DNS Changer Malware- its effects and how to secure your computer from this

DNSChanger Malware has been infecting computers from November last year.

The roughly half a million devices are still infected with DNSChanger.

Infected machines had their Domain Name System settings altered so websites would redirect to servers controlled by the criminals. The scammers reportedly earned millions in affiliate and referral fees by diverting users through those sites.

Computers affected with this Trojan will not be able to access Internet after 9th July.

If infected machines are not fixed by then, their Internet connections will go dark.

On Google, infected computers will see a warning atop their screen when completing a search (see below). 

  

Read more about this Malware and how to check whether your computer has been infected by this here in FBI’s Publication

http://www.fbi.gov/news/stories/2011/november/malware_110911/DNS-changer-malware.pdf

Tech Buzzwords that's selected as Words of the year - 2011 by Oxford Dictionary

• Arab Spring: A series of anti-government uprisings in various countries in North Africa and the Middle East, beginning in Tunisia in December 2010.
• Bunga bunga: Used in reference to parties hosted by the former Italian prime minister Silvio Berlusconi, at which various illicit sexual activities were alleged to have taken place.
• Clicktivism: The use of social media and other online methods to promote a cause.
• Crowdfunding: The practice of funding a project or venture by raising many small amounts of money from a large number of people, typically via the Internet.
• Fracking: The forcing open of fissures in subterranean rocks by introducing liquid at high pressure, especially to extract oil or gas.
• Gamification: The application of concepts and techniques from games to other areas of activity, for instance as an online marketing technique.
• Occupy: The name given to an international movement protesting against perceived economic injustice by occupying buildings or public places and staying there for an extended period of time.
• The 99%: The bottom 99% of income earners, regarded collectively.
• Tiger mother: A demanding mother who pushes her children to high achievement using methods regarded as typical of Asian childrearing.
• Sifi: A bank or other financial institution regarded as so vital to the functioning of the overall economy that it cannot be allowed to fail, a.k.a. “systemically important financial institution.”

No Major Application implement DEP and ASLR for preventing unauthorized programs for taking over your PC

Big-name Windows applications neglect security

Two important security technologies, Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), go a long way toward preventing unauthorized programs from taking over a PC. And Secunia Research just published a white paper with a disturbing analysis of popular Windows programs that don't use either. Windows XP Service Pack 2 introduced DEP back in 2004. It's is a technique that uses both hardware and software to keep a PC from executing programs that sit in areas that should be holding data. Historically, one of the easiest and most fruitful ways to take over a PC involves a buffer overflow - where an attack routine sticks a malicious program inside a data area and then tricks Windows into "running" the data. When a program asks Windows for DEP protection, and the hardware supports DEP, buffer overflow attacks are considerably more difficult. Not impossible, mind you, but DEP does pretty well blocking the most common and straightforward attacks.

ASLR arrived with the release of Windows Vista in 2007. When a program tells Windows that it wants to use ASLR, Windows sticks pieces of the program in randomly assigned parts of memory. If an attacker tries to access a specific location in the program, the attacker has to guess the location of the pertinent piece of the program, which can be quite difficult. Together DEP and ASLR aren't invincible, but they're formidable. In Windows 7 (and to a lesser extent Vista), turning on both DEP and ASLR is reasonably easy if the program is written properly and doesn't use certain undesirable coding techniques that fell out of favor years ago. That's why it's so shocking that many of the programs you and your users run every day don't support either or both.

Secunia tested sixteen applications - the most commonly used Windows apps as reported by Secunia's PSI scanning program. Each of the tested programs has been used as the vector in a real attack in the past two years. As of last month, none of these programs use DEP: Sun's Java JRE, Apple's QuickTime, Apple's iTunes (running on Win XP), OpenOffice, Google's Picasa, Foxit Reader, VLC Media Player, AOL's Winamp, and RealPlayer. Secunia determined that if a program doesn't use DEP, there's no reason to check for ASLR - kind of a security crawl-before-you-can-walk situation.

Read full story here : http://www.codeguru.com/daily_news/article.php/405208

WireShark- one of the best network protocol analyzer

Today I came to know one of the best network protocl analyzer called : wireshark.

According to it’s site :

Wireshark is the world's foremost network protocol analyzer, and is the de facto (and often de jure) standard across many industries and educational institutions.

Features

Wireshark has a rich feature set which includes the following:

• Deep inspection of hundreds of protocols, with more being added all the time
• Live capture and offline analysis
• Standard three-pane packet browser
• Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
• Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
• The most powerful display filters in the industry
• Rich VoIP analysis
• Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
• Capture files compressed with gzip can be decompressed on the fly
• Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platform)
• Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
• Coloring rules can be applied to the packet list for quick, intuitive analysis
• Output can be exported to XML, PostScript®, CSV, or plain text

 

Get the Software from this site: http://www.wireshark.org

Symantec Security "best practices" for system admins

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":
• Use a firewall to block all incoming connections from the Internet to services that should not be publicly available. By default, you should deny all incoming connections and only allow services you explicitly want to offer to the outside world.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.
• Disable AutoPlay to prevent the automatic launching of executable files on network and removable drives, and disconnect the drives when not required. If write access is not required, enable read-only mode if the option is available.
• Turn off file sharing if not needed. If file sharing is required, use ACLs and password protection to limit access. Disable anonymous access to shared folders. Grant access only to user accounts with strong passwords to folders that must be shared.
• Turn off and remove unnecessary services. By default, many operating systems install auxiliary services that are not critical. These services are avenues of attack. If they are removed, threats have less avenues of attack.
• If a threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread threats, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate compromised computers quickly to prevent threats from spreading further. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.
• If Bluetooth is not required for mobile devices, it should be turned off. If you require its use, ensure that the device's visibility is set to "Hidden" so that it cannot be scanned by other Bluetooth devices. If device pairing must be used, ensure that all devices are set to "Unauthorized", requiring authorization for each connection request. Do not accept applications that are unsigned or sent from unknown sources.

Web Security - A Report by Websense for first half of 2009

WebSense (websense.com) is a leading web security research company.

They have released report of web-security for the first 2 quarters of year 2009.

Its worth reading. Here is the summary:

Web Security

• Websense Security Labs identified a 233 percent growth in the number of malicious Web sites in the last six months

and a 671 percent growth during the last year.

• 77 percent of Web sites with malicious code are legitimate sites that have been compromised. This remains

unchanged from the last six-month period.

• 61 percent of the top 100 sites either hosted malicious content or contained a masked redirect to lure unsuspecting

victims from legitimate sites to malicious sites.

• 95 percent of user-generated comments to blogs, chat rooms and message boards are spam or malicious.

• 50 percent of Web pages linked to Web sites categorized as “Sex” also served malicious content.

• 69 percent of all Web pages with any objectionable content (e.g. Sex, Adult Content, Gambling, Drugs) also had at

least one malicious link.

• 78 percent of new Web pages discovered in the first half of 2009 with any objectionable content had at least one

malicious link.

Email Security

• 87.7 percent of email messages were spam. This represents a three percent increase over the last six months.

• 85.6 percent of all unwanted emails in circulation during this period contained links to spam sites and/or malicious

Web sites.

• Shopping remained the leading topic of spam (28 percent), followed closely by cosmetics (18.4 percent), medical

(11.9 percent) and education (9.5 percent). Education themed spam has nearly doubled over the previous period

and may be related to the recession as spammers seek to exploit people looking to gain new skills or obtain fake

qualifications to help their job prospects.

Data Security

• 37 percent of malicious Web/HTTP attacks included data-stealing code. This remains unchanged from the last

six-month period.

• 57 percent of data-stealing attacks are conducted over the Web. This number has stayed consistent over the

six-month period.

Read more here:

http://www.websense.com/site/docs/whitepapers/en/WSL_Q1_Q2_2009_FNL.PDF

Few interesting facts:

More than 47 percent of the top 100 sites support user-generated content.

• Not surprisingly, sites that allow user-generated content comprise the majority of the top 50 most

active distributors of malicious content. Blog hosting sites that offer free hosting and good reputations

provide malware authors with the perfect combination to compromise unsuspecting users.

• 61 percent of the top 100 sites either hosted malicious content or contained a masked redirect to

lure unsuspecting victims from legitimate sites to malicious sites. In many cases these redirects

appeared as the actual Web site, when in fact the content served on that page was being hosted

elsewhere.

• Websense Defensio technology enabled Websense Security Labs to identify a significant and

alarming trend regarding the ease with which Web 2.0 sites can be compromised: 95 percent

of user generated comments

How to be safe from Spaming

Always follow these rules for being safe from Spams:

* Never mention your personal and professional Email address in any of the Discussion forums, news groups, chat rooms, scraps[orkut], or in soical networking sites.

• Remove /hide your email address- if you have mentioned it in the "Profile" Section of any of the website you use, like- Orkut, Hi5, MySpace, Blogpost, Yahoo profile etc...
  

* Use a different Email ID other than your personal or professional Email ID to register for newsletters
* For registering at different sites use a constant email address something like reg_yourname@gmail.com and redirect the mails coming to this Id to a predefined folder (Yahoomail) or mark it with a label(Gmail). Create Rules for this available in settings of every e-mail services.

* When disclosing your email address in public use a different email address other than your personal e-mail address.
* If you are a Yahoomail user, use a feature provided by yahoo called "Disposable mail". This allows you to create e-mail aliases. You can use different aliases for different purposes, like for registration purposes create an address like yourname-reg@yahoo.com, for public sharing your ID create an address like yourname-pub@yahoo.com. The add-on is that you can redirect the mails sent to you in a predefined folder and when you start to get spams on that address you can simply delete that email-alias and enjoy to get certain for not getting any spams further on that email address.

• NEVER NEVER forward emails sent to you to all of you in your address book or a group of people in the address book just for fun. If required, forward the mail to only selected people.
• When you do So, you send an open invitation to the spammer to spam you as all the addresses mentioned in the TO or CC or BCC fields are sent to the spammer as well.
  
• You can Also copy paste the content and compose a new email from the old message for being safe

I will be sharing some more email security tips as time allows...