Antivirus Security News

Hacker attack siphons off $150,000 in teacher salaries from payroll systems

2012-12-01T11:05:00.000-08:00

Hackers used the American Thanksgiving holiday to launch a crafty attack against a local school district in the state of Wisconsin, compromising a direct deposit system, and stealing $150,000 intended for teachers.

Administrators in the Stanley-Boyd school district in the western part of Wisconsin were alerted to the attack by their bank on November 21, according to a report in the Chippewa Herald.

According to the newspaper, the attackers compromised the district's network and altered its direct deposit file, supplanting employee bank account information with accounts belonging to the attackers.

AnchorBank, based in Madison, Wisconsin, noticed the unusual activity and alerted the district. The district has notified the FBI, which is investigating.

In the meantime, AnchorBank said it had been able to retrieve a portion of the stolen payroll as of November 27, and believed it could recover most of the lost funds.

Hacking school districts isn't about changing grades "War Games"-style.

(Though that still happens, too!) .

Rather, school districts and municipalities are a prime target for cybercriminal gangs, many based outside the United States.

Hackers are attracted to the small towns because they often are short on IT security expertise, but have easy access to cash through bank accounts and lines of credit. Beyond that, the decentralized nature of many municipal operations can make detection difficult.

In just the latest incident, in October, the town of Burlington, Washington, disclosed that hackers had compromised a number of town systems used to operate an online utility billing system and stolen $400,000 from a city bank account.

Article Source

How Much Do Antivirus Rankings Matter to You?

2012-12-01T11:03:00.002-08:00

German antivirus lab AV-Test recently tested several security suites. Most of them declined since a few months ago, particularly Microsoft Security Essentials, our favorite Windows antivirus app. We still love it, but the recent AV-Test makes us wonder: How much do these ratings matter to you?

Microsoft Security Essentials was half a point shy of passingthe AV-Test, due to problems detecting zero-day threats. Other recent tests by AV Comparatives were better, but still mixed. That said, Microsoft Security Essentials has never been the top ranker in these tests (usually the top spots are the paid security suites), but it's something worth pondering.

What do you think? Does it matter to you?

The Antivirus Era Is Over

2012-10-14T01:54:00.000-07:00

Two weeks ago today, computer security labs in Iran, Russia, and Hungary announced the discovery of Flame, "the most complex malware ever found," according to Hungary's CrySyS Lab.

For at least two years, Flame has been copying documents and recording audio, keystrokes, network traffic, and Skype calls, and taking screenshots from infected computers. That information was passed along to one of several command-and-control servers operated by its creators. In all that time, no security software raised the alarm.

Flame is just the latest in a series of incidents that suggest that conventional antivirus software is an outmoded way of protecting computers against malware. "Flame was a failure for the antivirus industry," Mikko Hypponen, the founder and chief research officer of antivirus firm F-Secure, wrote last week. "We really should have been able to do better. But we didn't. We were out of our league, in our own game."

The programs that are the lynchpin of computer security for businesses, governments, and consumers alike operate like the antivirus software on consumer PCs. Threats are detected by comparing the code of software programs and their activity against a database of "signatures" for known malware. Security companies such as F-Secure and McAfee constantly research reports of new malware and update their lists of signatures accordingly. The result is supposed to be an impenetrable wall that keeps the bad guys out.

However, in recent years, high-profile attacks on not just the Iranian government but also the U.S. government have taken place using software that, like Flame, was able to waltz straight past signature-based software. Many technically sophisticated U.S. companies—including Google and the computer security firm RSA—have been targeted in similar ways, albeit with less expensive malware, for their corporate secrets. Smaller companies are also routinely compromised, experts say.

Some experts and companies now say it's time to demote antivirus-style protection. "It's still an integral part [of malware defense], but it's not going to be the only thing," says Nicolas Christin, a researcher at Carnegie Mellon University. "We need to move away from trying to build Maginot lines that look bulletproof but are actually easy to get around."

Both Christin and several leading security startups are working on new defense strategies to make attacks more difficult, and even enable those who are targeted to fight back.

"The industry has been wrong to focus on the tools of the attackers, the exploits, which are very changeable," says Dmitri Alperovitch, chief technology officer and cofounder of CrowdStrike, a startup in California founded by veterans of the antivirus industry that has received $26 million in investment funding. "We need to focus on the shooter, not the gun—the tactics, the human parts of the operation, are the least scalable."

CrowdStrike isn't ready to go public with details of its technology, but Alperovitch says the company plans to offer a kind of intelligent warning system that can spot even completely novel attacks and trace their origins.

This type of approach is possible, says Alperovitch, because, although an attacker could easily tweak the code of a virus like Flame to evade antivirus scanners once more, he or she would still have the same goal: to access and extract valuable data. The company says its technology will rest on "big data," possibly meaning it will analyze large amounts of data related to many traces of activity on a customer's system to figure out which could be from an infiltrator.

Christin, of Carnegie Mellon, who has recently been investigating the economic motivations and business models of cyber attackers, says that makes sense. "The human costs of these sophisticated attacks are the one of the largest," he says. Foiling an attack is no longer a matter of neutralizing a chunk of code from a lone genius, but of defeating skilled groups of people. "You need experts in their field that can also collaborate with others, and they are rare," says Christin. Defense software that can close off the most common tactics makes it even harder for attackers, he says.

Other companies have begun talking in similar terms. "It goes back to that '80s law enforcement slogan: 'Crime doesn't pay,' " says Sumit Agarwal, a cofounder of Shape Security, another startup in California that recently came out of stealth mode. The company has $6 million in funding from ex-Google CEO Eric Schmidt, among others. Agarwal's company is also keeping quiet about its technology, but it aims to raise the cost of a cyber assault relative to the economic payoff, thus making it not worth the trouble to carry out.

A company with a similar approach is Mykonos Software, which developed technology that helps protect websites by wasting hackers' time to skew the economics of an attack. Mykonos was bought by networking company Juniper earlier this year.

Antivirus companies have been quick to point out that Flame was no ordinary computer virus. It came from the well-resourced world of international espionage. But such cyberweapons cause collateral damage (the Stuxnet worm targeted at the Iranian nuclear program actually infected an estimated 100,000 computers), and features of their designs are being adopted by criminals and less-resourced groups.

"Never have so many billions of dollars of defense technology flowed into the public domain," says Agarwal of Shape Security. While the U.S. military goes to extreme lengths to prevent aircraft or submarines from falling into the hands of others, military malware such as Flame or Stuxnet is out there for anyone to inspect, he says.

Agarwal and Alperovitch of CrowdStrike both say the result is a new class of malware being used against U.S. companies of all sizes. Alperovitch claims to know of relatively small law firms being attacked by larger competitors, and green technology companies with less than 100 employees having secrets targeted.

Alperovitch says his company will enable victims to fight back, within the bounds of the law, by also identifying the source of attacks. "Hacking back would be illegal, but there are measures you can take against people benefiting from your data that raise the business costs of the attackers," he says. Those include asking the government to raise a case with the World Trade Organization, or going public with what happened to shame perpetrators of industrial espionage, he says.

Research by Christin and other academics has shown that chokepoints do exist that could allow relatively simple legal action to neutralize cybercrime operations. Christin and colleagues looked into scams that manipulate search results to promote illicit pharmacies and concluded that most could be stopped by clamping down on just a handful of services that redirect visitors from one Web page to another. And researchers at the University of California, San Diego, showed last year that income from most of the world's spam passes through just three banks. "The most effective intervention against spam would be to shut down those banks, or introduce new regulation," says Christin. "These complex systems often have concentrated points on which you can focus and make it very expensive to carry out these attacks."

But Agarwal warns that even retribution within the law can be ill-judged: "Imagine you're a large company and accidentally swim into the path of the Russian mafia. You can stir up a larger problem than you intended."

Top Eight Security Tips for Windows 8

2012-09-29T10:51:00.000-07:00

Microsoft is releasing Windows 8, the newest version of the Windows operating system, for general availability on October 26. Although Windows 8 offers enhanced security features, it also raises new security concerns because of changes to the graphical user interface and a new online app store. We’re offering the following eight security tips to help you stay secure as you move to Windows 8.

1. Exercise caution with apps for the new Windows 8 user interface (formerly known as Metro)

Some familiar applications have been completely re-written for the new Windows 8 UI. As a result they may work completely differently, despite looking the same. For example, an application historically delivered as an executable could now be entirely web-based. This impacts the visibility your existing security and monitoring tools have into these apps.

2. Use the Windows 8 style UI version of Internet Explorer

By default, plugins are disabled, blocking a major target for exploit kits and Blackhole attacks.

3. Make sure your security vendor can flag malicious Windows 8 UI apps

Windows 8 UI apps have important differences from regular applications, and your security product should be able to distinguish the two. The security product should correctly flag malicious or modified Windows 8 UI applications (tampered, modified, invalid license).

4. Disable hard drive encryption hibernation

Hard drive encryption is a cornerstone of data protection. If possible, disable the hibernation option in Windows 8 through group policy, as it doesn’t always work well with encryption.

5. Make sure your hardware carries the “Designed for Windows 8” logo

To carry this logo, hardware must be UEFI compliant. This means you can take advantage of the secure boot functionality available in Windows 8. Secure boot is designed to ensure the pre-OS environment is secure in order to minimize the risk from boot loader attacks.

6. Make application control a priority

The Windows 8 app store makes application control increasingly important for both malware prevention and productivity control. While the Windows Store will be secured, history shows that malicious apps are likely to slip through. Disable the use of apps that aren’t relevant to your organization.

7. Treat Windows RT (ARM) devices like any other mobile devices

Make sure you impose the same security levels on Windows RT devices as all others. You should have the ability to control, track, remote wipe and encrypt them.

8. Review application permissions in the Windows Store

Applications in the Windows Store must list any resources they require. Carefully review these permissions in the details tab as some will grant access by default to your location information, calendar, etc.

You should still run a full security suite for superior filtering and centralized management and reporting. While Microsoft has included a minimalist antivirus and firewall, most organizations will still require commercial-grade security. And of course, all the old security rules also apply with Window 8. It’s still a bad idea to allow automatic log-on. Above all, remain vigilant.

‘Flame’ Virus explained: How it works and who’s behind it

2012-09-03T12:57:00.000-07:00

Flame may be the most powerful computer virus in history, and a nation-state is most likely to blame for unleashing it on the World Wide Web.Kaspersky's chief malware expert Vitaly Kamlyuk shared with RT the ins and outs of Stuxnet on steroids.

Iran appears to be the primary target of the data-snatching virus that has swept through the Middle East, though other countries have also been affected.The sheer complexity of the virus and its targets has led Moscow-based Kaspersky Lab to believe a state is behind the attack.

Kaspersky first spotted the virus in 2010, though it may have been wrecking havoc on computer systems for many years.Vitaly Kamlyuk told RT how his company discovered it, just what makes Flame so significant, features of the virus that could point towards its creator, and why we all lose out in this intensifying cyber-war.

RT: So, how did you spot the malware, was it a planned investigation, or did it come by surprise?

Vitaly Kamlyuk: It was by surprise. We were initially searching for a [different form of] malware. We were aware of the malware that had spread throughout the Middle East, attacked hundreds of computers and wiped their hard drives, making the systems unbootable after that. It was actually after an inquiry from the International Telecommunications Union, which is a part of the United Nations, who actually asked us to start conducting research. When we started looking for this mysterious malware in the Middle East, we discovered this suspicious application that turned out to be even more interesting than the initial target of our search.

RT: According to one of your experts, 'Flame' does not appear to cause physical damage, so why has it been dubbed the most hazardous cyber-attacks in history?

VK: It’s actually on the same level as the notoriously known Stuxnet and Duqu [attacks], because we suspect that there is a nation state behind the development of this cyber attack, and there are reasons for that. This application doesn’t fit into any of the existing groups of developed cyber attack tools. There are currently three groups. There are traditional cyber criminals who are hunting users’ data (like log-ins and passwords) to access bank accounts over the Internet and steal money, send spam, or conduct dubious attacks.This [Flame] doesn’t fit into the group of traditional cyber criminal malware. Also, it doesn’t fit into the activists’ malware who are using typically free and open source tools to attack computers on the Internet. And the third known group [at this time] is nation-states.

RT: What makes this malware different from all other Spyware programs and what damage can it do?

VK: It’s pretty advanced – one of the most sophisticated [examples of] malware we’ve ever seen. Even its size – it’s over 20 megabytes if you sum up all the sizes of the modules that are part of the attacking toolkit. It’s very big compared to Stuxnet, which was just hundreds of kilobytes of code: it’s over 20 megabyes. And the Stuxnet analysis took us several months, so you can imagine that a full analysis of this threat may take us up to a year. So we think it is one of the most sophisticated malware [programs] out there.

It’s also quite unique in the way it steals information. It’s possible to steal different types of information with the help of this spyware tool. It can record audio if a microphone is attached to the infected system, it can do screen captures and transmit visual data. It can steal information from the input boxes when they are hidden behind asterisks, password fields; it can get information from there.Also it can scan for locally visible Bluetooth devices if there is a Bluetooth adapter attached to the local system.

RT: Is there a connection between this new cyber threat and previous large-scale virus attacks?

VK: We are trying to compare and find similarities between this development and previous [ones] of course, but there are so few of them – Stuxnet or Duqu mostly. There is no reliable relation between Stuxnet and Flame as we call it…they are completely different. Because Stuxnet was a small application developed for a particular target with the specific objective to interact with industrial control systems and break them down. And Flame is a universal attacking tool kit used mostly for cyber espionage. So there are so things that [Flame] shares in common with Stuxnet and Duqu, and these are the vulnerabilities that are used by both [types of] malware. Probably one malware simply copied vulnerabilities from the other malware program when they were published.

RT: So this means that cyber warfare is evolving rapidly, and 'Flame' vividly confirms this trend. Can less technologically developed nations resist such attacks, or is it game over for them?

VK: It’s never game over in this area, because even if the country isn’t technologically developed in this area, it doesn’t prevent them from cooperating with organizations like ours and with private companies in the security industry that can provide them with valuable pieces of information which can actually result in the discovery of such threats. And when we discover such threats, we permanently add them to antivirus databases, and users from those nations can use freely available trial tools and commercial antivirus [software] to protect their systems.

RT: This enormous stratum of data that 'Flame' can gather, who would need it and is it really possible to analyze such an avalanche of information?

VK: First of all, when we’re talking about the size of data that is to be analyzed, we know that the attackers do not infect as many victims as possible. Their resources are limited; it seems that they understand that. They are keeping the number of infected machines more or less the same. So it’s the same level. When they finish analyzing data that has been stolen from one network, they remove the malware and switch to another.So we think that it’s still possible the extract only the data they are interested in.

RT: So can we call this a cyber war, and if so?

VK: Stuxnet and Duqu were bright examples of cyber weapons which could even physically destroy infrastructure, and this [Flame] is a continuation of this story. So this is another development in this roe which continues in addition to Stuxnet and Duqu.There are also nation stations supporting [these] developments. We think that cyber warfare has been going on for years already. People were just probably not aware of it because cyber warfare has a unique feature: it’s hidden. Nobody knows when cyber warfare operations are going on. This is the key feature of it.

RT: Who is behind these cyber attacks?

VK: Like with Stuxnet and Duqu, it’s currently unclear who is behind it. It’s very hard to find out who is behind it because when we try to follow the traces, who controls the application – it connects to the command and control centers – it turns out to be… dozens or even more servers spread around different countries around the world. More than 80 or 90 domains are associated with those servers. Most of them are registered with fake identities. So they’re pretty well protected and hidden. So it is unclear who is behind that, and we try not to speculate who could be behind such attacks. We try to base it on pure facts like the language we extract from the code. In this case, we only found traces of good English used inside the code.

RT: So who do you think is winning this war?

VK: I think that humanity is losing to be honest, because we are fighting between each other instead of fighting against global problems which everyone faces in their lives.

Article Source

Fake antiviruses

2012-09-02T12:33:00.002-07:00

Basic description

Fake antivirus software is a scam commonly used by malicious software creators in order to sell fake security software to unwitting victims. The scam will typically involve a webpage or pop-up that informs the user they have viruses or other malware on their computer, even though they do not. It then offers to clean the infection. When the user opts to clean up they are required to pay to obtain a version of the fake software the will perform the cleanup. After the victim pays the software may or may not cease the fake warnings.

Technical detail

Fake antivirus, also known as rogue antivirus or scareware, is one of the leading ways for malicious hackers to make money from unsuspecting Internet users. The fake antivirus software typically warns the user that they have various fictional security threats present on their computer. The warnings themselves are false but they are often backed up by believable descriptions of the supposed malware.

When the user chooses to remove the threats they are asked to purchase or register the product and taken to a website that will process the payment details.
The webpages that users are taken to may look like one of these:

Fake antivirus is spread using a variety of methods, all designed to draw an unsuspecting user into installing the software.

Email and messaging
Criminals send spam email and social network messages with the software installer attached, using a social engineering lure to persuade the recipient to open the attachment. Common lures include tax refund information, package delivery notifications or pictures of topical news stories.

Search engine poisoning
Hackers create pages related to common or topical search terms and design them to appear high in search engine results. This makes it likely that people will encounter the page during their usual search activity. The webpages may either display warnings about infection that encourage the user to purchase the fake antivirus, or they download a video player which is actually the fake antivirus installer.

Compromised websites
Cybercriminals often break into other websites in order to spread their software, relying on the site's popularity to draw innocent users. The hackers will then install extra code into the compromised pages, again with the goal of either displaying fake security warnings or exploiting a browser vulnerability to install their software directly. Cybercriminals will often combine these techniques to increase the effectiveness of their fraud.

The fake antivirus software makers use a variety of names for their software to make it appear legitimate. Examples of these names include:
AntiSpywarePro
Antivirus Plus
Antivirus Soft
Antivirus XP
Smart Internet Protection
Security Defender

Some will also steal the names of legitimate security software.

Article Source

Bitdefender Relaunches Clueful as Free Social Web-Guide on iOS App Behavior

2012-08-31T07:26:00.002-07:00

Former iOS Privacy App made available again with more features for consumers to learn how Apps treat their data and privacy

Bitdefender, the award-winning provider of innovative antivirussolutions, today announced the relaunch of Clueful, the first security application to empower iPhone owners to distinguish privacy violating apps. Replacing the controversially removed iOS App Store version, Clueful returns as a free web-app globally.

Available for free at http://www.cluefulapp.com via iPhones, iPads and PCs alike, the new Clueful adds more features and more vital privacy information for users. Users are informed of Apps that are careless with usernames and passwords, track location, read and use address books, access calendars, drain a device’s battery, overly target users with ads, don't encrypt personal data or transmissions, track and aggregate the owner’s usage through multiple analytics networks, and more.

Alongside access to Top App listing information, users can now add comments on any App’s clue card and comment on how developers handle their privacy.

“The iPhone is the most personal of your personal devices, storing large amounts of private information that app developers would love to access. We feel Clueful is one of the most useful and valuable tools available to consumers and are excited to relaunch it,” said Bitdefender’s Chief Security Researcher, Catalin Cosoi. “We’re putting Clueful out as a comprehensive, full-featured guide to iOS apps with added social features and are preparing further advances for this new technology. There will be much more about Clueful coming soon.”

Bitdefender®, the award-winning provider of innovative antivirussolutions, continues to work with Apple to bringing the initially approved and later pulled Clueful back on the App Store.

ZUHGRGUVN872

Article Source

PandaLabs Offers Security Tips to Stay Safe This Summer

2012-08-30T12:18:00.000-07:00

PandaLabs, the anti-malware laboratory of Panda Security, The Cloud Security Company, today published its annual security tips for consumers to stay safe this summer and avoid falling victim to computer fraud. During the summer, people (especially children) have more spare time on their hands for using computers and connecting to the Internet more frequently, thus increasing the risk of falling victim to malicious code.

One of the newest scams that has surfaced recently involves sending fake flight confirmation emails. The potential victim receives a fake confirmation for ‘recently purchased tickets’ with instructions on how to open an attachment to view the ticket. The file, however, is a Trojan of the Sinowal family that is designed to steal users’ confidential information.

“In the summer, many people book flights online to get to their holiday destinations,” said Luis Corrons, technical director of PandaLabs. “Cyber-crooks are taking advantage of this situation to send a new wave of fake emails aimed at tricking users into opening the attachments and infecting their computers.”

Security Tips for Summer Vacation

PandaLabs is continually analyzing the latest Internet trends, and with this in mind, offers the following advice to help safeguard users’ security this season:

Use caution with social networking sites: People give out too much information about their holiday plans on social networking sites, even tipping criminals off about their empty homes. Check privacy settings and avoid sharing private information on social networks.

Install parental controls: Children spend more time in front of computers during summer vacation. Installing a good parental control program on the computer will help minimize children’s vulnerability on the Internet.

If you can avoid it, never use a shared computer: If using a shared or public computer on vacation is a must, prevent identity theft by making sure your account doesn’t automatically save your password and user ID. If you suspect the computer’s security has been compromised by a virus, leave it and use another. Take care when connecting an external device to the computer, as it may become infected without your knowledge.

Take care with email: Email is one of the main virus entry points, so pay special attention to it. Do not open messages from unknown senders or click on dubious links.

Beware of public Wi-Fi networks: You could be hooking up to a network set up by hackers to steal any information that you share across the Internet. When you connect to email, social networking sites or online stores, make sure you are using a secure connection (https), so that traffic is encrypted and no one else can access the information.

Keep your computer up-to-date: Malware seeks to exploit existing security holes in systems to infect them. Make sure all necessary security patches and updates are properly installed.

Protect your computer: Make sure you have reliable, up-to-date protection installed on your computer. There are many free, reliable solutions on the market, like Panda Cloud Antivirus, available for download at www.cloudantivirus.com.

“By following PandaLabs’ tips for staying secure, users can enjoy their summer vacations with greater peace of mind. Just as people would lock all doors and windows before going on vacation, consumers should also take great care to protect their digital worlds,” added Corrons.

Article Source

50% of users cannot recognize a phishing message

2012-08-29T10:16:00.002-07:00

The standard data theft method is social engineering – a potential victim is lured onto an infected web-page or is duped into opening a file attached to an e-mail. It is not always easy to recognize such a message, as a survey conducted in May 2012 by O+ K Research at the request of Kaspersky Lab demonstrates. During the survey, 50% claimed they are incapable of recognizing a phishing message or a forged web-site.

The overwhelming majority of phishing messages are delivered through e-mail or social networks. The reason is simple: these are currently the most wide-spread means of communication. According the same research, 86% of PC users check their e-mails regularly, and 73% communicate in social networks. 54% of users chat on the Internet regularly with their smartphones. Cybercriminals who use phishing as a tool to steal data are primarily interested in gaining unauthorized access to social network accounts, accounts in online banking and payment systems, and e-shops. According Kaspersky Lab, in June 68% of phishing messages related to such services were targeted at data theft.

The results give indirect evidence that the mass messaging method bears fruit: about half of the O+K Research respondents noticed they have already encountered suspicious correspondence in social networks or e-mail. Thus, 47% of PC users got a message with a suspicious link or an attachment, and 29% of respondents got letters on the name of a bank (social network, another service, etc.) with a request for confidential information.

Moreover 26% of users admitted that their computers had been infected as a result of opening an attachment to a letter, and 13% of respondents had entered personal or financial data at suspicious pages. Therefore when fighting against fake and infected messages and web-sites, instead of relying upon your own efforts it is better to use specific solutions. The new Safe Money technology, presented as a part of Kaspersky Internet Security 2013, helps to detect and block attempts to steal your sensitive data via phishing web-pages and malware linked to online shopping or banking services.

Quite a high percentage of users fell prey to phishing on their mobile devices. 24% of tablet users and 18% of smartphone owners received correspondence with suspicious links and attachments. 14% and 11% respectively had letters on behalf of a bank or social network. One can presume that as we see more and more mobile devices going online, the amount of phishing letters for mobile platforms will also grow. Therefore it is high time to think of protecting you mobile devices with specific anti-phishing solutions. This function is already available in Kaspersky Mobile Security and Kaspersky Tablet Security.

Article Source

Facebook connects users to free antivirus software

2012-08-27T12:07:00.001-07:00

Facebook is now directing users who think their computer might be infected to sites where they can get free antivirus software.

The Malware Checkpoint for Facebook sends people either to sign up for Microsoft Security Essentials or McAfee Scan and Repair. Mac users are referred to an Apple Security Updates site.

Facebook already notifies users when the site detects a possible malware infection on an individual machine, and provides these users free antivirus software to clean up the infection. The social network has now opened up its anti-malware campaign to all users in order to them them proactively protect themselves, according to a post on the Facebook Security page:

If you are concerned that your device may have been infected by malware, you can visit http://on.fb.me/infectedMSE or http://on.fb.me/infectedMcA to be self-enrolled in either our Microsoft Security Essentials or McAfee Scan and Repair malware checkpoints...
1. The McAfee option will download a small program onto your Windows computer to perform a one-time scan of your system for malware. It will not interfere with your existing anti-virus or other security products. After it scans your system, it will give you the option to automatically or manually remove the files it flags as malicious.
2. The Microsoft Security Essentials option is a full anti-virus product. Upon download and install, it will add anti-virus software to your computer that will continue to protect your system with the latest anti-virus signatures from Microsoft.

Last year, Facebook added new security features, including Login Approvals and warnings when users are about to get hit by clickjacking and cross-site scripting attacks or malicious links on sites. Earlier this year, the site began offering free antivirus assistance and improved its external blacklist system to protect users from malicious Web sites.

Article Source

Nasty Trojan that encrypts your files

2012-08-24T11:06:00.001-07:00

There is a lot of nasty malware out there and a new one popped up this week. This particular malware is a Trojan and the idea behind it is not new though the Trojan now has new and improved ways to spread. Unsuspecting users can be infected by the Trojan by clicking on infected links, particularly in forums.

This Trojan is a ransomware that encrypts your files (documents, image and shortcut files) and demands a password to decrypt the files. This password is available for the small price of €50. If the user attempts to enter a password, he will get five attempts before the files are locked and sealed, impossible to decrypt. The Trojan is called Trojan:W32/Ransomcrypt. Once the files have been encrypted, the EnCiPhErEd ending is added to their file name. A text message is displayed, offering the user to enter a password. If the password is wrong (which it of course is because the user has no idea what it could be), another text message appears that offers the release of the encrypted files after the ransom has been paid. F-PROT Antivirus users will be happy to know that a virus definition for this infection has already been released. F-PROT Antivirus users with updated programs should be safe from this malicious Trojan.

To avoid infection of this type, we encourage users to avoid clicking on suspicious links and never to enter their credit card number or transfer money after a mysterious pop-up message from a product or service that you did not request is displayed on their computer. Installing and using a good antivirus is also essential. Also, and this can not be said too many times, it is absolutely vital to have a back up of all files, photos and documents. Regularly take a back up of all your computer data and store it in a safe place.

Article Source

McAfee antivirus update hits enterprise customers

2012-08-24T11:04:00.001-07:00

DAT 6807 and 6808 updates crippled antivirus programs and left some computers without an Internet connection

A buggy update released last week by security vendor McAfee for its consumer and enterprise antivirus products, left the computers of its customers unprotected and, in some cases, unable to access the internet.

The incident affected both home and business users, some of whom were still trying to sort out the problems caused by the updates on Monday and Tuesday, according to messages posted on McAfee's community forums and Facebook page.

The problems were introduced by McAfee updates DAT 6807, released on 17 August and the subsequent DAT 6808, depending on which product was used.
After installing these updates some home users started encountering errors when accessing the McAfee Security Center console, which prevented them from performing any action inside the program. Other users experienced a loss of internet connection on their computers.

McAfee confirmed these problems on Sunday in a technical document that described two possible solutions, both requiring users to update to a newly released DAT 6809 file.

One workaround, intended for users who lost internet connectivity on their computers, involved uninstalling the product, rebooting the computer, downloading an updated version of the product from McAfee's website and installing it.

The other solution described automatic and manual methods of updating existing installations to DAT 6809. Users who continued to encounter errors after updating to this DAT version were advised to uninstall the product using a specialised tool called McAfee Consumer Product Removal (MCPR) and then install the updated version of the product.

Users of McAfee VirusScan Enterprise (VSE) 8.8.x, the company's flagship enterprise antivirus product, had to wait until Monday for a so-called superDAT hotfix that wouldn't require them to reinstall the product on thousands or hundreds of affected computers.

For VSE, the bad updates caused issues with the on-access scanner (OAS), a critical component that checks all files accessed by the system for signs of malware, the company said in a support document published on August 20.

Some administrators in charge of antivirus deployment in corporate environments expressed concern that while the OAS remains disabled a user could get infected and the malware could spread to other computers on the network.

"I have 46 out of 152 computers, having this issue," said a user on the McAfee community forum for business products. "I currently have over 3000 endpoints with this problem - solution asap please McAfee," another user said.

"The issue is well over 24 hours old now, and it's been 'officially' confirmed for nearly 24. That's a very long time to have AV [antivirus] in a faulty state," one wrote hours before McAfee released VSE 8.8 Hotfix 793640 to remediate the issue. "At least one saving grace is that many customers had their machine switched off over the weekend," he said in a later post.

VSE 8.8 Hotfix 793640 is mandatory and includes the full DAT 6809 package, McAfee said.

Because of this the file is approximately 100MB in size and deploying it to thousands of machines posed a challenge for some administrators.

"McAfee is working on a smaller solution that will remediate the issue without the need to include the full DAT package," the company said. "There is no current ETA for this release."

In the meantime, McAfee recommended that the hotfix be deployed in stages on networks with offsite branches, where it might cause bandwidth issues. "For example, schedule the update task to run for one group at a time," the company said.

Another problem encountered by administrators was determining which of the systems under their care were affected. The ones with the buggy DAT files should report a DAT and antivirus engine version of 0.0000 to the central ePolicy Orchestrator (ePO) server.

However, after the hotfix is deployed, some computers can continue to report this bogus information because of caching until they are forced to provide full property data to the ePO server, McAfee said.

Even though the hotfix does not force a reboot, the company recommended that administrators reboot all client systems at their earliest convenience in order to validate that the fix was successfully installed.

Some users whose affected systems include servers were not happy with this. "This has predominantly affected our servers and rebooting them isn't an option," a customer said on the McAfee forum yesterday.

"I work in a very tightly controlled environment and rolling out a 100mb hotfix that MAY require a reboot ASAP is not going to happen," another user said.

This is not the first time that McAfee has issued a bad DAT file. In April, a DAT update for McAfee email gateway security products resulted in system crashes and message scan failures.

However, McAfee is not the only antivirus company that was forced over the years to deal with buggy updates that affected their customers' computers in a serious manner.

"Since these events are becoming a worrying trend, should we implement test procedures inside our organiSations as we do with other updates like the ones deployed by Microsoft with Windows Update?" asked Manuel Humberto Santander Pelaez, a security incident handler at the SANS Internet Storm Center.

Some users who responded to Pelaez believe that testing every antivirus update would cost too much time and resources compared to the possible benefits. Others said that delaying the update deployment by 24 hours or deploying the updates in stages starting with the least critical systems would limit the impact of a bad update.

Delaying antivirus updates increases a computer's window of exposure to the latest threats. However, this is a calculated risk that some administrators are apparently willing to take.

Article Source

Symantec antivirus update causes Windows XP machines to crash

2012-07-17T06:06:00.000-07:00

Customers were not happy after security firm Symantec made a recent update to its antivirus software, causing some Windows-based PCs to crash repeatedly, showing a dreadful “blue screen of death” in many cases. The company released a statement on its website saying it received a number of reports with machines running Windows XP that were continuing to show the blue screen after rebooting.

It was discovered that the issue had been limited to machines running any combination of Windows XP, the latest Sonar antivirus software version, the 18 Sonar signature set from the July 11 revision and software from third parties. “The root cause of the issue was an incompatibility due to a three way interaction between some third party software that implements a file system driver using kernel stack based file objects – typical of encryption drivers, the SONAR signature and the Windows XP Cache manager,” Symantec said.

Enraged customers said they were forced to remove the software manually and disable their machines. Someone had said on the discussion boards that Symantec would compensate customers for the inconvenience, but the company recently responded to the problem saying that it would not be providing compensation packages. Symantec said it was working hard on a solution and providing technical support to customers, including directly reaching out to customers who had posted about the issue on the discussion boards.

Bitdefender 2013 launched

2012-07-16T09:23:00.000-07:00

Bitdefender has released its 2013 range: Antivirus Plus 2013 ($49.95), Internet Security 2013 ($69.95), and the high-end Total Security 2013 ($79.95).

And the headline addition this time is Safepay, a secure virtual browser which aims to protect your online banking and shopping details (although the technology will help to shield any confidential online activity). It’s a useful feature and is available on all three products.

The 2013 products also now include a “USB Immunizer”. Right-click a flash drive in Explorer, select “Immunize this drive” and it’ll be protected against future infection by autorun-based malware.

The other major new feature is Anti-Theft, a computer location service which is available in Total Security 2013 only. If your system is lost or stolen then just log in to your Bitdefender account, and you may be able to display its whereabouts on a map, as well as locking the computer remotely or, as a last resort, wiping it clean.

And just as you’d expect, several of the existing features have also seen worthwhile enhancements. The parental controls are more capable, Safebox now allows secure file sharing, and the MyBitdefender dashboard now makes your program status accessible to any internet-connected device, for instance.

Put it all together and this looks like a solid move forward for Bitdefender. Safepay in particular seems a very effective way to avoid malware, and it’s good to see the tool available in every program across the range. If you’re looking for a new security suite then Antivirus Plus 2013, Internet Security 2013, and Total Security 2013 deserve careful consideration, and 30-day trial builds of each are available now.

Avira AV update hangs systems

2012-07-12T08:49:00.000-07:00

A faulty update for Avira's paid-for anti-virus software blocks harmless processes and may in some cases stop computers from booting. The update results in the ProActiv behavioural monitoring component becoming oversensitive in its treatment of executable files.

According to user reports, ProActiv blocks trusted system processes such as cmd.exe, rundll32.exe, taskeng.exe, wuauclt.exe, dllhost.exe, iexplore.exe, notepad.exe and regedit.exe. In some cases this results in Windows failing to boot properly. It also appears to be blocking non-OS applications such as Microsoft Office, the Opera web browser and Google's Updater program.

All versions which include the ProActiv behavioural monitoring component are affected, including Avira Antivirus Premium 2012 and the enterprise version; only 32-bit systems are affected, as ProActiv doesn't currently support 64-bit operating systems. On the Avira forum, an employee of a company which runs Avira on one hundred computers complains that, "This update has been pretty catastrophic. The whole company ground to a standstill."

Until the problem has been resolved, users are advised to disable Avira's ProActiv behavioural monitoring component
In view of the arbitrariness with which the behavioural monitoring component is blocking files, users who have installed the update are advised to disable ProActiv. To do so, access Avira's settings, activate the Expert mode using the switch on the left and uncheck 'Enable Avira ProActiv' under 'Realtime Protection', 'ProActiv'. According to user reports, if Windows is having difficulty booting, this can be fixed in some cases by starting in safe mode and then deactivating ProActiv.

In a statement to The H's associates at heise Security, Avira confirmed the problem and said that its developers are currently working on an automatic update to resolve the bug. The potential scale of the bug is huge – according to Avira, the faulty update has already been downloaded more than 70 million times; this figure includes those running the free version of Avira which is not affected. The company has now stopped distributing the update.

Update: Avira recommends adding exceptions for the affected system processes to the ProActiv's Application filter. However, as the list of processes is rather long, it is still advised for the time being to disable ProActiv.

Update 16-05-12: Avira has released an update for its products that caused them to block legitimate Windows applications and system processes.

Bitdefender Clueful removed from the Apple app store

2012-07-09T09:22:00.001-07:00

The Bitdefender app for Apple devices cluefulapp.com was removed from the appstore.

Clueful was designed to be the only way to really understand iOS apps, how they use your private data and treat your privacy. This one-of-a-kind product identifies intrusive applications and shows you what they do behind your back.

We do not know at the moment why Apple did this, no comments were issued on the topic.

With Clueful, Bitdefender said it can now answer questions about what your apps are doing. It shows which apps are accessing your location, tracking your in-app usage, reading your address book, linking your actions across apps to a single identity, needlessly keep GPS running, thereby draining your battery, accessing your UDID, and a host of other ills. To do so, Clueful examines what applications are running in memory and then retrieves audit information from the “Clueful Cloud.” (That’s the name for the space where Bitdefender maintains all the data on apps, and it’s also the way they ensure communication between the app and Bitdefender’s research labs.)
To create the Clueful Cloud, Bitdefender built proprietary technology similar to what they use for their anti-virus products, but customized for iOS apps. But because it’s a proprietary technology and patent pending, the company won’t go into detail about the specifics of how it works. But the long and short of it is this: Bitdefender tests apps, creates a database, and then shares that info with the Clueful app to give you insight about the apps you use on your phone.

Facebook announces Antivirus Marketplace

2012-07-08T05:04:00.000-07:00

Facebook today announced the Antivirus Marketplace, or just The AV Marketplace for short. The news is two-fold: the social network giant has partnered with Microsoft, McAfee, TrendMicro, Sophos, and Symantec to provide its users with access to full version antivirus software free for six months, and the five companies will also augment Facebook's URL blacklist system with their own URL blacklist databases.

First let's talk about the free software, since everyone likes free stuff. The AV Marketplace is aimed at the hundreds of millions of Facebook users who don't currently have security protection on their computer. Facebook lets you download licenses to full versions of antivirus software: Microsoft Security Essentials, McAfee Internet Security 2012, Norton AntiVirus, Sophos Anti-Virus for Mac Home Edition, and Trend Micro internet security for PCs and Macs. After six months, for the ones that aren't free forever, you'll have to pay up.

Out of the five options, I prefer Microsoft Security Essentials, which is free forever, not just six months. I've recommended MSE since day one, and I will continue to do so until something better comes along.

The marketplace is accessible from the Facebook Security Facebook Page, or via this direct link: on.fb.me/FBAVMarketplace. Facebook wouldn't say, but I'm assuming it will eventually expand its list of antivirus partners to offer further free alternatives for its users. The social networking giant says arming its users with antivirus software will "empower them to stay safe no matter where they are on the web."

At the same time, Facebook's over 901 million active users will now be protected by the combined intelligence blacklists of the security industry. Facebook's URL blacklist system, which already scans trillions of clicks per day, will now incorporate the malicious URL databases from these security companies.

This means that whenever you click a link on Facebook, it not only be checked against Facebook's blacklist, but also the blacklists provided by Microsoft, McAfee, TrendMicro, Sophos, and Symantec. For more information on how Facebook's URL blacklist system works, check out How Facebook protects users from malicious URLs.

Last but not least, Facebook also said these companies will be writing posts on Facebook Security to provide important security material to help Facebook users keep themselves, and their data, safe. To get these updates in your News Feed and Ticker, you'll need to Like the Facebook Page.

"Nothing is more important to us than the safety of the people who use Facebook, and the security of their data," a Facebook spokesperson said in a statement. "The Facebook Security Team has pioneered many innovative defense systems against viruses, spam and phishing attacks, as well as extensive automated enforcement mechanisms that quickly shut down malicious pages, accounts and apps. Truly effective security requires cooperation and we are excited about this partnership with many of the leaders in the security community to better help us defend against existing threats, anticipate new ones and arm people with the tools they need to protect themselves."

Article Source

Flame worm one of the most complex threats ever discovered

2012-07-06T04:06:00.001-07:00

The jury is out on whether 'Flame' (also known as 'Flamer' or 'Skywiper') is 'the most lethal cyberweapon to date' as some have claimed, or just a highly complex and sophisticated piece of malware. But simply from looking at the volume of security vendors' blog posts dedicated to the malware since its discovery this week, it is clear that Flame is far from ordinary.

One thing we do know is that there is a lot that isn't known yet. Because of both its size - when fully deployed, it is almost 20MB - and its complexity, researchers expect the full analysis to take several months at least.

What is known is that Flame is a modular piece of malware that has worm-like features, which allows it to spread on a local network. The use of modules is not unique to Flame: prevalent trojans such as ZeuS and SpyEye allow for the use of modules or plug-ins. However, whereas the latter kinds of malware are used to target the masses (stealing online banking details, sending spam), Flame's capabilities, which include network-sniffing, taking screenshots and recording audio conversations, suggest it is being used for cyber-espionage purposes.

So far, a few hundred infections are known, with victims varying from individuals to state-related organisations. Most of the victims are located in the Middle East: of the few hundred known infections, Iran features most prominently as a location, followed by Israel and Sudan.

The complexity of the malware, the prevalence of infections in Iran, as well as a number of technical features (such as the use of the Lua scripting language), suggest similarities with Stuxnet and Duqu. However, there are many differences too: unlike Stuxnet it does not appear to target SCADAs and the number of infections is probably significantly larger than that of Duqu. It is currently unclear whether the malware uses any zero-day exploits.

It is possible that Flame was developed by the same group that developed Stuxnet and Duqu, though likely as a parallel project. Given the location of the infections and the fact that developing something like Flame would require huge resources, many believe the governments of one or more rich Western nations are behind the malware. However, as with Duqu and Stuxnet, noone has been able to prove such claims.

While it has been discovered only recently, it is believed that Flame has been around for some time, possibly going back as far as March 2010. Writing about the malware, F-Secure's Mikko Hyppönen said that this is a case where the anti-virus industry has failed.

Virus Bulletin will continue to follow the developments around Flame and report about it on www.virusbtn.com and on our Twitter feed. While complacency is rarely a good idea when it comes to cybercrime, it is worth pointing out that the vast majority of users and organisations are unlikely to be affected by the malware.
Article Source

Free Cloud AntiVirus Security Startup Immunet Reaches 500,000 Members

2010-09-08T11:00:00.000-07:00

PALO ALTO, Calif., Sept. 7 /PRNewswire/ -- Immunet, the developer of next-generation security and Cloud AntiVirus technologies, today announced it has reached over 500,000 users of its free AntiVirus product, Immunet Protect. Immunet Protect 2.0 launched in June 2010 and received a 4.5 star rating from CNET. Immunet provides real-time protection from over 14 million threats through the Immunet Cloud. The product is extremely lightweight (up to 35 times smaller than competing products), fast, and compatible with other market leading security software.

"We've grown extraordinarily fast since we launched our beta product in August of 2009. We owe our success to our members who recommend and share Immunet with their most trusted contacts, friends, and family," says Oliver Friedrichs, Immunet Founder and CEO, "We've focused on changing the AntiVirus experience from one that cripples your PC to one that is streamlined and seamless. In addition, the approaches used by traditional products protect you from less than 50% of new threats; Immunet Protect fills that gap. Our rapid growth demonstrates that performance and efficacy continue to be a real pain point for Consumers as they seek out new solutions."

Each time a user downloads the free Cloud AntiVirus software from immunet.com, they can protect their friends and contacts by inviting them into their community. Each new member in the community enhances the strength of Immunet's Collective Immunity(TM) technology. This technology offers members a network protection effect that keeps their personal PCs and the computers of their friends and family safe online. Each time a virus is blocked on one computer in the Immunet Community, all other PCs are instantly protected from the same virus. This collaborative approach leverages 'strength-in-numbers' to grow stronger with each new community member.

"I'm extremely excited to see our software used by over half a million people to protect their PCs. We're now protecting members in over 192 countries, including the Vatican City!" says Cofounder and VP of Engineering Alfred Huger. "We welcome the next 500,000 members with open arms."

Immunet Protect Free 2.0 is available as a free AntiVirus download from the Immunet website, www.immunet.com. Users can upgrade to Immunet Protect Plus for advanced, offline protection at anytime, while Immunet Protect Free will always remain free.

About Immunet

Immunet was founded in July 2008 by AntiVirus industry veterans to address a sweeping shift in the Internet threat landscape. Immunet utilizes the latest advances in computing, including cloud computing, collective intelligence, data mining and machine learning. Immunet Protect 2.0 is a free Cloud AntiVirus download that provides real-time protection from over 14 million threats daily.

To connect with Immunet please visit www.immunet.com, follow us on Twitter @immunet or visit the Immunet Facebook Fan Page.

Collective Immunity(TM) is a registered trademark of Immunet Corporation.

Article Source

Fake antivirus software using ransom threats

2010-09-08T10:59:00.001-07:00

Fake antivirus programs appear to be adopting some of the money-raising tactics of more threatening ransom malware, security company Fortinet's latest threat report has found.

The most prevalent malware variant during August was TotalSecurity W32/FakeAlert.LU!tr, a malicious program that masquerades as antivirus software in order to sell worthless licenses for non-existent malware. On its own it accounted for 37.3 per cent of all malware threats detected by the company during the month.

Unlike standard fake antivirus programs, however, the new version of TotalSecurity takes the ruse a stage further by preventing any applications other than a web browser to run, claiming they are 'infected'. The user is invited to have the infection cleaned by buying the bogus TotalSecurity product.

Adding an extra layer of sophistication to its arsenal - and no doubt aware how quickly bogus antivirus software is blocked by genuine security products - TotalSecurity can now vary the downloads it feeds to target PC using server-side polymorphism. Put another way, the exact version downloaded to a victim's PC will constantly change which makes detection harder.

"This is a technique typically seen with botnets, such as Waledac, and has been picked up by the developers of TotalSecurity. This is another example of how relying purely on antivirus is not a silver-bullet approach to protecting systems from infection," said Fortinet's threat research head, Derek Manky.

According to Fortinet, such attacks demonstrate the vulnerability of PC-based antivirus software. A layered defence would have a better chance of detecting TotalSecurity by either intercepting the initial spam used to spread it or by blocking the download website.

Once rare enough to be a curiosity, malware using threats and direct interference with a PC's operation have slowly become more common.

A previous report from Fortinet in March noted a sudden surge in the technique, about a year after the first aggressive use of ransomware in the form of the notorious Vundo Trojan. That particular piece of malware used crude encryption of a victim's files.

In July came news of the odd Krotten Trojan that disables a victim's PC in a variety of ways before asking for a tiny payment to be made to a Ukrainian mobile phone network. Two months before that researchers in Japan discovered the Kenzero porn blackmail Trojan that threatens to post a victim's embarrassing browsing history to a public website.

Join CIO, the CIO Executive Council & IDC on 6 October at Australia’s premier Melbourne event for senior IT executives – the CIO Summit 2010.

Article source

Antivirus isn't dead--it's growing up

2010-09-08T10:58:00.000-07:00

We've been hearing it for years: antivirus software is dead. But is it really? If so, it seems to have more lives than Richard Nixon.

Rather than being the industry's swan song, mobile devices could be its redemption opportunity.
The antivirus industry is in major transition as threats have evolved from being just the viruses and worms written to exploit holes in Windows that plagued computers in the 1990s to the exploits that target vulnerabilities in Web applications and end user gullibility today.

Many consumers fork over at least $40 for Norton AntiVirus or something similar, many more are turning to free antivirus from AVG or Avast (here's why), and yet millions of computers are still getting hit with infections daily.

While no antivirus software is perfect, the perception that AV often isn't doing a good enough job is backed by studies. Recent benchmark tests pegged the average detection rate among major antivirus products at about 75 percent. (In one test, three out of 10 products stopped all of the original exploits, but the vendors are not named. However, the tests are to be taken with a grain of salt given the variances in testing standards.)

Antispyware and antispam have become standard in most AV, or antimalware, products as vendors have expanded their software into endpoint protection suites. And many have begun placing as much emphasis on heuristic technologies that look at the behavior or reputation of a piece of software as well as matching it to a database of malware signatures. But malware writers are adept at testing their code against the antivirus software and tweaking it until it passes through undetected.

As an alternative, some people are turning to whitelisting technologies that allow only approved programs to run on a computer. Whitelisting is akin to the closed environment of the iPhone where Apple vets every app and is largely effective in protecting the devices, said Gartner analyst John Pescatore. (Bruce Schneier discusses the problems with whitelisting in his essay from last year on the state of the antivirus industry.)

"Antivirus in the e-mail server does a lot of good things...(but) antivirus on people's desktops is almost totally ineffective," Pescatore said. "The antiviral model has been broken for quite a while."

With the fast rise of smartphones and new electronics like iPads, the big challenge for antivirus companies is how best to protect those devices.

It's obvious the traditional antivirus software model won't work, in large part because handheld devices have limited processing power, memory and storage, said Rebecca Bace, chief executive of Infidel, a security consultancy. That's where the cloud comes in, she said.

"There is market demand from the consumer that this will be rolled in as part of the service," Bace said. "This is part of the utilization of network access; something you expect a provider to offer. When I sign up with Verizon, to a degree I'll have the expectation that they'll handle all the security stuff."

Pescatore has a similar view of the future of mobile security.

"In the smartphone world, the answer will not be putting antivirus clients on every phone," said Pescatore. "The answer will be (malware) filtering by cellular carriers...Everything that goes on the phone has to go through the carrier."

Clearly, the antivirus space is grappling with how to move to mobile, said Hugh Thompson, who serves as chair of the RSA Conference and is founder of consultancy People Security and an adjunct professor of software security at Columbia University.

"The challenge for antivirus is how to adapt to new devices, how to allow users to make better choices around what they're doing, and from a business perspective it's coming down to the cloud--what does antivirus mean in the cloud?," he said. "Those three points will define AV over the next two to three years."

Mobile is likely a big reason behind Intel's $7.6 billion acquisition of McAfee, according to Thompson. "For Intel to buy McAfee, they can build some synergies there so that when the chip is released they will have an antivirus solution that supports the chipset and the platforms that come on it," he said.

In general, a big part of the problem for people today is the fact that they are putting so much of their lives on the Web and they don't realize that that data, albeit in numerous different Web sites and sources, can be easily used to trick them into accepting malware with open arms. Sites like Facebook, LinkedIn, and Twitter have expanded peoples' circles of friends and acquaintances exponentially and that can be used to advantage in personalized attacks.

Antivirus will eventually have to defend against social engineering attacks as well as malware, Thompson said.

For instance, an e-mail coming from someone claiming that they met you at an event a few months back and you have a friend in common is more likely to be trusted than one with a generic reference like "LOL is this you?" with a link that appears to lead to a video.

"In the future, an antivirus product will go out and analyze the information and say this is the data that is out there on the Web, this could be a legitimate person, but it will make you aware that you are connected to this person on LinkedIn and you tweeted about a meeting five months ago," Thompson said. "That context sensitive level of threat information is going to be really important in the future."

"It's a fascinating time for AV," he said. "Rumors of its death have been greatly exaggerated over the last few years."

Article Source

VMworld 2010: Day 1, Attendees Say “Yes, We Cloud!”

2010-09-01T14:36:00.002-07:00

This year’s VMworld topped all expectations and attracted 17,021 attendees, an impressive number considering the state of the economy and the overall retreat in conference attendance due to budget cuts. The theme this year is, “Virtual Roads. Actual Clouds.” it’s all about how we get to the Cloud.

. While the opening keynote was heavily branded and influenced by cloud, it was very apparent that the focus and the innovation were geared towards the applications. Making applications available from anywhere, at any time using any device summarizes the opening keynote.

The keynote started by showing a humorous short movie that was attempting to describe and define Cloud Computing, it even enlisted the help of “The Oracle” from the feature trilogy “The Matrix” to try and define Cloud Computing to no avail.

Up first was VMware Chief Marketing Officer Rick Jackson to kick off the opening session by taking us down memory lane, recapping the value add and cost savings that VMware’s products delivered to organizations. Jackson also emphasized the need for open standards when dealing with virtualization and cloud computing, an extremely welcome step, but we can start with VMware View, allowing it to be hypervisor independent.

Paul Maritz then took center stage for the official keynote, “virtually speaking” Maritz declared the death of the operating system, taking a jab at Microsoft. He first reports that in 2010 the number of virtual machines deployed far surpassed the number of physical machines. He then indirectly uses this analogy to announce that virtualization, today, replaces the hardware and that the application platforms replace the operating system.

He tries to soften the blow a bit by saying that this will happen with or without VMware but the underlying message was clear; VMware wants to build the next generation applications independent of a general purpose operating system.

Maritz also emphasized the importance of automation and orchestration on private and public clouds, noting that today, for every dollar spent on CapEx, $6 to $8 is spent on OpEx, therefore, VMware is dedicated and will continue to innovate in these areas.

Dr. Stephen Herrod, CTO and Sr. VP of R&D was up next, he announced 2 VMware acquisitions, Integrien, a company based out of Armenia that focuses on visual, real-time performance and analytics. The second acquisition was of TriCipher, a single sign on solution for SaaS portals.

Herrod also took a big jab at Microsoft, indirectly criticizing Hyper-V’s inability to live migrate more than 1 VM at a time.

Herrod then announced the availability of vCloud Director, a highly automated, self-service, pay-as you go engine that allows enterprises and service providers alike to extend this functionality to their users. A slew of security products were also announced, notably the vShield Endpoint, an Antivirus offloading mechanism, which allows anti-virus to be offloaded from the VMs onto an appliance that front ends and scans the traffic before it gets to the VMs. vShield App and vShield Edge were also security product announcements which I will be blogging about in more details later.

vFabric was an interesting announcement; it is a cloud application framework that allows for the writing of applications that can run on private and public clouds interchangeably. Today, most cloud based applications have a lock in mechanism where it’s either a public cloud offering or a private cloud offering, this new product aims to resolve that.

The anticipated announcement of VMware View 4.5 with support for Windows 7, type-2 off-line use case, MAC support and support for vSphere 4.1 was next, followed by the release of a VMware developed View Client for the iPad, which featured a really cool demo of the new product and its use cases.

After the keynote, I had a chance to interview Herrod, and asked him about the disappearance of the Client Virtualization Platform project (CVP), VMware’s Type-1 client hypervisor; stay tuned for his answer on video! about this and other topics.

Article Source

Oman: Antivirus solution for 35,000 PCs

2010-09-01T14:36:00.000-07:00

MUSCAT -- The Ministry of Education has implemented a new online virus detection solution for 35,000 PC terminal users in response to rapidly increasing malware volumes. The ministry has adopted the antivirus for Windows Workstation of Kaspersky Lab, a leading developer of secure content management solutions, to beef up its network
security and reduce vulnerability and exposure to hackers, spam and virus.

"The detection rates of the previous vendor's solution could not keep up with the rate of infections and the Ministry of Education took the decision to identify a new solution to resolve the issue at endpoint level," said the ministry's spokesperson Ali bin Suleiman al Hinai. "We chose Kaspersky Lab because of its high detection rates of viruses and
the solution's ability to perform with the minimum resources possible. Our tests of Kaspersky Lab's product on one of
our live servers showed that it detected and removed more malware than any other solutions we tried.

"We have already seen the important benefits the new products have introduced to our operations through compatibility with existing IT security infrastructure, higher detection rates, user friendly interface and ability to maintain high performance without slowing down our systems," said Al Hinai.

The ministry has also acquired a further 1,000 Kaspersky Antivirus for Windows servers licenses for its network of servers across the Sultanate. It took less than four months for the Ministry to implement the full solution across its network.

"We are very proud to have won and implemented our superior antivirus solutions across the network of Oman's Ministry of Education," said Tarek Kuzbari, Managing Director, Kaspersky Lab, Middle East.

"This project demonstrates our ability to provide governmental institutions with bespoke solutions that meet their discerning and sensitive requirements.

"The Middle East's government sector ranks high among our regional priorities and the Ministry of Education of Oman is the latest in a long list of government institutions that have adopted Kaspersky Lab's security solutions."

Article Source

Which Countries Have the Safest Web Access?

2010-08-29T08:08:00.000-07:00

Seven of the 10 safest countries in which to surf the Internet are in Africa, with Sierra Leone rated the safest, according to a study by the Internet security firm AVG.

Researchers compiled a list of virus and malware attacks by country picked up by AVG security software, with data from more than 127 million computers in 144 countries to determine incidence rates of such attacks. Sierra Leone's average incident rate was one attack for every 692 Web surfers. The study was conducted the last week of July. (See also "Top Standalone Antivirus Software for 2010.")

After Sierra Leone, Niger fared well with one in every 442 surfers likely to be attacked while online.

Although specific factors were not mentioned for considering Sierra Leone as one of the safest in the world, it could be the result of the low level of Internet users in the country. Though the low broadband penetration and Internet use in African countries have been cited as the major factors for the safest record, AVG Chief Research Officer Roger Thompson wrote on his blog that the research should serve as a warning to those who are travelling to other countries with plans to use the Internet.

The Caucasus region was the most vulnerable for online attacks, while by country Turkey, Russia, Armenia and Azerbaijan have the highest rates of virus and malware attacks. The U.S. ranked ninth with one in every 48 Web surfers at risk, while the U.K. was 30th with a rate of one in 63.

Article Source

Panda Cloud Antivirus 1.1.2

2010-08-28T09:46:00.000-07:00

Version 1.1.2 of Panda Cloud Antivirus was just published. You can get it from http://www.cloudantivirus.com.

This minor release includes some basic fixes:

* Fix for error 1603 during install or upgrade from previous versions.
* Fix for behaviour blocker FPs of WMP, VLC, OpenOffice, fubar2000, etc.
* Corrections of certain string translations (italian, japanese, etc.).
* Search reset fix during installation.
* Fix for problems with outdated Silverlight installations.
* Updated traybar notifications to show that they come from PCAV.

Users of the Free Edition can upgrade to this new version by simply downloading the new installer and executing it. The installer will uninstall the previous version and install the new one after a reboot.

Users of the Pro Edition do not need to upgrade to this new version as their installation will be upgraded automatically and transparently as needed.

Article source