News of Other trends in malware - - - - News clips - - - - - -

Not all malware spreads via email or the web.

The Conficker worm43,

for instance, uses Internet and network protocols to spread, alongside infecting USB sticks — but does not infect email or web systems.

While Conficker, which exploited a Microsoft security vulnerability and first appeared in late 2008, truly made its presence known during the first few months of 2009, media hysteria leading up to April 1, 2009 (when it was scheduled to change the way it looked for new instructions) helped push Conficker into notoriety.

Although it is clear that many firms and organizations struggled to protect themselves adequately from attack49, it is debatable whether the hyperbole regarding the worm helped improve the general state of computer security or was mistakenly seen as the computer security industry "crying wolf."

Conficker – A worm gains notoriety

"Will your PC be jacked on April first,44"

"The Conficker Worm: April Fool’s Joke or Unthinkable Disaster?45" and "PC security forces face April 1 showdown with Conficker worm46" are just some of the headlines that helped Confickermania gain momentum before the alleged significant date of April Fool’s Day.

Ironically, by and large, the computer security industry was not responsible for the hysteria regarding Conficker and April 1. Instead, it appears that the story was largely brewed up by elements of the media, despite many security vendors announcing that users were unlikely to notice anything different on April Fool’s Day.

Sure enough, April 1 2009 saw no unusual activity by Conficker and many were left wondering who had started the buzz 47— and perhaps more importantly, how to protect themselves from future iterations48.

Hackers exploited death of an actress using SEO techniques

Malware

Cyber Criminals Using fear
Prey on IT security fears and fool users into believing their computer have a problem when their computer does not. Such attacks, commonly know as scareware or rogueware love to prey on our computers. the fake antivirus software business is a growing business continues to be a big earner for cyber criminals.

Usually, scareware is planted on websites in the form of pop-up advertisements, or disguised downloads. Many times however, there have also been occasions when hackers have spammed out scareware, or links to it, using from an average of five dtectedper day during 2008.
Many hacking gangs have become proficient at rapidly producing professional - looking fake websites posing as legitimate security vendors. Bogus anti-virus software has also been distributed by poisoning the results of popular search engines through search engine optimization [SEO] techniques and other affiliate schemes

Many other attempts . . . . .
Beatty and Shania Twain in their attempts to steal money38.

• March Hackers used Natasha Richardson’s untimely death in advantageously39 stuffing webpages with keywords about the late actress in order to lure unwary surfers into visiting their dangerous sites and infecting their computers.

• March Hackers capitalized on a widespread issue with Symantec’s Norton Anti-Virus product40, poisoning search engines in an attempt to cash in on unsuspecting computer users searching for advice.

• June Opportunistic cybercriminals took advantage of the deaths of Farrah Fawcett41 and Michael Jackson42 to spread malware and spam.

THREAT: INTERNET EXPLORER FLAW GIVES HACKERS

INVISUS IALERT

WHAT YOU NEED TO KNOW:

Microsoft corp. has released a warning about a serious
computer security vulnerability it hasn't fised yet.

This new hole disclosed Monday affects Internet
explorer users whos computers run the windows xp or windows
server 2003 operating software.

The exploit used by hackers can allow them to remotely take control
of victims' machines. What makes this treat even more serious
is that the victims don't need to do anything to get
infected except visit web site that's been hacked. there
are no prompts to download anything or open anything up.

WHAT YOU NEED TO DO:

* What you need to do:

*Try not to visit any sites you are unfamiliar with until this is
patched by microsoft.

* Remember to always keep your INVISUS software updated
and run scans regularly. Your software will detect tools
the hacker may use to control your computer.

* Don't click on links or visit websites that are sent to you in
emails . they may be taking you to a hacked website.

OTHER INFORMATION:

The vulnerability affects a part of Internet Explorer that is
used to play video. The Problem arises from the way the video
software interacts with internet explorer, which opens a hole for
hackers to tunnel into.

Thousands of sites have been hacked to serve up malicoius
software that exploits the vulnerability. People are drawn
to these sites by clicking a link in spam e-mail.

Virus: Michael Jackson's Death Spread Viruses

What you need to know:

Another major news story sparks the release of viruses. Hackers
Are takin advantage of the highly publiscized death of Michael
Jackson and duping unsuspecting users into installing malware on
their computers.
What you Need to Do:

* Be Skeptical of links and sites that play on the hot news topics

* Do not open email that contain attachments that you were not expecting.

* Do not click on links in emails that promise information
or picuters of michael Jackson.

* Be sure to keep your Invisus software up and to date and run
regular scans.

Other Information:

ONE OF THE VIRUSES IS DISTRIBUTED THROUGH A FILE NAMED
Michae-wwww.google.com.exe. This file has been distributed
throught photos - google.com and possibly also through photo-msn.org,
facebook-photo.net and orkutimages.com. Don't visit these sites.

If you run Michael-www.google.com.exe. it drops files named
reptile.exe and winudp.exe, which are backdoor IRC bots, and
which display a fake error message dialog box: "Picture
cannot be displayed." Once a backdoor is installed, you
are open to many more attacks and risk of losing personal
information.

Social Security Numbers continued

Concern over the privacy of those numbers has grown in the wake of hundreds of data breaches reported by businesses, governments and educational institutions, breaches that have exposed millions of consumer records -- including SSNs.

In recent years, a number of states have passed legislation to redact or remove the numbers from public documents, such as divorce and property records, and bankruptcy filings. In addition, legislation introduced this year by Rep. Rodney Frelinghuysen (R-N.J.) and Sen. Dianne Feinstein (D-Calif.) would prohibit the display, sale, or purchase of Social Security numbers without consent, and would bar businesses from requiring people to provide their number.

The researchers at Carnegie Mellon set out to see if they could discover people's numbers by first exploiting what is publicly known about how the numbers are derived.

The Social Security number's first three digits -- called the "area number" -- is issued according to the Zip code of the mailing address provided in the application form. The fourth and fifth digits -- known as the "group number" -- transition slowly, and often remain constant over several years for a given region. The last four digits are assigned sequentially.

As a result, SSNs assigned in the same state to applicants born on consecutive days are likely to contain the same first four or five digits, particularly in states with smaller populations and rates of birth.

As it happens, the researchers said, if you're trying to discover a living person's SSN, the best place to start is with a list of dead people -- particularly deceased people who were born around the time and place of your subject. The so-called "Death Master File," is a publicly available file which lists SSNs, names, dates of birth and death, and the states of all individuals who have applied for a number and whose deaths have been reported to the Social Security Administration.

CMU researchers Acquisti and Ph.D student Ralph Gross theorized that they could use the Death Master File along with publicly available birth information to predict narrow ranges of values wherein individual SSNs were likely to fall. The two tested their hunch using the Death

Master File of people who died between 1972 and 2003, and found that on the first try they could correctly guess the first five digits of the SSN for 44 percent of deceased people who were born after 1988, and for 7 percent of those born between 1973 and 1988.

Acquisti and Gross found that it was far easier to predict SSNs for people born after 1988, when the Social Security Administration began an effort to ensure that U.S. newborns obtained their SSNs shortly after birth.

They were able to identify all nine digits for 8.5 percent of people born after 1988 in fewer than 1,000 attempts. For people born recently in smaller states, researchers sometimes needed just 10 or fewer attempts to predict all nine digits.

Records of an individual's state and date of birth can be obtained from a variety of sources, including voter registration lists and commercial databases. What's more, many people now self-publish this information as part of their personal profiles on blogs and social networking sites. Indeed, the researchers tested their method using birthdays and hometowns that CMU students published on social networking sites, with similar results.

Privacy and security experts praised the Carnegie Mellon study, saying it should be a wake-up call to policy makers and industry leaders, many of whom have resisted switching to a more secure consumer authentication system due to the sheer cost of changing the current system.

"Sure, the study says that if you were born in a big state on a busy day you're probably still safe," from having identity thieves guess your entire SSN, Anderson said. "Still, I think many people would find it unacceptable that a system continues in use which in effect exposes tens of millions of Americans to fraud and other kinds of harm."

"Because of the way the SSN has been designed, asking for the last four numbers of the SSN puts people at risk because those are the only numbers that are unique to you and cannot be guessed easily by someone who might want to use your identity,"

Social Security Numbers Can Be Guessed

Researchers have found that it is possible to guess many -- if not all -- of the nine digits in an individual's Social Security number using publicly available information, a finding they say compromises the security of one of the most widely used consumer identifiers in the United States.

Many numbers could be guessed at by simply knowing a person's birth data, the researchers from Carnegie Mellon University said.

The results come as concern grows over identity theft and lawmakers in Washington push legislation that would bar businesses from requiring people to supply their Social Security number when purchasing a good or service.

"Our work shows that Social Security numbers are compromised as authentication devices, because if they are predictable from public data, then they cannot be considered sensitive," said Alessandro Acquisti, assistant professor of information technology and public policy at Carnegie Mellon University, and a co-author of the study.

A Social Security Administration spokesman said the government has long cautioned the private sector against using a Social Security number as a personal identifier, even as it insists "there is no fool proof method for predicting a person's Social Security Number."

"For reasons unrelated to this report, the agency has been developing a system to randomly assign SSNs," which should make it more difficult to discover numbers in the future, Mark Lassiter, a spokesman for the Social Security Administration, said by e-mail.

Introduced in the 1930s as a way to track individuals for taxation purposes, Social Security numbers were never designed to be used for authentication. Over time, however, private and public institutions began keeping tabs on consumers using the numbers, requiring people to present them as proof of identity, such as when applying for loans, new employment, or health insurance.

Up to 95 Percent of All Email Is Now Spam

It's hard to believe it's come to this, but only l or 2 out of 20 email messages are now not spam according to Barracuda Networks, which offers spam filtering services and which analyzed a billion messages to arrive at that figure.The speed with which this figure is rising is astonishing. In 2001, Barracuda says spam accounted for only 5 percent of all mail, hitting 70 percent by 2004, 80 to 85 percent by 2005, and 85 to 90 percent by 2006. While spam won't actually hit 100 percent next year, it could certainly be close. (For its part, Symantec pegs the 2007 spam figure at 71 percent, up from 56 percent last year.)

Whichever figure is right doesn't really matter: The truth is that spam is getting worse, and fast, no matter how many laws are passed outlawing the nuisance. (The linked story also notes that over half of business customers consider spam the "worst form of junk advertising" there is. My vote: Junk faxes.)

Another trend I've been seeing: Spam filters' false positives for good messages are getting worse, too, but at the same time you can't really live without the filter, can you? The takeaway: Check your spam folders regularly, and train your filter as accurately as you can to reduce false positives down the line.

10 Quick Fixes for the Worst Security Nightmares

In the world of comic books, every bad guy is an evil genius. On the Web, hackers, spammers, and phishers may be evil, but they're not required to be geniuses. They can make a healthy living just by exploiting known security holes that many users haven't bothered to patch. Or by relying on the propensity of millions of people to do things they've been told over and over not to do.

The silver lining is that you don't have to be a genius to avoid these common attacks either. Implement a few simple fixes, and you'll avoid most of the bad stuff out there.

Fix 1: Patch Over the Software Bull's-Eye

Have you turned off automatic updates for Windows and other programs on the rationale that "if it ain't broke, don't fix it?" Then consider this: Your programs may be very, very broken, and you don't know it. The days of big splashy viruses that announce themselves to PC users are over. The modern cybercriminal prefers to invisibly take control of your PC, and unpatched software gives them the perfect opportunity to do so.

Today, a hijacked Web page--modern digital crooks' attack of choice--will launch a bevy of probes against your PC in search of just one unpatched vulnerability it can exploit. If it finds one, better hope your antivirus program catches the ensuing attack. Otherwise you likely won't even notice anything amiss as it infects your system.