Category: Security

More Firefox security vulnerabilities

Secunia’s Vulnerability Report for Mozilla Firefox 1.x shows seven advisories for 2005, making a total of 11 since the browser was officially released last November. Three of the 11 issues (27%) are unpatched, and five are shown as partially fixed.

In the same period of time, Secunia has issued 15 advisories for Internet Explorer 6, five of them in 2005. According to Secunia, 32% of all current IE6 advisories are unpatched.

Interesting reading.

How to fumble a security update

Microsoft’s response to the current flap over “poisoned” Windows Media files is a case study in how not to respond to a security issue. On February 15, Microsoft issued two updates to Windows Media Player 10 – a comprehensive roll-up that changes the version number from 3646 to 3802, and a smaller patch that reportedly adds “additional integrity checks to the DRM [digital rights management] system.” Members of the company’s public relations team then made the rounds of the mainstream PC press announcing that the problem was solved.

No, it wasn’t. Based on my analysis, the current “fix” is inadequate, and many if not most Windows users remain unprotected from an important security flaw.

Continue reading “How to fumble a security update” →

An update on the Windows Media Player security snafu

eWeek’s Ryan Naraine has an excellent update on the “poisoned Windows Media files” controversy that I’ve been covering here for the past few weeks. (See this post for a roundup of the confusion over the WMP10 update; and see “Someone at Microsoft doesn’t get it,” which I posted on January 14, for details on the problem itself and Microsoft’s response.) Ryan writes:

Redmond has hemmed and hawed on its response to the threat and the circumstances of the latest admission isn’t sitting well with security researchers.

When the first red flag was raised in early January, Microsoft made it clear that the use of rigged .wmv files to exploit the DRM (digital rights management) mechanism was not a software flaw.

A week later, the company reversed course and promised new versions of WMP within 30 days. “While this issue is not the result of any exploit of Windows Media DRM, we do recognize it may cause problems for some of our customers,” the company said in a statement. To help mitigate these problems, Microsoft said the software would be tweaked to “allow the end-user more control over when and how any pop-ups display in the license acquisition process.”

I’ve just re-tested some samples of the infected Windows Media files using the latest build of Windows Media Player 10. I can’t see any difference in behavior. Meanwhile, as Ben Edelman has already documented, anyone using Windows Media Player 9 Series is still at risk, and the Windows Media Player 10 update is not listed as a Critical Update. Microsoft now says they will issue a “down-level patch” for Windows Media Player 9 users. No word on when it will be available.

Ben and I are quoted extensively in this story. As I told eWeek, I can’t figure out why no one from Microsoft bothered to call or e-mail Ben, Eric L. Howes, or me, back in January, when all of us had conducted extensive tests and published our findings. I’m also baffled that Microsoft’s Security Response Center hasn’t taken ownership of this problem. As I told eWeek, “If Windows Media Player is going to be a part of the operating system, it has to play by the same rules as the rest of the Windows team.” That means taking reports like this one seriously and making sure the update actually fixes the problem.

A leading maker of spam software goes offline

How do spammers send out millions of messages at a time? One tool is a program called Send-Safe, which is marketed and sold by a company in Russia. Some have speculated, in fact, that the program’s makers are directly or indirectly related to the authors of the Mydoom, Bagle, and Sobig viruses.

Today, F-Secure reports that the company’s flagship Web site has been shut down. The details are interesting reading:

There are some interesting developments going on with the Send-Safe spamming tool. Together with tools like “Mailerboy” and “Darkmailer”, Send-Safe is one of the most popular tools used by spammers to send spam. Send-Safe even includes a built-in support for sending the spam via home machines infected with viruses like Mydoom, Bagle and Sobig.Whois info of send-safe.com

Various antispam organizations and authorities have tried to fight the company behind Send-Safe with little results. The company is run by Mr. Ruslan Ibragimov, operating just outside downtown Moscow.

Especially our friends at Spamhaus have aggressively tried getting the website http://www.send-safe.com shut down. Suprisingly, the site has apparently been hosted by MCI Worldcom – one of the largest service providers in the world.

But now something is finally happening, as the website has disappeared.

The screen shots provide a fascinating window into how this stuff works. If you’re a computer security wonk, the F-Secure News from the Lab blog should be in your list of must-read RSS feeds.

More on Virus Hunter and BitDefender

Recently I reported on iDownload’com’s Virus Hunter, which bears a strong resemblance to the highly regarded BitDefender. (See “iDownload: A case history in unethical marketing” for more details.) I wrote to BitDefender and asked them to explain the relationship. Today, I received this reply from a spokesperson for BitDefender:

iDownload is indeed our partner and we license our technology to them; iDownload licenses further our technology to their customers under the name of Virus Hunter.

The marketing and sales operations are entirely iDownload’s responsibility (including refund policy, pricing etc). We have notified the company about the conditions under which the certifications can be used and hope such situations will be avoided in the future (as you see the respective references have been removed already).

Since I published my story two days ago, iDownload has removed the unauthorized reference to ICSA Labs.

iDownload: Follow the money

Yesterday I published two articles about iDownload.com, a company that makes a product called iSearch, which is installed using deceptive techniques. The company has recently sent cease-and-desist letters to the owners of several Web sites that referred to iSearch as “spyware” or “malware.” It also makes commercial security products, including Virus Hunter, which it sells using questionable techniques.

This morning I read the latest issue of the Windows Secret newsletter, which leads with an article by Brian Livingston that neatly sums up the issues with iDownload. I’ve done some of my own investigations, and the details collectively add up to a picture of exactly how the makers of this type of software get rich by preying on the innocent.

Continue reading “iDownload: Follow the money” →

iDownload: A case history in unethical marketing

Earlier today, I wrote about the efforts of a company called iDownload to suppress apparently accurate descriptions of their product by several anti-spyware activists.

Since that time, I have done more research on the company, and I can report exclusively that they have used the trademark of a widely respected security certification firm without authorization to sell a questionable product. Here are the details.

iDownload sells an assortment of what purport to be security products. If you visit their products page, you can see this logo and descriptive text for Virus Hunter:

Vh_logo

The company claims the product is certified by ICSA Labs. This is a prestigious honor and not lightly awarded. ICSA Labs is a division of CyberTrust, which was formed recently by a merger of TruSecure Corporation and BeTrusted. Its staff and management number some of the world’s foremost authorities on computer security and information technology. To earn ICSA Labs certification, a product must pass a series of stringent tests, and it can be removed if it fails the testing at any time.

When I reviewed the list of certified products at ICSA Labs’ Web site, I did not see any mention of Virus Hunter. So I fired off an e-mail to Larry Bridwell, Content Security Programs Manager for ICSA Labs. I received the following response within three minutes:

VirusHunter is NOT certified by ICSA Labs nor has it ever been submitted for testing.

We have sent a letter by post requesting that the certification claim be removed.

When I looked more closely at the Virus Hunter information pages, I found all the warning signs of an operation that should not be trusted:

  • No contact information for the company.
  • No details of the company’s management or ownership.
  • No privacy policy.
  • Exaggerated claims of security, including references to a nonexistent virus lab.
  • Appeals to fear: “DOWNLOAD NOW Hurry before you lose your system! If you have contracted a nasty virus, your system could be rotting away as you read this.”
  • Phony testimonials, including one claim that “Virus Hunter’s engine was awarded a perfect score…” with no link or even name of the source, only a date.

Vh_testimonial

The citation doesn’t mention the publication’s name, and a review of the leading publication that does tests of this sort, Virus Bulletin, does not turn up any tests of Virus Hunter – in its February 2004 issue or any other time. Interestingly, a legitimate product called BitDefender makes a remarkably similar claim in a press release on its site, dated in February 2004:

Bitdefender Standard was awarded the VB100, the Virus Bulletin certification that the product is able to detect all the viruses which are currently extant in the wild. Once again, BitDefender passed with flying colours, and the test team noticed an improvement in the overall detection rates from previous tests.

Is there a relationship between BitDefender and Virus Hunter? Yes, according to the Technology Integration section of the BitDefender Web site, which lists Virus Hunter as a “reference” on a list that includes legitimate companies like GFI, Laplink Software, and Sunbelt Software. In fact, Virus Hunter is identical to BitDefender Standard except for a few logos. See for yourself:

Vh_screen
Virus Hunter Professional (click for larger image)

Bit_def_std
Bit Defender Standard (click for larger image)

As you can see, they’re identical except for the logo, and the text in the linked “virus warnings” on the Virus Hunter Web site is absolutely identical to listings from the BitDefender encyclopedia, which is why I stated with confidence earlier that there is no “Virus Hunter labs.”

In fact, anyone who buys this version instead of the official BitDefender product is getting ripped off.

  • BitDefender Standard has a free 30–day trial. Virus Hunter doesn’t.
  • BitDefender Standard costs $29.95. Virus Hunter costs $34.95 for the download, and the company charges a mandatory shipping and handling fee of $4.95 for physical delivery of a CD to customers in the Continental United States. That’s a total of $10 more than the original BitDefender product.
  • BitDefender will accept a request for a refund. At the Virus Hunter site, the terms read: “iDownload maintains a strict no-refund policy.”

Vh_terms

Now, why would anyone want to do business with this company?

Oh, one more thing. IDownload sells its software through a secure Web site. I inspected their SSL certificate and was knocked over when I saw who had issued it:

Vh_cert

Yes, ChoicePoint, Inc., the same company that is currently “under fire for being duped into allowing criminals to access its massive database of personal information…” According to an Associated Press story, ChoicePoint has hired a retired Secret Service agent to help revamp its screening process and has “announced plans to rescreen 17,000 business customers to make sure they are legitimate.” I hope they look very closely at iDownload.

Kids’ laptop riddled with spyware!

I was depressed to read this post from a Microsoft blogger who claims to be involved with security: Argh! Kids’ laptop riddled with spyware!

I downloaded the current beta version of MS’ new Anti-SpyWare tool yesterday and installed it on my kids’ laptop. When I ran the scan, I found something like 16 different types of SpyWare installed. The trigger was starting up IE on the machine and being greeted with something called the “Megasearch” tool bar!

I can say that the new Anti-SpyWare tool seems to do a really good job. Of course with SpyWare, you don’t know what you don’t know. There could be another dozen SpyWare packages installed on my system that the tool didn’t detect, but at least I know I got some. Oh well, what are you going to do?…

Jeebus, the last thing I want to hear from someone who works at Microsoft is this sort of defeatist attitude. Especially when they’re involved in security. What are you going to do? Back up the kid’s data. Wipe the hard disk and reinstall Windows and all programs. Set up safeguards to make sure no unwanted programs get installed again. Ban Kazaa and anything lke it. Give the kid a Limited user account.

It works.

Yet another reason to install SP2

In the comments to an earlier post, someone noted a screen shot of an ActiveX dialog box that included the “Always trust content from this company” option. He asked the obvious question: Why isn’t there a “Never trust content…” option?

Short answer: There is. But only if you’re running the latest Windows version.

If you’ve installed Windows XP Service Pack 2, you’ll find that the wording in this dialog box has been changed to specifically refer to installing software rather than the confusing “trust content” wording. Here’s what the new dialog box looks like; note that you first have to click the Information Bar to display this dialog box and then you have to click a More Options button to see these settings:

Never_install

We noted this important change in Windows XP Inside Out, Second Edition and the larger Windows XP Inside Out Deluxe, Second Edition), both of which cover SP2 thoroughly:

In earlier versions of Windows XP, the dialog box used with signed downloads included a check box that allowed you to specify that you always trusted the publisher using that certificate. By selecting this check box, you could automatically install future downloads from your favorite publishers without having to see the Security Warning dialog box every time.

Windows XP SP2 adds the counterpart to that feature—a check box that lets you identify a publisher as untrusted. If you determine that a particular company’s widely distributed ActiveX controls and programs don’t belong on your computer, you can designate that publisher as untrusted, and no user of your computer will be able to install software that uses that publisher’s digital certificate.

If you haven’t installed SP2 yet, this is yet another reason to do so. If you’re holding off because you’ve heard bad things about SP2, please do some more reading starting here. SP2 is quite safe and reliable, and the few known issues are relatively easy to deal with.