TechBlog

There are always peculiar things malware researchers discover while analyzing new samples. VirusTotal 24/43 Let’s remember the filename as HD Porn TV for later😉 Our victim runs it thinking they will see the latest porno in HD quality. Instead they get a new browser ‘theme’ with a Turkish flavor: Internet Explorer: Firefox: The bad guys hijack Winsock: And filter traffic through: ...

Tom Kelchner, Sunbelt blog: Alert reader Laurie (my boss actually) forwarded a copy an email she received from a friend. It said the sender was “…pleased to announce the newest version of Antivirus 2010 for Windows.” There was a link to click, of course. Something called “Antivirus 2010” for sale in November is very odd for three reasons: It’s nearly 2011 and legitimate AV companies are putting out their 2011 versions. There was a rogue security product last year called “Antivirus 2010.” (VIPRE detection: FraudTool.Win32.Antivirus2010 (v)) Although a lot of companies make a product named Anti-Virus 2010, they usually put their name in front of it, such as “Kaspersky Anti-Virus 2010” or “Norton AntiVirus 2010.” The Antivirus 2010 rogue graphic interface from 2009: ...

The Redmond company today published its announcement for the upcoming November Patch Tuesday. Microsoft wants to release 3 security bulletins which deal with 11 security vulnerabilities within Office and PowerPoint (up to the brand new Office 2011 for Mac) and Forefront Unified Access Gateway. A patch for the just recently detected 0-day vulnerability in Internet Explorer is not in the list. Adobe meanwhile ships an update for the Flash Player to version 10.1.102.64 today and plans one for the Reader and Acrobat next week. The Flash update is available via the Download Center and fixes the“authplay” vulnerability which got public last week. But the company has to deal with a new security vulnerability as well. It’s not yet exploited and it remains currently unknown whether it is exploitable to infect PCs with malware, but Adobe investigates the flaw. On a public security list a so-called Proof-of-Concept (PoC) has been published which just shows a Denial-of-Service attack. ...

Google Operation System blog: Google Chrome is the first browser that has a meaningless version number. Since Chrome is automatically updated, most people use the latest version of the software a few days after it’s released. Google’s help articles aren’t the only ones that ignore Chrome’s version number. Yahoo has recently released a report that recommends developers to assume that Chrome users are running the latest version. “Chrome has been progressing rapidly through versions, and Google has communicated its intent to continue rapid development and short release cycles. As a result, we’ve modified our strategy for Chrome to advise testing on the latest [generally available] release of Chrome as soon as it is issued, with prior versions moving to X-grade as soon as they are superseded.” ...

Ed Bott’s Microsoft Report posted something interesting in ZDNet: You want a good, solid, free antivirus program? Microsoft Security Essentials fills the bill nicely. Unfortunately, even though it was officially released more than a year ago, it’s still one of the best-kept secrets in personal computing. Its installed base of 30 million users worldwide might sound big in raw numbers, but it’s a drop in the bucket compared to the billion-plus Windows PCs in use. ...

SANS.edu: We received a couple of reports about Microsoft’s “Smart Screen” flagging harmless sites as malicious. Initially, we considered the possibility of an infected ad service. But it may be a bug in Smartfilter as well. Some reports on twitter show that the problem has been resolved. Please let us know if you have sample URLs that are still affected. To disable smart screen: Select “Internet Options” from the “Tools” menu. Select the “Advanced” tab and find the “Enable SmartScreen Filter” setting (about the 10th item from the bottom. Scroll all the way down). Needless to say: This will also remove the smart screen protection from real-evil sites, not just from appear-to-be-evil-to-smartscreen-today sites. The setting should only be changed if you can’t wait for the problem to be fixed.

A perverted hacker who spied upon more than 200 women via their webcams and microphones, after infecting their computers with malware, was arrested earlier this year by the FBI after a two year investigation. The 31-year-old man broke into victims’ personal computers, and stole personal information. Threatening to share the private information with their parents and email contacts, the man pressured the young women (some of them still young teenagers) into providing him with risqué pictures and videos. ...

Microsoft has released a security advisory concerning a vulnerability affecting Internet Explorer versions 6, 7 and 8. This vulnerability may allow an attacker to execute arbitrary code. Full details here. Visit Microsoft’s page here to get full instructions. You can find the workarounds under the “Suggested Actions” twisty. The workarounds include overriding the Web site CSS with a user-defined style sheet, deploying the Enhanced Mitigation Experience Toolkit, enabling Data Execution Prevention (DEP) for Internet Explorer 7 and setting Internet and Local intranet security zone settings to “High” to block ActiveX Controls and Active Scripting in these zones.

Wall Street Journal: It looks like Steve Jobs may have something to be nervous about after all. Google Inc.’s Android platform has taken the lead in the U.S. smartphone market, according to several new reports by technology research firms. In the third quarter, devices with the Android operating system were installed in 44% of smartphones, while Apple Inc.’s iPhone came in second place with 23%, according to market research firm, NPD Group. RIM’s BlackBerry trailed behind in third place with 22%. One big caveat: NPD tracks consumer activity, but doesn’t measure corporate cellphone purchases. ...

The Jack PC from Chip PC Technologies offers a neat and novel thin-client desktop computing solution where the computer doesn’t just plug into the wall, it is the plug in the wall. Running on power provided by the Ethernet cable that also connects it to the data center server, the computer-in-a-wall-socket supports wireless connectivity, has dual display capabilities and runs on the RISC processor architecture – which gives the solution the equivalent of 1.2GHz of x86 processing power… Continue Reading With the Jack PC, the computer’s in the wall! ...