Ransomware : A new kind of Maleware

Ransomware is a kind of malware (malicious software) that criminals install on your computer so they can lock it from a remote location. 

Ransomware generates a pop-up window, webpage, or email warning from what looks like an official authority. It explains that your computer has been locked because of possible illegal activities on it and demands payment before you can access your files and programs again.

e.g.

How do criminals install ransomware?

Ransomware is usually installed when you open a malicious email attachment or when you click a malicious link in an email message or instant message or on a social networking site or other website. Ransomware can even be installed when you visit a malicious website.

How do I avoid ransomware?

There are several free ways to help protect your computer against ransomware and other malware:

• Keep all of the software on your computer up to date. Make sure automatic updating is turned on to get all the latest Microsoft security updates.
• Keep your firewall turned on.
• Don't open spam email messages or click links on suspicious websites.
  How do I remove a ransomware infection from my computer?
  Here are two methods on how you may be able to remove a ransomware infection from your computer.
  Method 1: Use the Microsoft Safety Scanner
  
  
  Before you begin, you will need to have access to a computer that is not infected and is connected to the Internet, so you can download a copy of the Microsoft Safety Scanner.
  
  
  Try to restart your computer in safe mode. Here's how:
  In Windows 7
  In Windows Vista
  In Windows XP
  If you are able to restart your computer in safe mode, run the Microsoft Safety Scanner in your computer.
  Restart your computer after running the Microsoft Safety Scanner.
  If this resolves your ransomware infection, follow these steps to take once your computer has been cleaned.
  If this does not resolve your ransomware infection, follow Method 2.
  Method 2: Use Windows Defender Offline
  
  
  Before you begin: you will need to have access to a computer that is not infected and is connected to the Internet, so you can download a copy of Windows Defender Offline.
  
  
  The way Windows Defender Offline works, is by allowing you to:
  
  
  Download a copy of the tool from a computer that has access to the Internet
  Save a copy of the recovery tool to a removable drive, in order to create bootable media
  Run the recovery tool on a compromised computer
  Note: Windows Defender Offline is not a replacement for a full antivirus solution providing ongoing protection. It is meant to be used in situations where you cannot start or scan your infected computer due to a virus or other malware actively running on the computer and impeding antimalware software.
  
  
  Here's how to use Windows Defender Offline:
  
  
  Determine if you require the 32-bit or 64-bit download. See the Microsoft Help and Support article for instructions on how to check if your infected computer is running a 32- or 64-bit version of Windows.
  Using a computer that can connect to the Internet, download the version of the Windows Defender Offline that applies to your infected computer.
  
  
  If your computer is a: 
  
  
  - 32-bit computer, then download the 32-bit version here. 
  - 64-bit computer, then download the 64-bit version here.
  
  
  Note: For the recovery tool to be effective, make sure you download the version that matches your infected computer. For example, if your 64-bit desktop is affected, you will need to download the 64-bit version of Windows Defender Offline and save it to a removable drive.
  Save the downloaded file to a local drive on your computer.
  Launch the downloaded file, and create a bootable device by following the instructions on the wizard. We recommend creating a bootable USB or CD; if you create a bootable USB, this can be updated for future use.
  From the infected computer, boot from the USB or CD you created in step 4. You may need to set the boot order in the BIOS to do this. This is device specific, so if you are unsure, refer to your system manual or manufacturer.
  Follow the prompts to run a full system scan. Depending on the outcome of the scan, your next steps will vary. Follow the prompts from Windows Defender Offline to manage any threat detections.
  If this resolves your ransomware infection, follow these steps to take once your computer has been cleaned.
  
  
  source: http://www.microsoft.com/security/portal/shared/ransomware.aspx

Read More

Virus writers target children

Virus writers target children with cartoon gaming websites that secretly infect their parents' PCs

• Sites offering cute games secretly infect PCs
• Sites with 'game' or 'arcade' in title pose danger
• Infections remain until when parents log in
• One site infected 12,600 users last month 

Children are the latest target for writers of computer viruses - seen as an easy 'way in' to their parents PCs.Hackers are targeting children with sites that install malicious software on PCs, disguised as innocent-looking cartoon gaming websites. But the sites quietly load programs onto the PCs which lurk in the background, which can steal information from adults, long after the children have logged off. 

Youngsters are seen as easy targets, because they  will not stop and think before clicking on a link, whereas adults tend to be slightly more cautious.Children are targeted using sites that offer free games - with one.

'Games like these require clicking and children don’t think much about what they are clicking on,' said Ondrej Vlcek, CTO of AVAST Software. 'This makes them – or their parents’ computer – quite susceptible to malicous software.'
'Games like these require clicking and children don’t think much about what they are clicking on. This makes them – or their parents’ computer – quite susceptible to malicous software,' says Avast's CTO.Within the last month, the security firm identified 60 sites with the word 'Game' or 'Arcade' in the title which were infected with malicious software - either through the sites themselves, or infected adverts. The 'driveby downloads' infect the computer with trojan software that direct the PC towards sites which infect it with further malicious software.The way children browse the web - impulsively hopping between different sites - makes them easy targets, says Avast. 'If there is something dangerous, a child will find it,' said Mr. Vlcek.Most of the infected sites seem legitimate, although some may have been created specifically to distribute malware. There is no way to visually spot the danger.As ever, the solution is to ensure you are using an up-to-date browser and have security features such as warnings activated. Antivirus programs such as Norton can be set up to give warnings that a site may be infected, or even that individual adverts may pose a risk.'At a minimum, people need an antivirus program that looks for various kinds of malware and scans websites for infections.
s:-http://www.dailymail.co.uk/sciencetech/article-2087257/Hackers-target-children--gaming-websites-secretly-infect-parents-PCs.html

Read More

Israeli hackers Vs Saudi hackers

 Israeli hacker known as “0xOmer” has already made headlines after publishing hundreds of Saudi credit card numbers in retaliation against Arab hackers, claiming to be Saudis, who published tens of thousands of Israeli credit card details on the Internet last week.
“This is just the beginning,” 0xOmer told The Jerusalem Post Wednesday.
“We have over 300 Saudi credit card numbers in our possession... and the personal details of over 10,000 people in Saudi Arabia, including full names, e-mails and addresses. If they publish one more little detail on Israel, we will attack in full force and publish all of the credit card details.”
On Wednesday night, the Saudi hacker released what he said were 200 more Israeli credit card numbers, and called other anti-Israel online activists to step up web attacks.
Responding to the development, 0xOmer said he would release thousands of personal information accounts belonging to Saudis.
“They want force? No problem,” he wrote. “We have a further 300,000 working Saudi credit card numbers. We are seriously considering whether we should publicize them.”
The hacker provided a glimpse into how a developing cyber-war is being fought.
Last week, Israeli credit card companies and the Bank of Israel scrambled to cancel credit card numbers compromised by the actions of the anti-Israel hacker. Now, Saudi banks will have to take the same steps to protect their customers.
“I belong to a group of hackers named Israel Defenders,” 0xOmer said. The team, he added, is made up of four members who function like an organized cell with a clear division of labor.
“My role is to find and exploit security breaches at the highest levels,” he told the Post.
Another member of the team, code-named “7ukk1,” is in charge of defacing websites and handling foreign media relations; according to 0xOmer, he is an IDF soldier serving in Military Intelligence.
A third member specializes in breaking into servers. The fourth member helps 0xOmer identify security gaps.
“It’s very easy to be a hacker. It’s a matter of studying for two to three months and you can master the field,” he said. “The only difficulty is in finding Arab websites because they’re in a different language.”
But such websites have already been found in the form of a Saudi shopping website, where security breaches were identified.
The hackers are interested only in sending a warning to anti-Israel hackers at this stage, and stopped short of providing credit card information that can be used to make fraudulent purchases, 0xOmer added.
“I didn’t publicize the three-digit number on the back of the card [necessary for online shopping],” he explained. But if hostile Internet activists continue attacking Israeli targets, Israel Defenders will publish hundreds of credit card numbers, along with the three-digit code.
The four youths are taking up what they say is a deterrence posture in an online world that is increasingly being used as a battle arena.
The arena is dominated almost exclusively by the young.
“Many want to know how old I am, and some think I’m an adult. The right answer is that I’m 17,” 0xOmer said.
On his Twitter account he posted a link to a media report on the Israeli hacking group, adding, “Israeli pride!” He also directed expletives at “0xOmar,” the hacker who exposed the Israeli credit card numbers.
s:http://www.jpost.com/NationalNews/Article.aspx?id=253181

Read More

ATM malware spreading around the world

IDG News Service - Cash machines around the world are hosting malware that can harvest a person's card details for use in fraud, a situation that could worsen as the malware becomes more sophisticated, according to a security researcher.Analysts at Trustwave's SpiderLabs research group were surprised earlier this year when it obtained the ATM malware sample from a financial institution in Eastern Europe, said Andrew Henwood, vice president of SpiderLabs's Europe, Middle East and Africa operation. Trustwave does forensic investigations for major credit card companies and financial institutions as well as penetration tests.
"It's the first time we have come across malware of this type," Henwood said..[malware]
The malware records the magnetic stripe information on the back of a card as well as the PIN (personal identification number)..[malware] That data can be printed out on the ATM's receipt roll when a special master card is inserted into the ATM that launches a user interface. It can also be recorded on the magnetic stripe of that master control card."We were surprised at the level of sophistication," Henwood said..[malware] "It does make us generally pretty nervous.[malware]."Most ATMs run security software, but financial institutions haven't focused on their security as much as other systems, Henwood said."ATMs were kind of an afterthought and were considered to be fairly stable," Henwood said. "I'd say there's not been enough focus in the past on ATM infrastructure."
Those who wrote the malware have detailed knowledge about how ATMs work, Henwood said. The sample they tested ran on ATMs using Microsoft's Windows XP operating system.[malware].[malware]
The sample did not have networking capabilities, but that may be a natural evolution. That's particularly dangerous since most ATM machines in developed countries are networked. The danger is that the malware could be engineered into a worm that, once on one ATM, spreads through all ATMs on a network, Henwood said.To install the malware, a person would need access to the inside of the ATM or a port in which software could be uploaded. That means insiders could be involved, or cybercriminals have picked a lock on an ATM in order to install the software, Henwood said.
taken from computerworld.
[malware].[malware].[malware].[malware].[malware]

Read More

Cyber espionage

Cyber spying or Cyber espionage is the act or practice of obtaining secrets without the permission of the holder of the information (personal, sensitive, proprietary or of classified nature), from individuals, competitors, rivals, groups, governments and enemies for personal, economic, political or military advantage using illegal exploitation methods on the Internet, networks or individual computers through the use of cracking techniques and malicious software including Trojan horses and spyware. It may wholly be perpetrated online from computer desks of professionals on bases in far away countries or may involve infiltration at home by computer trained conventional spies and moles or in other cases may be the criminal handiwork of amateur malicious hackers and software programmers.
Cyber spying typically involves the use of such illegally gained access to secrets and classified information or illegally gained control of individual computers or whole networks for an unethical and illegal strategic advantage and for psychological, political and physical subversion activities and sabotage. More recently, cyber spying invovles analysis of public activity on social networking sites like Facebook and Twitter

Read More

Computer Operations Security

Operations security and controls safeguard information assets while the data is resident in the computer or otherwise directly associated with the computing environment. The controls address both software and hardware as well as such processes as change control and problem management. Physical controls are not included and may be required in addition to operations controls.
Operations security and controls can be considered the heart of information security because they control the way data is accessed and processed. No information security program is complete without a thoroughly considered set of controls designed to promote both adequate and reasonable levels of security. The operations controls should provide consistency across all applications and processes; however, the resulting program should be neither too excessive nor too repressive.
Resource protection, privileged-entity control, and hardware control are critical aspects of the operations controls. To understand this important security area, managers must first understand these three concepts. The following sections give a detailed description of them.


RESOURCE PROTECTION
Resource protection safeguards all of the organization’s computing resources from loss or compromise, including main storage, storage media (e.g., tape, disk, and optical devices), communications software and hardware, processing equipment, standalone computers, and printers. The method of protection used should not make working within the organization’s computing environment an onerous task, nor should it be so flexible that it cannot adequately control excesses. Ideally, it should obtain a balance between these extremes, as dictated by the organization’s specific needs.
This balance depends on two items. One is the value of the data, which may be stated in terms of intrinsic value or monetary value. Intrinsic value is determined by the data’s sensitivity — for example, health- and defense-related information have a high intrinsic value. The monetary value is the potential financial or physical losses that would occur should the data be violated.
The second item is the ongoing business need for the data, which is particularly relevant when continuous availability (i.e., round-the-clock processing) is required.
When a choice must be made between structuring communications to produce a user-friendly environment, in which it may be more difficult for the equipment to operate reliably, and ensuring that the equipment is better controlled but not as user friendly (emphasizing availability), control must take precedence. Ease of use serves no purpose if the more basic need for equipment availability is not considered.
Resource protection is designed to help reduce the possibility of damage that might result from unauthorized disclosure and alteration of data by limiting opportunities for misuse. Therefore, both the general user and the technician must meet the same basic standards against which all access to resources is applied.
A more recent aspect of the need for resource protection involves legal requirements to protect data. Laws surrounding the privacy and protection of data are rapidly becoming more restrictive. Increasingly, organizations that do not exercise due care in the handling and maintenance of data are likely to find themselves at risk of litigation. A consistent, well-understood user methodology for the protection of information resources is becoming more important to not only reduce information damage and limit opportunities for misuse but to reduce litigation risks.


Accountability
Access and use must be specific to an individual user at a particular moment in time; it must be possible to track access and use to that individual. Throughout the entire protection process, user access must be appropriately controlled and limited to prevent excess privileges and the opportunity for serious errors. Tracking must always be an important dimension of this control. At the conclusion of the entire cycle, violations occurring during access and data manipulation phases must be reported on a regular basis so that these security problems can be solved.
Activity must be tracked to specific individuals to determine accountability. Responsibility for all actions is an integral part of accountability; holding someone accountable without assigning responsibility is meaningless. Conversely, to assign responsibility without accountability makes it impossible to enforce responsibility. Therefore, any method for protecting resources requires both responsibility and accountability for all of the parties involved in developing, maintaining, and using processing resources.
An example of providing accountability and responsibility can be found in the way some organizations handle passwords. Users are taught that their passwords are to be stored in a secure location and not disclosed to anyone. In some organizations, first-time violators are reprimanded; if they continue to expose organizational information, however, penalties may be imposed, including dismissal.

Read More

Defense in depth...IT SECURITY

Information security must protect information throughout the life span of the information, from the initial creation of the information on through to the final disposal of the information. The information must be protected while in motion and while at rest. During its lifetime, information may pass through many different information processing systems and through many different parts of information processing systems. There are many different ways the information and information systems can be threatened. To fully protect the information during its lifetime, each component of the information processing system must have its own protection mechanisms. The building up, layering on and overlapping of security measures is called defense in depth. The strength of any system is no greater than its weakest link. Using a defence in depth strategy, should one defensive measure fail there are other defensive measures in place that continue to provide protection.
Recall the earlier discussion about administrative controls, logical controls, and physical controls. The three types of controls can be used to form the basis upon which to build a defense-in-depth strategy. With this approach, defense-in-depth can be conceptualized as three distinct layers or planes laid one on top of the other. Additional insight into defense-in- depth can be gained by thinking of it as forming the layers of an onion, with data at the core of the onion, people the next outer layer of the onion, and network security, host-based security and application security forming the outermost layers of the onion. Both perspectives are equally valid and each provides valuable insight into the implementation of a good defense-in-depth strategy.
Security classification for information
An important aspect of information security and risk management is recognizing the value of information and defining appropriate procedures and protection requirements for the information. Not all information is equal and so not all information requires the same degree of protection. This requires information to be assigned a security classification.
The first step in information classification is to identify a member of senior management as the owner of the particular information to be classified. Next, develop a classification policy. The policy should describe the different classification labels, define the criteria for information to be assigned a particular label, and list the required security controls for each classification.
Some factors that influence which classification information should be assigned include how much value that information has to the organization, how old the information is and whether or not the information has become obsolete. Laws and other regulatory requirements are also important considerations when classifying information.
The type of information security classification labels selected and used will depend on the nature of the organisation, with examples being:
 In the business sector, labels such as: Public, Sensitive, Private, Confidential.
 In the government sector, labels such as: Unclassified, Sensitive But Unclassified, Restricted, Confidential, Secret, Top Secret and their non-English equivalents.
 In cross-sectoral formations, the Traffic Light Protocol, which consists of: White, Green, Amber and Red.
All employees in the organization, as well as business partners, must be trained on the classification schema and understand the required security controls and handling procedures for each classification. The classification of a particular information asset has been assigned should be reviewed periodically to ensure the classification is still appropriate for the information and to ensure the security controls required by the classification are in place.

Read More

Malware types

Adware Malware
Adware Malware is the class of programs that place advertisements on your screen. These may be in the form of pop-ups, pop-unders, advertisements embedded in programs, advertisements placed on top of ads in web sites, or any other way the authors can think of showing you an ad. The pop-ups generally will not be stopped by pop-up stoppers, and often are not dependent on your having Internet Explorer open. They may show up when you are playing a game, writing a document, listening to music, or anything else. Should you be surfing, the advertisements will often be related to the web page you are viewing.
Spyware Malware
Programs classified as Spyware Malware send information about you and your computer to somebody else. Some Spyware Malware simply relays the addresses of sites you visit or terms you search for to a server somewhere. Others may send back information you type into forms in Internet Explorer or the names of files you download. Still others search your hard drive and report back what programs you have installed, contents of your e-mail client's address book (usually to be sold to spammers), or any other information about or on your computer – things such as your name, browser history, login names and passwords, credit card numbers, and your phone number and address.


Spyware Malware often works in conjunction with Toolbars Malware. It may also use a program that is always running in the background to collect data, or it may integrate itself into Internet Explorer, allowing it to run undetected whenever Internet Explorer is open.


Hijackers Malware
Hijackers Malware take control of various parts of your web browser, including your home page, search pages, and search bar. They may also redirect you to certain sites should you mistype an address or prevent you from going to a website they would rather you not, such as sites that combat malware. Some will even redirect you to their own search engine when you attempt a search. NB: Hijackers Malware almost exclusively target Internet Explorer.


Toolbars Malware
Toolbars Malware plug into Internet Explorer and provide additional functionality such as search forms or pop-up blockers. The Google and Yahoo! Toolbars Malware are probably the most common legitimate examples, and malware Toolbars Malware often attempt to emulate their functionality and look. Malware Toolbars Malware almost always include characteristics of the other malware categories, which is usually what gets it classified as malware. Any toolbar that is installed through underhanded means falls into the category of malware.


Dialers Malware 
Dialers Malware are programs that set up your modem connection to connect to a 1-900 number. This provides the number's owner with revenue while leaving you with a large phone bill. There are some legitimate uses for Dialers Malware, such as for people who do not have access to credit cards. Most Dialers Malware, however, are installed quietly and attempt to do their dirty work without being detected.

Read More

Malware

Malware is short for “malicious software."  It includes viruses and spyware that get installed on your computer, phone, or mobile device without your consent. These programs can cause your device to crash and can be used to monitor and control your online activity. Criminals use malware to steal personal information, send spam, and commit fraud.
Avoid Malware
Scam artists try to trick people into clicking on links that will download malware and spyware to their computers, especially computers that don't use adequate security software. To reduce your risk of downloading unwanted malware and spyware:


Keep your security software updated. At a minimum, your computer should have anti-virus and anti-spyware software, and a firewall. Set your security software, internet browser, and operating system (like Windows or Mac OS) to update automatically.
Don't click on any links or open any attachments in emails unless you know who sent it and what it is. Clicking on links and opening attachments – even in emails that seem to be from friends or family – can install malware on your computer.
Download and install software only from websites you know and trust. Downloading free games, file-sharing programs, and customized toolbars may sound appealing, but free software can come with malware.
Minimize "drive-by" downloads. Make sure your browser security setting is high enough to detect unauthorized downloads. For Internet Explorer, for example, use the "medium" setting at a minimum.
Use a pop-up blocker and don't click on any links within pop-ups. If you do, you may install malware on your computer. Close pop-up windows by clicking on the "X" in the title bar.
Resist buying software in response to unexpected pop-up messages or emails, especially ads that claim to have scanned your computer and detected malware. That's a tactic scammers use to spread malware.
Talk about safe computing. Tell your kids that some online actions can put the computer at risk: clicking on pop-ups, downloading "free" games or programs, opening chain emails, or posting personal information.
Back up your data regularly. Whether it's text files or photos that are important to you, back up any data that you'd want to keep in case your computer crashes.
Detect Malware
Monitor your computer for unusual behavior. Your computer may be infected with malware if it:
slows down, crashes, or displays repeated error messages
won't shut down or restart
serves up a barrage of pop-ups
displays web pages you didn't intend to visit, or sends emails you didn't write
Other warning signs of malware include:
new and unexpected toolbars
new and unexpected icons in your shortcuts or on your desktop
a sudden or repeated change in your computer's internet home page
a laptop battery that drains more quickly than it should
Get Rid of Malware
If you suspect there is malware is on your computer, take these steps:


Stop shopping, banking, and doing other online activities that involve user names, passwords, or other sensitive information.
Update your security software, and then run it to scan your computer for viruses and spyware. Delete anything it identifies as a problem. You may have to restart your computer for the changes to take effect.
If your computer is covered by a warranty that offers free tech support, contact the manufacturer. Before you call, write down the model and serial number of your computer, the name of any software you've installed, and a short description of the problem.
Many companies – including some affiliated with retail stores – offer tech support on the phone, online, at their store, and in your home. Decide which is most convenient for you. Telephone and online help generally are the least expensive, but you may have to do some of the work yourself. Taking your computer to a store usually is less expensive than hiring a repair person to come into your home.
Once your computer is back up and running, think about how malware could have been downloaded to your machine, and what you could do differently to avoid it in the future.

Read More

How to kill malicious processes

Using safe mode
Most of malicious processes are inactive when PC operates in safe mode with networking. To reach safe mode with networking, do following:
Reboot
Press F8 early on (you can press F8 couple times)
Choose Safe mode with networking (preferably) or safe mode from menu
On success you should not see any alerts that bother you under normal mode
Killing processes using task manager
The benefit of using task manager is that you do not need to download anything. Task manager is present in all windows computers, though it might be disabled and provides little control


Open task manager by either pressing ctrl+shift+esc or pressing ctrl+alt+del and choosing from menu. For best results, try doing so just after windows login, while other processes are still loading
If it fails, go to go to Start->Run and type taskmgr
If this fails, go to C:\Windows\System32, copy taskmgr and rename it to 1.scr , 1.com or other random name. Launch that file. You can try right-clicking on it and choosing Run as administrator on Windows Vista or Windows 7
Choose process TAB, choose to see processes of all users (optional)
Choose malicious process from the list, right click on it
Press End process
On successful stop of malicious processes alerts should disappear and you can continue to next steps of malware removal.
Killing processes using process explorer
Process explorer provides more information on how the processes were launched. Also it is not blocked together with Task Manager. If it is blocked from execution, try saving it as 1.scr, 1.com or iexplore.exe before execution.


Download Process explorer from here : http://download.sysinternals.com/Files/ProcessExplorer.zip and unzip.
Launch process explorer (procexp.exe )
Select malicious process and press DEL.
On successful stop of malicious processes alerts should disappear and you can continue to next steps of malware removal.

Read More