basics from time to time."

For more information on Stonesoft's network security solutions and insight into current computer security threats, please visit www.stonesoft.com.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Fraudulent Spam E-mail Purported From FBI Deputy Director John S. Pistole

A spam e-mail claiming to be from FBI Deputy Director John S. Pistole is currently being circulated. This attempt to defraud is the typical e-mail scam using the name and reputation
of an FBI official to create an air of authenticity.

As with many scams, the e-mail advises the recipient that they are the beneficiary of a large sum of money which they will be permitted to access once fees are paid and personal banking information is provided. The appearance of the e-mail leads the reader to believe that it is from FBI Deputy Director John S. Pistole.

This e-mail is a hoax. Do not respond.

The IC3 continues to receive and develop intelligence regarding fraud schemes misrepresenting
the FBI and/or FBI officials. The scam e-mails give the appearance of legitimacy through the use of pictures of FBI officials, seal, letter head, and/or banners.

These fraud schemes claim to be from domestic as well as international FBI offices. The typical types of schemes utilizing the names of FBI officials and/or the FBI are lottery endorsements and inheritance notifications but can cover a range of scams from threats and malicious computer program attachments (malware) to online auction scams.

These scams use the social engineering technique of employing the FBI's name to intimidate and convince the recipient the e-mail is legitimate.

Please be cautious of any unsolicited e-mail referencing the FBI, Director Mueller, Deputy Director Pistole or any other FBI official claiming that the FBI is endorsing any type of Internet activity.

Always be cautious when responding to requests or special offers delivered through
unsolicited e-mail:

* Guard your personal information as well as your account information carefully.
* You should never give any personal, credit, or banking information in response to
unsolicited e-mails.

Consumers always need to be alert to unsolicited e-mails. Do not open unsolicited e-mails or click on any embedded links, as they may contain viruses or malware. Providing your PII will compromise your identity!

If you have received this e-mail, or a similar e-mail, please file a complaint at www.IC3.gov.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Google Trends Used to Promote Fake Anti-Virus Software

PRNewswire/ -- Internet criminals are using Search Engine Optimization tactics to promote links to free hosted blog sites in an attempt to dupe unsuspecting visitors into infecting themselves with malware and fake anti-virus products, say experts from Marshal's TRACE threat team.

Criminals are using tools such as Google Trends to identify the most popular and current Internet search terms. The same criminals then use new blogs on free hosting sites, such as Windows Live Spaces and AOL Journals, featuring the same search terms. When an Internet user then makes a search using those popular terms they get multiple links to these hosted blog sites in their search results. If the user then clicks on the link, thinking it is relevant to their desired search, they are taken to a blog site with an apparent embedded video player. If the user clicks on the video player, they are prompted to load a 'codec', which surreptitiously loads malware, including fake anti-virus software that promises to clean non existent viruses from the computer in return for their credit card details.

"A recent example of an exploited search term was 'OJ Simpson Verdict'," said Phil Hay, lead threat analyst for Marshal's TRACE Team. "The criminals identify this as a 'hot' search term and then ensure their Windows Live Spaces blog contains 'OJ Simpson Verdict'. This promotes the blog up the order in Google search results and increases the chances that users will hit those web pages."

"Using search engine optimization to promote web pages hosting malware shows increasing levels of sophistication and professionalism on the part of the criminals," said Hay. "The use of fake video players to disguise the installation of fake anti-virus programs is not new. This kind of activity has been going on for many months now, but previously the links have been promoted via spam. This new approach shows a diversification of tactics."

According to Marshal, the malicious executables downloaded by clicking on the fake video player are not reliably detected as malware by established antivirus programs, further adding to the seriousness of the criminal's activity.

"Fake anti-virus programs are especially prevalent right now," said Hay. "Once installed, the program pops up and tells you it has found viruses on your computer and offers to clean these if you are willing to pay via credit card. The viruses the program reports are fake, the program itself is fake and the so called legitimate company you deal with is fake. The whole thing is a con designed to part you from your money. It is fairly sophisticated and convincing."

"Now the criminals are trying new methods of promoting their malicious web pages that aren't dependant on spam. Our advice is to not blindly trust results from Google searches, and be wary of these kinds of links to hosted blog sites. Also, if you are unfortunate enough to be infected by one of these fake anti-virus products, do not provide any credit card information or payment of any kind. Use a legitimate and reputable anti-virus solution from a name brand vendor," said Hay.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page

Top 10 Ways To Stay Safe Online

(NAPSI)-You don't have to be a computer genius to protect yourself online and you don't have to spend a lot of money. By following a few commonsense tips, you can make the most out of your Internet experience while protecting yourself and your family from online threats.

1) Protect your computer. The best thing you can do to keep the bad guys out of your computer is to use three inexpensive technologies: anti-virus software, anti-spyware software and a firewall. Some security companies provide all three in one easy-to-use package.

2) Protect your identity. On the Internet, your personal data (Social Security number, birth date, etc.) is extremely valuable and can be used against you. Keep it protected.

3) Protect your children. Children face unique risks on the Internet and require unique rules and safeguards. Monitor your kids' online activities closely. There are many tools available to help you protect them from online threats.

4) Stay up to date. Those security tools won't do any good unless you keep them up to date. You should be able to set them to update automatically. The same goes for your computer itself. It should be set to automatically install security updates.

5) E-mail safely. E-mail is a favorite tool of online crooks. Even legitimate-looking messages can be scams. Learn how to filter for "spam" and spot the signs of scam e-mails.

6) Protect your accounts. Choosing hard-to-guess passwords and changing them regularly can help prevent criminals from getting at your money or personal information.

7) Make copies. Regularly backing up your music, photos and other important files can save you if your computer crashes or is stolen.

8) Know your options. If something does go wrong, there are resources available to help get you back on your feet.

9) Keep informed. Subscribe to the National Cyber Alert System from the U.S. Computer Emergency Readiness Team at www.uscert.gov. Through the alert system, you can receive timely information about current cyber security problems to protect home and office computers.

10) Get your school involved. Suggest or sponsor an event at your local school or university designed to increase student and staff cyber security education and awareness. Download EDUCAUSE's cyber resource kit online at www.educause.edu.

-----
www.fayettefrontpage.com
Fayette Front Page
www.georgiafrontpage.com
Georgia Front Page
www.artsacrossgeorgia.com
Arts Across Georgia