Microsoft nabs another McAfee virus expert
692828
Jimmy Kuo, a former McAfee fellow, will join the security industry newcomer as senior security researcher.
433190
(InfoWorld) - With security vendors warning of new malware that exploits a recently patched flaw in Windows, Microsoft Corp. is saying that attacks are not on the rise. Earlier this week, two new malicious programs popped up, both of which took advantage of the MS06-040 Windows Server service vulnerability. This prompted Symantec Corp. to raise its ThreatCon rating to 2 on Thursday, an indication that users should be at a heightened level of security awareness. But on Friday Microsoft said that even with these new variants, the total number of computers being attacked was unchanged. "We're not seeing an increase in attacks, just minor variations," said Stephen Toulouse, security program manager with Microsoft's Security Response Center. Symantec's Oliver Friedrichs agreed that "the overall volume of attack attempts is fairly consistent," but he said that the fact that hackers had continued to pound away at the MS06-040 vulnerability is troubling. "The fact that we are seeing more threats exploiting these vulnerabilities, that in itself is disconcerting," said Friedrichs, a director of emerging technologies in Symantec Security Response. Symantec has counted six variants of the MS06-040 attacks to date. Symantec rates the two new programs spotted this week, W32.Dasher.G and W32.Spybot.AKNO, as low risks. AÂ security bulletin on MS06-040, which affects most versions of Windows, is available. The MS06-040 patch has to do with Windows' Server services, which are used for a variety of networking tasks, such as file sharing and printing. Because the flaw relates to widely used and network-enabled features, security experts have warned that it is a likely candidate for a widespread worm. Shortly after the patch was released, the U.S. Department of Homeland Security took the unusual step of warning users of the flaw, saying it could put the nation's infrastructure at risk. To date, however, no widespread outbreak has appeared.
378682
A critical weakness found in many Microsoft programs looks like it is about to be exploited by virus writers. The bug only came to light last week, but code is now circulating that could be used to attack vulnerable machines.
324277
McAfee Inc.'s board of directors on Monday named former EMC Corp. executive Dave DeWalt as the security software company's chief executive officer and president.
73967
Friends of friends XenSource, the server virtualization company, has added a second former Microsoft staffer to its management ranks, recruiting the exec responsible for leading a number of big Windows products.â¦
386657
Company's eTrust software detects a Windows file as a virus and deletes it, causing some servers to crash and fail to reboot.
169476
Microsoft has fixed a critical flaw in the Windows operating system that could be used by criminals to create a self-copying computer worm attack.The software vendor released its first set of patches for 2008 on Tuesday, fixing a pair of networking flaws in the Windows kernel. Microsoft also released a second update for a less-serious&#160;Windows flaw that would allow attackers to steal passwords&#160;or run Windows software with elevated privileges.The critical bug lies in the way Windows processes networking traffic that uses IGMP (Internet Group Multicast Protocol) and MLD (Multicast Listener Discovery) protocols, which are used to send data to many systems at the same time. Microsoft says that an attacker could send specially crafted packets to a victim&#39;s machine, which could then allow the attacker to run unauthorized code on a system.Security experts say that there is no known code that exploits this flaw, but now that the patch has been posted, hackers can reverse-engineer the fix and develop their own attack code.Because IGMP is enabled in Windows XP and Vista by default, this bug could be used to create a self-copying worm attack, Microsoft said Tuesday.&quot;Theoretically this is wormable, and that&#39;s why this is rated critical,&quot; said Tim Rains, security response communications lead with Microsoft. However, Microsoft does not believe that hackers will have an easy time developing attack code that will work reliably. &quot;We&#39;ve done a thorough analysis of the vulnerability, and we&#39;ve come to the conclusion that there are several technical mitigating factors that make it unlikely to get reliable remote code execution,&quot; Rains said.Windows uses the IGMP protocol for many popular consumer applications such as streaming video, multiplayer games, and universal plug-and-play, but the protocol is usually blocked at the router. A derivative of IGMP, MLD is the multicast protocol used by IPv6 systems and is enabled on Vista by default.&quot;If it became a worm it could take over an internal network pretty quickly, or at least all the machines where multicast is enabled,&quot; said Eric Schultze, chief technology officer with Shavlik Technologies. &quot;But this one is going to be mitigated because a lot of people have blocked multicast.&quot;The critical MS08-001 update that fixes this flaw also patches a second, less-serious bug in the Windows networking stack that could be leveraged to launch a denial-of-service attack against a Windows system. This vulnerability lies in the Internet Control Message Protocol Router Discovery Protocol (ICMP RDP), which is used by Windows to find out how to communicate with the network. Because this capability is not turned on by default, Microsoft considers this to be merely an &quot;important&quot; bug.Microsoft&#39;s other Tuesday update, MS08-002, fixes an elevation of privilege flaw in the Windows Local Security Authority Subsystem Service (LSASS), used to manage account credentials in Windows.This flaw could be exploited by attackers to steal passwords or run their code with a higher level of privilege on Windows, said Schultze. &quot;The primary concern is Johnny who is a user becoming Johnny admin,&quot; he said. But if attackers were to combine an attack that exploited this flaw with another exploit that would allow them to run code on the system, then &quot;that could become a critical issue,&quot; he said.
753042
(InfoWorld) - The notorious Mpack hacker toolkit is installing malware that carries out its chores -- including spewing spam -- from within the Windows kernel, making it extremely difficult for security software to detect it, Symantec said Thursday. The Trojan horse that Symantec has dubbed "Srizbi" is being dropped onto some PCs by the multi-exploit Mpack, a ready-to-use attack application that until recently has been selling for around $1,000. Responsibility for a large-scale attack launched from thousands of hijacked Web sites last month was pinned on Mpack, as was a follow-up campaign waged from compromised Internet porn sites. Although Mpack can force-feed any malicious code to a commandeered PC, Symantec researchers said Srizbi stands out. Rather than follow the current practice of hiding only some activities with rootkit-cloaking technologies, Srizbi goes completely undercover. The new Trojan, said Symantec, works without any user-mode payload and does everything from kernel mode, including its main task: sending spam. "When Trojans go to spam, they go out to user land," said Dave Cole, director of Symantec's security response team, referring to malware writers injecting their code into visible Windows processes to carry out spam-sending tasks. "Srizbi, though, is basically using kernel libraries [to send spam]," said Cole. "It's calling the kernel libraries it needs." A blog entry by Kaoru Hayashi, a senior security response engineer at Symantec, spelled out the technical details. "Srizbi seems to move a step forward by working totally in kernel mode without the need to inject anything into user mode," wrote Hayashi. "To manipulate the network connection directly in kernel mode, it attaches NDIS and TCP/IP drivers and gets all the Ndis* and Zw* functions that it needs. This technique also allows the Trojan to bypass firewall and sniffer tools, and to hide all its network activities." Translation: Only advanced security tools will detect Srizbi. It's also the first full-kernel malware spotted in the wild. "It's evolutionary, not revolutionary, but it's indicative of what we see in the threat landscape," Cole said. "And if your security software is relying only on [Windows'] APIs to detect malware, you won't be protected. You need something that uses modern, anti-rootkit techniques." Cole added other information to the Srizbi story, in particular his suspicion that its author is probably the same hacker who created Rustock, a dangerous polymorphic Trojan from 2006 that also relied on rootkit technology to avoid detection. "It appears to be from the same author," said Cole. "He's been quiet for a while, and everyone has been waiting for Rustock 2.0. Some thought he'd maybe went away, but [Srizbi] uses some of the same components as Rustock." Cole expects Srizbi to follow a similar trajectory. "The pattern with Rustock seemed to be to get something out there that might be sloppy at first, but to evolve it over time. It's reasonable to believe that [Srizbi] will do the same." According to Symantec's research, the new Trojan is sloppy. "Users may be able to detect the presence of this malicious code via a registry key that happens to not be hidden by the rootkit component," said an alert to Symantec's DeepSight customers. The registry key to look for, said Symantec, is: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RcpApi\\"MachineNum" = "[six random digits-six random digits-two random digits]" In other Mpack-related news, a third Symantec security researcher said today that he's spotted the toolkit selling for as little as $150, an 85 percent reduction from its previous $1,000 price tag. "Considering the toolkit is written in a script language, it is easy to redistribute and modify," said Eric Chien, a Symantec security response engineer. "The sellers likely didn't even need to buy it themselves, but rather probably found some of the multiple Web sites that did not employ standard Web site protections, allowing them to download the whole kit for free. "Talk about clearance sales." Mpack's wider "distribution" spells trouble not only for the hacker -- suspected to be Russian -- who created the multiple-strike attack kit, but for users, too. "Its usage is likely to grow," said Chien. "In addition, without a single author controlling the distribution of the toolkit, we also expect to see forks of the source code with additional exploits, bug fixes, and other feature enhancements."
706555
A false positive in company's antivirus products leads to quarantine or deletion of some Windows users' copies of explorer.exe.
378656
THE BAGLE worm is back from the dead with three new variants which are different enough to avoid some AV scanners. McAfee, Symantec and Sophos also reported intercepting many samples of the new worms and advised customers to update antivirus signatures.
764173
Trend Micro has displaced McAfee in becoming the new anti-virus solution provider for MSN Hotmail. Trend will provide both anti-virus scanning and cleaning protection for MSN Hotmail&#39;s 187 million email accounts.
329699
TechWeb - Mozilla Corp. has hired a former Microsoft security strategist to help secure its open-source software, particularly its Firefox browser.
241353
The new flaw is unrelated to the help-file flaws discovered by a Chinese security company last week. Microsoft took the Chinese security group to task for disclosing the vulnerability without giving the company a chance to develop a fix.
581971
A planned component for Microsoft&#39;s next version of Windows is causing consternation among antivirus experts, who say that the new module, a scripting platform called Microsoft Shell, could give birth to a whole new generation of viruses and remotely
480567
Microsoft has switched from McAfee&#39;s anti-virus technology to Trend Micro&#39;s for its free Internet E-mail service MSN Hotmail.
709646
Microsoft&#39;s MSN Hotmail service will drop security provider McAfee in favor of Tokoyo-based Trend Micro. Trend Micro will deliver real-time antivirus scanning and cleaning protection for the
592989
(InfoWorld) - McAfee Inc. has apologized to users for bugs in the company's new line of client protection software, released last month. In an e-mail sent to some users last week, McAfee Executive Vice President Bill Kerrigan acknowledged that there had been glitches in the roll out. "We would like to extend our sincere apologies to anyone who may have had problems with their computers due to the upgrade," he wrote. Not all McAfee customers have been given the new software, which is going through a phased roll out, according to a McAfee spokeswoman. However, users who receive software updates from McAfee directly, or who purchased the software in the past month may have had problems, she said. Both McAfee and rival Symantec Corp. have been contending with Microsoft Corp.'s recent entry into the antivirus market, hoping to stay one step ahead of their new competitor. With this new line of products, code-named "Falcon," McAfee introduced a new user interface as well as its SiteAdvisor Web site-rating software. McAfee estimates that fewer than 1 percent of customers who downloaded the new software have had difficulties, but the problems they experienced could be annoying. The new software didn't work well with some ISP (Internet service provider) software, causing browsing slow-downs for some users, the company said. And customers who had disabled firewall protection would be presented with notification messages that could not be ignored, an annoyance for some. Some customers were simply confused by the new user interface, McAfee added. "While we believe no oneâs computer protection was compromised, we have worked quickly and hard to resolve the issues," Kerrigan said. "In fact, we have already sent out an update that automatically fixed the glitches caused by the upgrade." Customers who have complained about the bugs are being offered a free 3-month extension to their subscription, a McAfee spokeswoman said. The bugs made Web surfing a drag, said Matt Saefkow a programmer in Cleveland. "One out of every 10 images would not load unless I refreshed the page a number of times, " he said. "I was frustrated to the point where I no longer had any interest in trying to fix a program that should have helped my computer stay alive." Even before this latest update, Saefkow had experienced problems running FTP (File Transfer Protocol) and P-to-P (peer-to-peer) software on his PC, but the Web browsing bug was the last straw, he said. He has chronicled his difficulties with theÂ software on his blog. He now plans to remove the McAfee software and download a free product, which he hopes will be less of a drain on his PC. "When McAfee itself is causing a computer to feel like it's affected [by malicious software] that's counterproductive," Saefkow said. "I'm not going to be spending money on antivirus." Â