Malware News

Vulnerability in Gmail can help with theft of domains

Recently in the Internet there was an information that vulnerability in Gmail service which was considered for a long time already eliminated, actually is not eliminated completely. Therefore your account can become a potential victim of theft and harmful attacks. About presence of this vulnerability it became known in December, 2007 when David Airey has suffered from theft of his own web site. Later Google has declared that the problem has been solved, however, seemingly, it still exists. Problems begin when you enter into your Gmail account and then visit a harmful web site. It is not important, whether you click on the link from the account or not, the harmful site in any case is capable to get access to your internal “identification cards”.

Read the rest of this entry »

Lockheed Martin and Boeing will be engaged in the state cybersafety

Bloomberg informs that two largest world defensive contractors, American Lockheed Martin and Boeing, allocate resources and prepare for expansion of forces for work in a new direction - cybersafety. In the companies say that the market large corporate and state orders in the field of cybersafety by 2013 will reach 11 billion dollars and as the most part of these expenses will have on the American networks two companies start to prepare for pie section in advance.

Read the rest of this entry »

System Security: new rogue application

System Security is new rogue software. The installer is hosted at http://webnetworksecurity.com (91.211.64.31).
view additional information on System Security

Microsoft confirms presence of new vulnerability in SQL Server

Microsoft company has confirmed existence of new potentially serious threat of security for users of its databases SQL Server. Vulnerability is detected in one of procedures of duplicating of tables of subscription which under certain conditions can lead to remote performance of a code. However while Microsoft did not hear, that someone used this hole in protection or that someone from users has suffered from it.

The company has told about presence of vulnerability last Monday. The hole in protection is linked to “incorrect check of parametres” in procedure “sp_replwritetovarbin”, used for duplicating of tables of subscription for users. According to Microsoft vulnerability can lead to remote performance of a code for users of various versions of Microsoft SQL Server into which list have not entered only Microsoft SQL Server 7.0 Service Pack 4, Microsoft SQL Server 2005 Service Pack 3 and Microsoft SQL Server 2008 which, according to the company, are not subject to this danger. Besides, for usage of this vulnerability attacking it is necessary or authentificate, or to use advantages of vulnerability “SQL injections” which leads to authentification. Also, MSDE 2000 and SQL Server 2005 Express by default do not resolve ras connections. Therefore for usage of this vulnerability on these systems attacking it is required to initiate locally explot.

Now the question still is researched by the company by results of what she has promised to accept “suitable operation”, to protect the users. However while Microsoft has only offered a solution technique, allowing to lock attack, but, however, not eliminating a problem absolutely. The method consists in prohibition of performance of procedure “sp_replwritetovarbin” that as a result will pour out for lack of upgrades of tables for “refreshed subscriptions” (updatable subscriptions).

Photo frames with viruses

Samsung company has warned that compact discs with the software for some models of digital photo frames can contain the Trojan program.

Harmful program W32.Sality.AE can get into system at installation from a compact disc of application Frame Manager for operating system Windows XP. Samsung asserts that the malware doesn’t work under Windows Vista.

Developers of security software have registered for the first time W32.Sality in April of this year. In due time updated anti-virus programs easily find out this harmful application.

According to the official prevention os Samsung, compact discs with the malware may be included into the package of photo frames of the following models: SPF-75H, SPF-76H, SPF-85H, SPF-85P and SPF-105P. The manufacturer recommends to refrain from installation from a disk and to download corresponding version Frame Manager from the download center of Samsung.

Malware developers choose the target of buyers of digital photo frames not for the first time. So, in the beginning of this year company Best Buy has stopped sales of photo frameks Insignia infected with a virus.

Chinese hackers will do 7 years in prison

The government of China has offered the new law, according to which persons plead guilty of illegal access to computer systems, will be punished in the form of imprisonment for a period of seven years.

On Monday in Standing committee of China meeting of national representatives (it is the highest legislative body of China) the second reading of the bill has taken place. As the Chinese mass-media informs, the correction to the operating Criminal code provides almost identical degree of responsibility and similar punishments for cybercriminals and those who provides them with equipment and software.

Correction acceptance will provide law enforcement bodies and judicial authority of China with the first lawful resource of opposition to the wave which has overflowed the country of thefts of the personal data. Now the Criminal code of the Peoples Republic of China provides punishment only for the persons making illegal penetration into the state computer systems. According to official figures, in one only provinces Hunan criminals daily steal passwords to twenty thousand accounts of on-line games, whose common market cost is estimated in 200 thousand yuans (almost $30 thousand). The authorities of the Peoples Republic of China see serious threat of informational safety in these operations and intend to regard them as criminal offences.

In 2009 amount of malware will increase

Experts from PandaLabs predict further increase of amount of malware programs.

From January till August 2008 Panda Security laboratory has found out the same quantity of new kinds of malware that for previous seventeen years together taken. In 2009 this tendency, according to experts, will remain or even progress.

In forthcoming year dominating types of harmful programs, according to PandaLabs forecast, will become bank trojans and fake antiviruses. Cybercriminals will rely even more often on social networks and quite legal resources cracked through vulnerability in server platforms. Besides, experts mark, next year the technics of packing of a harmful code by means of special custom-made tools for the purpose of difficulty of its detection becomes especially popular.

Panda Security Laboratory also predicts substantial growth of quantity of the harmful software aimed at platforms of increasing popularity, such as Mac OS X, Linux or iPhone. Besides, in the conditions of financial crisis it is necessary to expect growth of popularity of false offers on the work which purpose consists in attraction of monetary actives.

For 2009 experts predict revival of classical harmful codes, such as viruses. These programs will be used not to violate correct work of systems or block access to files, but for the purpose of masking of trojans, used for theft of the bank information.

The USA are not ready for a cyberwar

The two-day excercices which have passed in the USA last week, have proved inability of the country to protect it’s key computer networks from encroachments from the outside.

In the exersices organised by consulting company Booz Allen Hamilton, 230 representatives of government agencies, the private companies and public organisations have taken part. Experts should stop conditional intrusion, using real skills and receptions. Experiment has shown that in case of the massed cyberattack Americans can have complexities in distribution of duties, planning, communication and other aspects. As vice-president Booz Allen Hamilton Mark Gerencser has declared, now the United States do not have any strategy, applicable to a similar situation. He also has  noted absence of the official which could incur a management in case of threat.

James Langevin, the head of subcommittee of the Congress of the USA of cybersecurity, also has expressed concern concerning a condition of information security of the country. Successful attack to key computer networks can lead to refusal of an electrical supply and crash of bank system.

On termination of experiment before its participants the head of the Ministry of internal security of the USA Michael Chertoff has acted. In his opinion, in not so long-term future the cyberattack will become the standard actions previous to army operations. In this connection the minister has specified in necessity of updating of the international legislation and military doctrines. Now to the USA there is an active discussion of a question on establishment of a post of the adviser of the president on cybersafety.

The USA are in the lead by quantity of websites with malware

Sophos company has published the total report with results of the analysis of a situation with safety in the Internet in 2008.

Today, most of sites with malicious software — 37 % — are hosted on the American servers. The second place in the rating is China with 27,7 % of potentially dangerous web pages. Russia takes 9,1 % from total of sites with malware and closes a three of the antileaders.

Further in decreasing order of number of harmful resources follow: Germany (2,3 %), South Korea (2,1 %), Ukraine (1,8 %), Great Britain (1,7 %), Turkey (1,5 %), the Czech Republic (1,3 %) and Thailand (1,2 %). The least dangerous is Singapore — 0,3 %.

Sophos company also notices that in leaving year the United States were the leader in amount of distributed spam. Today through computers located in the USA 17,5 % of all spams-letters are dispatched. Some reduction of volumes of a spam has been noted in the end of autumn in connection with closing of American hosting-provider McColo on which resources the command centres of several of the largest botnets worked. According to the research, frauds more and more often attack users of social networks, and the quantity of letters with harmful investments for a year has grown five times. At the same time in 2008 demountable carriers became one of the basic tools of distribution of malicious programs.

The computer worm entices victims with discounts at “McDonald’s” restaurants

PandaLabs warns about mass dispatch of electronic letters with the harmful program P2PShared.U, disguised under messages from a network of restaurants of a fast food “McDonalds”.

In heading of the infected letters it is said that “McDonald’s” wishes addressees of happy Christmas. The letter text looks as follows: “McDonald’s” is glad to present you the last menu with huge discounts. Simply print the coupon from this message and go to the nearest McDonald’s for FREE gifts and FANTASTIC discounts ». Messages look so as if start with domain Mcdonalds.

The users, fallen for the bait malefactors and agreed to follow to instructions in the letter, instead of the discount in McDonald’s receive harmful program P2PShared.U Having got on the computer of a victim, this worm starts to dispatch the copies on the found e-mail addresses. Besides, P2PShared.U copies itself in the folders used by file exchange programs, under the names related to security applications, multimedia tools and so on. Thus, the user, tried to download any of these applications, gets infected also.