Malvertising on ImageShack

Today while conducting research on the alleged Latvian power hack, I came across some interesting malvertising on imageshack, where pictures of the purported hack have been hosted.

Advertising on the page loads a exploitable Java vulnerability that Kaspersky recognizes as Exploit.HTML.CVE.2010-4452.m, which then tries to download Trojan.win32.TDSS.cgir. TDSS as some of you may recognize is a rootkit that can access Windows at its lowest levels and can prove extremely difficult to remove.

Upon opening the page, the advertisement loads, and a connection to http://--removed--ediagroup.com/enc/jv.html is made. This launches the actual exploit. A second page http://--removed--ediagroup.com/load.php?2 is loaded which drops the Trojan containing the TDSS malware.

Kaspersky already detects both the exploit, as well as the Trojan payload. This serves as a reminder of the importance of keeping your Anti-virus up to date.

We will update with further details as they become available.

full nod32 download est nod32 serial

Trojan:W32/Trojan

This program performs a malicious action, either due to deliberate intent or to bugs in its programming. Malicious actions may vary from data tampering to disabling a computer system.

esed nod32 indir nod32 indir com nod32 nod32 keyleri

Trojan:SymbOS/ZeusMitmo.A

When installed on a mobile phone, this trojan monitors all incoming SMS messages and acts as a backdoor for receiving commands sent by an attacker via SMS messages.

indir com nod32 nod32 keyleri nod32 keyler nod32 key

Review of iOS Forensic Analysis Posted

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

ElcomSoft to sell iPhone decryption toolkit

The Russian company says it has a way to decrypt iPhone file system dumps and thus let law enforcement agencies get forensic access to the smartphone.

est nod32 serial 64 bit nod32

Answering Questions on Reading Tips

full nod32 download est nod32 serial 64 bit nod32 esed nod32 4

Rumors: iOS 5 will include new widgets, voice recognition technology (Appolicious)

Appolicious - A week out from its Worldwide Developers Conference, Apple has made a pretty big announcement about what we can expect to see at its summertime event: new software, new software, new software.

indir nod32 indir com nod32 nod32 keyleri nod32 keyler

Malvertising on ImageShack

Today while conducting research on the alleged Latvian power hack, I came across some interesting malvertising on imageshack, where pictures of the purported hack have been hosted.

Advertising on the page loads a exploitable Java vulnerability that Kaspersky recognizes as Exploit.HTML.CVE.2010-4452.m, which then tries to download Trojan.win32.TDSS.cgir. TDSS as some of you may recognize is a rootkit that can access Windows at its lowest levels and can prove extremely difficult to remove.

Upon opening the page, the advertisement loads, and a connection to http://--removed--ediagroup.com/enc/jv.html is made. This launches the actual exploit. A second page http://--removed--ediagroup.com/load.php?2 is loaded which drops the Trojan containing the TDSS malware.

Kaspersky already detects both the exploit, as well as the Trojan payload. This serves as a reminder of the importance of keeping your Anti-virus up to date.

We will update with further details as they become available.

nod32 turkce nod32 full indir nod32 full download full nod32 download

Email-Worm:W32/Email-Worm

This type of worm is embedded in an e-mail attachment, and spreads using the infected computer's e-mailing networks.

nod32 esed nod32

Is Network Solutions Snatching Domain Names?

Numerous individuals have discovered that when they search for a domain name at Network Solutions, the domain register is automatically registering the name for Network Solutions.

esed nod32 key esed nod32 keys est nod32 key esed nod32 serial

#HITB2011AMS - IE Security Flaw Exposes Your Cookies

An Italian security researcher has demonstrated an exploit in Microsoft’s web browser that could allow remote stealing of digital credentials, or cookies, The Register is reporting.

Rosario Valotta demonstrated his “cookiejacking” proof of concept last week at the Hack in the Box security conference in Amsterdam. His hack exposes a flaw in all current versions of Internet Explorer (IE) to steal session cookies that Facebook and other websites issue once a user has entered a valid password and corresponding user name.

The cookie acts as a digital credential that allows the user to access a specific account. This code specifically targets cookies issued by Facebook, Twitter and Google Mail, but Valotta said the technique can be used on virtually any website and affects all versions of Windows. “You can steal any cookie. There is a huge customer base affected (any IE, any Win version).”

indir com nod32 nod32 keyleri nod32 keyler nod32 key

Blade servers and convergence pick up steam (InfoWorld)

InfoWorld - Last week, IDC released the latest version of its Worldwide Quarterly Server Tracker.

nod32 guncel keyler nod32 guncel key güncel key nod32 full nod32

Spam and the death of Osama bin Laden

As we mentioned in a previous blog post, every time there is news of global interest, cybercriminals try to exploit that interest for their own malicious purposes. The death of Osama bin Laden was no exception - it was used in spam as well as black hat SEO.

We have detected two spam mailings capitalizing on the news of Bin Laden’s death, both of which were used to distribute malware.

One included a password-protected ZIP archive. The message subject was: “pictures of osama bin laden dead?”

What is strange about the mailing is that the text was taken from a standard spam message which is supposedly sent by a girl who wants to introduce herself to a man and is asking him to have a look at pictures of her that are attached.

güncel nod32 keyleri nod32 guncel keyler

Symantec to buy Clearwell for $390m

News in brief: Security company to develop its e-discovery software...

(silicon.com - Security)

nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler nod32 guncel key

Osama's death in Twitter

Continuing our investigation on the Osama's death campaign, we were especially concerned about the potential distribution of malware on social networks, because of their speed of propagation. So we have been monitoring Twitter, getting some million tweets and a huge number of URLs too. No surprise here as during the last 24 hours the average was 4.000 tweets per second related to this topic. Here you can see how even Internet traffic was affected.

Analyzing these URLs, we found some interesting stuff.

The first one is a Facebook scam campaign posing as Osama's death video:

nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler

RSA Lays Off Security, Sales Staff

Layoffs are part of an ongoing restructuring across EMC caused by acquisitions that officials estimated in 2006 might ultimately claim 1,250 jobs.

nod32 turkce nod32 full indir nod32 full download full nod32 download

Worm:W32/Downadup.AL

Worm:W32/Conficker.AL is a variant of Worm:W32/Downadup that can spread using three different methods and is capable of hiding its actions on the infected machine, as well as downloading files from remote sites.

esed nod32 keys est nod32 key

Osama?s home videos and The ?Advertising? Botnet

Yesterday the US government released some home videos of Osama Bin Laden in his Pakistani hideout. Screenshots from the video were used for malicious blackhat SEO via Google Images. Many legitimate nginx-based Web sites were attacked and exploited by taking advantage of the CVE-2009-2629 vulnerability. The compromised sites were injected with the following script:

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

More Net giants deal in shady drug ads

Microsoft, Yahoo, and IAC have accepted ads for Web sites that sell pharmaceuticals without requiring a prescription, CNET has learned, a practice that reportedly landed Google in legal trouble.

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

Rumor: Twitter to launch photo-sharing service (Digital Trends)

Digital Trends - Twitter is about to unveil its own photo-sharing service, according to a TechCrunch report. Citing “multiple sources,” the report says the service could be up and running as early as Tuesday.

nod32 guncel key güncel key nod32 full nod32 esed nod32 keyleri

Virus:W32/Concept

A malicious program that secretly integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run.

esed nod32 4 nod32

Rogueware campaign targeting Mac users

Not only Windows users are a target of bad guys that want to distribute rogueware. Now they are also attacking Mac users using the same and old blackhat SEO techniques, poisoning search results in popular search engines.

During our research about Osama Bin Laden's death we saw the same malicious domains serving two rogueware applications specific to Mac OSX, called Best Mac Antivirus and MACDefender.

When doing searches the user can be redirected to some malicious domains, like this for example: ***-antivirus.cz.cc/fast-scan2/

So the malicious pages check for: browser agent (it must be Safari), the IP address (only US domains now) and the referrer (if it is Google or other search engine). After these checks the malicious page will show a fake scan screen:

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

Trojan-Downloader:W32/KDV-176347

This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler

Osama?s home videos and The ?Advertising? Botnet

Yesterday the US government released some home videos of Osama Bin Laden in his Pakistani hideout. Screenshots from the video were used for malicious blackhat SEO via Google Images. Many legitimate nginx-based Web sites were attacked and exploited by taking advantage of the CVE-2009-2629 vulnerability. The compromised sites were injected with the following script:

nod32 serial nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri

Report: Major weapons makers see networks breached by hackers

Hackers break into computer systems of Lockheed Martin and other major U.S. military contractors, potentially gaining access to information about future weapons programs as well as military technology currently in use, according to a report.

64 bit nod32 esed nod32 4

Quiet Tuesday

After last month's mega patch Tuesday this month's can only be described as very quiet. A total of three vulnerabilities are getting patched in two bulletins, MS011-035 and MS011-036.

MS011-035 deals with a remote unauthenticated vulnerability in the WINS service which can lead to code execution running with SYSTEM privileges. This vulnerability affects the Microsoft Server products. Though consistent exploit code seems unlikely it looks rather easy to DoS the service.

MS011-036 deals with two vulnerabilities in Powerpoint. CVE-2011-1269 will likely see consistent exploit code, while Microsoft believes there won't be functioning exploit code for CVE-2011-1270. As pointed out by Kurt Baumgartner here Microsoft is introducing a new exploitability index this month.

indir com nod32 nod32 keyleri nod32 keyler nod32 key

Packed:W32/PeCan.A

This program is packed using a packer program associated with numerous other malware.

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

Monthly Malware Statistics, April 2011

The following statistics were compiled in April using data from computers running Kaspersky Lab products:

• 221,305,841 network attacks blocked;
• 73,211,764 attempted web-borne infections prevented;
• 189,999,451 malicious programs detected and neutralized on users’ computers;
• 86,630,158 heuristic verdicts registered.

DDoS attack on LiveJournal

The DDoS attack that targeted LiveJournal.com at the end of March continued into early April and was big news in Russia. The fact that we had been monitoring one of the botnets responsible for the attack meant we discovered quite a few details about the incident.

Initially, every computer in the botnet received commands to attack one or two links per day. On 4 April, however, the bots received a list of 36 links that included http://livejournal.com and http://livejournal.ru. The other links in the list led to popular pages in the Russian-language blogosphere. The pages in question were unavailable at various times on 30 March, 4 and 6 April. The attacks stopped after 6 April.

The botnet we monitored was based on the popular Optima bot which appeared for sale at the end of 2010. Several indicators suggest that the zombie network behind the DDoS attacks brought together tens of thousands of machines infected with Optima. Apart from DDoS attacks, the bot’s functionality includes downloading other executable files to infected computers and stealing passwords for a number of popular programs.

nod32 full indir nod32 full download full nod32 download est nod32 serial

Virus:W32/Duts.1520

A malicious program that secretly integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run.

esed nod32 key esed nod32 keys

Malvertising on ImageShack

Today while conducting research on the alleged Latvian power hack, I came across some interesting malvertising on imageshack, where pictures of the purported hack have been hosted.

Advertising on the page loads a exploitable Java vulnerability that Kaspersky recognizes as Exploit.HTML.CVE.2010-4452.m, which then tries to download Trojan.win32.TDSS.cgir. TDSS as some of you may recognize is a rootkit that can access Windows at its lowest levels and can prove extremely difficult to remove.

Upon opening the page, the advertisement loads, and a connection to http://--removed--ediagroup.com/enc/jv.html is made. This launches the actual exploit. A second page http://--removed--ediagroup.com/load.php?2 is loaded which drops the Trojan containing the TDSS malware.

Kaspersky already detects both the exploit, as well as the Trojan payload. This serves as a reminder of the importance of keeping your Anti-virus up to date.

We will update with further details as they become available.

güncel key nod32 full nod32 esed nod32 keyleri esed nod32 key

Green Your Tech: 5 excellent eco apps for your iPad or iPhone (Yahoo! News)

Yahoo! News - Apps that bring tree huggers and iPhone and iPad lovers together for the greater green are few and far between. While they might be in relatively short supply at the moment, there are a handful of green apps out there ?

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

Exploit:W32/MSWord6.Gen

The identifies a Microsoft Word document that has been modified to perform an unauthorized, malicious action.

nod32 keyleri nod32 keyler nod32 key esed nod32 download

APT Drives Up Bomber Cost

full nod32 esed nod32 keyleri

Exploit:W32/MSWord6.Gen

The identifies a Microsoft Word document that has been modified to perform an unauthorized, malicious action.

nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler nod32 guncel key

Security researcher finds 'cookiejacking' risk in IE

An independent security researcher says the browser is vulnerable to hackers gaining access to a person's cookie files and then logging on to password-protected sites.

nod32 turkce nod32 full indir nod32 full download full nod32 download

French "three strikes" anti-piracy software riddled with flaws

The French "three strikes" policy was put on hold last week after the private company tasked with collecting piracy data, TMG, was hacked and found to be insecure. The hack has allowed the company's data-collecting software to be examined. It turns out that servers weren't the only thing that TMG failed to properly secure; their anti-piracy software is riddled with flaws, too.

TMG's server was running a custom-written administration program coded in Delphi. It had the unusual security feature of not requiring any authentication at all, allowing anyone connecting to port 8500 to send commands to the server. The commands it supports are limited—shutdown or reboot the computer, stop or start a peer-to-peer client, and update the software on the server—but due to their shoddy design these commands are sufficient to allow hackers to do whatever they want. The update command connects to an FTP server, retrieves a file, and then executes it—all without authentication—and rather than connecting to a specific FTP server, it allows the server to be specified when the update command is given.

This allows an attacker to set up their own FTP server, put their malicious program onto the server, and then tell the TMG system to update from the hacker-controlled server. In this way, they can make the TMG server run whatever software they want. If all of TMG's anti-piracy servers are running the same administrative program, then they are all susceptible to being attacked in this same, trivial way.

güncel nod32 keyleri nod32 guncel keyler nod32 guncel key güncel key nod32

Review of Windows Internals, 5th Ed Posted

esed nod32 antivirus nod32 turkce

Rootkit:W32/Zxshell.B

Rootkit:W32/Zxshell.B is dropped by Backdoor:W32/Zxshell.A and basically functions as a protection mechanism for its main payload file.

nod32 full indir nod32 full download full nod32 download est nod32 serial

Time to party! Windows 7 is here!

It's only a few days away. The official launch of Windows 7 is here!

And of course, that means its time to party!!! You may have heard about the Windows 7 House Parties that are being thrown all around the world. Basically thousands of small groups of people are getting together to see what Windows 7 can do.

Personally, I thought we needed to do more. So fellow MVP and friend Charlie Russel and I decided we would throw our own party. But focused on IT pros and not the consumer angle. We plan to have a lot of fun, showing the cool features of Windows 7 for IT pros like BitLocker, AppLocker and DirectAccess. We plan to bring a bunch of laptops and show new shell extensions, Powershell, new multitouch features and basically sit around and enjoy hours of Q&A for those that haven't tried it yet. We are even planning on installing Windows 7 on a guest's Macbook to show how well it does using Bootcamp on Apple hardware and even on small netbooks.

I also wanted to send a message out to the Vancouver IT community to clear up some misconceptions. This is a party hosted by Charlie and myself. This is NOT a Microsoft event. Microsoft was gracious enough to let us use their facility and even sprung for some of the cost for pizza. However, they never planned this out. Nor did the local VanTUG and VanSBS groups.

Our party is an INVITATION ONLY event. Because we are limited in our own budget and constrained in where we could have the party... we only have enough room for 75 people. So we could only allow a certain number of our friends to come. Charlie and I decided the best way to handle this would be to simply invite who we wanted, and then open it to our friends at the local user groups on a first come, first served basis. This is why there is a cap on the registration on the event, and why it booked up so quickly.

I am hearing through the grapeline that there is a LOT of descent in the Vancouver IT community who feel that Microsoft, VanTUG and VanSBS did a poor job organizing this. >LET ME BE CLEAR. This is a personal party that Charlie and I organized. If you were lucky enough to get an invitation and registered, great. But if you didn't, don't take it out on Microsoft, the local usergroups or their leaders. It's not their fault!!!

We are using our own money and time to throw this party. Please be considerate and respect that we couldn't invite all of you. I am happy to see there is so much excitement about Windows 7 and that you wanted to party with us. And I am sorry if you feel it isn't fair that you didn't get invited. Please feel free to share your own Windows 7 experience, and host your own party. We may be the only IT pro party during the Windows 7 launch, but nothing says you can't have your own!

So party on. Welcome to a new world. Welcome to Windows 7!

est nod32 key esed nod32 serial esed nod32 antivirus nod32 turkce

Shades of ID cards haunt new authentication scheme

Coalition announces project to check identity online...

(silicon.com - Public Sector)

esed nod32 antivirus nod32 turkce nod32 full indir nod32 full download

Bejtlich Teaching at USENIX Security in San Francisco 8-9 Aug

64 bit nod32 esed nod32 4

Quiet Tuesday

After last month's mega patch Tuesday this month's can only be described as very quiet. A total of three vulnerabilities are getting patched in two bulletins, MS011-035 and MS011-036.

MS011-035 deals with a remote unauthenticated vulnerability in the WINS service which can lead to code execution running with SYSTEM privileges. This vulnerability affects the Microsoft Server products. Though consistent exploit code seems unlikely it looks rather easy to DoS the service.

MS011-036 deals with two vulnerabilities in Powerpoint. CVE-2011-1269 will likely see consistent exploit code, while Microsoft believes there won't be functioning exploit code for CVE-2011-1270. As pointed out by Kurt Baumgartner here Microsoft is introducing a new exploitability index this month.

güncel nod32 keyleri nod32 guncel keyler nod32 guncel key güncel key nod32

Trackware:W32/Tracking_Cookie

A program or data that can be used by a third party to identify a user or computer. The most commonly used trackware is a Tracking Cookie - a small piece of data that identifies a certain user or a certain computer, with the help of a web browser configured to store cookies. Certain programs are also used as trackware for portable computer systems, as a form of protection against theft.

nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler nod32 guncel key

Tecca TV: TechLife on iPad apps for cats, tweeting Toyotas, an invisible phone and more (Yahoo! News)

Yahoo! News - Welcome everybody to TechLife on Tecca TV, where we give you the top 5 technology-meets-lifestyle news stories in only 5 minutes. We want to bring a little Friday Fun to you every week! If you missed last week's edition, be ?

güncel key nod32 full nod32 esed nod32 keyleri esed nod32 key

TalkTalk launches HomeSafe network-level security

News in brief: New service for home broadband customers...

(silicon.com - Networks)

nod32 key esed nod32 download

British local authority takes Twitter to court in US (AFP)

AFP - An English local authority said on Sunday it had taken US micro-blogging site Twitter to court in California and forced it to release the details of a British user.

esed nod32 keys est nod32 key esed nod32 serial esed nod32 antivirus

Microsoft Uncovers 400K Tainted E-mail Addresses on Rustock Hard Drives

Microsoft investigators have uncovered more than 400,000 e-mail addresses from a single hard drive seized during the Rustock botnet takedown in March, according to court documents. The Rustock gang also had stolen credit card numbers.

Microsoft outlined its investigation into the hard drives belonging to the botnet’s command and control servers in a status report to the United States District Court for the Western District of Washington on May 23. Microsoft researchers had been analyzing and studying the hardware seized by the U.S. Marshalls Service and other law enforcement agencies during the March 17 raid, Network World reported May 24.

The investigators uncovered “additional evidence” that the seized servers had been part of the botnet’s “spam-dissemination,” Microsoft told U.S. District Court Judge James Robart in the filing. The hard drives contained custom software that assembled spam messages and text files containing thousands of email addresses and username/password combinations. Microsoft also found evidence that criminals had used stolen credit card numbers to purchase hosting and e-mail services.

nod32 serial nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri

Coding Tip: Why you should always use well known SIDs over usernames for security groups

So have you ever tried to restrict access to your applications in a way so that you can maintain least privilege?

I do. All the time. And recently it blew up in my face, and I want to share my experience so others can learn from my failure.

Let me show you a faulty line of code:

 if( principal.IsInRole( "Administrators" ) )
 

Seems rather harmless doesn't it? Can you spot the defect? Come on... its sitting right in the subject of this post.

Checking to see if the current user is in the "Administrators" group is a good idea. And using WindowsPrincipal is an appropriate way to do it. But you have to remember that not EVERYONE speaks English. In our particular case, we found a customer installed our product using English, but had a user with a French language pack. Guess what... the above code didn't work for them. Why? Because the local administrators group is actually "Administrateurs".

The fix is rather trivial:

 SecurityIdentifier sid = new SecurityIdentifier( WellKnownSidType.BuiltinAdministratorsSid, null );
 if (principal.IsInRole(sid))
 

By using the well known SID for the Administrators group, we ensure the check regardless of the name or language used.

Lesson learned the hard way for me. We have an entire new class of defect we are auditing for, which we have found in several places in our code. it always fails securely, NOT letting them do anything, but that's not the point. It is still a defect. Other accounts we weren't considering were "Network Service" (its an ugly name on a German target) and "Guest". Just to name a few.

Hope you can learn from my mistake on that one. That's a silly but common error you may or may not be considering in your own code.

indir nod32 indir com nod32 nod32 keyleri nod32 keyler

Facebook profile: No, it doesn?t work!

We are currently investigating a new malicious campaign on Facebook mostly targeting French-speaking users. When visiting infected users’ profiles, you see the following:

Translation: Wow, it really works! Find out who is viewing your profile!

The various links that are used rotate quite fast and lead unwitting victims to a website that explains what they need to do. Here’s what it looks like:

Basically, there are 2 steps.

• The first one is to copy a Javascript code using CTRL+C
• The second is to visit Facebook.com, paste the Javascript in your address bar and press “Enter”.

güncel key nod32 full nod32

Facebook stalker application now localized

It seems I’m not doing anything other than write about malware on Facebook, but here goes again. As you have probably read or seen yourself on Facebook, there are quite a few applications pretending to show you a list of people who have viewed your profile. I think the most common one is the “Stalker Application”.

Today I saw something that I haven’t seen before - the applications have changed tactics and have now been localized, meaning the page and message which is distributed is in different languages. In my case the language is Swedish, since I’m from Sweden, and I presume that the worms are also localized in other languages.

As with the other cases we have seen, the user is tricked into executing a JavaScript in their browser; that script then loads another script from another domain. The bad guys use this setup to make it harder for antivirus companies to block these domains. This particular case is pretty funny - because of a poorly configured web server we managed to get a complete list of all the domains used in this scam, and they have now been sent to our analysts so they can be blacklisted.

indir nod32 indir com nod32 nod32 keyleri nod32 keyler

Malware in the Android Market: here we go again

Yesterday several new pieces of malware were found in the Android Market by AegisLab. The first big outbreak of malicious software in the Android Market happened more than 2 months ago and there are some things in common between these cases:

• First of all, the March and May outbreaks were likely performed by Chinese hacker(s).
• Secondly, there were several pieces of malware in the official market in both cases.

The malware itself is not very interesting. It will send one SMS message to a Chinese number and after that it writes a marker “Y” in order to prevent further SMS sending.

SMS sending routine

All of the malicious applications were published by the same developer named ‘zsone’. The malware was removed by Google from the Android Market immediately after its malicious nature was discovered. But there is some evidence that some of the applications developed by ‘zsone’ and identified as malicious were uploaded to the Android Market a long time ago.

esed nod32 4 nod32 esed nod32 indir nod32

Worm:ACAD/Kenilfe.A

The worm is a malicious AutoCAD program that propagates via removable drives. It also attempts to download Visual Basic Scripts from remote servers, if certain conditions are met.

indir com nod32 nod32 keyleri nod32 keyler nod32 key

Security researcher finds 'cookiejacking' risk in IE

An independent security researcher says the browser is vulnerable to hackers gaining access to a person's cookie files and then logging on to password-protected sites.

nod32 keyleri nod32 keyler

Sony subsidiary So-net reports data breach

Sony's So-net Japanese ISP subsidiary warns customers that e-mail and rewards-points accounts were compromised.

esed nod32 keys est nod32 key esed nod32 serial esed nod32 antivirus

Lab Matters - Travel Tips: Stay Secure on the Road

For business travelers, the use of a laptop to stay connected to access business documents and connect to office resources is an absolute necessity. In this Lab Matters webcast, Kaspersky Lab malware researcher Stefan Tanase provides some general travel tips and advice to assist in protecting you, your laptop and your corporate data while you are on the road.

esed nod32 keys est nod32 key esed nod32 serial esed nod32 antivirus

Google, PayPal tussle over mobile payment secrets (AP)

AP - Google Inc.'s ambitious plan to supplant credit cards with smartphones has thrust the Internet search leader into a legal tussle with online payment pioneer PayPal, which contends Google stole its ideas by hiring away two key executives.

est nod32 serial 64 bit nod32 esed nod32 4 nod32

Exploit:W32/PDF-Payload.Gen

Exploit:W32/PDF-Payload.Gen is a Generic Detection for Portable Document Format (PDF) files that attempt to exploit vulnerabilities in the popular Adobe Acrobat Reader program.

full nod32 esed nod32 keyleri

More fakeAV for MAC. This time it?s massive

When my colleague Fabio wrote about a Rogueware campaign targeting MAC users, I investigated a bit into the origin of these campaigns. It was interesting how different researchers were getting those samples through searching images on Google. However, different searches always arrive at the same result, leading to the question: How many search terms have been poisoned?

That was an interesting question. But the answer came reading another very interesting research from Unmask Parasites. I recommend you read the post, but in essence it explains how thousands of sites have been infected with a very effective schema that allows the criminals to poison image search results. Could it be that this schema was connected to the fakeAV for MAC?

esed nod32 key esed nod32 keys est nod32 key esed nod32 serial

Cookie law won't be enforced in UK for a year

News in brief: British websites have one year to comply with new EU law...

(silicon.com - Security)

esed nod32 download nod32 serialleri esed nod32 indir nod32 serial

Backdoor:W32/Bohu.A

This program installs various files onto the system. Among the components installed are: a backdoor which connects to an external site to optain updates and other settings; and a component that monitors web traffic to various search engines in China and the domains of certain antivirus (AV) vendors.

nod32 full download full nod32 download est nod32 serial 64 bit nod32

Exploit:W32/D-Encrypted.Gen

A program or technique that takes advantage of a vulnerability to remotely access or attack a program, computer or server.

nod32 serial nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri

Trojan-Downloader:W32/KDV-176347

This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

nod32 esed nod32 indir nod32 indir com nod32

Patriot Act renewed despite warnings of 'secret' law

After senators reveal that Justice Department has a secret interpretation of controversial law, speculation turns to whether cell phone location records are being vacuumed up.

güncel nod32 keyleri nod32 guncel keyler nod32 guncel key güncel key nod32

Infosys faces grand jury as visa probe broadens

Indian offshore giant Infosys is facing a federal grand jury probe over the use of B-1 visas by its workers, an inquiry that was touched off by a lawsuit filed by a U.S. employee of the company.

Infosys, which relies heavily on visa holders to deliver outsourcing services to U.S. companies, announced this week a subpoena issued by the U.S. District Court for the Eastern District of Texas "requires us to provide information to the grand jury regarding our sponsorships for, and uses of, B-1 business visas."

The company said it plans to cooperate with the grand jury investigation. Infosys filed notice of the grand jury investigation on Tuesday with the U.S. Securities and Exchange Commission. A B-1 visa is a business visitor visa that is intended for short-term projects, such as attending meetings and conferences.

nod32 keyleri güncel güncel nod32 keyleri

Trojan-Downloader:W32/KDV-176347

This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

nod32 serial nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri

iOS 4 Hardware Encryption Cracked By Forensics Firm

Russian digital forensics toolmaker Elcomsoft said that it's the first forensics company to have successfully cracked the data security scheme of the iPhone 4. What that means is that digital forensic investigators will be able to circumvent, in many cases, the hardware-based encryption introduced by Apple with iOS 4.

Elcomsoft, however, said that its related tool for cracking iPhone 4 encryption, released Monday, will only be made available to law enforcement agencies, intelligence agencies, and professional forensic investigators.

Interestingly, Elcomsoft's announcement parallels the release of new research that details iOS 4 data security protections. Security researchers Jean-Baptiste Bedrune and Jean Sigwald, who work at IT services company Sogeti, last week presented a paper at the Hack In The Box conference in Amsterdam that details security changes to iOS 4, as well as how to crack them.

nod32 serialleri esed nod32 indir nod32 serial nod32 güncel keyleri

#HITB2011AMS - IE Security Flaw Exposes Your Cookies

An Italian security researcher has demonstrated an exploit in Microsoft’s web browser that could allow remote stealing of digital credentials, or cookies, The Register is reporting.

Rosario Valotta demonstrated his “cookiejacking” proof of concept last week at the Hack in the Box security conference in Amsterdam. His hack exposes a flaw in all current versions of Internet Explorer (IE) to steal session cookies that Facebook and other websites issue once a user has entered a valid password and corresponding user name.

The cookie acts as a digital credential that allows the user to access a specific account. This code specifically targets cookies issued by Facebook, Twitter and Google Mail, but Valotta said the technique can be used on virtually any website and affects all versions of Windows. “You can steal any cookie. There is a huge customer base affected (any IE, any Win version).”

indir com nod32 nod32 keyleri nod32 keyler nod32 key

Backdoor:W32/Backdoor

A remote administration utility that bypasses normal security mechanisms to secretly control a program, computer or network.

nod32 esed nod32

More fakeAV for MAC. This time it?s massive

When my colleague Fabio wrote about a Rogueware campaign targeting MAC users, I investigated a bit into the origin of these campaigns. It was interesting how different researchers were getting those samples through searching images on Google. However, different searches always arrive at the same result, leading to the question: How many search terms have been poisoned?

That was an interesting question. But the answer came reading another very interesting research from Unmask Parasites. I recommend you read the post, but in essence it explains how thousands of sites have been infected with a very effective schema that allows the criminals to poison image search results. Could it be that this schema was connected to the fakeAV for MAC?

nod32 full indir nod32 full download full nod32 download est nod32 serial

Is Network Solutions Snatching Domain Names?

Numerous individuals have discovered that when they search for a domain name at Network Solutions, the domain register is automatically registering the name for Network Solutions.

nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler nod32 guncel key

Trojan-Downloader:W32/Kazy-17907

This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

indir nod32 indir com nod32 nod32 keyleri nod32 keyler

Review of Beginning C Posted

nod32 keyleri nod32 keyler

Facebook profile: No, it doesn?t work!

We are currently investigating a new malicious campaign on Facebook mostly targeting French-speaking users. When visiting infected users’ profiles, you see the following:

Translation: Wow, it really works! Find out who is viewing your profile!

The various links that are used rotate quite fast and lead unwitting victims to a website that explains what they need to do. Here’s what it looks like:

Basically, there are 2 steps.

• The first one is to copy a Javascript code using CTRL+C
• The second is to visit Facebook.com, paste the Javascript in your address bar and press “Enter”.

esed nod32 indir nod32 serial nod32 güncel keyleri nod32 keyleri güncel

Worm:W32/Gurong.A

A standalone malicious program which uses computer or network resources to make complete copies of itself. May include code or other malware to damage both the system and the network.

esed nod32 indir nod32 serial nod32 güncel keyleri nod32 keyleri güncel

Review of Web Application Obfuscation Posted

est nod32 key esed nod32 serial esed nod32 antivirus nod32 turkce

An unlikely couple: 64-bit rootkit and rogue AV for MacOS

The Virus Lab recently came across a very interesting sample - a downloader containing two drivers and which downloads fake antivirus programs developed for both PC and Mac platforms. The malicious program is downloaded and installed using the BlackHole Exploit Kit. The latter contains exploits targeting vulnerabilities in JRE (CVE-2010-0886, CVE-2010-4452, CVE-2010-3552) and PDF.

Both drivers are standard rootkits with rich functionality. One of them is a 32-bit and the other a 64-bit driver. The 64-bit driver is signed with a so-called testing digital signature. If Windows - Vista and higher - was booted in ‘TESTSIGNING’ mode, the applications can launch the drivers signed with a testing signature. This is a special trap-door which Microsoft has left for driver developers so they can test their creations. Cybercriminals have also made use of this loophole: they execute the command ‘bcdedit.exe -set TESTSIGNING ON’ which allows them to launch their driver without a legitimate signature.

The following description refers to both rootkits because, apart from the platforms, their functionality is identical. Once the driver is successfully loaded and running on the system, it’s difficult to get rid of it. The rootkit blocks the launch of drivers belonging to anti-rootkit and antivirus products. This is done by using lists of file names for specific drivers and strings for which the rootkit searches the Security section of the DataDirectory array of the image being loaded. If the rootkit detects an “untrusted” driver being loaded, the bytes at the entry point of the image are changed, preventing it from loading correctly.

Fragment of the rootkit containing search strings used to block antivirus drivers

The rootkit protects the “main” application by hooking ZwOpenProcess / ZwOpenThread in SDT (only on 32-bit versions of Windows) and using object manager callbacks to access “trusted” applications. The file system is also monitored by connecting to file system stacks and the registry - by using registry callbacks.

This rootkit is yet more proof (after TDSS) that it’s unnecessary to bypass Patch Guard-а in order to implement rootkit functionality on 64-bit platforms.

The downloader is written in C++ and is itself not protected. Its main task is to install and launch the relevant driver (32- or 64-bit), then download and launch a list of files from URLs. Interestingly, one link leads to Hoax.OSX.Defma.f which we recently wrote about. Most importantly, the rootkit tries to run it…under Windows! It appears that the developers of the latest rogue AV program for MacOS are actively distributing it via intermediaries, who don’t really understand what it is they are supposed to install on users’ computers.

Fragment of the malicious code that downloads and launches the file

Kaspersky Lab products successfully detect and neutralize both Trojan-Downloader.Win32.Necurs.a and Rootkit.Win32.Necurs.a / Rootkit.Win64.Necurs.a.

esed nod32 keyleri esed nod32 key

Trojan:SymbOS/ZeusMitmo.A

When installed on a mobile phone, this trojan monitors all incoming SMS messages and acts as a backdoor for receiving commands sent by an attacker via SMS messages.

nod32 keyler nod32 key esed nod32 download nod32 serialleri

Worm:W32/Downadup.A

Worm:W32/Downadup exploits a vulnerability in the Windows Server service to spread copies of itself across a network. The worm also attempts to download files from a remote server.

esed nod32 keys est nod32 key esed nod32 serial esed nod32 antivirus

Come have Coffee and Code in Vancouver with me and Microsoft tomorrow

So John Bristowe, Developer Evangelist for Microsoft Canada will be hosting a Coffee and Code event in Vancouver tomorrow from 9 to 2 at Wicked Cafe. Come join him and fellow Microsoft peers Rodney Buike and Damir Bersinic as they sit and share their knowledge over a cup of joe.

I will be there too, and will be available if anyone wants to talk about secure coding, threat modeling with the SDL TM or if you want to talk about integrating AuthAnvil strong authentication into your own applications or architectures

I do hope to see some of you there. And if I don't... I will be seeing you at #energizeIT right?

What: Coffee and Code in Vancouver
When: April 8th, 2009 from 9am - 2pm
Where: Wicked Cafe - 861 Hornby Street (Vancouver)

nod32 key esed nod32 download nod32 serialleri esed nod32 indir

Microsoft Exploitability Index Changes

Microsoft is making changes to its exploitability index to help clarify vulnerability issues in its software to its customers, keeping its program far ahead of other major vendors. Still, no system is perfect.

Microsoft's Security Response Center team has a steep uphill climb to conquer the mountain of vulnerability handling in their software that slowly but surely are publicly discovered, exploited and discussed. It is not an enviable task.

In just five days, the team will roll out a couple of changes. One change splits exploitability ratings for their newest product versions from all older releases. The two updates for the upcoming Patch Tuesday will also provide information for the bugs even if they do not provide remote code execution, and instead provide a surface for denial of service attacks.

nod32 guncel key güncel key nod32

Twitter beefs up your control over third-party apps

Twitter will now provide more details on what specific account information a third-party app is requesting, while apps that want to access your direct messages will again need to permission.

nod32 guncel key güncel key nod32 full nod32 esed nod32 keyleri

Botnet management from Peru

Undoubtedly the cybercrime strategy is not just an eastern European matter. These attacks are committed through web applications like Malware Kits or Exploit Packs which look not only to centralize the stolen information, but also look to have a base platform that allows cybercriminals a place for rapid configuration (sometimes known as a Command and Control, or C&C).

Latin America has ceased to be a neglected region for cyber-attacks and has since become a suitable area for the local development of crimeware for managing botnets. This is further evidenced by the discovery of a criminal program, developed in Latin America (possibly from Peru), and called S.A.P.Z (Sistema de Administraci�n de PCs Zombi - Zombie PCs Administration System).

esed nod32 keys est nod32 key esed nod32 serial esed nod32 antivirus

Updated rogue AV installs on Macs without password

Mac malware gets a new name, new Mac interface, and installs without requiring a user admin password.

esed nod32 keys est nod32 key esed nod32 serial esed nod32 antivirus

Is Network Solutions Snatching Domain Names?

Numerous individuals have discovered that when they search for a domain name at Network Solutions, the domain register is automatically registering the name for Network Solutions.

full nod32 esed nod32 keyleri

Phishing at the Top Level

Opinion: ICANN and overbearing governments are gearing up for a major expansion of the attack surface of the DNS.

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

French "three strikes" anti-piracy software riddled with flaws

The French "three strikes" policy was put on hold last week after the private company tasked with collecting piracy data, TMG, was hacked and found to be insecure. The hack has allowed the company's data-collecting software to be examined. It turns out that servers weren't the only thing that TMG failed to properly secure; their anti-piracy software is riddled with flaws, too.

TMG's server was running a custom-written administration program coded in Delphi. It had the unusual security feature of not requiring any authentication at all, allowing anyone connecting to port 8500 to send commands to the server. The commands it supports are limited—shutdown or reboot the computer, stop or start a peer-to-peer client, and update the software on the server—but due to their shoddy design these commands are sufficient to allow hackers to do whatever they want. The update command connects to an FTP server, retrieves a file, and then executes it—all without authentication—and rather than connecting to a specific FTP server, it allows the server to be specified when the update command is given.

This allows an attacker to set up their own FTP server, put their malicious program onto the server, and then tell the TMG system to update from the hacker-controlled server. In this way, they can make the TMG server run whatever software they want. If all of TMG's anti-piracy servers are running the same administrative program, then they are all susceptible to being attacked in this same, trivial way.

nod32 keyler nod32 key esed nod32 download nod32 serialleri

Is Twittering safe?

So Susan has been on my case about Twitter for some time now. In a recent round table we were recording she "beat me up" about it, and tonight on IM we had a good discussion about the REAL vs PERCEIVED risks in Twitter.

Susan's biggest complaint is that security minded individuals shouldn't be blindly recommending the use of Twitter without educating the user on 'safe-twittering'. I would say that same logic exists for setting up web pages, blogs and the use of social networking sites like Facebook.

She stepped that up a bit tonight when she blogged her discomfort in the fact the RSA Conference was recommending Twitter as well.

So in an effort to stop spreading the FUD about Twitter insecurity, I wanted to share some of my thoughts through a quick set of safe twittering rules.

@DanaEpp's 5 Rules of Safer Twittering

• Never share information in a tweet that you wouldn't share with the world. You can never expect to take it back once it's on the Internet. Even though you can delete a tweet, 3rd party clients may still have it archived. If you feel you want to share private thoughts through Twitter, consider using a "Private Account" and limited it to only people you trust and want to share with. Of course, remember nothing prevents your friends from sharing your tweets with the world. So never share private information on Twitter. Ever. it's just easier that way.
  
• There is no assurance that a Twitter account is the person you believe it is. Deal with it. Anyone can register an account if it doesn't already exist. As a real world example, for some time @cnnbrk was NOT an official CNN account, even though most of the Twitter world thought it was. It wasn't until recently that CNN bought the account from James Cox (the account holder) for an undisclosed amount of money. Another example is the fact that one of Susan's Twitter accounts was actually created by a fellow SBS MVP, and not actually her. :-)
  
• Never click on links in a tweet, unless you trust the URL. If unsure, don't click! The worms that were used to attack Twitter came from people getting users to go to profile pages etc that they had control over for some interesting script attacks. With only 140 chars, its common to "shorten" the URL. Which means you might be clicking on a link blind. That's fine. But only trust shortened URLs that can be previewed BEFORE you go to it. As an example, my recommendation is to use something like TinyURL. However, here is the trick. When you create a TinyURL, use the preview mode. As an example, if you want to send someone to my blog you can use http://tinyurl.com/silverstr to go directly. However, if you use http://preview.tinyurl.com/silverstr it will stop at TinyURL.com and let the user SEE the link before they actually get to it. That is much safer. If using TweetDeck, select TinyURL as the provider, and when it creates the shortened url, simply add "preview." in front of "tinyurl.com".
  
• Use a 3rd party Twitter client instead of using the Twitter.com website directly. I am a fan of TweetDeck and Twitterfon, but there are tons of different clients out there. Why? It is the lesser of two security evils as it relates to web based attacks in Twitter. Most clients have ways to reduce or turn off linking, prevents the script attacks in profile viewing and generally is just an easier environment to stay protected in. Are these clients free of attack? Of course not. But its another layer of defense. Of course... you need to have trust in your client. But that's a story for another day ;-)
  
• You never know who is following you. Remember that. As you use Twitter more and more, you never know who might be watching. I recently had someone who has been trying to get an interview with me who follows me on Twitter, knew where I was having coffee one day because of a tweet I wrote (and it's geotag) and ended up coming down to confront me with his resume. Which was inappropriate in my books. But my own fault. I wasn't too concerned.. but it definitely gave me pause when considering my daughter uses Twitter and could be as easily found. Nothing like the potential of being stalked. GeoTagging makes it way to easy to find you. Remember that.
  

Look, Twitter is addictive. Simple. Short. Fast. A great way to see the thoughts of others you might care about. Ultimately though... like any other Internet based technology it has the potential to be abused... and put you at risk. No different than websites or blogs.

So be careful. Follow these rules and enjoy the conversation!

nod32 guncel key güncel key nod32 full nod32 esed nod32 keyleri

6 alternatives to Google Music Beta (Yahoo! News)

Yahoo! News - Google announced the Google Music Beta service during its recent I/O conference. Essentially, Google Music Beta will allow you to upload 20,000 of your songs to a virtual "locker," which you can access anywhere via the web or your Android device. Google ?

full nod32 download est nod32 serial

Review of Beginning C Posted

nod32 full indir nod32 full download full nod32 download est nod32 serial

Time to party! Windows 7 is here!

It's only a few days away. The official launch of Windows 7 is here!

And of course, that means its time to party!!! You may have heard about the Windows 7 House Parties that are being thrown all around the world. Basically thousands of small groups of people are getting together to see what Windows 7 can do.

Personally, I thought we needed to do more. So fellow MVP and friend Charlie Russel and I decided we would throw our own party. But focused on IT pros and not the consumer angle. We plan to have a lot of fun, showing the cool features of Windows 7 for IT pros like BitLocker, AppLocker and DirectAccess. We plan to bring a bunch of laptops and show new shell extensions, Powershell, new multitouch features and basically sit around and enjoy hours of Q&A for those that haven't tried it yet. We are even planning on installing Windows 7 on a guest's Macbook to show how well it does using Bootcamp on Apple hardware and even on small netbooks.

I also wanted to send a message out to the Vancouver IT community to clear up some misconceptions. This is a party hosted by Charlie and myself. This is NOT a Microsoft event. Microsoft was gracious enough to let us use their facility and even sprung for some of the cost for pizza. However, they never planned this out. Nor did the local VanTUG and VanSBS groups.

Our party is an INVITATION ONLY event. Because we are limited in our own budget and constrained in where we could have the party... we only have enough room for 75 people. So we could only allow a certain number of our friends to come. Charlie and I decided the best way to handle this would be to simply invite who we wanted, and then open it to our friends at the local user groups on a first come, first served basis. This is why there is a cap on the registration on the event, and why it booked up so quickly.

I am hearing through the grapeline that there is a LOT of descent in the Vancouver IT community who feel that Microsoft, VanTUG and VanSBS did a poor job organizing this. >LET ME BE CLEAR. This is a personal party that Charlie and I organized. If you were lucky enough to get an invitation and registered, great. But if you didn't, don't take it out on Microsoft, the local usergroups or their leaders. It's not their fault!!!

We are using our own money and time to throw this party. Please be considerate and respect that we couldn't invite all of you. I am happy to see there is so much excitement about Windows 7 and that you wanted to party with us. And I am sorry if you feel it isn't fair that you didn't get invited. Please feel free to share your own Windows 7 experience, and host your own party. We may be the only IT pro party during the Windows 7 launch, but nothing says you can't have your own!

So party on. Welcome to a new world. Welcome to Windows 7!

esed nod32 key esed nod32 keys est nod32 key esed nod32 serial

Bejtlich Teaching at USENIX Security in San Francisco 8-9 Aug

nod32 turkce nod32 full indir nod32 full download full nod32 download

Worm:W32/NetSky.B

A standalone malicious program which uses computer or network resources to make complete copies of itself. May include code or other malware to damage both the system and the network.

nod32 güncel keyleri nod32 keyleri güncel

Trojan-Spy:W32/Zbot.PUA

This type of trojan secretly installs spy programs and/or keylogger programs.

güncel nod32 keyleri nod32 guncel keyler nod32 guncel key güncel key nod32

Trojan-Dropper:W32/Agent.DKIT

A trojan that contains one or more malicious programs, which it will secretly install and execute.

esed nod32 4 nod32 esed nod32 indir nod32

Trojan:W32/AntiAV

Also known as a trojan horse program, this is a deceptive program that performs additional actions without the user's knowledge or permission. It does not replicate.

nod32 guncel keyler nod32 guncel key güncel key nod32 full nod32

Answering Questions on Reading Tips

güncel nod32 keyleri nod32 guncel keyler

RSA Lays Off Security, Sales Staff

Layoffs are part of an ongoing restructuring across EMC caused by acquisitions that officials estimated in 2006 might ultimately claim 1,250 jobs.

64 bit nod32 esed nod32 4 nod32 esed nod32

Peter Cochrane's Blog: Our digital slime trails

These days, leaving a record of our movements is almost inevitable - but does it matter?

(silicon.com - CIO Insights)

indir nod32 indir com nod32 nod32 keyleri nod32 keyler

Review of Hacking Exposed: Web Applications, 3rd Ed

nod32 serial nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri

Worm:W32/NetSky.B

A standalone malicious program which uses computer or network resources to make complete copies of itself. May include code or other malware to damage both the system and the network.

indir nod32 indir com nod32

Adware:W32/Apropos

This program delivers advertising content to the user. It is usually annoying but harmless, unless it is combined with spyware or trackware.

64 bit nod32 esed nod32 4 nod32 esed nod32

Trojan:Java/Rowindal

Also known as a trojan horse program, this is a deceptive program that performs additional actions without the user's knowledge or permission. It does not replicate.

nod32 turkce nod32 full indir nod32 full download full nod32 download

Microsoft: Critical Vista Patch Coming

Microsoft plans to ship two patches on Jan. 8, 2008 to patch code execution vulnerabilities in its newest OS.

nod32 full download full nod32 download est nod32 serial 64 bit nod32

Senator calls for smartphone app privacy policies (AP)

AP - A key member of the Senate Judiciary Committee is challenging Apple Inc. and Google Inc. to require all developers that make apps for their mobile devices to adopt formal privacy policies.

nod32 guncel key güncel key nod32

Review: Disconnecting in a too-connected world (AP)

AP - The knowledge that I'd be cut off from Internet and cellphone service in just a few hours started to relax me long before I reached the secluded, serene site of a two-day yoga retreat in upstate New York.

esed nod32 key esed nod32 keys est nod32 key esed nod32 serial

Virus:W32/Ramnit.N

A program that secretly and maliciously integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run.

nod32 serialleri esed nod32 indir nod32 serial nod32 güncel keyleri

Adware:W32/ClickPotato.A

This program delivers advertising content to the user. It is usually annoying but harmless, unless it is combined with spyware or trackware.

esed nod32 antivirus nod32 turkce

Rogue:W32/WinFixer.gen!A

The file appears to be suspicious, is potentially undesirable, or may be structured in a way or has characteristics that resembles known malware. This may indicate the presence of a malware infection, or that the suspect file is malicious.

nod32 esed nod32 indir nod32 indir com nod32

Apple will patch OS X to kill Mac Defender virus (Digital Trends)

Digital Trends - In the next few days, Apple plans to release a patch to its Mac OS X to kill the “Mac Defender” virus that has been tricking Apple users into giving away their credit card information. News of the patch comes from Apple’s Support site, which now has an entire page dedicated to the malware, which has spread like wildfire across the Mac world.

esed nod32 keys est nod32 key esed nod32 serial esed nod32 antivirus

Shades of ID cards haunt new authentication scheme

Coalition announces project to check identity online...

(silicon.com - Public Sector)

nod32 serialleri esed nod32 indir nod32 serial nod32 güncel keyleri

Worm:W32/NetSky.V

A standalone malicious program which uses computer or network resources to make complete copies of itself. May include code or other malware to damage both the system and the network.

est nod32 key esed nod32 serial

Backdoor:W32/Bohu.A

This program installs various files onto the system. Among the components installed are: a backdoor which connects to an external site to optain updates and other settings; and a component that monitors web traffic to various search engines in China and the domains of certain antivirus (AV) vendors.

indir nod32 indir com nod32 nod32 keyleri nod32 keyler

The role of mobile in LinkedIn, future social media IPOs (Appolicious)

Appolicious - LinkedIn?s recently announced initial public offering, which has valued the company at nearly 17 times its revenue from last year, has spurred interest and skepticism in future public offerings by social media powerhouses such as Facebook, Twitter, Groupon and Zynga.

est nod32 key esed nod32 serial esed nod32 antivirus nod32 turkce

Lab Matters - Password Security: Dos and Don'ts

There are countless firms that sell expensive computer security products and gear. But most experts will tell you that the one step you can take to most improve the security of your home or work computer is to have and follow strict password security. But what makes a password strong (or weak)? And what tricks might hackers, malware authors and cyber criminals play to get you to part with yours? Paul Roberts of Threatpost speaks with David Emm of Kaspersky Lab about proper password hygiene and the steps you need to take to secure access to your critical online and offline accounts.

esed nod32 download nod32 serialleri esed nod32 indir nod32 serial

Other:W32/Generic

Other:W32/Generic is a Generic Detection for a wide range of malicious programs, such as trojans, worms and keyloggers.

nod32 keyleri güncel güncel nod32 keyleri

Worm:W32/Todon.I

Worm:W32/Todon.I is a worm that spreads to new victim machines via infected removable and network drives. The worm also has trojan-downloader capabilities, as it attempts to download additional files from remote servers.

esed nod32 serial esed nod32 antivirus nod32 turkce nod32 full indir

TiVo results jump thanks to legal settlement (Reuters)

Reuters - TiVo Inc , which makes digital video recorders, reported a quarterly profit, reversing a year ago loss, thanks to the blockbuster patent settlement it reached with Dish Network Corp and EchoStar Corp .

est nod32 key esed nod32 serial esed nod32 antivirus nod32 turkce

CIOs getting savvy about outsourcing

IT 2011: Leaner, more flexible, less monogamous?

(silicon.com - CIO Insights)

nod32 güncel keyleri nod32 keyleri güncel güncel nod32 keyleri nod32 guncel keyler

Coding Tip: Why you should always use well known SIDs over usernames for security groups

So have you ever tried to restrict access to your applications in a way so that you can maintain least privilege?

I do. All the time. And recently it blew up in my face, and I want to share my experience so others can learn from my failure.

Let me show you a faulty line of code:

 if( principal.IsInRole( "Administrators" ) )
 

Seems rather harmless doesn't it? Can you spot the defect? Come on... its sitting right in the subject of this post.

Checking to see if the current user is in the "Administrators" group is a good idea. And using WindowsPrincipal is an appropriate way to do it. But you have to remember that not EVERYONE speaks English. In our particular case, we found a customer installed our product using English, but had a user with a French language pack. Guess what... the above code didn't work for them. Why? Because the local administrators group is actually "Administrateurs".

The fix is rather trivial:

 SecurityIdentifier sid = new SecurityIdentifier( WellKnownSidType.BuiltinAdministratorsSid, null );
 if (principal.IsInRole(sid))
 

By using the well known SID for the Administrators group, we ensure the check regardless of the name or language used.

Lesson learned the hard way for me. We have an entire new class of defect we are auditing for, which we have found in several places in our code. it always fails securely, NOT letting them do anything, but that's not the point. It is still a defect. Other accounts we weren't considering were "Network Service" (its an ugly name on a German target) and "Guest". Just to name a few.

Hope you can learn from my mistake on that one. That's a silly but common error you may or may not be considering in your own code.

nod32 esed nod32

Rootkit:W32/Zxshell.B

Rootkit:W32/Zxshell.B is dropped by Backdoor:W32/Zxshell.A and basically functions as a protection mechanism for its main payload file.

esed nod32 antivirus nod32 turkce nod32 full indir nod32 full download

Security strategy: Staff smartphones ring the changes

Employees' own devices at work must cause a security rethink...

(silicon.com - Security)

nod32 serialleri esed nod32 indir nod32 serial nod32 güncel keyleri

Blogger Bob--TSA's Internet mouthpiece (Q&A)

The U.S. government's most prominent and controversial spokesblogger answers questions from CNET about defending the Transportation Security Administration on the Internet.

güncel key nod32 full nod32 esed nod32 keyleri esed nod32 key

How bad is the Mac malware scare? (FAQ)

Windows users are familiar with the fake anti-malware ruse, but this is the first time it's been targeted at the smaller Mac market. CNET tells you what MacDefender is and what it means for Macintosh users.

nod32 esed nod32

Trackware:W32/Tracking_Cookie

A program or data that can be used by a third party to identify a user or computer. The most commonly used trackware is a Tracking Cookie - a small piece of data that identifies a certain user or a certain computer, with the help of a web browser configured to store cookies. Certain programs are also used as trackware for portable computer systems, as a form of protection against theft.

nod32 full download full nod32 download est nod32 serial 64 bit nod32

Monthly Malware Statistics, April 2011

The following statistics were compiled in April using data from computers running Kaspersky Lab products:

• 221,305,841 network attacks blocked;
• 73,211,764 attempted web-borne infections prevented;
• 189,999,451 malicious programs detected and neutralized on users’ computers;
• 86,630,158 heuristic verdicts registered.

DDoS attack on LiveJournal

The DDoS attack that targeted LiveJournal.com at the end of March continued into early April and was big news in Russia. The fact that we had been monitoring one of the botnets responsible for the attack meant we discovered quite a few details about the incident.

Initially, every computer in the botnet received commands to attack one or two links per day. On 4 April, however, the bots received a list of 36 links that included http://livejournal.com and http://livejournal.ru. The other links in the list led to popular pages in the Russian-language blogosphere. The pages in question were unavailable at various times on 30 March, 4 and 6 April. The attacks stopped after 6 April.

The botnet we monitored was based on the popular Optima bot which appeared for sale at the end of 2010. Several indicators suggest that the zombie network behind the DDoS attacks brought together tens of thousands of machines infected with Optima. Apart from DDoS attacks, the bot’s functionality includes downloading other executable files to infected computers and stealing passwords for a number of popular programs.

nod32 keyleri nod32 keyler nod32 key esed nod32 download

Announcing Elevation of Privilege: The Threat Modeling Game

I have had the pleasure over the past few months to spend some time playing with an early rendition of " Elevation of Privilege: The Threat Modeling Game". According to Adam, "Elevation of Privilege is the easiest way to get started threat modeling".  I couldn't agree more. If you have a team that is new to the whole process of threat modeling, you will want to check it out. If you are at RSA this week, drop by the Microsoft booth and pick the game up for free. If you aren't, you can download it here.

EoP is a card game for 3-6 players. The deck contains 74 playing cards in 6 suits: one suit for each of the STRIDE threats (Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service and Elevation of Privilege). Each card has a more specific threat on it.  You can see a short video on how to play and some more information about the game by checking our Adam's post here. In the end, it is a game that makes it possible to have more fun when thinking about threats. And that's a good thing.

Even more impressive is that they have released the game under Creative Commons Attribution license which gives you freedom to share, adapt and remix the game. So you if you feel you can improve up this, step up and let everyone know!!   

Congratulations to the SDL team at Microsoft for creating an innovative way to approach the concept of threat modeling.

full nod32 esed nod32 keyleri esed nod32 key esed nod32 keys

Hack in The Box Security Conference 2011 Amsterdam / NL

Since yesterday I've been attending the annual Hack-in-the-Box Quad-Track Security Conference in Amsterdam/NL. There's a very nice and open atmosphere here at the conference, besides the beautiful city of Amsterdam.

First, Joe Sullivan (CSO at facebook), held a very interesting keynote about the development of security innovations at facebook. For him innovation is „these hacking culture, we think about each day at facebook“. After explaining some of the newer security innovations (https-only, login notifications, login approvals [if e.g. geo-location of a user is suspicious], recognized devices, recent activity) he talked about the recent fb-scams with malicious scripts. „No one would do that, copying and pasting a script into the browser! - Yes, they do...“, he said.

Also a remarkable talk I attended was about binary planting, given by Mitja Kolsek (CTO at ACROS Security). In "Binary Planting: First Overlooked, Then Downplayed, Now Ignored" Mitja also showed a new method he called "advanced binary planting", which uses a feature from Windows' special folders (like control panel, printers, etc.) and clickjacking to make it possible to own the users' computer.

In the winter garden of the conference hotel there's a technology showcase area. Hackerspaces from all over Europe and the Netherlands are showcasing their projects here. There also is a capture-the-flag competition happening, a lock-picking and (sponsor) companies-showcase.

For more informations please see the conference website.

indir com nod32 nod32 keyleri