Beijing scores number one spot for malware
689638
(InfoWorld) - China is proving to be a mighty force not only economically, but also as the launching point for malicious software and spam. In June, some 40 percent of malicious software worldwide originated from Beijing, nearly doubling from 21 percent in May, said Simon Heron, managing director for security vendor Network Box. Spam from Beijing, however, dropped from 11 percent to 5 percent over the same time period, he said. Beijing kept the number one spot for malware, followed by Wattleup, Australia, at 3.7 percent, and Madrid, Spain, at 2.5 percent, according to Network Box. The percentage is calculated from event logs transmitted by about 700 customers using Network Box's security appliance, which has a firewall along with antispam, antivirus, antiphishing, and content filtering technologies. The company catches about 4 million samples of malicious software a day. As more and more users come online in China, there's a good chance those computers are using pirated software without up-to-date security fixes, making them prime targets for hackers who are actually located elsewhere in the world, Heron said. Those compromised computers, which are used to send spam and make it more difficult to identify the spammer, are so valuable that hacker gangs have been competing to take over machines, Heron said. If one gang finds a machine running another gang's Trojan horse program -- one that appears harmless to the victim but can be used to control a machine -- they'll try to remove the software. "If you finally have your Trojan onto a system, you donât really want it running somebody else's software because there's a better chance the user will realize it and do something about it," Heron said. "I guess thereâs no honor amongst thieves." Â
674257
China, computers and algorithms combine in a perfect storm.
425341
Spyware and other malicious code turns up most often on sites related to music and technology, a study concludes.
195292
an IBM security report finds malware is increasing in volume and sophistication this year.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
176831
The first computer worm to eavesdrop on network traffic after it infects a computer has been discovered by security experts. The SDBot.
692013
A new malware strategy that involves tracking IP addresses to see when a machine has already been infected could prove vexing for those attempting to hunt down malicious code, according to Finjan. The new tactic is already turning up on compromised Web pages.
564338
A rootkit based on proof-of-concept code presented at 2005's Black Hat conference is currently infecting thousands of Windows-based PCs, and researchers say it's a remarkably sophisticated -- and hard-to-eradicate -- infection.
409660
Tzvetan Ceco Chaliavski's workday begins just like most people's, with a check of his e-mail. But his inbox often contains more than 400 warnings and samples of viruses, worms and all manner of malware.
632910
Raids by the FBI and China's Public Security Bureau in the southern region of China has resulted in the arrest of 24,  and exposed a two billion dollar global software piracy syndicate, believed to be one of the largest in the world.
658952
If malware were insects, botnets would be termites -- they burrow in behind the walls of your security perimeter, lie dormant for a period of time, then attack.
517001
Hi-tech viruses and malicious software programmes -- or malware -- commonly infect computers the world over: filling mail boxes with spam, deleting e-mail addresses, damaging machines and costing billions to corporations.
145221
The Zafi.D worm, which disguises  itself as an e-mail holiday greeting, is currently the most  frequently detected worldwide virus, software security company  Panda Software said this week.
86315
The security vendor has fixed the damage, but the site briefly redirected visitors to a malicious site in China.
131542
Visit our glorious malware! Add embassy websites to the growing list of hacked internet destinations trying to infect visitor PCs with malware.â¦
263560
(InfoWorld) - Chinese police have arrested eight people in connection with the release of a computer virus known as Panda Burning Incense, according to an official news report. Among those arrested was Li Jun, a 25-year-old man from Wuhan, in central China, the official Xinhua News Agency said on its Web site. Li allegedly sold copies of the worm to 120 people, earning 100,000 renminbi ($12,876) from the sales, the report said, citing a statement from the Hubei Province Public Security Bureau. The arrests are the first in China for virus writing, Xinhua said. Panda Burning Incense, which is known by several other names, including Fujacks and Radoppan.T, was written in October 2006 and first attracted the attention of authorities and antivirus experts in January. The virus attacks the Windows operating system. Antivirus specialist SophosÂ last month described Panda Burning Incense as a "parasitic virus," which infects executable files on a PC. When infected, the icon of the executable file changes to an image of a panda holding three sticks of incense -- a traditional way of praying in China. The virus also allows attackers to circumvent some security processes on infected computers and spreads by attacking shared network resources. In a statement, Sophos said the virus does not present a risk of widespread infection, as the altering of program icons makes infection obvious. The company also discounted reports of widespread infection, saying it received only "one or two" such reports.
613518
Malware researchers have uncovered 'massive growth' in the number of PCs harboring silent rootkit infections.