bitdefender

It always amazes me when I find people that claim an operating system is impervious to malware.  Malware is everywhere and can even infect our routers and modems.  I have always used ClamAV when running Linux but now there is another alternative out there via BitDefender.

TuxRadar has a review of BitDefender for Linux and when all is said and done they give it a 10/10.  The product is free for home users but not for companies.  This sounds like an excellent pricing plan to me but unsurprisingly there are still a few Linux geeks freaking out because a company wants to make money.

One thing that I really like with BitDefender getting into the game is that they might be able to get updates out to clients quicker than ClamAV.  In the past I have seen some pretty delayed definition updates to ClamAV and in today’s computing world that can put your computer at risk.

Check It Out> TuxRadar

It is very common to run across malware distribution sites on the Internet but usually they are designed in such a manner that it is easy to know they are malicious.  One site in particular looks impressive and extremely legitimate but is infecting OSX computers with the OSX/RSPlug-F trojan.

Malware targeting Apple computers is on the rise and this one is going to draw in a lot of suckers.  It’s too bad that average Mac users think their computers are impervious to malware and don’t run an anti-virus.

Check It Out> Sophos Blog

Viruses and Spyware are just one of those things that is accepted in today’s computing world.  We frequently encounter friends with infected computers or even work for a living cleaning other peoples machines.  One thing is for sure, there is a never ending abundance of infected computers around the world.  There is one place that most of us do NOT expect to encounter malware, our routers and broadband modems.

Dronebl uncovered a botnet worm this last week called “psyb0t” that is spreading across the Internet that infects DSL modems and routers.  This is outright scary when you think about it.  Even your custom DD-WRT firmware is susceptible to this.

Most routers and modems use a very trim version of Linux and as such can be manipulated just like a desktop version of it.  The OS has fewer ways to be exploited due to it’s minimal nature but is a prime candidate for exploitation.  It is always connected to the Internet and can operate out of the owners view.  Any problems will be attributed to the computer connected to it and not the infected device.

PsybOt:

• is the first botnet worm to target routers and DSL modems
• contains shellcode for many mipsel devices
• is not targeting PCs or servers
• uses multiple strategies for exploitation, including bruteforce username and password combinations
• harvests usernames and passwords through deep packet inspection
• can scan for exploitable phpMyAdmin and MySQL servers

The thing that makes this so dangerous is that 99% of the home users out there would never suspect anything is wrong and just allow the device to continue to operate in it’s infected status.  Uninformed technicians will just believe the device has malfunctioned and just reboot it.  The chances of this type of malware flying under the radar is very good and is likely to be the “infection of the future”.

The size of the botnet is almost impossible to determine at this time but is suspected to be around 100,000.   As new as this infection is I personally expect this type of malware to spread rapidly in popularity amongst malware writers.  It virtually eliminates the need to worry about the device becoming disinfected.

How do I know if my device is infected?

During the infection process it blocks the telnet, sshd and web ports.  So in theory you would just need to try to access the device and if you can’t, it might be infected.  Resetting the device should result in the network being functional but the device inaccessible.

In my personal opinion if you can’t access the device but it appears functional I would hard reset it and then if you can access the device, re-flash it with updated firmware from the manufactures website.   Make sure that when you are setting up these devices you set a password/username that is unlikely to be bruteforced or easily guessed.

UPDATE:: @shanecorning pointed out on twitter that if you are patching this on a Linux machine make sure you are using a standard user account.

Check It Out> Dronebl

diebold-atm-pc

ATM’s are pretty awesome devices that virtually everyone uses no matter what country you are in.  They are convenient and typically located at every bank, mall and gas station.  Most average consumers never even begin to think about the possibility that they are not secure.  Usually they are concerned with someone seeing their pin number being entered or any personal information on the screen.  Very rarely do they ever think that the ATM is actually a computer and could be infected with malware.

That may start to change now that a very serious trojan has been detected which has infected some Diebold ATM’s.  Unearthed yesterday by Sophos when they heard a rumor from someone who works at a bank that there might be a trojan infecting them.  Typically this is disregarded as just another urban legend to try and scare people to be more careful but Vanja Svajcer at Sophos decided to take a closer look.  What he found is what most people did not expect, the rumor was true.

Typically ATM’s are running non-standard operating systems which makes it difficult to create a trojan for them or even find a way to get the machine infected. This was a very well made trojan designed to evade detection and steal money undetected.  It is not known for sure if the trojan has actually infected any ATM’s but it is designed for Diebold machines and someone on the inside was probably involved.  ATM’s do not have USB ports on the front of them for obvious reasons so there had to be another method of delivery.

Sergei at Threat Expert was able to do an in depth analysis of the trojan to see how it attaches itself to the machine and partially how a user could interact with.  Things such as printing receipts of captured card numbers and PIN’s is only part of it.  They potentially even have the capability to see how much money is in the machine.

If you use an ATM the bad guys will steal all of your money.  Well at least that’s what will soon be flashing all over the nightly news for a few days.  The reality of this discovery is that malware writers are targeting ATM’s but this is not the first time.  It is just the newest method to come around and surely won’t be the last.

Check It Out> Sophos, ThreatExpert, ZDNet

Most readers of this site will know what Twitter is and probably use it on a regular basis but for those that don’t, it is a micro-blogging site where the articles are 140 characters or less.  It’s popularity is gaining rapidly due to how quickly content spreads and how easy it is to use.

More and more companies are now using Twitter, some of which are good at it and others need some work.  One of the best groups of companies on Twitter to follow are Security and Anti-Malware companies.  When there is an outbreak they can help you to stay informed and get you the information to either stay uninfected or for how to clean the newest malware out there.

I have compiled this list after quite a bit of research and while I am sure I have found the bulk of AV/AS companies on Twitter I would appreciate others adding to it as well.  If you know of any that are missing from this list please leave their usernames in the coments section or send me a message @pfoty.

@AdAware – New account with only a Hello World post but expected to be very active soon.
@Atribune –  Has not been used  in 6+ months
@AviraAntivir –  Mostly software update information
@avgsecurity
@officialAVGnews – Almost all marketing information
@bitdefender – Very active and has excellent information
@CASecurity – Lightly used and mostly just CA related updates
@CiscoSecurity – Not just information about Cisco , includes a lot of security information.
@clamav – Only sends out updated deffinition information. Does not follow back.
@comodogroup
@DriveSentry – New account but off to a very good and active start
@Fortinet
@kaspersky – Relatively active account with lots of good information
@lavasoft – Marketing information and rarely used
@Malwarebytes – Protected and un-used but might be used in the future
@McAfeeAvertLabs – Active account deffinetly worth following
@McAfeeNews – McAfee related news updates
@Panda_Security – Very active account and has been around longer than most of the others
@PandaSecurityZA – South Africa branch of Panda but different content and less active
@PandaTechSup
@PCToolsDoctor – Not currently very active
@PCToolsSupport
@ScanSafe
@SophosLabs
@SPAMfighter – Extremely active account and is not exclusively about Spam
@SpybotSD
@Sunbelt_Support
@sunbeltsoftware
@symantecnews
@threatpost – Kaspersky site  feed
@TrendMicro – Relatively active account with good information
@webroot
@websenselabs
@WinPatrol

Many companies such as Symantec and Sunbelt have a lot of employees on Twitter that are very active but as of yet do not have the most active of corporate Twitter accounts.  I spoke with some employees of the companies on this list and most of them indicated that their companies Twitter accounts were going to be very active in the next couple of months but were waiting for resources to be dedicated to it.  This is good news especially when it comes to accounts like Lavasoft where the accounts are brand new with little to no content yet.

I have tried to limit this list just to actual security AV/AS companies but I will be adding another list this week of excellent people to follow in the malware industry.  Many of these people such as  @MalwareCity are websites dedicated to malware information and really offer a wealth of information for those seeking it.

As always if you would like to follow me on Twitter you can do so by going to @pfoty.  Following a lot of people on Twitter can be difficult but as someone who follows 700+ people I think the best way is with a program like Twirl.  It installs to your computer and makes it more like an instant messenger client rather than just a website.

UPDATE:: I have added Drive Sentry, ThreatExpert and PCToolsSupport to the list.  As people send me others I will continue to add them to the list so make sure you check back and get the updates.