Farstrider's Place

Spam Trojan Installs Own Anti-Virus Scanner

2006-10-21T13:42:00Z

I found this on E-Week.com and thought that it was pretty interesting!

Veteran malware researcher Joe Stewart was fairly sure he'd seen it all until he started poking at the SpamThru Trojan—a piece of malware designed to send spam from an infected computer.

The Trojan, which uses peer-to-peer technology to send commands to hijacked computers, has been fitted with its own anti-virus scanner—a level of complexity and sophistication that rivals some commercial software.

"This the first time I've seen this done. [It] gets points for originality," says Stewart.

"It is simply to keep all the system resources for themselves—if they have to compete with, say, a mass-mailer virus, it really puts a damper on how much spam they can send," he added.

The full story here!

Licensing Changes to Windows Vista

2006-10-14T22:30:00Z

I found this on Paul Thurrott's Supersite for Windows and thought it may be interesting! I am not sure if anyone else here has posted the article or made comment on the article so I will make my apologies upfront if this is the case!

I'm here to tell you that virtually everything you've read online about the changes to Windows Vista's end-user license agreement (EULA) is wrong. Microsoft is further limiting your rights to transfer Windows to new PCs? Wrong. Microsoft is limiting your ability to upgrade your PC? Wrong. Microsoft is limiting the Vista versions you can install in virtual machines? Well, that one is partially correct. But there's a reason.

Here's what's really happening.

Every version of Windows is accompanied by a EULA. This document is a contract that specifies your rights with regards to the copy of Windows you just obtained. The thing is, most people--over 90 percent--get Windows with a new PC, according to Microsoft. And their rights are substantially different from the rights of a customer who purchased Windows at retail. More specifically, versions of Windows that come with a new PC can't ever be transferred to another PC. They are, quite literally, bound to the PCs with which they were purchased. Retail copies of Windows... that's a bit different. But only a bit. We'll get to that.

What's happened is that Microsoft has clarified the EULA for Windows Vista. They've made it more readable, for starters, so normal people can get by the legalese and understand what the document really means. The Vista EULA is also clearer about certain things, including one of the supposedly controversial "changes" that the previously named online pundits are railing against. It also mentions virtualization licensing rights for the first time.

Here's what changed. Go here to read the full story!

It's working!

2006-04-20T07:39:00Z

It's working again! I have been trying to post on my blog for some time now and every time I clicked on the "post new" link my browser would shut down! I am not sure if there was a problem on the site or if it was only on my blog, but it appears to be fixed now so thank you to the person/s who sorted it out for me!

RootkitRevealer

2006-03-08T23:32:00Z

Here is a really cool link [ http://www.sysinternals.com/utilities/rootkitrevealer.html ]to another Sysinternals artical with a really nice desciption and download [Download RootkitRevealer (210 KB)] of RootkitRevealer that is an advanced patent-pending root kit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects all persistent rootkits published at www.rootkit.com, including AFX, Vanquish and HackerDefender (note: RootkitRevealer is not intended to detect rootkits like Fu that don't attempt to hide their files or registry keys). If you use it to identify the presence of a rootkit please let us know!

The reason that there is no longer a command-line version is that malware authors have started targetting RootkitRevealer's scan by using its executable name. We've therefore updated RootkitRevealer to execute its scan from a randomly named copy of itself that runs as a Windows service. This type of execution is not conducive to a command-line interface. Note that you can use command-line options to execute an automatic scan with results logged to a file, which is the equivalent of the command-line version's behavior.

Go to the site and have a look, a really nice article!

Note to Security Professionals

Because rootkits can use various mechanisms to detect RootkitRevealer's presence and foil detection by not hiding their objects from a scan, we are licensing a private build of RootkitRevealer available to qualified security organizations. Email us from your corporate email account if you represent a security company and would like to license the private build.

Download RootkitRevealer (210 KB)

Running as Limited User - the Easy Way

2006-03-08T23:26:00Z

Running as Limited User - the Easy Way

Malware has grown to epidemic proportions in the last few years. Despite applying layered security principles, including running antivirus, antispyware, and a firewall, even a careful user can fall victim to malware. Malware-infected downloads, drive-by exploits of Internet Explorer (IE) vulnerabilities, and a careless click on an Outlook attachment sent by a friend can render a system unusable and lead to several hours with the Windows setup CD and application installers.

One of the most effective ways to keep a system free from malware and to avoid reinstalls even if malware happens to sneak by, is to run as a limited user (a member of the Windows Users group). The vast majority of Windows users run as members of the Administrators group simply because so many operations, such as installing software and printers, changing power settings, and changing the time zone require administrator rights. Further, many applications fail when run in a limited-user account because they’re poorly written and expect to have write access to directories such as \Program Files and \Windows or registry keys under HKLM\Software.

An alternative to running as limited user is to instead run only specific Internet-facing applications as a limited user that are at greater risk of compromise, such as IE and Outlook. Microsoft promises this capability in Windows Vista with Protected-Mode IE and User Account Control (UAC), but you can achieve a form of this today on Windows 2000 and higher with the new limited user execution features of Process Explorer and PsExec.

Process Explorer’s Run as Limited User menu item in the File menu opens a dialog that looks like and acts like the standard Windows Run dialog, but that runs the target process without administrative privileges:

PsExec with the –l switch accomplishes the same thing from the command line:

An advantage to using PsExec to launch limited-user processes is that you can create PsExec desktop shortcuts for ones you commonly launch. To make a shortcut for Outlook, for example, right-click on the desktop, choose New->Shortcut, enter the path to PsExec in the location field and click Next. Enter Outlook as the name of the shortcut and press Finish. Then right click on the shortcut to open its properties, add “-l –d“ and the path to Outlook (e.g. C:\Program Files\Microsoft Office\Office11\Outlook.exe) to the text in the Target field. Finally, select Change Icon, navigate to the Outlook executable and choose the first icon. Activating the shortcut will result in a Command Prompt window briefly appearing as PsExec launches the target with limited rights.

Both Process Explorer and PsExec use the CreateRestrictedToken API to create a security context, called a token, that’s a stripped-down version of its own, removing administrative privileges and group membership. After generating a token that looks like one that Windows assigns to standard users Process Explorer calls CreateProcessAsUser to launch the target process with the new token.

You can use Process Explorer itself to compare the token of a process running with full administrative rights and one that’s limited by viewing the Security tab in the Process Properties dialog. The properties on the left are for an instance of IE running in an account with administrative group membership and the one on the right for IE launched using Run as Limited User:

The privilege lists immediately stand out as different because the limited-user token has so few privileges. Process Explorer queries the privileges assigned to the Users group and strips out all other privileges, including powerful ones like SeDebugPrivilege, SeLoadDriverPrivilege and SeRestorePrivilege.

The difference between the group lists is more subtle: both tokens contain the Builtin\Administrators group, but the group has a Deny flag in the limited-user version. Fully understanding the effect of that flag requires a quick background on the Windows security model.

Windows stores an object’s permissions in a Discretionary Access Control Lists (DACL) that consists of zero or more Access Control Entries (ACEs). Each ACE specifies the user or group to which it applies, a type of Allow or Deny and the accesses (e.g. read, delete) it allows or denies. When a process tries to open an object Windows normally considers each ACE in the object’s DACL that matches the user or any of the groups in the process’ token. However, when the Deny flag is present on a group that group is only used by during a security access check to deny access to objects, never to grant access.

CreateRestrictedToken marks groups you don’t want present in the resulting token with the Deny flag rather than removing them altogether to prevent the security hole doing so would create: a process using the new token could potentially access objects for which the removed groups have been explicitly denied access. Users would therefore be able to essentially bypass permissions by using the API. Consider a directory that has permissions denying the Builtin\Administrators account access, but allows Mark access. That directory wouldn’t be accessible by the original instance of IE above, but would be accessible by the limited user version.

The result of running applications as limited user is that malware invoked by those applications won’t be able to modify system settings, disable antivirus or antispyware, install device drivers, or configure themselves in system-wide autostart locations.

There are some limitations, however: because the limited-user processes are running in the same account and on the same desktop as other processes running with administrative privileges, sophisticated malware could potentially inject themselves into more privileged processes or remotely control them using Windows messages. When it comes to security, there’s no single cure all and every layer of protection you add could be the one that eventually saves you or your computer.

This artical found at Mark's Sysinternals Blog: http://www.sysinternals.com/Blog/

BT 'quadruples' broadband speeds

2006-03-04T21:19:00Z

BT is to increase its broadband speeds by up to four times from 31 March.

The firm said 78% of its users would be able to access at least four megabits per second (4Mbps), compared with the maximum of two available now.

Almost half would get 6Mbps and those close to their local exchange would be able to access 8Mbps.

Some rival providers already offer up to 24Mbps, but their services are restricted mainly to clusters of users in big cities.

BT said more than 5,300 exchanges serving more than 99.6% of UK homes and businesses were being upgraded to support the higher speeds.

As well as making web browsing and e-mailing quicker, higher speeds mean people can do more with their net connection, such as watching video, listening to audio, and playing online games.

What can you say, except that a certain supplier [In South Africa] of so called high-speed broardband (512 and 1024 kbps!) should take note!!!

£7m found in car repair yard raid

2006-03-04T21:12:00Z

Police investigating the £53m Securitas depot robbery in Kent say up to £7m was found in a raid at a vehicle repair yard in south-east London.

Most of the banknotes stolen 10 days ago in Tonbridge in the UK's biggest cash robbery are still missing.

A 43-year-old man arrested in the raid on ENR Cars at Graves industrial estate in Welling has been released on police bail, police said on Saturday.

On Saturday, a 28-year-old man was held in the Bexley area over the robbery.

A small amount of money was also found at Elderden Farm in Staplehurst, Kent

The raid, Britain's biggest cash robbery, happened at the Securitas depot in Tonbridge, Kent, in the early hours of 22 February.

French MPs vote on digital piracy

2006-03-04T20:21:00Z

French MPs vote on digital piracy!

By Alasdair Sandford
BBC News, Paris

French MPs who have already voted once to legalise the online sharing of music and films are to consider the matter again next week.

In December they backed a move to allow internet users to download as much material as they want in exchange for a small fee.
If it becomes law France would be the first country to authorise the swapping of copyrighted music.

When you buy something over the internet, it's exactly the same as when you are in a shop; you have to pay the cashier, and if you don't, there is an alarm.

Herve Rony, Syndicat National de l'Edition Phonographique

The full story here http://news.bbc.co.uk/1/hi/technology/4770458.stm

Firms still have problems with Telkom ADSL

2006-03-01T23:28:00Z

Thought that this would make for some interesting reading!

Telkom and Eskom seem to be having a bit of a competition to see who can offer the most unreliable service.. they are neck and neck following the last few weeks events, but the stars tell us that Eskom will probably win this one in the long run. A great deal of people are experiencing extensive downtime with their ADSL services, and this could probably be wholly attributable to Eskom's magnificent foresight in expanding their electricity output to meet the demand of a growing economy and shutting off different areas at random times to make up for the shortfall. This of course wreaks havoc on Telkom's exchanges who all hopefully have those lovely rumbling V8 generators installed. Still though, there are problems, and as Telkom has rid themselves of all those people who were working so hard to make the company rich, there is a massive waiting list for those who have line problems because - and no one knew this was coming - there is almost no one left to come and help you.

So if you are one of the thousands of people who is now sitting without your "super-fast always-available" Telkom DSL connection, all you can do is hope that the Internet Gods smile on you and bless you with some good luck.. you need it as much as Telkom does these days!

This found on http://www.hellkom.co.za/ front page! Dated: Sunday, 26 February 2006

Back Again!

2006-03-01T11:43:00Z

I have not looked at this for so long I forgot it was still here!! Perhaps I should give it some attention again!

Indian Cracks Microsoft’s Anti-piracy WGA Program

2005-07-27T22:06:00Z

An Indian programmer seems to have broken Microsoft’s much-touted "impenetrable" anti-counterfeiting system called 'Windows Genuine Advantage' (WGA).

According to a report in rediff, Debasis Mohanty, a Bangalore based software researcher claims to have cracked WGA through an "easy-to-exploit" weakness in the software for generating illegal copies of the Windows XP programme. WGA is an anti-piracy programme devised by Microsoft that keeps a tab on consumers whether they are running legitimately licensed copies of Windows XP.

Mohanty has posted a proof-of-concept programme on Microsoft's security mailing list demonstrating how the WGA validation check can be tricked to generate key codes on illegal copies of the software by using a secondary Microsoft validation tool called 'genuinecheck.Exe'

According to reports, Microsoft confirmed the claims of Mohanty and a company spokesperson said they did expect counterfeiters to try a number of different methods to circumvent safeguards provided by WGA.

• Validation via WGA will be required for all customers using Windows Update (WU), Microsoft Update (MU) for Windows content, and the Download Center (DC). Security updates remain available to all Windows users — with or without WGA validation — via the DC or Automatic Updates.

• Microsoft has provided ongoing added-value software offerings for genuine users throughout the WGA pilot as a way of providing these customers with richer Windows experiences. Microsoft has augmented its initial offerings with additional offers for a total value of approximately $450.

• Microsoft has enhanced and simplified the validation process by automatically checking participants’ PCs to determine whether they are running genuine Windows software. All Windows users will no longer be required to enter their 25-digit product key in order to validate their software.

Internet Explorer 7 - Features

2005-07-27T21:42:00Z

Internet Explorer 7 - Features

salmonela writes "Rumors have it that the Windows Vista Beta 1 build will be released to testers tomorrow, according to Winbeta. However, Microsoft made it clear on the official website of Windows Vista that Windows Vista Beta 1 will be in the hands of the developers and IT Professionals by August 3rd, 2005 (This seems to be a MSDN release date).

We can expect some new features which will be included with the pre-release, Beta build of Internet Explorer 7. However, there is one distinguishing feature:

Phishing Filter

An interesting and fresh feature in Internet Explorer 7 (Beta). “Phishing” has become one of the top problems in our internet lives, just like viruses, trojans and most of all spyware. We, users, mainly find “Phishing” in our emails, where spammers take advantage in acquiring our personal details and login details of popular websites.

Microsoft made it a priority to help solve this problem by including this element in IE 7 (Beta). The filter will then ask the user whether they would like to have the “Phishing Filter” automatically turned on to check all future websites.

By the looks of it Microsoft will be creating a database with a list of websites that are potentially “Phishing Oriented”.

Other features:

1. Tab-Browsing
2. RSS-Reader/Aggregator
3. New user interface
4. Integrated Search field

More and more features will be released soon.

Source page: XPSource This is what it says on the source page! : “Good Evening folks, Unfortnately I had to remove certain news items which are releated to Windows Vista (Longhorn).

I hope you understand,
Jose Francisco”

Crap Cleaner version 1.21.130. (NEW)

2005-07-19T19:54:00Z

Here is the new version Crap Cleaner 1.21.130

v1.21.130
- Moved Tools and Options into the listbar and they now load
  into the main window rather than a new window.
- Fixed listbar display issue with Japanese characters.
- Added REMOVESELF cleaning parameter to delete folders and
  not just empty them.
- Added cleaning for: Google Earth, Ad-Aware SE Plus,
  Photoshop CS and CS2, Microsoft AntiSpyware,
  PerfectDisk 7.0, Azureus.
- Updated cleaning for: Windows log files,
  Real Player, Adobe Reader 7.0,
  SpyBot Search and Destroy.
- Updated Swedish, Spanish and French translations.
- Minor display fix to the Applications tree.
- Minor interface tweaks.

v1.20.118
- Restyled frontend to make features more obvious.
- Added support for Netscape 8.0.
- Added Hungarian and Czech languages.
- Improved ActiveX Issue scanning.
- Reduced the size of some of the supporting OCXs.
- Changed output window to scrollable textbox.
- Added default option to summarize IE Temporary Internet
  File cleaning, rather than listing all the files.
- Updated registry scanner to include the MUI Cache.
- Added Firefox Saved Form Information cleaning.
- New redesigned Tools section.
- Added some keyboard shortcuts.
- Fixed minor bug in IE History analysis.

Download
Latest Version
473KB

Hackers Actively Exploiting XP Flaws

2005-07-14T01:56:00Z

Giving an additional urgency to this month's software patch release, Microsoft has issued a warning that two of the upgrades fix flaws that are actively being exploited on the Web.One of the patched problems is a hole in Microsoft's Java Virtual Machine that allows hackers to take control of a computer. Another one affects the Color Management Module inside Windows. FULL STORY NewsFactor Top Tech News

Internet Explorer 7 to be ready by Christmas.

2005-07-13T23:50:00Z

Microsoft has detailed its forthcoming privacy and security plans, which include enhancements to Internet Explorer 7 and the addition of digital rights management software into applications at the document level.

Despite earlier plans not to do a browser update until Longhorn's release in 2006, Microsoft chairman Bill Gates confirmed that code for IE 7 will be available this summer in beta and in full by Christmas.

The browser will incorporate antivirus technology from recently acquired Sybari, and enhanced anti-phishing software.

"Anti-phishing will definitely be built in to IE 7," said Brendon Lynch, senior privacy strategist at Microsoft.

"We are looking to make it very visible and easy to use to ensure that it's really effective. The technology works in a similar way to anti-spam technologies by picking up keywords and writing styles."

Looking further ahead, the Redmond giant plans to introduce more control over rights to information, even within documents.

SQL Server 2005, due for launch in November, will see the encryption of all data, with individual user access based on clearance levels.

Lynch explained that some customers are interested in using the same technology within documents, so that certain paragraphs of text could be hidden from unauthorized users while still allowing them to view the remaining parts of the document.

"Office 12 will see some of this technology," he said. "Then the same principles can be applied to other applications."

Much of the technology to perform these tasks is in existence. Metadata in Word documents already records keystrokes, and logs which computer opened which document.

In addition computer systems using Server 2003 and Office 2003 can be configured to lock down documents from selected users.