Our new Indie Games subforum is now open for business in G&T. Go and check it out, you might land a code for a free game. If you're developing an indie game and want to post about it,
follow these directions. If you don't, he'll break your legs! Hahaha! Seriously though.
Our rules have been updated and given
their own forum. Go and look at them! They are nice, and there may be new ones that you didn't know about! Hooray for rules! Hooray for The System! Hooray for Conforming!
[Shields Up] Computer Security Thread
Posts
The 2012 issue of Fornax. | Steam and Origin: Espressosaurus
One thing that's caught my eye, though, is an apparently brutal takedown of the Sophos antivirus suite. This was delivered as a presentation, but there's a Google Documents paper on the topic available here. The conclusion of the article is as follows:
The analysis is pretty biting, accusing Sophos of using doublespeak and obfuscating language to shield their lack of efficient protections. Even their signature based detections come under fire. The meat of the article is a bit too technical for me to digest fully, but it does seem very thorough. I'm hoping we can see additional in-depth analyses in the future, for other antivirus suites. I'd like to see them all broken down in this manner.
You stand at the crossroads to the flow of all information. Your current position is very close to the Penny-Arcade forums, but at the edges of your perception you can sense the dark, chaotic forces of the nether-net. You feel you are being watched from the (Shroud) of darkness that encircles the area. A (Pedestal) rests in the center of the clearing. Exits are (N)orth, (S)outh, (G)ames and Technology, and (P)orn.
>Go P
You can't go that way.
>Examine Pedestal
A small, waist-high column stands before you. Atop its flattened apex, there rests a scroll and an sealed container. The scroll details that the container holds within an upgrade for Adobe's Macromedia Flash. The version contained within is 10.3.183.5 - more recent than what you currently have installed.
>Examine Shroud
Suddenly from the darkness, there spring a pair of wild, malicious programs! They attempt to attack you through a very new Flash vulnerability, grabbing you and trying to drag you toward an unknown URL. You must act quickly, or be taken to whatever destination these ruffians have in mind!
>Go G
There's no time for that now!
>Go P
There's REALLY no time for that!
>Get ye Flash
At the last possible moment, you grasp the pedestal, and acquire the upgrade for your Flash plugin. The malicious programs no longer can grasp you - their grip slips away now that the vulnerability in your Flash is closed. They grumble and snort, slinking back into the darkness to leave you alone once more. They size you up as they retreat - You know they'll return once they locate another vulnerability.
For now, you are safe. You have won the day, brave champion of the internet that you are.
>Go P
The Internet really is an Adventure, isn't it?
The 2012 issue of Fornax. | Steam and Origin: Espressosaurus
:^:
SE Minecraft Fishing ( Wiki | Treasure Hunt )
(I just discovered an event ticket site that requires flash for taking payments but doesn't even use SSL. I decided I wasn't that interested in going after all…)
DropBox invite link - get 250MB extra free.
The problem is that flash is just so old. People have had years and years to learn to it. So now it has to be dragged forward to meet modern security standards.
This is why I prefer silverlight.
I get the impression from the op that I would be better off with windows firewall and microsoft security essentials rather than CA. Is there any reason I should try and make CA work or should I just kick it to the curb?
I quite agree on this point. Load yourself up with MSE and the Windows Firewall (I have mine set to 'Public'), and you should be fine. The CA security suite won't be offering you much more than what you'll be getting with those offerings.
As an additional note, however, I will say that NoScript and Flashblocking options for your browser should also be installed. As well as having MalwareBytes AntiMalware on the side.
Further tightening of security is possible, but with these tools installed you'll have a solid baseline of protection.
The software firewall is for threats that get brought into your network, because someone plugged in a thumb drive with something nasty on it.
The 2012 issue of Fornax. | Steam and Origin: Espressosaurus
It seems like it would take a lot of work to get this to work though. From what I understand you'd have to setup blocking for outgoing requests, as well as specifying what programs can make requests on certain ports. This prevents malware from using any random port to contact home, and it stops it from using common ports like port 80, but it still won't stop it from using a common port (like port 80) if it can trick your software into thinking it's your browser; which seems like it would be very easy to do since your machine is already infected. I am not positive about this though, so I am interested to know if this is how the software firewall would be used, and how hard this would be to setup.
If you have some kind of a LAN behind the hardware firewall, then the software firewall is a fine and dandy thing for the reasons I gave. If you don't, then perhaps it is redundant--assuming you have that router setup properly and there are no holes you aren't aware of. Basically it doesn't really hurt you to just use the default windows firewall; it's there already, most applications talk to it easily, and it's easy to configure.
The 2012 issue of Fornax. | Steam and Origin: Espressosaurus
There's something else, but I'll put down a big disclaimer that the following is just my personal opinion: If you've been infected, firewalls aren't necessarily going to do much for you. The talked-up advantage of a software firewall is that it can prevent malware from calling home once it infests your system, thus preventing data theft and eavesdropping. But if you get infected (and these days, that most likely means getting rooted) then the firewall isn't likely to know what's going on, can be bypassed, or even controlled by the infection (just as you infer above, Jebus). I don't put much stock in the idea that a firewall will keep you safe after an infection, but I do believe it is a necessary tool for preventing inbound intrusion. Software firewalls are also nice for keeping an eye on grayware that isn't out-and-out malware, but might be doing something you don't want. By that I mean programs that phone-home without your consent or knowledge can be blocked from accessing the net.
I'm also thinking I should set him up with sandboxie but I just know that's going to be real pain in the arse explaining the implementation of it to him; is it worth the grief running it for him?
I'll also certainly be setting him up an LUA for his day to day browsing, I'm assuming that dropmyrights would be a good fit for him too? I'd like to implement some form of software restriction policy but I think that might be too much of a hassle
Secret Satan's Wishlist!
I'd definitely say that Microsoft Security Essentials and MalwareBytes are good starts. My personal opinion (others may have more detailed understanding than I) is that Comodo isn't going to be adding much to the mix here. Ditto with BitDefender. With MSE and Windows firewall, you've got those bases covered, and the other options are redundant, though potentially useful in a pinch. Looking toward additional, different layers of security is the best idea, as you've indicated.
A Limited User Account is a great idea. If you set one up, you won't need DropMyRights - DropMyRights is designed to allow Administrative users demote programs. If you're already running limited, you're already safe there in privilege regards.
In terms of Sandboxie and/or a Software Restriction Policy - These are the most solid defenses you could add to a system, in my opinion, because they are preventative, rather than reactive. They do come with the highest usability penalty, though. If your buddy is going to be installing a lot of software, you may be fighting an uphill battle. An SRP will keep things safe, but it will make installation of software a hassle that might be difficult for your friend if he struggles with computers. Sandboxie is very transparent if configured appropriately, in my opinion. You can designate specific locations, like a download folder, where files are to be automatically recovered. It's a bit of a security risk to do so, but it can help people who aren't necessarily good with computers. If your friend will be downloading and installing a lot of software, though, social engineering might be the bigger threat.
In the end, sadly, it's mostly dependent upon what your buddy is going to be comfortable with. I tend to be a bad judge of what people can handle, myself. I set some family members up with a Sandboxie install, and it was only a matter of a week before I was getting upset phone calls claiming that "Sandy-box is making Fox-Fire break my printer!"
I guess the real big point here is to curb his bad browsing habits and general poor PC security. He's learnt from bitter experience that no, in fact he hasn't won a brand new iPod and that a browser based malware scan he didn't initiate did not in fact locate a dangerous virus and need to be installed immediately. I think if I can explain how these kind of things infect your system and be mindful of it, we can put off sandboxie until later down the track.
Secret Satan's Wishlist!
And from what you describe, some sort of sandboxing might be ideal for your friend. The nice thing about an SRP or Sandboxie is that, even in the event that he clicks on a malicious banner ad or agrees to install a malicious piece of software, it'll never infect his system - it will either get purged with the sandbox, or else be denied the ability to run. The downside is, of course, him wondering how to install software and/or wondering where his files are. Unfortunately the people most likely to benefit from a sandboxing or virtual machine solution are simultaneously those who have the hardest time using it.
Oh! Also, I'd be sure to install an Ad blocker, a Flash blocker, NoScript, and a browser capable of auto-updating itself. If you take care of the javascript and ad issues in a browser, you reduce the chances of an attack happening in the first place. Even if your friend specifically visits a nasty site, if NoScript is in place there's a chance that an attack can't launch to begin with.
What worries me is that I assume someone got my xbox live login somehow. I have scanned my computer with Security Essentials, Housecall, and Malwarebyte. None of them found anything. Is it likely that I have a virus/malware that I have not detected? I am a little confused, since the login for my live account is different than pretty much every other account on my computer, and I haven't logged into my live account from my computer for at least 6 months.
Otherwise, yeah, I'd be worrying about an unknown, unidentified infection.
The 2012 issue of Fornax. | Steam and Origin: Espressosaurus
It isn't something easily guessed. It was the exact same login as my Sony account back when that whole fiasco went down. I changed my Sony stuff, but didn't think about my xbox account. Maybe they got it from there? I dunno, if there was an infection on my PC that could get my live account I'm kind baffled why they would stop there. None of my other accounts were touched. And I haven't logged into my account from any other computer.
The 2012 issue of Fornax. | Steam and Origin: Espressosaurus
You're best off using services like LastPass & Key Pass(sp?).
Once someone malicious has an email address and password from you (that they extracted from one of those leaks), they'll likely try the combination to break into your email account, as well as trying other services you're probable to be using (amazon, newegg, XBLA in this case). If they get into your email, they can use recovery options and your inbox history to get control of accounts with different passwords.
Using unique passwords for each site you browse/log into is important because of this. And because that's freaking hard to keep track of, Shroud's suggestion of a password manager is typically regarded as a good one.
It's a rootkit with INCREDIBLE regeneration capabilities, and has tripwires built in for when it's even detected at all.
Some writeups are:
http://www.eweek.com/c/a/Security/InfoSec-Cracks-Open-ZeroAccess-Rootkit-to-Find-Unique-Features-462289/
http://threatpost.com/en_us/blogs/zeroaccess-rootkit-latest-line-x64-malware-appear-052411
http://www.securelist.com/en/blog/493/MAX_sets_its_sights_on_x64_platforms
So far I have not yet found ANY reliable method of cleaning a system with it without damaging or outright destroying the OS. Until further notice, if you detect it, your only option is not just nuking the drive and partition table, but doing a full 0's and 1's sweep to purge even the unallocated space. This rootkit creates a hidden volume on the drive that isn't detectable by any known methods, and only a complete wipe and secure-clean pass (treat it like you're treating a drive with sensitive material before giving the drive away...32 passes with a wiper)...
As far as I can tell, the rootkit cannot easily infect vista/7 machines with windows defender intact, as we've gotten ahold of a live copy of the installer, and on a test machine, ANY attempt to run it has been stopped by windows defender. It seems the security has to be disabled by something else in order for it to slip by, or out of date. Once it's on, it does nothing destructive by itself, but acts as a remote control in order for more malware to be downloaded to the machine and installed past security, or whatever other commands the attacker wishes to issue to it.
So heads up, this one's nasty.
The idea of user mode malware having this kind of capacity seems off to me. How could the dropper put anything anywhere sensitive without admin access? I'm not saying it doesn't do that, I'm just baffled. This means that it'd be possible to compromise a LUA, if the vector were launched.
Also, if I'm interpreting this correctly... it creates a hidden partition? One that masquerades as unallocated space to evade reformatting? Pure, uncut evil, right there. I'm not sure how the nasty could launch itself again after a reformat, though. Would the MBR still need to be compromised for the dormant rootkit in the hidden partition to go active?
Thanks much for these links. Very interesting to see how this stuff has evolved even beyond TDL4.
If the president had any real power, he'd be able to live wherever the fuck he wanted.
MSE was installed and possibly running, but there was no system tray icon and no service listed.
I attempted to install our corporate Panda Cloud AV and it kept hiccuping on the install with an "unknown error".
While in the Remove Programs window, uninstallations would just kick off at random for random pieces of installed software. At this point I said fuck it, made a backup of user's files and proceeded with format.
I've had lots of quirky problems with people's machines running Security Essentials lately. I don't know if it's being targeted because it's free or what.
It's making me consider some of the paid software. Maybe the paid software companies are behind it.
Nintendo ID: Beltaine
3DS: 2423-2361-7857
Steam: beltane77 PSN: Beltaine-77
Not that they are irregular or anything; rather, some people just don't set up an update schedule, or they tell it to ask them before updating and the pop-up bugs them until they cancel the updates entirely. And the newer the exploit and the older the definitions, the greater the chance of infection...
DropBox invite link - get 250MB extra free.
To chime in regarding the corruption of downloaded files on installation, I'd recommend grabbing the installers for MSE and MBAM from a known-clean (or cross-platform) computer and burning them to a disk. Then try to install them on the system in question from that disk. If you're still having issues after that, then I'd recommend trying a Rescue Disk or LiveCD. There are some infections that are vicious when it comes to polymorphic infestation of executables, and they can corrupt quite a bit. Of course, it could also be a hard drive issue. It's hard to say, but I'd at least try getting the files from another source first.
And yes, I do believe that MSE is gaining more and more visibility these days. Just like any antivirus suite, they've gotten big enough that the malware authors are specifically designing their payloads to avoid MSE. This is to be expected for any solution these days, even paid ones. ESET is great, and I love using it, but it's evaded just as much as MSE is according to the reports I've seen. This is why having layers of protection beyond signature-based antivirus is so important: You need antivirus to protect you from the known threats, but it's going to do jack-squat against the new ones.
After reading about Zaccess, I nearly shat my pants and made sure all my home units were updated and i've been keeping an eye out for when i inevitably run in to it at work. Well... I didn't run in to it at work. I'm sitting here with my uncle's unit running some scans cause he said it was acting screwy. Sure enough, he has Zaccess.
I'm attempting a removal with the following tools, It is probably going to go horribly wrong.
Panda
Webroot
Trend
Spyware Doctor
A^2
HJT
and my last resort; DBAN
Has there been any successful removal of this fucker yet? Or is it nuke it from orbit in all instances? Also, is there any way to detect the hidden partition on the drive; possibly using linux?
If khalathas can give you any advice on the matter, it'll be better than my own. He's been poking at it, while I've just been trying my damnedest to avoid it!
I'm terrified of the chance of having to do this to more than 1 computer.