Beware the Valentines Day Storm

No, I’m not talking about your spouses reaction if you forget a gift on Thursday, February 14^th. Like many past holidays the well known “Storm” Trojan is using the upcoming theme of love to trick users into clicking on malicious sites.

Typical Email subject lines that I’ve already looked into include:

• Our Love is Free
  
• Happy Valentines day
  
• I Would Dream
  
• Hugging My Pillow
  
• Inside My Heart
  
• Sending You My Love
  
• The Dance of Love
  
• Eternal Love
  
• A Rose for my Love

You get the idea right? As always, I recommend against clicking on links you’ve received in E-mails. It’s also important that you download new Windows security updates in a timely manner. Most Trojans like Storm depend on security holes which haven’t yet been patched.

Just to be sure it’s clear, this kind of Trojan is a bad thing.
Many of you may think of a Trojan as something that protects you against disease and untimely new family members. A computer Trojan is analogous to the legend of the large wooden horse used by the Trojan army to conquer the city of Troy.

Read More

Winter.exe comes in like a Lion

Earlier this month I started to see an increase in requests for a file name Winter.exe. I didn't have a good feeling about this filename and our follow up research proved I was correct. Our friend Temerc has a good write up on this infiltration at his forum, Temerc Internet Countermeasures. The other exe’s that appear to be included are infos.exe, autos.exe and a few randomly created filename. Fortunately, they all show up in WinPatrols’ startup programs list. The filename bronto.dll showed up in our IE Helpers list.

Google has done a good job at making it easy for people to create Blogs, but in many ways, it’s too easy. A huge number of Google Blogspot, blogs are being created and have become host sites for this file and other malicious programs. I wrote earlier his month that Spamhaus was blocking any Email which included a Google blog in the content of the message. This was a dramatic step but has proved to be necessary.

Trend Micro is referring to these blog traps as “Poisonous Blogs”. There are a number of ways you might get to these blogs including…

• A link to the Blog is included in a teaser Email.
  (Typically, it’s a greeting card, free product, drug or naked celebrity. This week we’ve frequently seen what claims to be video of Bhutto’s assassination)


• The blog might show up in a typical Google search.
  (These sites are too new to be validated by programs like SiteAdvisor)


• You click on the “Next” button on a Blogspot site.
  (This feature is disabled on Bits from Bill)

Our friends at SunbeltBlog have also written about this topic and show how easy it can be to run across these blog traps. Alex at Sunbelt provided some good screen shots and stresses how video “codec” scams are frequently used as an malware entry point.

If you see a message that says “You need to download new version of Video ActiveX Object to play this video file”, run away! Don't press cancel or even trust the red close box in the corner. Press Ctrl-Alt-Del and look at your list of processes. Select your browser( iexplore.exe or firefox.exe) and click on End Process.

Read More

Biggest Security Hole Continues to be People

In the old days the easiest way to access a computer system was to go directly through a human. It wasn’t always done through the use of wargames dialer which dialed up phone numbers in search of computers with modems. Most time it was as easy as calling a secretary at the computer center and saying…

“Hi, this is Fred from IBM. We found a problem with the computer system and it appears most of your data has disappeared. I’m not sure if you’re responsible but we need your account and password to fix this problem.”

It may sound silly but it worked and the same methods are used today. They’re just a little more sophisticated.

When the storm Trojan was first detected I didn’t give it a lot of consideration. I even suggested that everyone was over reacting.

“Are attachments like this still getting through Email filters? Are people downloading attachments with names like, video.exe, full video.exe, Read More.exe, Full Text.exe or Full Clip.exe to see new stories? I say no. At least not to the extent deserving of this weekends attention.”

I’m willing to admit my evaluation at the time may have been shortsighted. When the attack is this large, it doesn’t take a huge percentage of victims for a problem to become serious.

It’s not as difficult as you might think to get folks to fall prey to a socially engineered attack. I’m sure a large number of intelligent people believed it when “Your family member has sent you an eCard” arrived in their Email.

The most effective attacks I’ve been tracing try to scare readers into taking an action when they think they’ve already had their account or machine compromised.

The following are other examples I’ve seen regularly in my Email. What would you do if you thought someone had purchased a new Dell computer using your PayPal account?

And how bad would you feel if someone gave you a bad recommendation on eBay?

I have a pretty good imagination and it didn’t take me long to think of other examples on my own. Here’s one that targets users in the U.S and I’m guessing it would trick a number of folks into granting full access even pass their firewall.

Obviously, user education will never be 100% effective but don’t panic. A lot of folks like myself will continue to spend time coming up with new ideas on how to reduce and/or prevent damages.

In case you are interested, you really can receive Amber alerts on your computer or mobile device by signing up at http://www.amberalert.gov/

Read More