MoMusings

I’ve no idea how many of you out there in blog-land use Twitter, but I’d guess quite a few of you do?

As a relatively new Twitter user, I’ve not seen much of the problems that Twitter has experienced over the last year, including account hacking, phishing, 419 scams, worms and other malcode problems. One area that seems (at least to me) to have been rather quiet has been spam via Twitter.

Until the last week or so, I’ve never received any. I’d be interested to know how many of you out there in blog-land who use Twitter have seen similar things to what I’m about to discuss.

I don’t think there is a specific name for Twitter spam, so I’ve coined one; Twam.

I’m sure the more creative of you out there can come up with something better?

Let’s have a look at a couple of examples I’ve seen in the last week or so:

1. The Vote For Me Twam
I received the following notification and when I checked out the profile for that user all their tweets were requests to vote for them in some beauty pageant.

As you can see at the time I was sent this they had a fair few followers and were following (Twamming) lots of other Twitter users. when I checked this particular account again this morning, it was still active and still only begging for you to vote for her at 60P per text no less! The number of followers now stands at 343 and she is following (Twamming) 1,986 other Twitter users.

2. The Porn Advertising Twam
I received the following notification just this morning and when I checked out the profile for that user they only have one tweet with a link to a porn site! So.they seem to be using Twitter to advertise their porn site.

Shortly after receiving the above notification, I received another using the same name, but from a different Twitter account. Their feed was exactly the same as the first one I received just 30 minutes earlier.

When I just checked both of these accounts (before publishing this) that were advertising a porn website they have now been closed by Twitter.

Needless to say I have blocked these Twitter accounts, as I don’t want to see what they offer and I don’t want to give them any credibility by being seen as being followed by them.

I wonder if this is the start of a major spam (twam) attack on this social networking site? I wouldn’t be surprised as this fate has already befallen FaceBook, Myspace and many other similar sites.

For those of you who are interested in following me on Twitter (no not you spammers/twammers) you can easily find me via my name or my Twitter account which is talkytoaster.

If you spot anything interesting feel free to send me a Tweet or a Direct message.

Take care and happy Tweeting.

Well, I received a rather interesting invite sent to me via the Yahoo! Calendar service. Have a look at it [screenshot below], what do you think?

Hands up all those that are tempted to respond to this?

OK

Now, hands up all those that are NOT tempted to respond to this?

Hmmm….

So, before I cover this in more detail, let me see what happens when I click on the RSVP to this invitation text, which is a hyperlink. This is where we end up [screenshot below]

This is the real Yahoo! Calendar website, so it isn’t a phishing scam, is it? Is it real, does someone really want to give me a cheque for 1.5 Million US Dollars, or is it some other form of scam?

OK, time to tell you what is going on here, and what the e-mail is all about, and why the sender used Yahoo! Calendar to send it.

The email really was sent via the Yahoo! Calendar service, and clicking on the link contained in the e-mail really does take you to the genuine Yahoo! Calendar site and a real Yahoo! Calendar invite. But why?

The answer to the why, is that this enabled the e-mail sender to have a better chance of getting the email, seen in the first screenshot, to the intended recipients, yes I said recipients, not recipient. Did you notice that in the web site screenshot the 90 undecided text? Yes, this invite was sent to 90 intended recipients, not just me. Does this mean that this was sent by someone with over 135 Million US Dollars to give away?

Of course not, this is just a new twist on the old 419 scam [aka the Nigerian scam, also known as Advance-Fee-Fraud]. The sender just used the Yahoo! Calendar service to try and increase the chances of his invite [the scam text in the invite] getting past any anti-spam defences that the intended recipients might have in place.

There is no money [sorry!], there never was, if you were foolish enough to contact Mr Luke Yayi, you would be assured that the money was real, but somewhere along the way you would be asked to part with money to pay for things such as, handling fees, taxes, shipping fees, and maybe even bribes! So, instead of getting the alleged money you were promised, you would end up losing money, or worse. You would also end up on a so-called “suckers list” and get more 419s, not only via e-mail, but also through your letterbox.

So next time you receive such an invite, not only ones from a calendar service; it could be from any online service, such as: news groups, blogs, social-networking sites, feedback forms, mailing lists and so on. Think very carefully before you click on any links or contact anyone mentioned in the invites/e-mail body, at the very least you could end up on a phishing site, at worst you could lose money, or worse, as there have been cases of beatings and even murders linked to these scams.

If you want to read more on the subject of 419s then I have written several articles which were published in the Virus Bulletin magazine, reprints of these can be found here, [http://momusings.com/papers] along with all my other published articles and papers.

Right, I need to put together another presentation for yet another conference, this time I’m covering penetration testing and ethical hacking.

As previously mentioned on this blog, I was going to attend the Virus Bulletin 2008 conference as just a delegate, for the very first time; I usually attend as a speaker. The conference was held at the Westin Ottawa, in Ottawa, Canada [surprisingly ] between the 1st and 3rd of October.

However, I ended up being a speaker again, which I don’t mind, but I was actually looking forward to having a more relaxed conference than I usually do, but that’s life!

This posting is a quick review of the conference:

Day 1 – Wednesday 1st October 2008

The first day of the conference started at 10:30 with Helen Martin’s opening address, this was followed at 11:00 by the Keynote address “The AV industry: Quo Vadis?” presented by Alex Eckelberry of Sunbelt Software. This was a very interesting speech and contained lots of useful information, as well as a general overview of what the bad guys [and girls] are up to, as well as what the good guys [and girls] are up to.

You can find a recording of it here, along with the slides: http://sunbeltblog.blogspot.com/2008/10/virus-bulletin-2008-keynote-address.html

The final session on the Technical Stream before lunch was also interesting, a presentation by Morton Swimmer [who used to work for IBM] entitled:

• Towards integrated malware defence

It was a good presentation, however as Morton had moved to TREND just before the conference he no longer had access to all his data, which was a shame, as it seems to have been rather an effective solution.

Then it was time for lunch.

After lunch, the conference continued in its normal two stream mode; Corporate stream and Technical steam. Normally I spend most of the conference in the technical stream, and on this first day that was pretty much the case. I spent the whole afternoon in the Technical Stream.

The first two presentation after lunch were:

• Your computer is now stoned (…again!). The rise of MBR rootkit – Kimmo Kasslin, F-Secure
• When the hammer falls – effects of successful widespread disinfection on malware development and direction – Matt McCormack, Microsoft

The presentation given by Kimmo was esepcially interesting as it covered the rebirth of MBR infectors; something that had almost died out when Windows NT, 2000 and XP came along [yes there have been some MBR infectors for those, but not many, and not with stealth capability].

Then we had a short break for Tea and coffee before the attending the final pair of presentations on the technical stream. These were:

• Applying user-mode memory scanning on Windows NT – Eric Uday Kumar, Authentium
• Packer visualisation: a fast entropy scanning algorithm that preserves local detail – Li Sun, RMIT University

I decided to sit in on the vendor presentation after the days main proceedings, this was given by my good friend David Harley, from Eset.

Later we had the “Welcome drinks reception” which is a nice ice-breaker, especially for those that have not been to a VB Conference before as it is very informal and relaxed.

This was staged with a couple of Ice Hockey players; for those that wanted pictures, as well as a bit of fun from Ken Bechtel, who’s hat did the rounds and photos were taken of those that ended up wearing it, including me. If you’ve ever met Ken, you’ll know which hat I mean as he is rarely seen without it.

Day 2 – Thursday 2nd October 2008

Day two started early for me as I was informed when I arrived that I might be needed to present [I was the emergency reserve speaker; "in case of a missing speaker, break glass and grab Martin "], as one of the speakers for the morning session on the Technical Stream was unaccounted for; he never did turn up.

So, I had to go back to my hotel [I wasn't staying at the Westin], get changed, grab my laptop and get back to the conference by the morning tea break to check that my laptop worked fine with the projector, it did.

This meant that I effectively missed the first two presentations I had planned to attend, oh well.

To complicate matters, I was also supposed to be chairing the three sessions on the Corporate Stream between the morning tea break and lunch; which I couldn’t now do, as I was presenting in the other stream at the same time. Luckily, my old friend from Nortel, John Morris, stepped into the void as the new session chair.

So after the morning tea-break I was back in the Technical Stream for the next three presentations, these were:

• The robustness of new email identification standards – Reza Rajabiun, COMDOM Software and York University
• Coordinated distributions method for tracking botnets sending out spam – Andrey Bakhmutov, Kaspersky Lab
• Malware forenscis: detecting the unknown – Martin Overton, IBM ISS

The presentation given by Andrey was extremely good, some excellent research which was well presented and explained. This led to a flurry of questions.

It seemed rather surreal when I gave my presentation, as it was designed for an audience on the Corporate Stream; so as an old English saying goes “it was like teaching my grandmother how to suck eggs“. In other words the presentation was an overview of forensic techniques and tools for finding and analysing malware [known or new] on an infected system.

This was presented on the Technical Stream to about 70 or more of the worlds best malware researchers, hence my use of the saying.

The presentation was actually based on my EICAR 2008 paper which I was unable to present at the EICAR conference, ironically due to the fact I was tied up in a malware forensics case.

Then it was time for Lunch, not only to refuel with food, but also to discuss and digest what we’d seen so far.

I received some nice feedback from a few of those that sat in, and no awkward questions. In fact one of the guys who were running the audio-visual side of the conference said he thoroughly enjoyed my presentation and found it most useful and enlightening.

After lunch, once more I decided to sit in on the Technical Stream until the tea/coffee break, at least. The next four presentations, all last minute ones limited to 20 minutes each, were:

• VB testing – present status, future plans, John Hawes, Virus Bulletin
• Race to zero with online scanners, Boris Lau, Sophos
• There is (some) honour among South American authors of infostealer trojans!, Pedro Bueno, McAfee
• Apple iPhone programming with SDK, Marius van Oers, McAfee

This year these short technical presentation worked rather well, although it was hard for some of the presenters to keep to the 20 minute slot limit, yes, you know who you are.

Then it was time for another caffeine break

After the tea/coffee break I moved to the Corporate Stream as I was chairing the last two presentations on that stream, these were:

• The NorTel Mailer: effective open-source spam filtering for enterprises – Chris Lewis, Nortel
• SCADA security – who is really in control of our control systems? – Peter Allor, IBM

Both of these were very interesting presentations and it was a shame that so few delegates had decided to sit in on them.

Before the day was over we also had our first panel session, this was:

• The state of anti-malware testing

Later we had the “pre-dinner drinks and the Gala dinner and entertainment”.

As always the food was excellent and the entertainment this year differed quite a bit, it was a quiz, which was fun but took longer than expected to complete. As one delegate was heard to say “we have travelled 3,500 miles for a pub quiz!“. Personally, I enjoyed it, it just needed to be shorter.

Day 3 – Friday 3rd October 2008

The final day of the conference had arrived, I’m still not sure where the first two days had gone, but they sure went quickly!

As we started slightly later on the last day, to allow for those that had partied hard until the small-hours to get some sleep, and maybe quite a bit of black coffee, there was only a single presentation before the first coffee/tea break of the day. The one I decided to attend was on the Corporate Stream, again:

• Understanding and teaching bots and botnets – Randy Abrams, ESET

This presentation covered a topic that I had presented on back at VB2005 in Dublin, but from a high-level perspective and more focussed on how to educate staff about these threats via using robot vacum cleaners known as Roombas.

As usual Randy was both informative and entertaining.

So, another quick tea and coffee break and then back to the Technical Stream until lunch, these were the next presentations I sat in on:

• Automatic rules-based binary analysis with IDA Pro and CLIPS – Ryan Hicks, AVG
• Rebuilding testing for the future – Igor Muttik
• Samples.malware.org: sample sharing for the next decade? – Richard Ford, Florida Institute of Technology

All of these were very good and interesting talks and all generated lots of discussion and questions.

Then it was time for the final lunch of the conference, but before that, all the speakers had to get together for the traditional “Speakers Photo”. As usual, much hilarity was had by all. However, I think I can honestly say that this years photo was the quickest ever as it took less than 5 minutes to organise all the speakers and take a number of photos.

After lunch I spent the first part of the afternoon on the Corporate Stream.These were the presentations I sat in on:

• Where do your users want to go today and can you stop them? – Bruce Hughes, AVG
• The name of the dose: does malware naming still matter? – Pierre-Marc Bureau and David Harley, ESET

Both of these were interesting and prompted a number of questions from the audience.

Then it was time for the final refreshments break. Yes, it was the very last VB2008 Tea and coffee break of the whole conference.

The final presentations of the day, and the conference, were straight after the break and I decided that I’d sit in on the last one on the Technical Stream again. This was:

• Darwin inside the machines: malware evolution and the consequences for computer security – Peter Ször, Symantec
  Dimitris Iliopoulos, Keck Graduate Institute of Applied Life Science

This was a very interesting presentation, basically saying that malcode could in theory evolve following Darwinian principles. Not sure that we will see such malware any time soon, as there are a number of things that need to happen first.

Although all the conference papers presentations had finished there was a very interesting and lively panel discussion on:

• Security in banking forum

Finally it was time for the Conference closing session, once more led by Helen Martin, the editor of Virus Bulletin.

It included the usual selection of scenic photos as well as general candid shots taken during the conference, including some ‘comic’ ones. This year it seemed to be another case of “I’m Sparticus“, as a lot of people seemed to be wearing Ken Bechtel’s hat, including me, and no it wasn’t him in varying disguises either!

My final impressions of VB2008 are mixed; I enjoyed it, but I [and others who I chatted with] seem to think it may have lost its edge. Is this a case of becoming too commercialised or due to a lack of the usual swathe of quality research papers [which may be due to security companies cutting research budgets], or is it just a sign of the times as the marketplace has matured and that threats have now converged?

If you attended VB2008 and have an opinion, then please let me know your thoughts, thanks.

Copies of the slides used by the speakers during the presentations can be found here: http://www.virusbtn.com/conference/vb2008/slides

The full agenda for the conference can be found here: http://www.virusbtn.com/conference/vb2008/programme/index

Finally, if you are really curious and want something to put you to sleep, then you can also find a selection of scenic photos I took whilst in Ottawa, here: http://picasaweb.google.com/overtonm/OttawaCanada2008?authkey=SEeottY873o#

Well, that’s another VB conference covered, I’m already looking forward to the possibility of attending next year, where it will be in Geneva, Switzerland at the end of September 2009. Right, now I need to find some ideas for a few abstracts to submit….any suggestions?

Next week the Virus Bulletin International Conference is being held in Ottawa, Canada [1st to the 3rd of October]. This is the premier conference for people involved with fighting malware and related security threats. The programme can be found here.

This year I was going to be there just as a delegate; normally when I attend this conference I attend as a speaker, which means I have to write a paper and present it at the conference to an audience of 50-200 uber-geeks from various industries as well as the world’s best malware researchers.  This can be pretty daunting! This will be my 11th Virus Bulletin Conference since my very first I attended and presented at back in 1996.

However, I’ve now been asked to be a reserve speaker, so I have to have a presentation ready, just in case I’m needed. The last time I was a reserve speaker it was for VB2002 which was held in New Orleans that year, and was nearly washed away by a hurricane! Needless to say, I ended up presenting my paper that year.

If any of you ready this are going to be there, then please feel free to stop me and have a chat, or just to say hello. I don’t bite, honest

The presentation I am working on for the conference is to do with malware forensics, so it should be fun to do, as well as interesting for any audience I get; if I get to present it, that is.

As usual, I will write a short review of the conference, including what I personally found interesting, and may also post some mini-reviews and updates via Twitter.

If you can make it, then I hope to see you there; if not then stay tuned and I’ll post a review as soon as I can.

An accident waiting to happen!

In fact a number of these accidents have already happened. But I’m getting ahead of myself. So, why do I think that they are inherently bad?

Personally, I hate out of office notifications, not because it means that I can’t get a reply from the person I sent an e-mail too in the first place, but because they can be misused by not just the person who is ‘Out of the Office‘ but also by the ‘Bad Guys and Girls‘. Let me explain in more detail, what I mean…

1. Too Much Information
Often when people enable ‘Out of Office‘ they offer too much information; such as when they are going and coming back, and where they are going to. They also often include a second person’s details to contact in their absence; including their full e-mail address. This is then often enabled for all incoming e-mail to their e-mail address, which means that not only internal [company/organisation] colleagues are informed, but also, in many cases anyone on the internet that sends them e-mail. The next two points explain in more details why this is a ‘bad‘ thing.

2. Confirmation that your e-mail address exists
As mentioned above, if you enable your ‘Out of Office‘ notification to send an automatic response to all e-mail that is received, you are assisting spammers, scammers and malware authors by confirming that the e-mail address is in use [that makes it worth more]. If you also include another persons details to contact while you are away, then the ‘Bad Guys and Girls‘ can also harvest that to either sell on for profit to others, misuse it themselves, or often both. The end result is more spam, scams and malware arriving in yours and anyone else’s inbox that you kindly supplied in your ‘Out of Office‘ notification, I’m sure that they will be quick to thank you for all the extra ‘crud‘ they are now receiving

3. Physical and Cyber attacks while you are ‘away‘.
If you are unwise enough to indicate you are on holiday or just out of the country where you normally reside, then the ‘Bad Guys and Girls‘ can do a number of things whilst you are not at home. If they have enough data on you, then you could come back to find your house burgled, full of squatters, vandalised or even worse.

If they don’t have access to that level of information then can hack into your personal webspace, social networking and other web sites you may use. They could also perform a ‘Joe Job‘ or a ‘DDoS‘ to discredit you or damage your business or reputation. While you are away they may use your stolen identity to take out loans, credit cards and even mortgages in your name. If they already have some of your financial data, such as bank account or credit card data, you could suddenly find your bank account empty or unathorised charges [and ATM withdrawals] on your debit or credit cards.

In all these cases listed above, this is only likely to happen if you have come to their attention; such as being a thorn in their side, or making life difficult for them, or someone else is willing to pay for the information and/or attacks to take place.

If you don’t believe that these things happen, then I can assure you that many of the cyber attacks happen to many of us who work in computer security, especially those that are widely published or who work for anti-malware companies or in law-enforcement.

Figure 1: Too Much Information is an Invitation for Trouble!

4. Bounced Spam
This is the latest way that ‘Out of Office‘ notifications can be mis-used and it affects all of us who are already on spammers/scammers and malware authors lists (or soon will be).

Here is the scenario:
The Bad Guys or Girls sign up for a free webmail account, at say, Google, Yahoo, Live, etc. and then enable the ‘Out of Office‘ feature. They then place the spam message they want to distribute in the ‘Out of Office‘ e-mail body.

Next, the spammer sends this new webmail account with the enabled ‘Out of Office‘ feature, lots of e-mails using spoofed ‘From:‘ addresses so that the ‘Out of Office‘ reply will be sent to the intended victim [the spoofed From: address].

Why do this? Well, e-mail sent from this booby-trapped spamming webmail account will contain anti-spam header information, such as DKIM, DomainKey, Sender ID or any of the other similar systems, which means that the mail server that deals with the intended victims email will be more likely to let the spam through as it has come from a trusted source.

This is now easier for the spammers to do, as the CAPTCHA systems used by Yahoo and Googlemail have been cracked; so that they can now automate the creation of these ‘trusted‘ ‘Out of Office‘ spam relays.

Figure 2: Out of Office Spam Setup

So, next time you go to enable your ‘Out of Office‘ feature, think carefully about what information you provide, and if you can do not enable the respond to internet address option, as you may live to regret it!

It seems that the Storm Worm Gang have finally changed their social engineering tactic from the New Year e-cards that we have been seeing since the 26th of December until the 2nd of January when they sent out their last new version of that particular tactic!

So, what are they now using to get you to infect your computer? They are using fake MySpace invite e-mails which contain links to phishing quality fake MySpace websites.

This seems rather spooky as I was blogging about social network engineering on the 4th of January!

Here’s a screenshot of what just one of these new MySpace based emails look like:

The body text can be one of a number of fake names and text strings. The rest of the e-mail including the links appear to be fairly static, at the moment, anyway. Once more the link is an actual domain name, rather than the more usual IP address based links that the Storm Worm gang used to use.

Of course, when you click on the link you go to a very professional, but fake MySpace site.

Here is a screenshot of the web page you could end up on if you click on the link in one of these fake MySpace themed e-mails.

In fact there are several links in the e-mail which take you to different domain names, all under the control of the Storm Worm gang.

Here’s another example showing another domain name in use.

The message shown is fake, the ‘install_flash_player.exe‘ file offered isn’t genuine, in other words, if you are unwise enough to download the file and run it you won’t get a copy of Flash Player installed, in fact you will get a bot installed instead and your computer will join one of the many Storm Worm botnets.

Just to make it crystal clear, the file offered on this site will NOT install or update Flash Player; All that will happen is that your computer will be infected and turned in to a zombie [bot infected computer that is part of a botnet], if it is not protected by any mitigating technologies, such as up-to-date anti-virus, and so on.

At the time of publishing this entry detection was still very patchy, with a number of the top anti-virus products not detecting the malware laden file as infected, you have been warned.

As mentioned before, please do not go to these sites and download the files offered, as they are real, live, malware.

More details on the file currently being offered can be found here on my VSUB blog, complete with detection results at the time of publishing.

No doubt I’ll be updating this post in the next day or so, as the Bad Guys and Girls tinker with their latest social engineering technique, or they change it to a new one…

As I post this I have now received over FIFTY of the fake MySpace invite e-mails!

Social networks such as Myspace, LinkedIn, Facebook, Bebo, Xing and all the others are BIG business at the moment, all of them trying to be ‘the one‘ that everyone must be seen on.

So, it isn’t that surprising that the Bag Guys and Girls have started to take an interest in them, is it?

However, it isn’t just Social Networking sites that they are interested in, they are also interested in Virtual Worlds and On-line Games, such as SecondLife and World of Warcraft, amongst others.

This post will cover some of the things the Bad Guys and Girls have so far tried in these areas, many of which may surprise users of these online communities, be they social networks, virtual worlds or on-line games.

Hand up all of you out there that use Facebook? Many, if not most of you, then do use it….not that surprising, so for you Facebook users out there, you need to be aware of something I’ve been expecting for some time on this network, malicious applications (Facebook applications or plugins).

This new application uses social engineering, in this case it uses the same techniques that proved to be so successful for the ILOVEYOU e-mail worm, these being curiosity and sex!
When installed Secret Crush [Created by Secret Crush] will request that you invite five friends before you can see who has a secret crush on you. Needless to say, this is a form or viral marketing, and even if you comply and effectively infect five of your friends [who may shortly no longer be your friends], you still won’t be shown who your secret crush is, because there was no secret crush, it was all a ploy to get you to install it.

You are directed to a Zango [previously known as 180Solutions] website to install Crush Calculator which is a piece of Spyware! This means that Secret Crush is actaully a Facebook Trojan Horse which uses social engineering.

If you think that this is a new phenomenon in social networking sites then you’d be mistaken. Myspace has had a number of malware adventures over the last year or so, with the Sami Worm probably being the most successful.

SecondLife has also seen malicious virtual objects inserted into it, these when interacted with by users, begin to replicate, impacting the performance of the system.

Instead of writing lots of fluff about these I’ll just supply a number of links so that you can get more information about these threats, when you have some time to spare.

Links:

Facebook:

• Nice write-up by Guillaume Lovet on the Secret Crush application http://www.fortiguardcenter.com/advisory/FGA-2007-16.html

Myspace:

• http://blog.washingtonpost.com/securityfix/2006/07/myspace_ad_served_adware_to_mo.html
• http://www.computerworld.com/securitytopics/security/holes/story/0,10801,105484,00.html
• http://www.f-secure.com/v-descs/js_quickspace_a.shtml
• http://www.f-secure.com/weblog/archives/00000930.html

SecondLife:

• http://www.technewsworld.com/story/viruses-malware/54384.html
• http://anti-virus-rants.blogspot.com/2006/10/second-lifes-grey-goo.html
• IBM’s own Morton Swimmer also wrote a paper on the attacks that SecondLife has seen so far: http://www.virusbtn.com/conference/vb2007/abstracts/SwimmerHusemann.xml

World of Warcraft:

• http://www.f-secure.com/v-descs/wow.shtml
• http://www.theregister.co.uk/2006/05/08/wowcraft/
• http://www.theregister.co.uk/2007/09/11/online_games_hacking_trends/

The bottom line is that for the Bad Guys and Girls, this is not about being social, nor is this a game to them as they do not care if the systems or people they socially engineer to infect their avatars or their computer are in the real world or a virtual one, it is all about stealing information, property and making money [or friends], not virtual money but real hard cold currency….

Will 2008 become the year of the Social Network Engineer?