PC-Armor Computer Security News Blog

The Trojan Money Spinner

F-Secure posted a piece on their web blog today titled, “The Trojan Money Spinner“.  Mika Stahlberg from the F-Secure Security Research Program gave a presentation at the Virus Bulletin Conference 2007 in Vienna, Austria last week and they included a link to an excellent 7-Page report worth reading.

You will find the article at: http://www.f-secure.com/weblog/archives/archive-092007.html#00001281 and it contains links to the PDF report.

Check it out…it’s worth it!

Identify Phishing Sites

F-Secure.com has an informative article on their Blog from September 17, 2007 about identifying Phishing Sites that is worth reading.  You will find it at:

http://www.f-secure.com/weblog/archives/archive-092007.html#00001278

What’s nice about the article, which by the way, doesn’t have much text, but if you look at their comments and each screenshot for which the comment was intended; you will see the methodology they use to ultimately find a list of Phishing sites.

Check it out.

Subject: Football Fan Essentials

Lately, anytime something “newsworthy” crops up, the spammers and phishers jump all over the story and as many people know, today is the NFL’s opening day.  Well, it didn’t take long for malicious e-mails to start surfacing, in fact, I received one this morning with the subject line of “Football Fan Essentials”.

In this particular e-mail, the bait is an “Online Game Tracker” and by clicking a link pointing to “http://IP address”, the victim is led to believe they will be able to follow the scores of the football games throughout the day.  However, the unsuspecting victim will most likely become infected with a variant of the Storm Worm.

As usual, when I saw this, I did my homework and checked out the SANS Internet Storm Center Diary for any late-breaking news about this latest threat and sure enough, they were on top of it.  Here is the story:

http://isc.sans.org/diary.html?storyid=3361

F-Secure also posted a warning on their Blog at: http://www.f-secure.com/weblog/

Anyone who reads security news blogs and articles understands that it is never a good idea to click on any link containing an IP Address and this link is no different.  Don’t take the bait…just delete the e-mail!

And the threats keep evolving…

SearchSecurity.com published a very good article by Noah Schiffman titled, “Building malware defenses: From rootkits to bootkits” and it is a warning to everyone that they need to lock down physical access to their computers because of the latest threat…bootkits.  The article can be found here:

Before I read this article, I thought Rootkits were the most threatening form of compromise; but after reading this article, I think bootkits have just moved into first place.  Why?  Bootkits infect computers during the boot process, before the operating system loads and this means that detection is virtually impossible.

The good news is that you can protect your computer against this type of infection by:

- Configuring the BIOS to disable any boot devices other than the hard disk
- Use strong and complex BIOS password, which would be required to successfully boot the computer
- Limit physical access to your computer AND the motherboard by locking the case to prevent access to the interior of the case
- And if you really wish to lock it down, you could disable the USB and Firewire ports in the BIOS; but that could really hinder your computer’s functionality.

Check the article out…you’ll be amazed at the damage a bootkit is capable of causing!

Interesting Story from Glenn Beck on Headline News

Glenn Beck had an interesting piece this evening about how a Nuclear Power Plant in the United States, whose location was not disclosed, hired someone to test the security of the computer systems securing the nuclear power plant.  The power plant did not believe their network could be hacked; but as it turns out, the computer engineer was successful at hacking into the power plant.

It appears the electronic data management system in use by today’s utility companies needs an overhaul to tighten up the security and plug the holes that hackers could exploit.  Mr. Beck’s expert guest analyst was Johannes Ullrich of the SANS institute and as Mr. Ullrich explained, there are a number of things that a hacker could do if they successfully break into these systems and some of those things could be very damaging.

If I remember correctly, one of the things Mr. Ullrich was asked was, “Does China possess the knowledge to successfully launch an attack against our power plants and other critical infrastructure components?” According to Mr. Ullrich, the answer was “Yes”.  Why?  Well, apparently, many of our processors and other computer components are being manufactured in China and obviously, if they are making the parts that are securing our systems, then they probably know how to compromise systems built with those parts.

This is disturbing news!  With so many negative news headlines surfacing lately regarding attacks against our military computer systems, as well as phishing attacks against users of personal computers coming from China…why are the computer parts we rely on and use, still being manufactured in China?  In fact, with all of the other harmful products coming out of China from toothpaste, to pet food, to toys…why are American companies allowing this to continue?  Maybe it’s time for American businesses to move their manufacturing plants back home to the good ‘ol USA.  Just a thought…