Security – Page 22 – Paul's Tech Talk

Being a Bad BOT!

PaulFebruary 23, 20097 Replies

I had the strangest thing happen today, Seemed a Bad Bot was Crawling my pages. I was getting at least 60 page views an hour from this bad Bot!! The individual IP’s of this Bad Are:

65.208.151.112
65.208.151.113
65.208.151.114
65.208.151.115
65.208.151.116
65.208.151.117
65.208.151.118
65.208.151.119

[ad#ad2-right]After the first initial hour of this going on, I started wondering what this bot was doing. I did some more research into this little bot. I did find out it is owned by Kintiskton LLC. (Twitter Search)

Anyways It bothers me that when you do a Google Search for this company, it comes back with no company. Some people have already did there research and have come up with very little.

I dug even more and some are saying this might be Homeland Security, and I have my own thoughts on this. I might be paranoid myself but if there is no company out there and the IP keeps coming back, I assume it is BAD mojo. Some people worry that it is a hacker probing for vulnerabilities and that worried me.

I decided with the Help from Godaddy, to ban the lot of IPs. I figure someone is trying to get information or trying something they shouldn’t, I’ll stop it myself. If you have WordPress and are also having problems with this ip, you can ban it by adding this to your HtAccess file:

order allow,deny
deny from 65.208.151.112
deny from 65.208.151.113
deny from 65.208.151.114
deny from 65.208.151.115
deny from 65.208.151.116
deny from 65.208.151.117
deny from 65.208.151.118
deny from 65.208.151.119
allow from all

This is how you block those ip in the HtAccess file. Thanks to WordPress for showing me how.

PDF Zero Day Vulnerability in the Wild

PaulFebruary 20, 2009

From sources all over the internet, Adobe made a sent out a Security bulletin yesterday:

APSA09-01 (Buffer overflow issue in versions 9.0 and earlier of Adobe Reader and Acrobat)

[ad#ad2-right]A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe Plans on patching this March 11, 2009

and According to some other reports are saying:

Symantec Security Response has received several PDF files that actively exploit a vulnerability in Adobe Reader. We are continuing to remain in contact with Adobe on this vulnerability in order to ensure the security of our mutual customers.

[via Symantec]

With PDF files being used all over the business world, this will create undo problems with the IT Field. This also could be used to make Botnets and make the network involved become sluggish. It must be warned that there are a whole wide variety of possibilities that could be done with this exploit. Shadowserver Foundation recommends disabling the Javascript in your Adobe Reader. Until the patch comes out you will need to be careful on what you open up and possibly check each and every PDF with an Anti-virus. This should help minimize the likely hood of getting a virus or Trojan, but is not going to be a 100%. The only way you can prevent a 100% right now is not to use PDFS until they have Fixed this problem.

Barack Obama isn’t leaving the White House!

PaulJanuary 19, 2009

In a story from Sophos, some e-mails are going around saying that Barack Obama is not going to be president or that he will not be inauguration. Sopho’s also makes a great comparison for the two sites and it does try to look like the official site.

[ad#ad2-right]

Which if you click on the “Continue Reading” link it will try to send a file “Speech.exe” which is W32/Waled-Gen or Mal/WaledPak-A. It is a fake site to look like the real site, it is never a good idea on clicking on links that looks real. For those of you who want to watch the Inauguration online I would suggest Hulu:

You can watch it happen when it happens. So sit back relax and enjoy the show!!

Microsoft issues 1 Major update 1-13-09

PaulJanuary 13, 2009

Well it has been release Microsoft issued an update to the system:

[ad#ad2-right]

Vulnerabilities in SMB Could Allow Remote Code Execution

Microsoft Security Bulletin MS09-001 – Critical (KB958687)

This security update resolves several privately reported vulnerabilities in Microsoft Server Message Block (SMB) Protocol. The vulnerabilities could allow remote code execution on affected systems. An attacker who successfully exploited these vulnerabilities could install programs; view, change, or delete data; or create new accounts with full user rights. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter. Best practices recommend that systems that are connected to the Internet have a minimal number of ports exposed.

This is one of those updates you really need to install as soon as you can. You should also get a free firewall or buy one. I looks to be a vulnerability in the ports and if you’d have a firewall besides windows you should be safe but that is besides the point. If you are security congenious then you should install this update ASAP. If your worried this will effect you system then you will need to backup your system before you do this update. If you feel you’ve might of been infected with this Vulnerability you could always go get a free antivirus program and scan your system. This is the sure way of fighting a Virus and making sure your safe, although people argue that Paid virus programs are quicker to be updated with virus databases, it’s all in the matter of preferences.

New Twitter Phishing -jannawalitax.blogspot.com

PaulJanuary 3, 2009

I read Chris Prillo’s Blog about this and wanted to investigate this even more. When you go to this site it looks like:

When you go here the web address is : http://twitter.access-logins.com/login/ and it looks like it was a redirect form the blogspot.com site. so what I did an experiment and just took off /login/ on the address and this pops up:

[ad#ad2-right]

This website looks to like a facebook website so now you have to ask where is this at: Hunan China. After I did a whois look up it looks like China is at it again. These are trying to get on to your account to either spam or use it to get people to install software. So what are things you can do? If you have a question about this always check it out. That is why I like to check everything out with these types of phishing scams. I don’t know why they want twitter accounts, I just know they are doing this now. So if you get this message:

hey! check out this funny blog about you… jannawalitax . blogspot . com

Just ignore it and possibly blog the twitter account. That is probably a bot or someone’s account been hacked and is no longer valid. I’ll leave that up to you on how you handle that account. This is to warn people about this account and warn people. Help Protect your password with Roboform, don’t just use one password for all accounts. It also seems to be possible worm, if you think your infected check out my resource on remove the worm. Here’s the link to that talks about this being a worm.