Microsoft Scrambles to Quash 'Friendly' Worm Story
611203
Researchers' suggestions of using wormlike software to distribute patches draws security concerns.
519444
Timing of viruses that exploit a flaw in IE could be sign that creators are trying to unsettle Microsoft.
579800
(InfoWorld) - Microsoft said it moved quickly to remove a banner advertisement that appeared on its instant-messaging program for a software application that falsely hypes security threats on a user's computer. "We immediately investigated the reports and removed the offending ads, as this is a violation of our ad-serving policy," wrote Microsoft spokeswoman Whitney Burk, in an e-mail Tuesday. Last week, computer security analysts noticed twoÂ advertisements for WinfixerÂ -- a self-described security program that also goes by the name ErrorSafe -- on Windows Live Messenger. Security companies have labeled it as a "potentially unwanted program." They believe the program falsely alerts users to problems with their computer and encourages them to purchase the application. It falls into an informally named category of program called "scareware," whose creators try to bully users into downloading their program or face problems with their computer. Microsoft, which called Winfixer "malware," did not detail how the ads appeared. However, the Center for Democracy and Technology (CDT), a civil liberties and consumer group in Washington, D.C., has investigated how questionable ads promoting spyware and other malicious software have appeared on ad networks. The incident highlights how even a well-resourced company such as Microsoft can be vulnerable to the vagaries of complex associations of Internet advertising networks. "There are often a host of parties involved in the advertising chain, making it difficult to track the journey an advertisement takes from its original source to a user's computer," according to a CDT report released last year. It's extremely hard to police advertisements, as the organizations which supply them could suddenly substitute new ones, said Graham Cluley, senior technology consultant for Sophos, a security software company. "There remains a risk that advertisements may be vetted and approved when first placed with an advertising network only to be later 'updated' to advertise less savory products," Cluley said. "This isn't just a problem for Microsoft, it's a problem for any company which is delivering advertisements to its userbase." The U.S. Federal Trade Commission (FTC) has undertaken several actions against companies that have created special programs designed to exploit security vulnerabilities in computers, that -- like Winfixer -- purport to repair the machine. The Winfixer incident sparks concerns over end-user security and could be especially important for Microsoft. The company seeks to use advertising to subsidize the cost for free services such as Windows Live Mail, formerly Hotmail, and other Web-based services it's using to compete with online offerings from Google Inc. "For years I have been holding up MSN Messenger banner advertisements as an example of how advertisements can be safely served up to end users without putting them at risk of malware," wrote Sandi Hardmeier, a Microsoft Most Valued Professional and specialist in Internet Explorer, on her blog. "Now, everything has changed. This simply shouldn't have happened." Winfixer, which sells for around $39.95, has a shady history, experts says. It's a persistent program, constantly popping up on newly-created domains under various aliases, including ErrorSafe, WinAntiVirus and DriveCleaner, said Chris Boyd, security research manager for FaceTime Communications Inc. The changing names and versions are hard to keep up with for security analysts, let alone for ad network managers who may have no idea of the true nature of the program, Boyd said. "The suspicions are that it [Winfixer] is a quite sophisticated operation," Boyd said. At one time, Winfixer was one of several bad programs installed in a bundle by hackers on vulnerable machines, wrote Ben Edelman, a malware researcher and doctoral candidate at Harvard University, on his Web site. The hackers exploited the Windows Metafile (WMF) problem, a particularly dangerous security hole that appeared in December 2005 and prompted Microsoft to hurriedly issue an off-schedule patch. As always, users should be careful. "The responsibility ultimately falls on the users to be wary of advertisements which may be selling inappropriate or potentially damaging -- to data or finances -- goods," Cluley said. Â
273824
Virus writers have grafted a network sniffer into the latest variant of the SDBot worm series. So far there are no reports of SDBot-UH in the wild but the inclusion of selective network sniffing along with
278915
Google helped shut down a spreading computer worm this week by denying the malicious software&#39;s use of its search engine, but the Santy.
132097
(InfoWorld) - A sophisticated computer worm spreading via AOL Instant Messenger (AIM) is setting up a botnet that may be difficult to combat, security researchers said. The worm, known as W32.pipeline, propagates when AIM users click on a Web link that appears to have been sent to them by someone on their buddy list. They receive a message along the lines of, "Hey, would it be okay if I upload this picture of you to my blog?" If the recipient clicks on the link, an executable file that looks like a JPEG will download into a Windows folder, according to researchers at security company FaceTime Communications Inc. The file can then execute a number of different attacks, said Chris Boyd, security research manager for FaceTime Security Labs and the researcher who discovered the worm. It can open up the email port on the PC and send out spam messages. It can also install a variant of the "hacker defender" rootkit, which is widely deployed and difficult to remove. One of the most dangerous aspects of the worm is that it can also connect to remote file upload sites, which Boyd believes the worm authors' use as sort of staging sites where they can continuously download new infections. Once a computer is infected, the program will propagate using the same instant messaging method. The worm is unique because the program seems to be able to contact a number of different sites around the globe randomly. FaceTime researchers had different results when running the same file. "Previously, where we've seen something similar to this attempted, if one file is pulled offline or removed by an ISP, the whole chain goes down," Boyd said. "But this one, if one file goes missing or gets pulled down, it will potentially make a call to another file. It has quite a random aspect to it."So far, he estimates that the botnet -- a group of similarly infected computers that are remotely controlled -- has 1,000 to 2,000 members. More computers may have been infected but not made part of the botnet. The best defense is for AIM users to be wary of clicking on links. If a user receives an unexpected link from a buddy, the user can always reply to ask if they have sent the link, to make sure it is legitimate. FaceTime has updated its virus protection software to prevent users from infection, and other antivirus vendors may do the same. AIM users that get infected can try to remove the worm but may have to wipe and reformat their drives to get rid of it.
163584
A tremendous amount of confusion has arisen in recent days over whether security firm Symantec actually discovered a new vulnerability in Microsoft Word three days ago, or simply uncovered a new exploit of an existing problem that Microsoft already acknowledged. In what appears to be an effort at backtracking, Symantec today appears to be saying both simultaneously.
745683
How a simple bug betrays Microsoft's disdain for basic best practice principles
501620
Microsoft Corp. is flatly denying what it calls &quot;misguided reports&quot; of a flaw in its new Windows XP Service Pack 2 upgrade that exposes security information to hackers.
525318
Is Microsoft's anti-malware giveaway part of a master plan to flush out software pirates?
98994
A new version of the worm that spread from infected Microsoft Corp. Internet Information Services (IIS) Web servers in June has been identified and is using instant messages (IMs) and infected Web sites in Russia, Uruguay and the U.S. to spread itself, according to one security company.
342444
A new worm has been discovered in the wild that&#39;s not just settling for invading users&#39; PCs - it wants to invade their homes, too.
202057
A Trojan horse that exploits a recent critical flaw in Microsoft Windows&#39; handling of JPEG images has been posted to several newsgroups, but it has no way to spread, security experts said Tuesday.
119753
HELSINKI - Internet security experts are warning about a mass-mailing worm with the subject line &quot;Merry Christmas&quot; or &quot;Happy Holidays.
305362
Microsoft on Thursday flatly denied reports that one of Windows XP Service Pack 2&#39;s most touted features leaves users open to possible attacks.
19728
Do-gooder worm attempts to fix holes exploited by the earlier Santy infection--but could end up a pain.
576746
A Chinese hacker arrested just days ago will be allowed to release a fix for the worm that he helped write. But a security researcher questioned the wisdom of the move.