Antivirus vendors melt on Mac Malware Scare

Coincidence or not, a pair of antivirus software manufacturers offer new products at a time when Mac malware makes headlines.

The first is Avast free Antivirus for Mac. Although the product is not new, this version, now in beta, is strongly reworked from older versions. It includes analysis on application of the system of entire file and shields antivirus for e-mail, Web sites and applications.

The other program is F-Secure Anti-Virus for Mac, which costs $40 per year. It offers a virus in real time, scanner, and a "panic button" that instantly blocks all Internet traffic to the computer.

Other companies, such as Symantec and Intego, offered a software antivirus Mac for years.

Security Mac has been a major problem recently because of the MacDefender malware and its variants, stealthily on the Web through sites that use search engine optimization spam chapter in the search results. MacDefender is done so that the antivirus software, showing a Web page that looks like a screen for the detection of virus and then prompting the user to complete the installation process. If completed, the malware will require credit card information to remove non-existent viruses.

Apple to address this problem itself, with a security updating which blocks MacDefender and its variants. This resulted in a bit of carrot in which malicious programs try to defeat the defences of Apple, and Apple responds with daily updates of new malware definitions.

In other words, Apple security update is the work of antivirus software, at least for this particular strain of malicious software. An old issue: users of Mac Do need software antiviru in the first place?

Personally, I wouldn't install anti-virus on a Mac software. A threat against the malware as MacDefender may be rebutted with a little Krafty, because it cannot install without user's permission or deploy on its own. As for the virus, which can install and deploy on their own, there is very little evidence of major threats in the wild, and said Apple him have built-in protection against these attacks.

But MacDefender showed the bad guys are showing a greater interest in attacking Mac users. Anti-virus software manufacturers will argue that you can never be too cautious, but the best answer - and that does tax your wallet or your CPU - are attention without panic.

Follow Jared on Facebook and Twitter so today @ PCWorld for still more news of tech and comment.

Read More >>

Malware on the Rise

Malware is the thing to look out for these days. McAfee claims that they tracked more than six million different unique malware samples in the first quarter alone. Those numbers make the first quarter the most active quarter for malware issues ever.

In a statement, Vincent Weafer, the senior vice president of McAfee Labs, said, "It's been a busy start to 2011 for cybercriminals."

McAfee went on to say that February was the most active malware month. In February, 2011 there were 2.75 million samples alone. According to the company, in March, 2011 there were also more than 350,000 fake anti-virus software samples, which was the highest level in over a year; however, partially in part to the demise of the Rustock botnet, spam is at the lowest level since 2007.

"Even though this past quarter once again showed that spam has slowed, it doesn't mean that cybercriminals aren't actively pursuing alternate avenues," Weafer continued. "We're seeing a lot of emerging threats, such as Android malware and new botnets attempting to take over where Rustock left off, that will have a significant impact on the activity we see quarter after quarter."

The most popular OS for mobile malware is still Symbian, but McAfee reported that Android is gaining on Symbian and came in at number two. McAfee thinks that Android isn’t number one because Google allows for the side-loading of Android apps. This means that it does not have a main spot where it checks apps for any possible suspicious behavior.

Just this past week, Google had to remove more than two dozen apps from their Android Market due to malware issues. NetQuin, a mobile security firm, also identified more than 20 malware filled Android apps that went to the extent of auto-dialing phones to pile up high user fees.

When dealing with spam, McAfee tracked more than 1.5 trillion messages each and every day, but thankfully that number is less than half of what it was just a year ago.

Government agencies across the globe have been working hard to crack down on cybercrime. In September dozens of international cyber-gangsters who were responsible for the creation and spread of the Zeus botnet were arrested. Also, thanks to Microsoft, FireEye (an anti-malware company), the University of Washington and Pfizer (a pharmaceutical firm) Rustock was taken down in March.

In their statement McAfee warned that the creators of the Zeus bot are hard at work merging the Zeus code with the SpyEye botnet. This would affect banking and online transactions, so it could cause some major issues if it isn’t handled.

"There was a strong uptick in new botnet infections toward the end of Q1, most likely due to the reseeding process, where cybercriminals slow down activity in order to spend time rebuilding botnets," McAfee said. "The botnet takedowns have resulted in an increase in the price of sending spam on the underground marketplace, showing that the laws of supply and demand also apply to cybercrime."

So why are people even falling for these threats? Well, cyber-criminals are very sophisticated these days. They make their scams look legit, so it’s hard to tell that it’s a threat sometimes until it’s too late. It seems that the spam that is promoting an actual product seemed to lure in the most people. IGNORE the e-mails advertising iPads and HDTVs. McAfee also noted a rise in “banker” Trojans. They lure people in talking about things like UPS, FedEx, USPS and the IRS. Unfortunately, on top of that, scammers are also taking advantage of crisis events like the Japan earthquake and tsunamis.

It’s just important to pay attention to what you are opening up or downloading before you do it. If you’re careful and take the necessary precautions, you should most likely be able to avoid any issues.

Rack-Mount Server rentals are ideal if your company needs an extra storage unit for company information while you are testing various types of storage solutions.

Whether you need a short-term rental or a long-term lease, we have the right kind of server for your needs.

Read More >>

Fake MacDefender Malware Originating from Russian Payment Processor

For about a month there has been a fake MacDefender malware that has been circulating and plaguing Apple computer owners. No one seemed to know where it was coming from, but finally on Friday, May 27 a computer security researcher made the claim that the fake malware could be traced back to an online Russian payment processor called ChronoPay.

"Some of the recent scams that used bogus security alerts in a bid to frighten Mac users into purchasing worthless security software appear to have been the brainchild of ChronoPay, Russia's largest online payment processor and something of a pioneer in the rogue anti-virus business," wrote security researcher Brian Krebs on his KrebsonSecurity blog.

The fake MacDefender and the incredibly similar scareware called MacProtector and MacSecurity tended to attack from points like infected Google Image search results. Once your computer is infected, it is incredibly difficult for Mac users to remove the malware. The issue is that the malware doesn’t have a dock icon and it attaches itself to the launch menu of the computer.

Krebs was able to trace the newest strains of the scareware back to ChronoPay by simply examining the two different domains that the software directs all of its Mac users to go to for a paid software security solution. While investigating, he found out that both mac-defence.com and macbookprotection.com were associated with the e-mail address fc@mail-eye.com. According to leaked ChronoPay documents, this e-mail address is owned by Alexandra Volkova, the company’s financial controller.

According to Krebs, both of the Mac domains listed above have been suspended by Webpoint.com, which is a Czech registrar; however, Krebs said that the fc@mail-eye.com account was used recently to register appledefense.com and appleprodefense.com. Despite this, Mac users have not yet reported being directed to either of these sites via malware like MacDefender.

"ChronoPay has been an unabashed 'leader' in the scareware industry for quite some time," Krebs writes. Just in 2008, it was the core processor of a site called trafficconvertor.biz. This was an “anti-virus” program that was designed to release the first strain of the Conficker worm. It was an incredibly destructive virus that still works to infect millions of computers across the globe.

"In the coming days, Apple will deliver a Mac OS X software update that will automatically find and remove MacDefender malware and its known variants," Apple wrote. “The update will also help protect users by providing an explicit warning if they download this malware."

Apple also released a document with detailed instructions for Mac users on ways to eliminate MacDefender from their computers.

Find out what is going on in the Tech Army World.



What are the Top 10 Money Making Missions?

What other companies have joined and what do they do?

How do I join the
Tech Army Organization ?

Read More >>

Mumba Botnet Has Infected 55,000 Computers

Research from free anti-virus software-maker AVG was released earlier this week and the findings show that over 55,000 computers from all over the world have been infected by the Mumba botnet. The report, which was prepared by the AVG Web Security Research Team, can be found at Blogs.AVG.com.

According to the report, over 60GB of personal data, such as social networking information, banking information, credit card information, and emails, has been stolen from people's personal and business computers. At least 33% of the infected computers are located in the United States, followed by 17% in German, 7% in Spain, 6% in the United Kingdom, and 5% in both Mexico and Canada.

Mumba botnet is a virus that was created by a group of cybercriminals known as the Avalanche Group. The Group is known for creating a mass-production system for phishing sites and other malware. Mumba uses Zeus, one of the most current and common forms of malware.

In a press release, Yuval Ben-Itzhak, the Senior Vice President of AVG said, "The unique infrastructure of the Mumba botnet means that going after the servers hosting the stolen data is now much more difficult than before. As cybercriminals become increasingly sophisticated, it is paramount that consumers and corporations prevent their PCs from becoming the next victim in these dynamic cyber attacks by using anti-virus and LinkScanner tools such as those that AVG offers for free."

Related Story:

1. Malware and Virus Removal

---

Looking for Computer / PC Rental information? Visit the www.rentacomputer.com PC Rental page for your short term business PC needs. Or see this link for a complete line of Personal Computer Rentals.

Read More >>

McAfee's Predicted Security Threats for 2010

McAfee recently released a report that predicts potential online security threats for 2010. To summarize, the anti-virus and computer security company, which is based out of Santa Clara, California, sees an increase in threats from social networking sites, banking security, and bot nets. In addition, they see increases in attacks targeting users, businesses, and applications. However, the findings weren't all negative. McAfee says they expect an increase in law enforcement and its effectiveness in fighting cybercrime.

As social networking sites, such as Facebook and Twitter, become increasingly popular, they'll most likely become a breeding ground for cyber attacks. On top of the increased number, the attacks will be more sophisticated. Facebook users are particularly vulnerable due to the number of third party applications used. Games and other applications are popular and most people will trust an invitation from their friends without using caution. But that invitation could easily be malware or something else designed to harm your computer. There's really no way to protect yourself other than avoiding the third party apps such as quizzes and games.

URL shorteners such as bit.ly and tinyurl.com are also expected to become a target of cybercrime. These tie-in to social networking because most people use them to post links to their profiles. The websites shorten a normal URL into a smaller one that will fit in almost any space and is especially popular on Twitter, where you only have 140 characters to gets your message across. One major problem with these smaller URLs is that they can't be previewed, so clicking on one at random could lead you to somewhere you don't want to be. This makes it a very easy target for crooks.

Due to the popularity of Microsoft products, cyber criminals have been taking advantage of them for years. However, as programs such as Adobe Reader and Flash become more popular, McAfee expects they will become a bigger target, taking over the top "honor" from Microsoft. In 2009, Adobe Reader saw an increase of problems due to security holes, leading the company to take a more proactive approach to patching up problems.

Email attachments have always been a problem when it comes to spreading malware and that threat is expected to continue and even get bigger. The company expects an increase in specific targets when it comes to email, and those include journalists, corporations, and individual users who could easily be convinced to download an attachment that is hiding a Trojan or other bit of malware.

Other projected problems include banking Trojans. Normally used to get your financial information, McAfee expects them to become so advanced that they will start interrupting transactions and even withdrawing money from your accounts. 2009 already saw an increase in banking cybercrime, with many Trojans making their way past strong bank security. Botnets are also expected to be a threat. McAfee calls them a "leading infrastructure for cybercriminals" and says they are "used for actions from spamming to identity theft." While they are harder to track down due to their ability to move from computer to computer without a central base of operation, there has been some recent success in shutting them down.

Despite all the many threats, McAfee does project an increase in law enforcement's ability to track down cybercriminals. Even so, there are steps you should take to protect yourself. Purchasing security software and keeping it updated is very important and something everyone should do. Keeping your PC up-to-date with Microsoft patches that protect your operating system, office suite, and browser is also important. You should also be sure that you are aware of all the latest threats and realize what's at risk. Exercise caution when opening files or downloading applications.

---

Looking for Computer / PC Rental information? Visit the www.rentacomputer.com PC Rental page for your short term business PC needs. Or see this link for a complete line of Personal Computer Rentals.

Read More >>

Free Quality Malware Protection from Microsoft

Microsoft has just released the Beta for their free malware protection product called "Windows Security Essentials" (Codenamed Morro).

This antivirus and anti-spyware program uses the same tried and tested scanning engine and signature updates as Windows OneCare (which goes away once MSE is out) and the ForeFront Client Security (Microsoft's business focused AV solution). It is available in 32bit and 64bit versions and has been optimized to provide a small system overhead and minimal user interface. This is in stark contrast to the bloated AV products available today from many of the main AV vendors.
Although this tool is intended as a consumer product it is difficult not to consider this in the SMB space as well, in the same way Windows Defender has become a standard part of most small business installations.
Those of you old enough, may well be asking yourself if this is going to be any different from the MS-AV farce in the days of MS-DOS 5.0 and Windows 3.1? Well we at CM have been testing this application for a few weeks now and we have found it to be excellent! The UI may be minimal but don't think for one minute that this product has cut back where it matters, its ability to detect and protect your system from malware attacks is top class. Check it out here: http://www.microsoft.com/security_essentials/
So tell you family and friends! Good, simple, solid AV protection is, at last, available for free!

Read More >>

Conficker Worm Set to Hit April 1

No this is not an April Fool's Day joke, this is serious. Every few years, the internet is hit by a vicious malware that wreaks havoc on on computers. And it all seems to happen on one day, April 1st, and security experts are racing against time to mitigate the impact of this hazard. For some reason, malware creators like to target April Fool's Day and this latest attack, known as Conficker C, is rumored to be the most damaging attack seen in years.

The infamous Conficker had its debut in late 2008 and started getting buzz when its victims reached over 9 million in January. This third installment, known as Conficker C, has grown increasingly more virulent, complicated and powerful. However, no one really knows what exactly the damages will be come emergence day.

What is really impressive, is that Microsoft is offering a quarter-million dollar bounty on the head of the maker of the worm. Security researchers are desperately digging into the worm's code attempting to engineer a cure or find the writer before the deadline. What is known, is that as of April 1, all infected computers will come under the control of one master computer located somewhere in the vast reaches of the internet. At this point, anything and everything is possible. These controlled computers could do a number of things. They could steal personal information, completely wipe hard drives, deny service, or even generate more pop-ups and extortion-like services designed to sell you made up security software.

Conficker is no ordinary virus, it's smarter than the others. It is really really good at hiding it's tracks. It uses an incredible amount of URLs to communicate with its HQ computer. Conficker's first version only used about 250 different URLs daily, allowing researchers and ICANN buy and disable. Unfortunately, Conficker C has increased the dosage to an astonishing 50,000 different addresses each day! This incredible size makes ot impossible track and disable each one by hand.

Right now you should be extra careful about protecting your computer. Only patch Windows through Windows update and upgrade your anti-malware software as well. You should also make sure your antivirus software is running too, because Conficker just may have disabled it.

It makes me wonder, what with all this talk about master computers, computer HQ, controlled computers, nation-wide extremely violent computer viruses and such, if we are slowly approaching the D-Day foreseen in the Terminator movies? On a serious note though, what is the purpose of these computer viruses? Why do people sit around and create something that ruins people's lives? What joy do they get from it? I guess we may never know. All we can do is protect ourselves as best we can and pray to God that the amazing people trying to help us stop this virus before it infects us all.

Read More >>

OneCare – Don’t Care

On November 18th Microsoft announced that the Windows OneCare product is being killed off (http://www.microsoft.com/Presspass/press/2008/nov08/11-18NoCostSecurityPR.mspx ). Instead of OneCare they are going to make available a free Windows client protection product code-named “Morro” which has been designed to provide a similar level of protection while managing to reduce the impact of this protection on the computer (1).
This change won’t be happening until June 2009 and support for OneCare is likely to continue until June 2010 but it has raised a lot of questions about how seriously Microsoft is taking consumer malware protection. I believe part of this confusion it driven by a misunderstanding in what is required now in the world of malware protection and I honestly believe that Microsoft has got it right here, let me explain how.
Without a doubt the face of malware protection has changed massively it is no longer a part-time hobby for bored students it is now a multi-million dollar industry funded by criminals making money from spam and stolen identities. The malware protection industry is dealing with masses of new malware daily (SophosLabs claims to receive 20,000 suspect samples everyday*) some of these are sophisticated new attacks but most of them are simply reworked examples of previous attacks which are simply dealt with once a signature has been developed. However this message does not help the malware protection vendors sell their product so in an attempt to make their products look better than the rest (and justify the ongoing costs of their products and subscriptions) we have seen the products bloat with extra features and elaborate user interfaces that look impressive but change little of the underlying security of the product.
Microsoft bought into this approach as well by adding features like “OneCare Circle” where home users can manage up to 3 home computers from one place and easily share printers between them. The trouble with these enhancements is that they increase the size and complexity of the product and for the most part they are an inconvenience to the average end user. No one wants to sit and watch a security scan slow their computer down while they are trying to get work done (even if it does look pretty) and the ongoing messages and reports that these product present are just irritating to most of us. We all want, and should get, a safe and secure computer that allows us to get on with the tasks we want or need to do on them with the minimum time and fuss.

Back to Basics with Morro
So how will Morro change things? Well Microsoft is going back to basics and ripping out all the unnecessary clutter and getting back to what matters; the scanning engine, or "Protection Engine" as Microsoft now calls it, and the signature updates.
The protection engine promised in Morro is based on the same engine used in OneCare, Forefront Client Protection, and the Windows Malicious Software Removal Tool (MSRT, the one that comes free already via Windows Update). This engine has a long pedigree as it was originally developed by a company called GeCad that Microsoft purchased back in 2003#, it has been updated by Microsoft as they have modified it to meet their own rigorous Security Development Lifecycle (SDL) coding process but it is still built on the same concepts. You will hear many discussions about just how good this protection will be and yes, there is an argument that other products like Kaspersky or Nod32 can provide better protection but this is like auguring that a BMW is better than a Ford when most of the world doesn’t even own a car and let's be honest would you turn down the option of a Ford if it was free? ;-)
By going back to basics and making Morro free Microsoft has taken a huge step forward in making it harder for malware to spread. Over time I am sure this protection will simply be rolled into the operating system (law suits allowing that is!) as this is where this protection belongs now. No serious operating system can function in today’s online world without at least this level of protection. The industry that has formed around Windows client malware protection will have to evolve or it will follow OneCare into history. With Morro, Forefront codename "Stirling", and Windows 7, 2009 is going to be an interesting year for Windows Security to say the least!

(1) Microsoft have also stated Morro is "a PC security solution tailored to the demands of emerging markets" but for this read "markets that want free client computer protection" I don't see why Microsoft would try to limit Morro to emerging markets if they are also getting rid of OneCare.
* Quote from Sophos Security threat report 07/2008
# http://www.microsoft.com/presspass/press/2003/Jun03/06-10GeCadPR.mspx

Read More >>