Stormy weather for malware defenses
519740
Virus writers go after anti-virus vulnerabilities When the Storm Worm swept through the internet in mid-January, the program's writers took a brute force approach to evading anti-virus defenses: They created a massive number of slightly different copies of the program and released them all at the same time.â¦
278665
Despite recent security patches, worms to attack Windows could be in the works.
503684
Talk about the worst of both worlds: When Jon Espenschied tried to untangle a malware attack on his dual-boot system, he found out just how vulnerable combining open- and closed-source software can leave a machine.
383128
We've feared it for a long time, and now the situation has come to pass: The malware's moving faster than the tools to thwart it. But since you can't simply hide under a non-wired rock and hope it goes away, it's worth knowing how AV manufacturers are battling back -- and how you can too.
41412
How spyware, a program that creeps onto a computerÂs hard drive unannounced, is wrecking the Internet.
405976
Letters: Going deeper on the question of security and operating systems.
538641
Worried about catching viruses, spyware, or other malicious software while surfing the Web?
716663
Networked multifunction devices share PC vulnerabilities to worms, hackers.
583590
The trials and tribulations of application dependency in a virtualized, hosted world.
408824
Well, if you haven&#39;t patched your PC yet, now is the time. A sample program hit the Internet on Wednesday, showing by example how malicious coders could compromise Windows computers by using a flaw in the
189152
Killing a virus attack before it becomes damaging is something of a holy grail in today&#39;s security environment. That&#39;s because most viruses today are distributed through attachments to e-mail
755872
(InfoWorld) - During the past two years, security experts and software vendors have downplayed the threat of so-called worm viruses, but new evidence suggests that the attacks are still as dangerous, if not more so, than ever. While the enormous mass-mailing worm viruses of years past -- such as the well-known MyDoom, Sobig, and Slammer attacks -- that were aimed at crippling IT infrastructure have all but disappeared, smaller outbreaks that aim to load financially-motivated malware onto end users' computers -- such as the recent Storm Worm -- will continue to menace the Internet, according to researchers. Consensus opinion among security experts has been that as businesses and consumers improved their desktop security tools and computing habits, it became harder for malware writers to lure the same volumes of people with worms. This trend pushed the attackers away from creation of the self-propagating threats and further into financially-motivated crimeware, market watchers observed. However, the continued spread and modification of Storm Worm, which first surfaced in mid-Jan. 2007, could illustrate an emerging breed of the attacks that is likely to trouble users in years to come. On Feb. 27, workers at security software maker Secure Computing released details of a newly-emerging variant of Storm Worm that adds a Web-based social engineering component to the attack's more traditional e-mail and IM delivery models. According to San Jose-based Secure, the new version of Storm Worm sits on an infected computer and waits for a user to post a message to a Webmail system or online bulletin board site, and then adds a link to those communications that sends anyone who clicks on the URL to a malware-laden Web page. Threats that sit on the Storm-generated sites include variants of the attack itself, along with a range of crimeware programs aimed to steal sensitive personal or financial information. Viruses like Storm, which can also be classified as a Trojan rootkit, reflect the manner in which attackers will leverage the time-honored worm platform to pass along their latest work, said Dmitri Alperovitch, principal research scientist at Secure. "We're not discounting the threat from targeted financial attacks, but those tend to take a lot of work to pull off, as the attacker must do recon on the organization or user and put a good deal of effort into each target," Alperovitch said. "The payback on those attacks is probably greater, but these types of worms like the new variants of Storm can pay for themselves pretty quickly; there's little doubt we'll see more designed in this manner." In addition to using the worm approach to distribute cutting-edge malware, the Storm variations have adopted a number of other characteristics typically associated with newer attacks. The threat code itself is being changed at a rapid pace to avoid detection by antivirus systems, according to the Secure researcher, and is using an ever-changing list of URLs and IP addresses to deliver its payload and fly under the radar. The swiftly-changing profile of Storm Worm will make it hard for traditional security products to keep up with such threats, he said. "With this added technique of constant morphing and many new variants, I can't imagine how signature-based based technologies will ever cope with this sort of thing -- people truly need behavior-based tools to stop them," said Alperovitch. "We haven't seen the mass mailing, mass targeting worms that were big in the past, and Storm is not mass targeting compared to some of those, but the Web component will allow it to propagate much faster, so we'll have to keep a close eye on it." Anti-virus software makers agreed that traditional signature-based tools alone will not suffice to stop the new breed of worm, but they said that the attacks can be thwarted using a combination of those products and newer behavior-based systems. Officials at AV market leader Symantec, based in Cupertino, Calif., said that they view Storm as more of a Trojan than a worm, based on the fact that its spread is relying on social engineering methods versus automated propagation. Either way, users should rely on a defense-in-depth security strategy to protect themselves from either form of attack, according to Dave Cole, director of Symantec's Security Response team. "The major threat of today isn't the worm of yesteryear, but really the Trojan attack as the designers are using really sophisticated social engineering to trick people into downloading," Cole said. "The classical worms are still out there, we still see a ton, but the reality is they are not infecting nearly as many people because of the defenses out there; these new ones are a bigger threat." While behavior-based tools such as IDSes may represent the most effective form of defense against the rapidly-changing worm threats of today, users should still employ signature-based anti-virus applications to protect against anything that sneaks through those filters, according to the Symantec researcher. Dan Hubbard, vice president of security research at San Diego-based Websense, said that much as with every other breed of malware, worms will be increasingly laced together with different types of attacks to help increase their reach and destruction. He said worms won't likely become the leading virus format again anytime soon, according to the expert, but they will remain on malware artists' palettes as yet another option when they are creating their latest work. "At a macro level, e-mail only worms have become less frequent, but their use in combination with other attacks is getting more sophisticated and will likely continue to appear," Hubbard said. "Automation will be used to deliver new variants even faster than ever, and they will be self-updating and self-modifying; this is part of the overall increase we're seeing in the variety of ways that people are being infected over the Web."
480779
Malware arrives in the form of a game, disables antivirus protection.
433186
Spyware problems continue to rise. Congress is stepping up to the plate--but will its efforts be more effective than CAN-SPAM?
376456
Vulnerability, rated as highly critical, could enable an attacker to compromise a user's machine.
378682
A critical weakness found in many Microsoft programs looks like it is about to be exploited by virus writers. The bug only came to light last week, but code is now circulating that could be used to attack vulnerable machines.
466917
This third and final article in the Metasploit series covers the msfcli scripting interface as well as the intuitive web interface to the Framework. The article also discusses what's new with version 2.2, and then introduces the exploit development process through an example.