Information Security Tips from Westfield Insurance

Hackers go commercial

For only $700, you too can become a hacker. New hacker tools are as easy to use and as well supported as any commercial software package. The Mpack toolkit is a particularly easy-to-use hacker kit being sold on Russian e-crime forums. It is "guaranteed to bypass all anti-virus programs at the time of purchase". Like many commercial software packages, it includes a year's worth of free updates and support for the hacker in the price. Mpack is also disturbingly common. It has been discovered embedded in more than 10,000 web sites so far.

Between the increased availability of these tools and the sheer number of vulnerabilities that they are programmed to automatically exploit, it is vital that you keep your computer's operating system and applications up-to-date and fully patched.

Regularly check for updates and immediately load them. Consider setting them to automatically update. And remember that you have to check for updates for every program you have on the computer, not just the Microsoft updates.

Shut down your computer every night. This limits your vulnerability to automated attacks against your computer. Depending on how your network is set up, it may also trigger your update process, making sure that the latest patches are loaded to your computer when you log on in the morning.

Mpack targets security holes in many common software programs including QuickTime media player, plug-ins for the Firefox web browser and Microsoft Windows. According to researchers at one anti-virus company, this toolkit uses simple yet very sophisticated web-based interfaces and allows the hacker to take control of the victimized computer to either steal information, install keyloggers or use your computer as a "zombie" to attack someone else. You can read this technical report for more about Mpack.

New Scams - continued

Last week, we highlighted two of the recent explosion of new scams and frauds. Here are two more examples. Always be alert for suspicious messages and never give out confidential information unless you are absolutely sure who's on the other end of the line.

Dept of Justice spams
The US Department of Justice announced a number of fraudulent emails claiming to be from the DOJ and alleging that the recipients (or their businesses) have been the subject of complaints filed with the DOJ and/or the IRS. The message often contains a "copy of the complaint" as an attachment and offers contact information to resolve the issue. Do not open the attachment. It's a trojan horse and will load malicious software onto your computer. Don't call the contact information either. You'll just open yourself up to a social-engineering scam as the person attempts to scare you into revealing confidential information. The DOJ does not send out email notices for these issues. Read more here.

MySpace worm
Many thousands of MySpace.com websites were successfully attacked by a new and particularly complex computer worm. In this attack, MySpace visitors who are browsing an infected page are redirected to a fake login page that attempts to steal the visitor's username and password. According to one researcher, about one in four falls for the scam. The hacker then changes the code on their MySpace page to trap even more visitors. The redirect works against some recent vulnerabilities in MS Windows and Internet Explorer. The same attack will also install software onto your computer, turning it into a part of a hostile botnet and possibly exposing all the personal information on your computer to the hacker.

Protect yourself by keeping your computer fully patched. By the way, the same research showed that many people choose weak passwords on MySpace, thinking that there's nothing to protect. Remember that hackers use this as an avenue into your personal information. Pick strong passwords even for websites like MySpace. Read more here.

Next week, we'll have an update on the State of Ohio's recent security breach and the relative merits of their "identity theft protection service".

"You've received a greeting ecard" trojan horse

I still remember the first time someone sent me an electronic greeting card. It was kind of hokey but it really brightened up my day. Sending one back was convenient, fun and best of all, free. Unfortunately, someone has recently launched an aggressive campaign that combines the worst aspects of spam and malicious software and is exploiting the popularity of e-cards. The hacker is using pre-packaged software to spam millions of messages across the internet that read with some variation of "You have received an ecard from" a school mate, a colleague or a family member.

If you open the message, you'll see a standard text-only message describing the e-card and offering you a link to a website where you can download your e-card. The messages claim to be from any of several legitimate ecard websites but in the versions that I've seen, the link is a raw IP address (such as http://12.345.67.89), not a domain name (www.example.com). Other versions may get more sophisticated and cover the IP address with a fraudulent domain. The IP addresses trace back to hundreds of different owners. My suspicion is that these are individual machines which have been hijacked as part of someone's botnet.

Opening the email won't do anything immediately bad to your computer (other than waste your time) but following one of the links is another story. Do not under any circumstances follow these links. Merely opening the page will trigger the download of a particularly nasty computer trojan horse which will then attempt to download even more malicious software onto your machine.

If your anti-virus program is up-to-date and running, it should catch and stop this trojan. However, if you get any kind of alert or think that you might have triggered one of these downloaders, you should run a full virus scan on your system. Call your IT department for instructions. Never open a message from an unrecognized sender and never open an attachment or follow a link in a message that you were not expecting.

Note: If you think the email card might be legitimate, you can check by opening a browser and typing the address of the greeting card company (for example, www.hallmark.com or www.bluemountain.com) and follow the instructions on the site to 'pick up an e-card'. This will usually involve entering the email address of the sender and a confirmation number from the email. If the message was legit, it will show up on the website. As long as you type in the address yourself (rather than following a possibly faked link) and you're going to a major company that you trust, it should be safe to check.

FBI Botnet Investigation

The FBI just announced the largest ever cybercrime investigation to disrupt and dismantle "botnets" and to prosecute some of the ringleaders in these criminal activities. So far, they have identified about 1 million compromised computers across the country. The FBI is working with the CERT Coordination Center at Carnegie Mellon Univ to notify the victim owners of the computers.

So far, the FBI has charged 3 people with cyber crimes as a direct result of this investigation; one hacker in Texas accused of infecting tens of thousands of computers, one hacker in Seattle accused of using botnets to send tens of millions of spam messages and one hacker in Kentucky accused of using botnets to disable other systems.

Note: The FBI will not contact you online and request your personal information. Nor will they offer to clean your computer for you. As word of this investigation gets out, be wary of fraudulent message appearing to come from the FBI or some other agency and offering to "fix" your computer for you. If you receive such a scam, file a complaint online with the Internet Crime Complaint Center or call the nearest FBI office.

A botnet is a network of other people's computers all controlled by a hacker. In a typical botnet setup, the first hacker uses viruses, worms or trojan horses to install malicious software (the bot) on your computer without your knowledge. The hacker builds up the network as large as possible – tens or even hundreds of thousands of compromised computers. He then rents out the right to use his network of hacked computers to the highest bidder. The second hacker sends out the command messages to all the hacked computers telling them to execute their attack. Examples of attacks might be distributed denial of service (flooding the target with so many requests that the real traffic can't get through), publication of phishing emails, click fraud and mass distribution of spam and spyware.

Unfortunately, the hacked computer's user might not even notice that his/her computer is being used by someone else. Look for slow performance, an outbox full of mail you didn't send or messages saying that you've sent spam. Any of these would be reason to investigate your computer carefully.

If you think your computer might be infected, contact your Technical Support immediately.

Take the following steps to protect your computer from being captured in a botnet:

• Pick strong passwords
• Install anti-virus software and keep it up to date.
• Install a firewall and keep it turned on.
• Keep your computer's software fully patched.
• Install and update anti-spyware software.
• Be careful what you download.
• Turn off your computer when you're not using it.

Sober worm resurfaces

Symantec, a computer security company, recently announced that they have seen a significant increase in message traffic containing a new variant of the old Sober worm. This email (generally written in either English or German) hides the malicious code in an attachment and uses social engineering in order to con the user into opening it.

The known English versions of the message read either
You notified us that you have forgotten your password. We have changed your password to a random sequence of letters and digits! For more detailed information, see the attached password file.
or
Your eMail has occurred an unknown error on our Server. Please read your mail and check the text. The full email is attached!

More variations of the wording of the scam email are likely to appear over time. The message can seem to come from anybody and could appear to come from a trusted institution like your bank. The attachment could be under several different names but so far have all been .zip files. (.Zip files are sometimes not as well screened by anti-virus programs.)

While this is probably not going to be a particularly dangerous worm, it is a reminder to:

• Never open attachments in unexpected emails
• Always keep your anti-virus software up to date.

The Sober worm was first released back in October 2003. Variants remained in circulation and caused significant damage for several years. The last major variant of this worm was in 2005. The hackers sending out this worm typically set it to take over PCs, send spam, download keyloggers, install rootkits, etc.

Hackers attack computers every 39 seconds

In the time it takes you to read this entry, two hackers will try to get into your computer.

The Hollywood stereotype of a hacker is a technically-savvy individual trying to get into a specific target computer - the spy trying to breach a military computer, the disgruntled employee vandalizing his former employer or the kid cracking a university system for bragging rights. In fact, most hackers today run brute force attacks using simple software-assisted techniques to randomly attack vast numbers of computers.

According to a Maryland Univ study, computers are attacked on average 2,244 times a day. That's an attack every 39 seconds.

Researchers in this study set up weak security on four computers with internet access, then recorded what happened as the individual machines were attacked. The vast majority of attacks came from relatively unsophisticated hackers using “dictionary scripts,” software that runs through lists of common usernames and passwords trying to break into a computer.

The most commonly guessed usernames were root, admin, test, guest, info, adm, mysql, user, administrator and oracle. The most common password-guessing technique was to use variations of the username. About 43 percent of all attempts simply reentered the username. The username followed by 123 was the second most-tried choice. Other common passwords included blank (that is, no password set), 123456, password, passwd, 123, test, asdf, qwerty and variations based on the date (such as January07).

Once hackers gain access to a computer, they set up back doors so they can easily regain access later, turning the target computer into part of their botnet which they will later either use directly or lease to other hackers so they can send out spam, attack yet more computers, run distributed denial of service attacks, etc.

Never use the kinds of usernames and passwords identified in this research. If your computer came with a default administrator or guest account, change the accountname immediately.

Always choose longer, less obvious passwords with combinations of upper and lowercase letters and numbers that are not as obvious to brute-force dictionary attacks. If your system can handle it, whole sentences make very strong passwords that are still easy to remember and to type.

Anti-Virus Software comparisons

Computer viruses have not been in the news much lately but they are still a serious threat to the stability of your computer and the safety of your information. In the past few years, virus writers have become increasingly sophisticated in both their techniques and their goals. Hackers are no longer so interested in viruses that merely commit vandalism (like wiping your hard drive). Today, they craft their viruses to install backdoors, keystroke loggers and other programs that will allow them to either control your computer or steak your information. The viruses themselves are often designed to work around many anti-virus programs. "Polymorphic" viruses will modify their own code in order to avoid detection. Others will quietly disable your anti-virus program so that you won't get the updates you need to clean the virus out. One virus recently discovered will even install its own anti-virus program designed to keep competitor viruses out.

If you don't have a good anti-virus program on your home computer already, pick one and install it immediately. Above all, keep it current and run your scans regularly.

Never disable your anti-virus program.

The Austrian organization, AV-Comparatives, has released their latest study of the relative effectiveness of 12 commercially available anti-virus software programs. Six of the programs earned their highest rating, McAfee and Dr Web earned their lowest rating and Microsoft's new OneCare package failed to qualify for any rating. You can also find a quick-reference table on the Comparatives page of the av-comparatives.org website.

The authors of the study are careful to say that you should consider not only how effective the programs are at finding and stopping viruses but also how easy the programs are to use and to keep current. An anti-virus program that blocks every possible threat but that also blocks your attempts to get work done is not a good choice even though it would score very highly on these tests.

"Storm Warning" email worm

Hackers are trying to exploit the storms which have been hitting Europe. F-Secure, a Finnish data security firm, announced the identification of the "Storm" email worm in emails with the subject line "230 dead as storm batters Europe." The file attached to the message contains a virus that creates a backdoor into the computer. This allows the hacker to later either steal data or to use the victim's computer to post spam messages to other victims.

This is part of the growing evidence that hackers are conducting real-time attacks, trying to take advantage of our curiosity and compassion during breaking new stories. Security experts estimate that thousands of computers have already been affected, mostly personal computers. Most corporate systems (including Westfield's) have already been configured to block this virus but the hackers know that many personal users are not as diligent at keeping their anti-virus software up-to-date.

• Do not open unsolicited emails.
• Keep your anti-virus software up-to-date and run it regularly.

Read this Reuters article for more.

iPods shipped carrying a computer virus

Apple recently announced that some of the iPod digital music players shipped over the last month carried a computer virus. This virus could be passed back to the user's computer and attack the Windows operating system. Most anti-virus programs would have identified and removed the virus as soon as the iPod was plugged in as long as the anti-virus definitions were up-to-date. Other manufacturers have had similar problems.

• Always keep your anti-virus program up-to-date and active.
• Don't connect your personal iPod to your work computer.

Read this msnbc.com story for more on Apple and this article if you have a Zen Neeon MP3 player.

Storm Warnings

US-CERT is warning of an increase in phishing and other fraud sites related to the hurricane season. They have already received reports of malicious activity associated with Tropical Storm Ernesto including 17 ernesto-related domain names registered by one person.

These emails and websites claim to be from legitimate charitable organizations and ask for donations to "aid the victims". Some of the sites merely steal the donations. Others use your personal information to either max out your credit card, empty your bank account or set up fraudulent accounts using your stolen identity.

As you may remember from last year, there were an unprecedented number of frauds set up within hours of Hurricane Katrina's strike. Two of the most egregious turned out to be fronts for a white-supremacist group. Many of the scammers looked at the standard storm-naming conventions and started registering fraudulent "charity" sites a year ago – long before the current storm season even started.

• Treat all requests for donation with caution. Never follow the "convenient" link in an unsolicited email. If you want to go to the website, retype the URL into your browser's address line by hand.
• Take the time to research the charity before making your donation. Make sure you know who's really getting your money.
• Report fraudulent or suspicious "charities" to the FBI's Internet Crime Complaint Center.

Keystroke Logger - defined

Keystroke loggers are small tools which covertly capture the user's keystrokes on his/her computer. They record every click the user makes including typos, backspacing and retyping. Some loggers will also capture the user's mouse movements and clicks and may even take snapshots of the contents of the user's computer screen.

Keystroke loggers were first developed by researchers to see how users interact with new software and to identify sources of error. More commonly, keystroke loggers are used by hackers as a means to obtain passwords or encryption keys and to bypass the user's security. Because the keystroke logger captures the information at the point of keyboard clicking, it can capture information which would normally be hidden from display.

Keystroke loggers are widely available on the internet.

Hardware keyloggers come in two types – visible (a device that attaches to the keyboard cable) and invisible (installed by opening up the keyboard case and soldering the logger into the circuits). A hardware logger will store the information until the person who installed it comes back to collect and download the data.

A software logger can be installed on your machine by a virus, worm or trojan horse. Software loggers will typically attempt to send the data back to the hacker through the internet. Because they are so easy to spread to a victim's computer, software loggers are now more common.

• Always keep your antivirus program and firewall turned on and up-to-date. Run anti-spyware software regularly.
• When using public computers (such as the library or a cyber-café), avoid visiting sites that require you to enter login details.
• Use common sense.

Adapted from: wikipedia.org

Viruses, Worms & Trojan Horses - defined

A virus is a piece of software code that, like a biological virus, makes copies of itself and spreads by attaching itself to a host, often damaging the host in the process. The host is your computer’s operating system. The virus then infects files that are transferred to other computers. Viruses use the host's resources (memory and hard disk space) and are sometimes deliberately destructive (erasing files or formatting hard disks). Many of the more sophisticated viruses do minimal direct harm but are designed specifically to allow others to access your machine without authorization.

While viruses are often malicious, some are fairly benign or merely annoying (for example, playing a message on a specific holiday or day of the month. Their uncontrolled self-reproduction wastes or overwhelms computer resources. "Good" viruses sometimes appear that are intended to spread improvements or to delete other viruses. Unfortunately, "good" viruses are quite rare, still consume system resources and may accidentally damage the systems they infect.

"Virus" is often used to describe all kinds of malware (malicious software), including those that are more properly classified as worms or trojans. Most popular anti-viral software packages defend against all of these types of attack.

• A virus must attach itself to another program to function.
• A worm is a self-contained program.
• A trojan is also a self-contained program, but unlike a worm which can send itself to other computers, a trojan must be loaded by an unsuspecting victim - usually by masquerading as an innocent download file or email attachment with a name like README.txt.exe.

Westfield Group protects our office computers by installing current anti-virus software on all computers, establishing firewalls at the computer access points and filtering all e-mails for malicious content. To help protect your system from viruses, worms and trojans:

• Never load a disk or file to your computer unless you know and trust the source.
• Never disable the anti-virus software even temporarily.
• Do not post your company e-mail address on a website or chat board. (Hackers frequently troll through those sites looking for target accounts.)
• Install anti-virus and firewall software on your computer and keep it current.