Panda Worm Author's Fix Fails

The accused mastermind behind the Panda Burning Incense worm has not done a very good job of making amends, according to security vendor Symantec Corp.

Li Jun, a 25 year-old man from Wuhan, in central China, was arrested last month for allegedly selling copies of Panda. He is the first man to be arrested in China for virus-writing, according to China's Xinhua state news agency.

In an effort to make an example of Li, state police said they made Li write software that would remove the worm, but after analyzing the software, Symantec says this program fails to undo many of the file and registry changes made by Panda. Worse, it is completely ineffective against some variants of the malware.

"This removal tool is not effective against most of the samples we have tested against and isn't fully effective against any of them," wrote Symantec researcher Hon Lau, in a Wednesday blog posting. "For Li, perhaps he may have learned the hard way that... it is much easier to write a program to cause destruction than it is to repair the damage."

Panda, which is also known as Fujacks and Radoppan.T was written in October 2006 and has since spread widely within China. According to Xinhua, Li made 100,000 renminbi (US$12,876) by selling copies of the worm to criminals who then distributed it. Li was one of eight men arrested in connection with the affair.

Li's uninstaller tool comes with an apology from the worm-writer himself, claiming that the program was written for research purposes, Symantec's Hon said. "He ends with a warning to beware of future threats (from others), and to take the necessary precautions," he wrote.

source : www.pcworld.com

Virus Disguised as IE 7 Download

If you receive an e-mail offering a download of Internet Explorer 7 Beta 2, delete it. A new virus is making the rounds that comes disguised as a test version of Microsoft Corp. current Web browser.

Security experts reported no widespread damage Friday morning, but they said the virus is notable for a couple of reasons. The e-mail includes a convincing graphic that looks like it could really be from Microsoft, and the virus is delivered when recipients click on a link rather than in an attachment, which makes it harder to stop it from reaching in-boxes.

"The idea of sending a link seems to be a trend among attackers; it's still fairly new and it works much better than sending a file," said Mikko Hypponen, chief research officer at F-Secure Corp.

The e-mails carry the subject line "Internet Explorer 7 Downloads" and appear to come from admin@microsoft.com. They include a blue, Microsoft-style graphic offering a download of IE 7 beta 2. Clicking the graphic will download an executable file called IE 7.exe.

The file is actually a new virus called Virus.Win32.Grum.A, and security experts were still analyzing it Friday to see what it does. Sophos PLC said it can spread by e-mailing itself to contacts in a user's address book. The virus tampers with registry files to ensure it gets installed, and it tries to download additional files from the Internet, said Graham Cluley, a senior technology consultant for Sophos.

Other specifics were unknown yet, but such viruses often install a keystroke logger to steal personal information, and establish a network of infected computers to launch a denial of service attack, Cluley said.

"We don't know anything yet about where it is coming from," Hypponen said. "It's fairly well made and hard to analyze with normal tools."

F-Secure had received many reports of the e-mail but few submissions of the virus itself, indicating that damage so far is limited. Cluely agreed: "I wouldn't classify this as one of the biggest viruses of the year, but that doesn't mean it isn't a threat" he said.

Detection of Win32.Grum by antivirus programs was "mediocre" on Thursday evening, according to Sunbelt Software Inc., and some big vendors were still not picking it up Friday morning, Hypponen said.

F-Secure and Sophos are blocking the virus and all major vendors are likely to do so soon, he said. Some e-mail filtering systems were also not blocking the virus on Friday morning.

The virus is being hosted on several servers around the world, which will increase the time it takes to identify and clean them all. They appear to be Web servers that have been hacked, Hypponen said. The SANS Internet Storm Center asked administrators to check their logs to make sure they are not hosting the file.

The virus affects only Windows users. "Microsoft is aware of this issue and is currently investigating this matter, including customer impact," a spokeswoman said via e-mail.

The final version of IE 7 was released last October, so Microsoft is unlikely to be advertising a beta of the product. Users can download a real version of the software at Microsoft's Internet Explorer home page.

source : www.pcworld.com

Bill Clinton Backs Electronic Health Records

Former U.S. President Bill Clinton on Thursday advocated an electronic medical records (EMR) law and said blogs could aid the U.S. political process.

Clinton appeared along with former President George H.W. Bush, a frequent partner on the lecture circuit, in a joint keynote address to the CTIA Wireless trade show in Orlando. Both men praised the wireless industry for generating economic growth and bringing the world closer together. Bush, 82, described himself as a Research In Motion Ltd. BlackBerry addict.

Saying he was doomed to be the straight man for Bush, whom he unseated in the 1992 election, Clinton gave more serious commentary on information technology, which he said has the power to improve the lives of disadvantaged people around the world and in the U.S.

Electronic medical records could cut US$100 billion of administrative costs of the U.S. health-care system, on which Americans spend $800 billion per year, Clinton said, referring to a McKinsey & Co. study. An EMR bill backed in the U.S. Senate by his wife, Senator Hillary Clinton of New York, and former Republican Senate leader Bill Frist failed despite three years of bipartisan effort, Clinton said.

"That's the number-one thing that can be done right now to make the American health-care system more efficient and cut costs," Clinton said. For one thing, EMR would save the cost of patients recounting their medical history every time they change doctors, which can also introduce errors because they may misremember things, he said.

Wireless technology is aiding in efforts to raise people worldwide out of poverty, one of the causes Clinton has been supporting since leaving office in 2001, he said. For example, in a micro-loan program in Bangladesh, the fastest-growing category of loans are those to women who buy cell phones and sell minutes to people in their villages who call relatives overseas and keep in touch with local markets, Clinton said. The program has raised 58 percent of all borrowers above the international poverty line, he said.

And in Haiti, the poorest country in the Western Hemisphere, the fastest-growing job is selling calling cards on the street, making young people into entrepreneurs and part of the economy, he said.

Blogs can play an important role in the media as the traditional media tries to cover an increasingly complex world with growing competitive pressures and fewer resources, Clinton said.

"Because they don't have to put out a newspaper or even put together a whole evening news show, these blog sites typically deal with one, or at most two, subjects a day, so they can do research and get the facts," Clinton said. "Technology needs to keep pushing this process of the public debate so that there will always be alternative channels."

source : www.pcworld.com

Startup Aims to Keep Network Security Vendors Honest

With the help of one of the world's best-known hackers, a little-known Austin startup hopes to give Internet service providers and enterprises a way to tell if their networking hardware is living up to its promises.

Late next month, BreakingPoint Systems Inc. plans to launch a new network test appliance that sniffs out security holes in devices like load balancers, intrusion prevention systems and routers. Called the BPS-1000, the device also gives users a way to see how their networking equipment performs under a high volume of networking traffic, said Dennis Cox, BreakingPoint's chief technology officer.

Cox and cofounder Craig Cantrell came up with the idea for BreakingPoint two years ago while working at 3Com Corp.'s TippingPoint division, where they realized that they were spending more money on testing equipment than they were on building products. What began as a running joke "every time we had to sign a purchase order for a half-million dollars worth of test equipment," eventually became a business plan, Cox said.

That vision is to build a product that gives customers an accurate picture of how their networking gear will behave in the real world -- before the bad guys have a chance to attack.

Shortly after the company was founded in September 2005, Cox hired HD Moore, maintainer of the popular Metasploit security testing tool. "He was one of the first guys I called up," said Cox. "There is no better person in the U.S. to break things than HD."

Today BreakingPoint has over 30 employees, including three security researchers who work with Moore to help develop BreakingPoint's security testing capabilities. Their job is to "do only evil," Cox joked, a play on Google's "Don't be evil" corporate motto.

While BreakingPoint's appliance does not use any of the Metasploit code, the company is leveraging Moore's expertise as a bug finder to offer customers a service called Strike Pack, which tests to see if about 2,500 attacks -- some of which have not yet been publicly reported -- are blocked on the network.

Over the past two weeks, BreakingPoint has already begun shipping its first few systems to network equipment makers, who are using it to test their own products, but Cox says that his company is also talking to enterprise customers -- particularly in the Internet and financial services markets.

Networking administrators can use the BPS-1000 to get a fix on how well their gear is really performing, something that some networking vendors try to hide with puffed up marketing materials, he said. "We believe that the network equipment manufacturers are selling equipment that isn't meeting its specifications," he said.

Enterprises "have service level agreements with a lot of these companies and they would like to prove that their SLAs are not being met," Cox said. "That would save them money."

BreakingPoint's appliance could be used to evaluate new network applications like VOIP (Voice Over Internet Protocol) systems before they are rolled out, he said.

Pricing for the BPS-1000 has not yet been determined, but it will sell in the US$100,000 to $200,000 range. One-year subscriptions to Strike Pack will cost between $20,000 and $40,000 per year Cox said.

source : www.pcworld.com

Hackers Build Private IM

Hackers have built their own encrypted IM (instant-message) program to shield themselves from law enforcement trying to spy on their communication channels.

The application, called CarderIM, is a sophisticated tool hackers are using to sell information such as credit-card numbers or e-mail addresses, part of an underground economy dealing in financial data, said Andrew Moloney, business director for financial services for RSA, part of EMC Corp., during a presentation at the International e-crime Congress in London on Wednesday.

CarderIM exemplifies the increased effort hackers are making to obscure their activities while continuing to use the Internet as a means to communicate with other criminals. "They're even investing in their own custom tools, their own places to work," Moloney said.

CarderIM's logo is humorous: two overlapping half suns in the same red-and-yellow tones as MasterCard International Inc.'s logo. The name, CarderIM, is a reference to the practice of "carding," or converting stolen credit-card details into cash or goods.

Often, the hackers who obtain credit-card numbers aren't interested in trying to convert the data into cash. But other people are. On the Internet, the two can meet. But the data buyers and sellers are constantly on the lookout for the "rippers" -- security experts or police who are gathering data on them, Moloney said.

It's not known how widely CarderIM is being used, but its distribution appears to be limited, Moloney said. Searches through Google uncover a few passing but incomplete references to the program. It's also not easy to find a copy of it.

"To get ahold of it [CarderIM] you need to be part of one of the trusted groups, which we have agents within," Moloney said.

During his presentation, Moloney showed a screenshot of an advertisement for CarderIM, which addressed the need to "secure the scene." The application supposedly uses encrypted servers that are "offshore" and does not record IM conversations.

Hackers may have needed a more secure IM application, since most of the free ones, such as ICQ, transmit messages in clear text, which can be intercepted, Moloney said.

"They know that we watch and listen," Moloney said.

source : www.pcworld.com

Senators Question Smart Card ID Requirements

enators and privacy advocates on Monday questioned a U.S. government plan to move ahead with smart card drivers license requirements, saying the cost will run into the billions of dollars and the cards could allow the government to track residents.

The Real ID Act, tacked on to a military spending bill in 2005, would require states to save digital copies of source documents such as birth certificates for drivers licenses and it would require states to share information in their drivers license databases. The goal of the new cards, which would include digital photographs and personal information in a machine-readable chip, would be to better ensure that the people carrying the ID cards are who they say they are.

Congress passed the Real ID Act in response to the Sept. 11, 2001, terrorist attacks on the U.S. The 9/11 Commission recommended that the government take steps to better ensure the validity of U.S. IDs. The pilot of the airplane that crashed into the Pentagon held three state drivers licenses, all of them fake, said Robert Barth, assistant secretary for policy development at the U.S. Department of Homeland Security.

"Real ID is fundamental to the security of our nation," Barth told the Senate Subcommittee on Oversight of Government Management.

But Senator George Voinovich, an Ohio Republican, complained that much of the cost for implementing Real ID would be passed on to states. DHS has estimated the cost of implementing Real ID at $14.6 billion over 10 years.

Voinovich also questioned how secure the cards would be. "You're going to be able to guarantee that information is going to remain private?" he asked Barth.

No one can guarantee that any data will be 100 percent secure, Barth answered, but a federal system would be "vastly, vastly" more secure than 50 separate state drivers license systems. "Whenever you have human beings involved ... you can't say there's zero risk," he said.

Voinovich pressed the question, asking if there were technological methods of defeating the proposed ID cards.

"We're going to provide the safeguards and do everything possible to prevent that from happening," Barth said.

Privacy advocates have also questioned the Real IDs, saying the data on the cards would allow the government to track citizens. "The machine readable zone on each Real ID license will provide a digital trail everywhere it is read," said Timothy Sparapani, legislative counsel for the American Civil Liberties Union.

Members of Congress have proposed that the Real ID card be required in order to vote, get a new job, obtain government benefits and travel on airplanes and trains, Sparapani said. "Senators should expect that no person would be able to function in our society without providing a Real ID-compliance license," he said.

In addition, the advocacy group the Center for Democracy and Technology said during a press briefing last week that the legislation doesn't restrict which employees of state drivers license bureaus can access the databases of private information. The Real ID act has no requirement for the security of the shared databases, said Jim Dempsey, CDT's policy director.

"The act doesn't mention the word privacy, and it barely mentions the word security," Dempsey said.

But Senator John Warner, a Virginia Republican, defended the Real ID Act. "We've got to come to the realization that the life before us is not the life behind us," he said. "We are facing some very, very serious threats."

source : www.pcworld.com