NWA-PCUG Newsletter Article, August 2004
Viruses, Worms & Other Security Issues
by Sue Crane, Editor
Bearly Bytes, Newsletter of the Big Bear Computer Club


It wasn't a good month for Internet Explorer. A computer virus designed to steal valuable information like passwords spread through a new technique that converted popular Web sites into virus transmitters. Hackers made subtle changes to the Web site so visitors get a piece of code that's designed to retrieve software that records a person's keystrokes. Such data, which can include credit card numbers, bank accounts and passwords, are collected for remote delivery to hackers, experts say.. Security experts worried about its method of delivery. The virus takes advantage of three separate flaws in Microsoft products and can be difficult to detect. Software updates to fix two of the flaws were released in April, but the third flaw is newly discovered and has no patch available yet. Computer owners can search their computers for the files "Kk32.dll" or "Surf.dat" to see if they are infected. They should obtain the latest security updates for Microsoft products and their anti-virus and firewall programs. For the flaw that lacks a patch, users should turn up security settings on Internet Explorer browsers to the highest levels. Users could also turn off the "JavaScript" feature on their browsers, though doing so could cripple functions on some sites. Removal tools are available from major anti-virus vendors. Security researchers suggest that using Microsoft alternatives is one way to surf the Web worry-free.

Computer viruses overall are on the rise. According to Sophos, "The number of new viruses released on the Internet in May hit a 2-1/2-year high.” Bill Gates claims Microsoft is responding to viruses and other online threats faster. "We will guarantee that the average time to fix will continue to come down," "The thing we have to do is not only get these patches done very quickly ... we also have to convince people to turn on auto-update."

Cisco Systems issued a patch for a security flaw in one of its Linksys routers that could give hackers access to consumers' home networks. Linksys WRTS54G 802.11g wireless router & other new Linksys routers, using firmware versions 2.02.7 and 2.02.2. Cisco posted a beta version of the new firmware (http://www.linksys.com/download/firmware.asp?fwid=201) on the Linksys Web site. Customers using the new Beta version should not experience problems even with the firewall turned off.

Microsoft is set to phase out support for both NT 4.0 Workstation and Server in the coming months. Microsoft officials have denied that the company is using product-support cut-off dates as a tool to force Windows users to upgrade. Windows 98 support was discontinued this month, too, but there are several sites on the Internet where 98 users can go for assistance. If you’re not upgrading to Windows XP and you need help, do an Internet search for “Windows 98 + support”.

Microsoft revealed a new long-term support policy along with upcoming technologies to boost security and reduce spam. The company will now guarantee a minimum of 10 years of support for all business and developer products, giving all customers the option of installing (IMF) Intelligent Message Filtering, a spam-blocking add-on. They also promised future improvements in spam blocking through E-mail Caller ID, a system Microsoft is working on to verify the sender of a message, thus enabling people to block junk messages.

Windows XP, SP2 will de-emphasize backward compatibility with legacy systems and code for the sake of security. Microsoft admits that as many as one application in 10 will experience problems due to the upgrade. However, Security experts advise Windows XP users install the update immediately and Windows expert Paul Thurott suggests, “If you ignore or put off this release, you'll only be hurting yourself.” Microsoft won’t be offering this service patch to those who have pirated copies of Windows XP. SP2 will check for bad Product IDs looking for pirated copies and will not install.

Yahoo’s new Anti-Spy toolbar gives adware the benefit of the doubt. Users who want to use the toolbar to identify adware have to remember to check a special box each time they scan. Meanwhile, Yahoo pays Claria Corp. (formerly Gator) a percentage of ad revenue when users click on paid listings. Claria and WhenU.com Inc., are accused of tricking users into accepting adware downloads and pop-up ads.

After Google introduced G-mail with 1Gb of free storage, competitor Yahoo quickly increased it’s 25Mb of free storage to 100 Mb free. The following day Yahoo’s email business was so good, most users couldn’t log on – or in many cases even get yahoo.com to load! In addition to Yahoo’s increased traffic, a reported DNS attack halted traffic on Microsoft, Google, Yahoo and Apple, among others. Akamai Technologies Inc., which provides services improving the reliability of large Web sites, claims the problems were caused by a "sophisticated" large-scale DDOS attack.' After other sites were restored, Yahoo users were still reporting glitches including site inaccessibility, slow page loads and inoperable buttons on the site. And now G-mail users are reporting they can't get messages through to users of Microsoft’s Hotmail. Yahoo’s web sites and services stumbled for the second time in less than a week when users were unable to log onto Yahoo's instant messaging program. Yahoo described the problem as an "isolated hardware-related issue. Some users also received confusing notices that their accounts had been suspended for exceeding storage limits when that was not the case. Microsoft will increase Hotmail's free e-mail storage limits from 2 megabytes to 250MB and its paid e-mail service, which costs $19.95 a year, from 10MB to 2 gigabytes, to counter rivals Google and Yahoo, who increased their online storage last month. Hotmail changes will begin in early July.

Phishing has become a major concern for banks and credit-card issuers, which end up footing the bill when a criminal runs up unauthorized charges on a stolen credit card. Visa USA, the FTC, the Better Business Bureau and the other coalition members said they plan to work together to teach consumers how to avoid phishing scams and to report suspicious e-mail to authorities. The advice to consumers is simple: Don't click on the link. “If you do, you may be the catch of the day," said Howard Beales, director of the FTC's Bureau of Consumer Protection. Beales encouraged Americans to forward any suspicious e-mail messages to the FTC at uce@ftc.gov. Such information is valuable, he said, because it helps investigators track scam artists, many of whom change their Web site locations and e-mail addresses frequently in an effort to frustrate law enforcement officials. Consumers can also send suspicious mail relating to their visa cards to phishing@visa.com. Beales stressed that legitimate companies rarely if ever send e-mail asking customers for sensitive data. Customers who have any question about such a request should go directly to the company's Web site by typing the company's Internet address into a browser window, rather than by clicking on a link in a suspicious e-mail. A number of private-sector firms have joined to create the Trusted Electronic Communications Forum that will work to design technical solutions to the phishing problem. The Anti-Phishing Working Group's Web site (http://www.antiphishing.org/) posts alerts about the latest phishing attacks and advice about how to avoid Phishing scams and what to do if you’ve given-out your personal information.

Yahoo, Microsoft, EarthLink, America Online, British Telecom, Comcast and other members of The Anti-Spam Technical Alliance (ASTA) announced a proposal of best practices for filtering and sending e-mail, authenticating e-mail senders by IP address or with digital content signatures to help prevent e-mail fraud, They called on ISPs to “police their networks more aggressively and cut off machines suspected of being launching pads for spam." When such machines are found, Internet providers are urged to block their Internet access until their owners come forward, at which point they will be given help to remove spyware, adware and malware. Group representatives believed the zombie problem is going largely unchecked because some ISPs are not taking such action. The Alliance is proposing that ISPs who are quarantining zombies might reject all mail from networks that are not doing so. ASTA, recommends that all PC users install virus protection and security systems and suggested that ISPs implement rate limits on outbound e-mail traffic, control automated registration of accounts and close all open relays. The IETF, which develops the technical standards that run the Internet, will publish initial recommendations on e-mail authentication in August. The FTC, meanwhile, plans to address the issue this fall. 'Filtering technologies are not enough.' Says Bill Gates. Microsoft is adding tools that would combat the forgery of e-mail sender addresses and allow senders to 'qualify' their messages so they can guarantee delivery. ... In addition, Mr. Gates said Microsoft is developing technologies to detect and block 'dictionary attacks,' where spammers send e-mail to a random assortment of names and then harvest the real addresses by collecting those that generate bounce-back messages." A Utah judge has granted an injunction to adware maker WhenU.com to temporarily halt the state's new anti-spyware law from going into effect on the grounds that the law is unconstitutional.

Security analysts have been warning of a cell phone virus. A group of underground virus writers has showed off what is believed to be the world's first worm that can spread on advanced mobile phones. The worm, named Cabir, was sent to security software firms Kapersky Lab of Russia and U.S.-based Symantec by a member of 29a, a group of virus writers from the Czech Republic and Slovakia who pride themselves in creating "proof of concept malicious viruses," the "Cabir" virus takes an approach that hampers its spread--it asks for permission to infect your phone.

Symantec, makers of Norton Antivirus, says the next big worm is likely to exploit flaws in instant messaging clients—and it will spread faster than any other worm on record. Eric Chien, chief of research at Symantec Security Response. "An instant-messaging threat could spread to a half a million machines in 30 or 35 seconds." All it takes is 30 seconds; IM users should be running antivirus software. Most engines have plug-ins for IM clients. Chien recommends using something other than the free clients, something that uses encryption and goes through a more rigorous testing process.

There is no restriction against any non-profit group using this article as long as it is kept in context with proper credit given the author. The Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member, brings this article to you.

Click here to return to top



==================================================================