Scammers Target Apple Users Through Windows

Given its limited market share, Apple users have been somewhat insulated against malware. While this is starting to change, this week, hackers found a roundabout way to exploit Apple by targeting iPad owners who use PCs. The scammers blasted e-mails with the subject line, “iPad Software Update." The e-mail instructed new iPad users to click on a link and install an iTunes update. Those who followed these instructions on a Windows PC, of course, didn’t actually get an update. Instead, they got malware that inserted itself into the “explorer.exe” process and opened the system’s back door, making it possible for hackers to take control of the system. 

In some ways, hackers have become remarkably predictable. As we previously noted, they piggy back on larger trends, chasing those who are, perhaps, swept in the flow of events and mistakenly overlook some malware red flags. As InformationWeek points out about the iPad scam, “the text isn't so poorly written as to be farcical. Even so, the use of the passive voice in the first sentence and the awkward wording suggests that the note's author doesn't work as a marketing professional at Apple or anywhere else.”

But eager new iPad owners might be so elated by the sleek device – and ensuring it is optimally compatible with their PC – that they might skim right through the e-mail, failing to notice passive sentence structure or awkward word choices. In fact, this is precisely what the hackers have built their strategy on.

Apple sold 300,000 iPads on the day the device launched and this figure is only rising – making the iPad a prime target for cyber criminals. But, so far, these hackers are spreading malware through their comfort zone – Windows.

Please pass this information along to members of your community, especially new iPad owners.  And remember to download Immunet’s free, lightweight AntiVirius product to better protect your PC. 

Google Adsense Phishing Scam

This morning while reading my mail I came across an email purportedly from Google notifying me that my AdSense account had been disabled. On closer inspection the email was a clear a phishing attack designed to steal my AdSense username and password. The mail looked like this:

You can see from the URL which I have outlined in red that clearly this is not going to take you to a real Google website but rather a (likely) hacked page at orientcasinos.com. If I go to the site it looks like a fair passing imitation of the actual AdSense page:

The URL though is still quite obviously not AdSense so thankfully this particular scam is not likely to go far. These sorts of scams are not new per se but it's important to understand that not only are your direct financial assets (bank account, credit card etc.) a target but so are your indirect financial assets like your AdSense account which controls potential revenues for your business. Like we posted earlier about Facebook accounts being targeted  your online presence is something you need to consciously guard as well as your PC. You can start by being sceptical about any email asking you to log in and change your credentials for an online service you use. If you do feel you need to follow up on an email which requests something like this, always open your browser separately and navigate to the site on your own, do not copy and paste from the email and do not click on the link in the email.

Beware of Hackers “Liking” Your Profile Too Much: Facebook Changes Call for User Vigilance

How much is your Facebook profile worth to you? This is probably not a question you ask yourself very often since Facebook provides its services for free. But quantifying the value of your profile is exactly how hackers think. Hackers who like your profile enough may steal it, and those with large social networks of friends may be at risk for getting attacked for the value and volume of their social contacts.

We think Facebook’s new “like” button is going to make people’s Facebook profiles more ubiquitous on the Web, since any site that you “Like” can now claim you as a user and display your profile picture and link to your page from their site. While the feature is great for marketers and users interested in receiving more targeted advertisements, it also exposes your profile more publicly to potential hackers and cybercriminals targeting accounts to hack.

This point was driven home most recently when a Russian hacker, known as Kirllos, was found to be peddling 1,000 Facebook IDs for amounts ranging from $25 to $45. Computerworld reports that Kirllos phished log-ons from a staggering 1.5 million Facebook users. There’s apparently no way to know whose accounts were among those hacked. But given those figures, it’s likely that someone connected to your network was touched.

And while this scam is troubling, it’s unfortunately more commonplace as Facebook has surpassed over 400 million users.  The size of the community makes it an attractive marketplace not only for legitimate marketers, but also for cybercriminals who try to scam users to click on links that download malware to infect others in your community, steal passwords, and run money scams on your friends by posing as you.  Facebook has beefed up its own security against hackers and is focusing on taking down attackers as soon as an attack is identified, according to Chief Security Officer Max Kelly. While Facebook is doing its part to protect users, Facebook users themselves can take proactive steps to minimize their risk from hackers.

We encourage users to continue to use Facebook with an eye towards safety and security. If you haven’t been thinking about your security and privacy on Facebook, now is the time to be more vigilant. Be sure you are using strong passwords and even a password manager tool to keep track of different passwords for each site you visit frequently. For more social networking safety tips, check out the Facebook Security page. 

You can minimize your risk of being a malware target by keeping your antivirus software up to date, and get extra protection with Immunet to ensure the highest level of real-time protection. Facebook users with Immunet can share fast AntiVirus protection for free with their Facebook friends. By sharing Immunet Protect with your closest network of friends, you can have peace of mind knowing that you – and those who you engage with most frequently – are protected and secure from threats.  Stay connected to your friends, but remain protected while doing so.

Share

Immunet on Facebook

Our Facebook Fans are protected by Immunet Protect. Are you?

False Positive Mayhem

I had a great conversation with Byron Acohido of The Last Watchdog and USA Today last night about how False Positives (FPs) in our industry occur. As AntiVirus vendors, we all live in fear of major False Positives; it keeps us up at night.  It has happened to everyone - including Symantec, McAfee, BitDefender and Kaspersky to varying degrees over the past several years.  FP’s vary in their level of severity, and range from minor – such as triggering on very obscure and rare programs used by only a few - to severe – such triggering on a core part of the Windows Operating System, which is exactly what has happened in this case.  Believe it or not but minor FP’s happen to vendors several times a week, but they rarely cause widespread damage, affecting only the more obscure applications; which is why we never hear about them at all – they simply don’t make the news.

All AntiVirus vendors use signatures as one form of detection – they are the most precise method by which to detect threats.  Most AntiVirus vendors have a variety of signature formats, and also a variety of detection engines – a requirement to keep up with the growing number of threats on the Internet today.   Normally you would see FP’s from ‘generic signatures’, behavioral engines, or heuristics, used to detect a complete family or strain of viruses.  It’s difficult to say what kind of detection was responsible for the most recent SVCHOST.EXE False Positive that McAfee fell victim to – but it sounds like a very precise detection in this case, meaning a potential lapse in the quality assurance process.

How Something like this can Happen

In order to understand how this can happen, it’s useful to understand the process that AntiVirus vendors undertake in order to generate detections.

1. Their user base; through the use of behavioral or heuristic engines
2. Honeypots and web crawlers
3. AntiVirus Industry sample exchanges with other vendors

In order for SVCHOST.EXE to make its way into a vendors sample collection, it will have come from one of those three sources.  Any one of these could have been the culprit in this case, since a reasonable percentage of the files collected through all of these channels are going to be FP’s.

FP’s have historically been produced by both human analysts and automation technologies, so it is difficult to say which the culprit was in this case but clearly SVCHOST.EXE made its way through the analysis process without being recognized as a problem.  It is quite possible for a junior analyst to mistakenly misclassify a clean file as a virus.

As vendors become aggressive and threats become more prevalent, the risks of FP’s also increase.  McAfee is certainly not alone with this problem.  That being said, the traditional form of publishing detections in this way leaves desktops over-exposed to situations like this.  There are clear cut safe guards that can be put in place to prevent these types of events, and newer cloud-based solutions have the benefit of detecting and mitigating FP’s within minutes, limiting the damage when they do occur.

I would expect the industry to take note of this event and make a renewed effort to avoid False Positives in the future.

More about the Specific False Positive in the McAfee Case

SVCHOST.EXE is a core part of the Windows Operating System, and it is a well known clean file.  Interestingly enough, very basic files like this frequently show up in AntiVirus vendor sample collections.  Consumer and enterprise users will often send almost anything suspicious to AntiVirus vendors for analysis, including many core Windows processes that are frequently seen running on the system via Task Manager.  It doesn’t help that some viruses actually masquerade as SVCHOST.EXE, leading to confusion and the submission of the legitimate SVCHOST.EXE process for analysis.  As a result – the appearance of SVCHOST.EXE in a sample collection is not surprising at all.  As for why the FP was not detected during QA, that is more difficult to answer.  The file was either not part of the clean set, or the QA process failed somewhere along the way.

At the moment it looks like each machine that was affected requires manual intervention.  It’s impossible to say how many systems were actually affected, but this was not an isolated event. Peter Svensson of the Associated Press reports many were affected, including Intel, and CNET’s Declan McCullagh reports, “the University of Michigan's medical school reported  that 8,000 of its 25,000 computers crashed.”  Geek.com’s Matthew Humphries reports numbers much lower, in the several hundred, in fact, ZDNet’s Ed Bott has some additional information worth a read too.

It would be difficult to estimate the monetary damage.  Ironically, the best measure on widespread system failure that we have seen has been that resulting from the widespread virus outbreaks in the past decade.  CodeRed in 2001, Slammer in 2003 and Sasser in 2004 might provide some baseline numbers on the effect of large scale system failure.

I can definitely sympathize with McAfee; nobody wants to have this problem while striving to protect people better.  They are working to correct the issue as engadget’s Nilay Patel quotes a first response from McAfee (worth a read).

Study Finds Disconnect Between Young People and AntiVirus Protection

A new study finds that while the vast majority of young people know about online security risks, they aren’t doing much to protect themselves. According to the RSA-sponsored study, 73% of young adults between 18 and 27 are informed about online security risks, and yet 71% say they’re not particularly “careful about policing their financial data, social networking accounts, and other passwords,” Newsweek reports on its Techtonic Shifts blog.

The blog reports:

 “The irony is that the most tech-savvy generation is the one playing Russian roulette—the one that knows the risk, but still does the risky behavior," says Sam Curry, chief technology officer at RSA, the IT security firm that sponsored the survey. 

The post also calls attention to some other alarming statistics:   

• Nine out of 10 respondents say they're linked to people they either don't know or don't know well on sites like Facebook and LinkedIn.
• Three quarters fear identity theft, but 57% don’t use services to prevent this, mostly because of the cost. A staggering 64% say they've already had their identity stolen, been hacked, or lost credit cards or sensitive data.
• 56% don't log out of accounts on their computers because it's just too much hassle to sign back in.

What many people don’t realize is, when they put their computers at risk they are also making their entire network of family and friends more vulnerable. Think for a moment about all the people you know who might not use AntiVirus protection, yet still engage with strangers on Facebook or don’t log off shared computers.

It’s a discouraging thought, but accessible solutions exist. Immunet is a free AntiVirus product that specifically protects its users against malware on social networks like Facebook and Twitter. Since it’s free (and simple) to download, it’s an excellent solution for young people wary of pricey, cumbersome AntiVirus programs.  If you know someone who could benefit from Immunet, pass along this post or send them information on downloading Immunet. After all, making your online community more secure, makes your PC more secure.  



Some Perspective for Consumers: More than a Crashed PC

There is a parallel conversation happening surrounding malware, viruses, and the like. Consumers discuss crashed PCs, spam, and concern over identity theft and wrecked credit. Yet it often seems that issues discussed by security professionals have little relevance to the average consumer. Today we offer some perspective for the consumer and highlight the very real, very relevant world that exists beyond that crashed PC. Peruse the week’s news below and understand how ‘cyber crime’ involves your ‘crashed PC’.

-  -  -

The US government plans to combat cyber attacks with more force and speed, reports the AP. Lt. Gen. Keith Alexander, the National Security Agency director and likely head of the new Cyber Command, has warned Congress against cyber threats.

Alexander’s counsel builds on comments President Obama made last year when he referred to cyber threats “one of the most serious economic and national security challenges we face as a nation.” Alexander also noted that identifying cyber attackers can be tricky, so the government will now allow retaliation even if the attacker remains unknown (as long as the response is approved by the president and complies with international law and guiding military principles).

This potent rhetoric resonates with the increased prominence of cyber crimes on the global stage. Earlier this week, the European commission announced plans to reveal new proposals for combating cyber crime.

Also earlier this week, a White House cyber security aide attending a conference in Germany said thefts of credit-card numbers and corporate secrets are even more menacing than cyber attacks on infrastructure, like the electricity grid. Interestingly, this conference was organized by top Russian cyber security officials. While Russia has been a hotbed for cyber crime, the country has not yet signed the European Convention on Cybercrime, which aims to enhance law-enforcement of cyber crimes between nations.

In other news this week, the Senate announced plans to introduce a bill that would create an ambassador to handle US cyberspace issues.

With cyber crime taking such a major role in global policy, consumers should take notice of their protections against threats. Immunet recently posted a two-part blog series on avoiding viruses, in addition to posts on scareware, black hat SEO, and social media threats. Have a look and learn how to do your part to protect your PC while combating global cyber threats.  



Cyber criminals using psychology to bait victims

As we’ve recently noted, scam operators are getting increasingly tricky in their tactics. More sophisticated means, like psychology, are being used maliciously against consumers. For example, a recent scam preyed upon the copyright anxieties of BitTorrent users by locking down their computers and bullying them into paying $400 for a “copyrighter’s holder fine.” The scheme feigned credibility by citing the fictional ICPP Foundation as the enforcer of the fine. 

It was, of course, no accident that the scam targeted BitTorrent users, many of whom are already uncertain about the legal minutia surrounding filesharing. Another egregious example targets eager job seekers, a particularly vulnerable – and sizable – group in this economy. The scam uses a fake job posting that “hires” applicants and asks them to undertake a trial project. The scam operators then ask the job seekers to purchase expensive electronics with their own credit cards (with the promise of being reimbursed). The electronics are sent to the scam operators and subsequently resold. The job candidates, of course, get nothing.  Another recent scareware technique exploited the grief of those seeking news surrounding the death of the president of Poland, as well as several other members of the state. In some cases, those looking for information on the national tragedy were redirected to sites that, again, bluffed users into paying phony licensing fees.

In each of these instances, the scammers preyed upon users’ insecurities, anguish, and even desperation to perpetuate their crimes. With this kind of emotional engineering, even those who consider themselves too savvy to fall victim to cybercrimes, could find they are suddenly vulnerable. Given how quickly cybercrime is evolving, it is staggering that so many consumers haven’t reconsidered their approach to malware protection. It’s become even more pressing that consumers have multiple filters to protect them against these complex threats. If you haven’t yet, learn more about the ways Immunet Protect can immediately strengthen your computer’s defenses against the malware lurking in today, and tomorrow’s, web. 

The Top Ten Immunet Companion AntiVirus Products

Did you know that Immunet Protect can be installed in addition to existing AntiVirus products? While over 60% of Immunet users run Immunet Protect as a standalone AntiVirus solution, just under 40% of Immunet users choose the side-by-side installation option.

At Immunet, we truly believe that all PCs should be running an effective, fast and lightweight AntiVirus product, which is why we offer Immunet Protect for FREE. We also believe that users shouldn’t be forced to uninstall protection that they already use and like if they can run our solution as an added protection layer that enhances overall security.

We’ve worked really hard to make Immunet Protect into a smart, lightweight and “friendly” AntiVirus product that is not only easy to use, but that allows users the freedom to run Immunet Protect alongside existing AntiVirus products. By providing added protection through the Immunet cloud without slowing down your PC with detection updates, we help make the Internet a safer place for the entire Web community. We also make it easy to share antivirus protection for free with your friends and family who don't want complicated security protection.

We recently ran an Immunet customer survey to ask users what they loved most about Immunet Protect, and we were very happy to hear that users felt we helped make their PCs safer from malware, even if they chose Immunet in addition to another security product. Says one user, “I am happy that Immunet detected several fake AntiVirus products that my other antivirus did not detect.”

In case you are curious about what other AntiVirus products that run well alongside Immunet Protect, please see our current list of “officially supported side-by-side installations”.

Here is the current list of Immunet Protect Top Ten Companion security products as of April 2010:

1.            AVG Internet Security

2.            avast! Antivirus

3.            Avira AntiVir

4.            Microsoft Security Essentials

5.            McAfee Internet Security

6.            Norton AntiVirus

7.            Kaspersky Internet Security

8.            Comodo Internet Security

9.            ThreatFire

10.          Spyware Doctor

We would also like to thank the over 60% of Immunet Protect users running the product as a stand-alone solution. Thank you for sharing Immunet Protect, and for choosing Immunet as your AntiVirus company of choice!

Have you become a Fan of Immunet yet? Please join our Immunet Facebook Fan Page and show your support!

Immunet on Facebook

Immunet on Facebook

Immunet Top Ten Active Countries - Join the List!

Here are the latest details on the Top Ten active countries within the Immunet Community, based on the number of active users connected to the Immunet Cloud in the month of March:

1. United States  

2. Japan

3. Italy   

4. Argentina   

5. United Kingdom   
6. Taiwan  
7. Vietnam  

8. Germany  

9. Turkey  
10. Canada  

(go Canada! Did you know the Immunet Engineering team is based in Calgary, Canada?)

Don't see your home country on this list? Help Immunet recruit active users from your country! Here's how:

- Promote Immunet via a banner or text link from your website or blog. Need a free Immunet banner? Grab one here:  Immunet Banner Gallery

- Get one of your country's top technology or security reporters to interview Immunet or review Immunet Protect. Connect them with either Oliver Friedrichs (oliver@) or Alfred Huger (alfred@) via email - we are very accessible.

- Tell your friends about Immunet! The best way to share Immunet is to invite your friends and family members to install Immunet Protect for free.  Use Facebook Connect or log in to your Immunet account and invite people using the email invite tool.

Don't have an Immunet account yet? Create one now for free!

Don’t Let Scareware Fool You

Read an interesting article about cybercrime firm Innovative Marketing Ukraine on PCMag.com last weekend.  The article provided insight on the company and background on the rogueware business—most fascinating was the impact it has on the entire world. 

As quick background, Innovative Marketing creates the most destructive and profitable viruses in the world.  The software pretends to scan for viruses—and surprise, surprise—when one is detected, it offers a solution to clean the machine—of course, at a cost between $50-80.  Quite the deceiving business… 

Rogueware businesses affect nearly 3.5 million PCs worldwide, and social networking puts more fuel on the fire.  The software is loaded on to Twitter and Facebook, for example, and from there, the viruses rapidly spread.  We’ve seen this most recently with the Panda Security look-alike software on Facebook.  Another example of how this is spread is through online marketing.  There was one instance when the New York Times ran a rogue advertisement on its Web site; every time a reader clicked on this particular ad his or her computer became contaminated.  A senior researcher at Websense expects hackers to more aggressively attack this avenue down the road.      

This is definitely a huge issue that all computer users need to be aware of.  Always be mindful of what you are downloading and clicking on, and make sure it is from a trusted source.  Install AntiVirus software on your machine, and frequently check to see if detection files are up to date.  Taking these simple steps can protect your computer, and save you the hassle of debugging your PC.