Vista – Page 23 – Paul's Tech Talk

PDF Zero Day Vulnerability in the Wild

PaulFebruary 20, 2009

From sources all over the internet, Adobe made a sent out a Security bulletin yesterday:

APSA09-01 (Buffer overflow issue in versions 9.0 and earlier of Adobe Reader and Acrobat)

[ad#ad2-right]A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe Plans on patching this March 11, 2009

and According to some other reports are saying:

Symantec Security Response has received several PDF files that actively exploit a vulnerability in Adobe Reader. We are continuing to remain in contact with Adobe on this vulnerability in order to ensure the security of our mutual customers.

[via Symantec]

With PDF files being used all over the business world, this will create undo problems with the IT Field. This also could be used to make Botnets and make the network involved become sluggish. It must be warned that there are a whole wide variety of possibilities that could be done with this exploit. Shadowserver Foundation recommends disabling the Javascript in your Adobe Reader. Until the patch comes out you will need to be careful on what you open up and possibly check each and every PDF with an Anti-virus. This should help minimize the likely hood of getting a virus or Trojan, but is not going to be a 100%. The only way you can prevent a 100% right now is not to use PDFS until they have Fixed this problem.

Careless Facebook profiling can lead to Identity Theft!

PaulFebruary 19, 2009

I just got in contact with a old friend from High school and another friend of mine suggest the new friend. I was looking at her profile and couldn’t believe what I saw:

As you can see this is not good I was amazed at how many people are giving out there birthdays and who they are married to to friends and family. So we heard about how people are claiming they need help or are in need of desperate money. This is nothing new, as you know people are having hard economy times and people are using the social engineering to scam people out of money.

I feel that I should warn people the important necessity. You shouldn’t be broadcasting your DOB and who your married to to your friends, just in case they get hacked.

Recent activity indicates that identity thieves are hacking into trustworthy profiles before selling on the login details to interested parties. This information is used by spammers to target legitimate users, posting misleading links on their “walls” – personalized message boards.

[Via Computing.Co.UK]

This deservese a little mind and a lot of understanding. By the spammers hacking into facebook accounts they have the chance to scam or spam people with links to possibly have a virus or trojan installer.

[ad#ad2-right]For example This one blog talks about the Virus:

Symantec’s Norton Antivirus software has flagged this as a “high risk” Infostealer.Gampass virus. More info on this particular Trojan vius is here. (Note: Symantec warns the risk level is “low,” since it originated in 2006, but this new Facebook email is a new iteration of the same virus.)

You might be inclined to click on this link because it’s from a friend, but they did not intentionally send it to you — and yes, their Facebook photo is attached, too.

[Via Sync-blog]

Now I went searching through my friends list and also found this little bit of information. As you can see this one is asking for people to use there account to scam people out of money. They could use this to find out even more information of the Other partner and make you believe your talking to the real deal. Saying they need money because they are stuck over seas or something like that. I’ve seen this on other blogs where people have sent money to “friends” but are actually people who are the scammers. Then if you send the money you are out of luck with your money and possibly your friends to. I am sure there are more but this is prime examples of what you shouldn’t do and why.

So what can you do to prevent Identity Theft and/or being scammed?

Roboform Review — A Password Manager that will help protect your passwords from key loggers and other such phishing sites. I strongly recommend it to to all who are security minded. (Never use the same password for all your accounts)

Are you worried about your identity? — This is good information in checking out sites that might be questionable. You can find out what type of site it by using your brains.

Old Phish Become New again — This is blog post about twitter and what may happen if you did give out your password. This is a good example of why you never should give out your password to third party websites.

Twitter Spammers a getting more smarter — This is also good example of what happens when you see become friends with someone who isn’t real. You could be the next to be spammed and/or impersonated.

If you follow some common steps you to could prevent from being the victim or getting your Identitiy stolen. Some things to remember is Never tell anyone your Birthday the whole date like someone did on twitter a few days ago. It’s nice that they are growing older but that gives people that much more information to use to steal your money or your idenitiy. Think before you give out any personal information like Age, Married, who your married to and anything that might be used to be able to access your account or your impersonate you. Remember only you can prevent from being scammed or lossing your identity, you wouldn’t want to have to pay for your mistakes.

Tech Journalist breaks the silence — Journalist got Pwned!!

PaulFebruary 18, 2009

It was another ordinary day for this tech journalist. He had just waken up from his lovely dreams and hadn’t realized that he was being baited with Phish. Yes that is correct he actually gave out his password to an Phish site and didn’t know it.

I have to admit that he didn’t hide it, in fact he decided to post about how he got Pwned and what happened.

The Face Of A Facebook Phishing Scam
[Click Picture to see the full story]

[ad#ad2-right]As you can see the site : Facebookcom.awardspace.com is a phishing site and should never give out your information to third parties. Some things to remember if you get an email with a link sometimes won’t send you to the real link. This can be easily done just like blogging. You don’t know where you will end up when you click an email link. One thing to remember is if in doubt log into facebook the old fashion way and see for yourself.

You could be the next person to have your Identity taken away from you. So what should you do to prevent this type of phishing attacks, assume any email you get from Facebook, Myspace, Twitter, and Any other Social Sites to be a possible phish email. These are always going to be a problem for these sites. The spammers want access to be able to spam your friends and family with links, or to make you look foolish. This is the reason they do it for Money or just for laughs.

One thing to remember is having a strong password will make it that much harder for you to be phished because if you can’t remember it you will be more careful. I will keep preaching this having a good Firewall and Anti-virus will also prevent you from getting viruses from these type of phishing attacks. It will also make it much more harder to go to sites that smell like Phish. Remember only you can keep your identity a secret.

Zero Day For IE7 Being used in the wild.

PaulFebruary 17, 2009

It looks like IE7 patches are being used right now in the wild. According to TrendMicro:

HTML_DLOADER.AS exploits the CVE-2009-0075 vulnerability, which is already addressed by the MS09-002 security patch released last week. On an unpatched system though, successful exploitation by HTML_DLOADER.AS downloads a backdoor detected as BKDR_AGENT.XZMS.

[Image from TrendMicro Blog]

[ad#ad2-right]As you can see this this can be very bad for the companies who wait a while. Internet Explorer is still being used 1 out of 4 users and I see it it all the time on my stats. The Good news is this isn’t as hard to get rid as the Conflicker but should be taken serious because the writers might start to want to get even more malicious and make it even harder.

This is the next step to prevent yourself from getting caught with your pants down so to speak, you need to patch all systems that have internet access. I still like the Autopatcher because it will do the job with very little input from the user. It also makes it easier for people to patch big systems. You should also consider installing some Free Anti-virus software to help protect the systems you do have.

From the looks of this virus, someone could easily make this into a botnet and you know how that can could affect your systems and your ISP. So it is best to get this months patches on the floor of your company as soon as possible.

You should also consider telling your users to start using Firefox to prevent infection from even happening. Until you patch, you are vulnerable.

Not safe to download a worm : Project Snowblind

PaulFebruary 16, 2009

It looks like I missed this one yesterday. There seems to be a rogue and probably somewhat of a warez version of the game Project Snowblind.

[ad#ad2-right]ccording to Sophos:

Project: Snowblind is a multi-player first-person shooter (in the same genre as Doom) released by Eidos Interactive a few years ago.

A closer examination reveals that the installation program comes with a little nefarious piece of malware (detected by Sophos as W32/Rbot-GXL) that will drop a file called vghhost.exe. This file is actually a network worm as well as an IRC backdoor Trojan.

I must also tell people that if you want to download the demo, you can download it from the EIDO website and Download.com website. I will say I didn’t know about this one until Technibble, published something about this. Some of the things he publishes are great for the IT Professionals who want to start their own businesses.

I also suggest the Computer Repair Utility Kit, It can be used on a USB and has some good programs that you can use in Computer repair.