US Court Halts Sale of Spyware Program

A U.S. court has ordered a software company to stop selling a program that secretly records keystrokes on a person's PC, the U.S. Federal Trade Commission said Monday.


CyberSpy Software, based in Florida, has sold the RemoteSpy program since at least August 2005, according to the FTC's complaint filed in U.S. District Court for the Middle District of Florida in Orlando. The complaint also names Tracer R. Spence, CyberSpy's CEO.

On Nov. 6, the court issued a temporary restraining order halting CyberSpy's sales. The court also ordered the company to disconnect servers that were recording sensitive personal information for RemoteSpy customers.

RemoteSpy is just one of dozens of software programs sold on the Internet that cross ethical and legal boundaries. Over the last few years, the FTC has taken steps to crack down on companies selling hard-to-remove advertising software and other deceptive or harmful applications.

The FTC's complaint said CyberSpy violated regulations prohibiting the installation of software without the consent of a user and surreptitiously collecting personal data. The FTC is seeking a permanent ban on the sale of RemoteSpy and wants the company to forfeit its gains from sales of the program.

RemoteSpy was advertised as being undetectable by antivirus software and was sold using the slogan "Spy on Anyone. From Anywhere." The company's Web site was down as of Tuesday, but Google's cache of its home page showed the program sold for US$89.95 with free technical support.

CyberSpy Software gave its customers special instructions on how to e-mail the program to an intended victim, disguising it as a harmless photo file.

Features included a "configuration wizard, a user tutorial and step-by-step instructions, including screenshots and examples of how to disguise the

appearance of the executable as an innocuous-looking file attachment," the FTC complaint read.

Once running, RemoteSpy would record all keystrokes, including passwords, and take snapshots of a person's screen every five minutes. It could also log instant message conversations as well as Web sites a person visited.

The information would be sent every 10 minutes to a server owned by CyberSpy, the complaint said. Purchasers of the RemoteSpy could then login through a Web-based interface to retrieve the details.

CyberSpy also contended that when RemoteSpy is running, it will not show up in the task manager, processes window or the add or remove software function on Windows PCs. It also supposedly has a cloaking ability, where it can move around on the PC's hard disk to avoid detection.

The FTC took action after a complaint about RemoteSpy was filed in March by the Electronic Privacy Information Center, a Washington, D.C.-based civil liberties advocacy group.

Read More»»

Denial-of-Service Attacks Intensify

Massive distributed denial-of-service attacks against ISPs and their customers doubled in intensity over the past year, according to a new survey. Distributed DoS attacks are now reaching 42Gbps in sustained intensity, up from 24Gbps last year and just 17Gbps the year prior to that, according to Arbor Networks' annual survey of ISPs from North America, Europe and Asia. (Some of the 66 global ISPs surveyed for the "Worldwide Infrastructure Security Report" are Arbor customers, some are not.)

"This attack size is the largest we've ever seen," says Arbor CTO Rob Malan. He links the larger scale of distributed DoS attacks directly to ISPs' ever-larger network backbones as well as growth in higher-speed local connections such as cable networks.

Malan believes many of the massive distributive DoS attacks are intended to strike and flood both ISP infrastructure and customer Web-facing applications. "These tricky requests tie up use of a database and Web server. They're not necessarily a typical security attack where they're looking for a vulnerability," he says.

On the plus side, the majority of ISPs surveyed expressed confidence in detecting distributed DoS attacks using both commercial and open source tools.

Survey results showed "significant adoption of inline mitigation infrastructure and a migration away from less discriminate technologies like blocking all customer traffic (including legitimate traffic) via routing announcements." The number of ISPs that use either source or destination-based access-control lists on routers as their primary attack-mitigation technique decreased from 47% to 30% this year, according to the report. "Many ISPs also report deploying walled-garden and quarantine infrastructure to combat botnets," the report states.

Still, it can take considerable time to fend off distributed DoS attacks.

Fifteen percent of respondents said it typically took 15 minutes or less to mitigate an attack. Another 15% said it took less than 20 minutes, and 14% said it took less than 30 minutes. It took an hour for 26% of respondents, and 30% typically needed more than an hour to mitigate a distributed DoS attack, even after it had been detected. ISPs said the most vulnerable elements of their infrastructure are DNS services, routers, VoIP components and load balancers.

For the third year in a row, fewer ISPs are referring attacks to law enforcement. Roughly 58% of the surveyed ISPs said they had referred no incidents to law enforcement over the past year, compared with 50% the year before. Among the reasons cited for not reporting the attacks was the opinion that law enforcement had limited capabilities and the expectation that customers would report the attacks.

When asked which threats caused the biggest drain on operational resources, ISPs named spam. Distributed DoS took second place. Peer-to-peer network usage, and its impact on operations in terms of engagement with law enforcement and other entities, was also listed by about 5% of respondents.

Another issue the report highlighted is concern that ISPs' security products don't adequately address the IPv6 routing protocol, which is starting to show growth in usage.

"Last year IPv6 didn't register in scale, but now it's emerging as a concern on the security side," says Malan. "Attackers are going to try it or use it as a transport mechanism for botnets. IPv6 has become a problem on the operational side."

The Arbor survey doesn't tally how many distributed DoS attacks were reported by the surveyed ISPs, or where the attacks originated.

The number of survey respondents, most of them senior network security architects or operations engineers, dropped slightly from 70 last year to 66 for this year's survey, but the geographic diversity of the ISPs represented was wider, according to Arbor. Half of this year's respondents described their ISPs as Tier 1 or Tier 2 organizations (the largest of ISPs), while the remainder were described as content, hosting or academic networks. Government, wireless and voice IPS, as well as some regional network providers and Internet exchange point operators, also were included.

Read More»»

PDF Malware Hits Acrobat Reader Flaw

PC Tools is reporting an increase in PDF-based malware, some of which can evade antivirus software.

According to a PC Tools blog posting, the security vendor's user community is seeing a slew of rigged PDF files attacking various buffer overflow vulnerabilities in the Adobe Acrobat Reader software. The PDF malware attacks target the newest publicly known Adobe Acrobat Reader vulnerability. Adobe issued a patch last week.

On some occasions users are duped into downloading malicious files that appear to be Microsoft software updates. More often, users appear to be downloading silent malicious installers.

Worryingly, two of the downloaded, packed files behave in a way that evades antivirus file scanning.

The PC Tools blog posting says: "A chunk of the standard download and execute shellcode that we are currently seeing pulls a file from hxxp://ascoprguide. net/lel / load.php?xpl=pdf, renames it as c:\\U.exe, and runs it on the victim's system. This "U.exe" then runs and installs other adware and spyware related components."

Read More»»

Thousands Hit in Broad Web Hack

Hackers have launched a massive Web hacking campaign, putting malicious links on as many as 10,000 servers, security vendor Kaspersky Lab warned Friday.

"We're estimating that in the last two days alone, between 2,000 and 10,000 servers, mainly Western European and American ones, have been hacked," Kaspersky wrote on its Web site Friday, "It's not yet clear who's doing this."

The attackers are most likely using compromised accounts on the Web sites or launching what's known as a SQL injection attack, where hackers trick the Web site's software into inadvertently running malicious commands.

The criminals add a line of JavaScript code onto the hacked sites that redirects victims to one of six servers. These sites, in turn, redirect the visitor to a server in China. That server can launch a variety of attacks, targeting known flaws in Firefox, Internet Explorer, Adobe's Flash Player and ActiveX, Kaspersky said.

If the victim's computer hasn't been patched, the attack code could install a variety of spyware and Trojan horse software, including one program designed to steal World of Warcraft passwords.

These Web attacks have become fairly common this past year, according to Roger Thompson, chief research officer with AVG Technologies. "These guys are pretty busy," he said via instant message. "We see them a lot."

Judging from their techniques and from his previous research, Thompson believes the attackers are college students based in China and that they may be the same group that notoriously hacked the Web sites of the Miami Dolphins and Dolphin Stadium ahead of the 2007 Super Bowl football championship.

Earlier this year, a similar attack compromised more than 1.5 million Web pages, Kaspersky said. "Things are still developing, and the similar nature of the malicious programs used in both attacks lead us to think that this new wave of attacks is potentially pretty serious."

Read More»»

Update: Hackers launch PDF attacks, exploit just-patched Reader bug

Antivirus defenses worthless, says researcher; users urged to patch ASAP
Attackers are exploiting one of the vulnerabilities in Adobe Reader that was patched earlier this week, security researchers warned today.

Adobe confirmed the attacks, and urged users to update the software to version 9 immediately, or if that's not possible, to deploy the patched version of Reader 8.

According to Bojan Zdrnja, an analyst at the SANS Institute's Internet Storm Center (ISC), malicious PDF (Portable Document Format) files are circulating that infect systems by exploiting one of the eight bugs Adobe Systems Inc. patched Tuesday.

"This is not surprising, though, as a fully working [proof-of-concept] has been recently published," said Zdrnja in an alert posted to the ISC site early Friday. "But it's interesting to see that the attackers modified the proof-of-concept little bit, probably in order to evade anti-virus detection."

Shortly before Adobe patched the older Reader 8.1.2, Core Security Technologies, a security company that had reported the bug to Adobe in May, published sample attack code as part of its own advisory about the danger posed by rogue PDF files.

The malicious PDFs examined by Zdrnja contained a variation of the Core Security code. "Parts of the publicly-posted proof-of-concept are visible, but the attackers also modified certain parts," he said. "This was probably enough to fool the [anti-virus] vendors."

In fact, that was the result, Zdrnja argued. As of 11 a.m. EST, no anti-virus company had yet released a detection signature that could finger the malformed PDF files.

Kevin Haley, a director of security response at Symantec Corp., seconded Zdrnja's findings a little later on Friday. "We've seen this out in the wild as well," said Haley, "although it doesn't seem to be widespread at the moment." Haley added that Symantec had issued anti-virus signatures to its customers since Zdrnja posted his alert.

A second attack PDF, published to the milw0rm.com site on Wednesday, is slightly more visible to anti-virus vendors. The proof-of-concept PDF is currently identified by about 14% of anti-virus vendors, according to VirusTotal, a free scanning and reporting service.

"If you haven't patched your Adobe Reader installations, do it ASAP as the attacks are in the wild," Zdrnja urged.

Adobe echoed that. "We strongly recommend users update to Adobe Reader 9, which is not vulnerable to this issue," the company said in an e-mail Friday. "Users of Acrobat 8 and Adobe Reader 8 who can't update to Adobe Reader 9 should install the 8.1.3 update to protect themselves."

The nimbleness demonstrated by the attacks is not new. "It's not unusual at all," Haley said, talking about the short span between Adobe's patching and exploits executing. And the fact that Core Security published proof-of-concept attack code certainly played a part, he added. "Once the code is out there, anyone can pick it up, modify it and use it," said Haley.

Read More»»

Once Thought Safe, WPA Wi-Fi Encryption Is Cracked

Security researchers say they've developed a way to partially crack the Wi-Fi Protected Access (WPA) encryption standard used to protect data on many wireless networks.

The attack, described as the first practical attack on WPA, will be discussed at the PacSec conference in Tokyo next week. There, researcher Erik Tews will show how he was able to crack WPA encryption, in order to read data being sent from a router to a laptop computer. The attack could also be used to send bogus information to a client connected to the router.

To do this, Tews and his co-researcher Martin Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively short amount of time: 12 to 15 minutes, according to Dragos Ruiu, the PacSec conference's organizer.

They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack

Security experts had known that TKIP could be cracked using what's known as a dictionary attack. Using massive computational resources, the attacker essentially cracks the encryption by making an extremely large number of educated guesses as to what key is being used to secure the wireless data.

The work of Tews and Beck does not involve a dictionary attack, however.

To pull off their trick, the researchers first discovered a way to trick a WPA router into sending them large amounts of data. This makes cracking the key easier, but this technique is also combined with a "mathematical breakthrough," that lets them crack WPA much more quickly than any previous attempt, Ruiu said.

Tews is planning to publish the cryptographic work in an academic journal in the coming months, Ruiu said. Some of the code used in the attack was quietly added to Beck's Aircrack-ng Wi-Fi encryption hacking tool two weeks ago, he added.

WPA is widely used on today's Wi-Fi networks and is considered a better alternative to the original WEP (Wired Equivalent Privacy) standard, which was developed in the late 1990s. Soon after the development of WEP, however, hackers found a way to break its encryption and it is now considered insecure by most security professionals. Store chain T.J. Maxx was in the process of upgrading from WEP to WPA encryption when it experienced one of the most widely publicized data breaches in U.S. history, in which hundreds of millions of credit card numbers were stolen over a two-year period.

A new wireless standard known as WPA2 is considered safe from the attack developed by Tews and Beck, but many WPA2 routers also support WPA.

"Everybody has been saying, 'Go to WPA because WEP is broken,'" Ruiu said. "This is a break in WPA."

If WPA is significantly compromised, it would be a big blow for enterprise customers who have been increasingly adopting it, said Sri Sundaralingam, vice president of product management with wireless network security vendor AirTight Networks. Although customers can adopt Wi-Fi technology such as WPA2 or virtual private network software that will protect them from this attack, there are still may devices that connect to the network using WPA, or even the thoroughly cracked WEP standard, he said.

Ruiu expects a lot more WPA research to follow this work. "Its just the starting point," he said. "Erik and Martin have just opened the box on a whole new hacker playground." - pcworld.com

Read More»»

Cyber Security As Worrisome As Drunk Driving To Moms

Nearly two-thirds (62%) of mothers surveyed were just as concerned about cyber dangers as they were about drunk driving or drug experimentation. While 44 percent worry about their children's online safety, almost a quarter worry about that more than what they might be doing outside the house.

They have good reason to worry. While 72 percent of mothers had a verbal agreement with their teens about what is allowed online, nearly half (48 percent) admitted not knowing all the time what goes on. Kids take advantage of that, McAfee says, and many are "spinning a web of evasive operations to avoid their parents' supervision.

Almost two-thirds (63%) of teens said they know how to hide what they do online from their parents; 43 percent have closed or minimized the browser when they heard their parents coming. Nearly a third (32%) have cleared their browser history, 16 percent have created secret email accounts or social networking profiles, and 11 percent have figured out how to unlock or disable parental or filtering controls.

Even after all the media coverage of the dangers teens face online, 52 percent admitted to giving out personal information online to someone they didn't know, and 24 percent have given personal photos and/or physical descriptions of themselves. Teen girls are twice as likely to do so than boys (34% compared to 15%).

Giving out too much personal information is the primary worry of 58 percent of mothers, while 44 percent worry about what their teens do when using the internet in their rooms alone, and 24 percent worry about their internet use when parents are out of the house.

"As a father of three I certainly worry about what my kids may do and encounter online," said Dave DeWalt, McAfee president and chief executive officer. "While progress has been made over the past decade to combat online dangers, they remain very real for our kids."

Some mothers have taken to covert actions to monitor their children. About a quarter (26%) have befriended their child on a social network, and 59 percent have checked their kid's browser history after they've finished using the Internet. Only 15 percent are using monitoring software.

Many of the teens surveyed (24%) said they'd be shocked to find out their parents were spying on them, one in five would be hurt to find that out, and 34 percent said they'd be offended by it.

To bolster online safety and help educate parents, McAfee has appointed Chicago mom Tracy Mooney as its first Chief Cyber Security Mom.

"There are times I've felt overwhelmed trying to keep up with all the new things my kids are doing online," said Mooney. "There's a lot of information out there, parents just need to know where to go to find it. Kids will always want to break the rules and stretch boundaries and you have to give them their space and privacy. What works for me is acting before it happens and teaching them how to behave responsibly and safely online, as you would teach them to behave in the real world." Jason Lee Miller

Read More»»