McAfee Steps On Its Dick

"PCs across the country rebooted continuously Wednesday, in a mass outbreak reminiscent of the widespread computer viruses from a decade ago. The cause this time wasn’t a virus, however, but a glitch on the part of a company that’s supposed to stop such malicious programs.

"Security company McAfee Wednesday morning issued a software update intended to give the computers that it’s contracted to protect a new list of malicious files to block and delete. Somehow a file that is part of Microsoft’s Windows operating system made it on to the list. And when McAfee’s software deleted this file, all hell broke loose.

"People all over the country reported that their computers stopped working. Among the victimized organization were a hospital in Rhode Island, police in Kentucky and the National Science Foundation, according to the AP.

"Jamal Mazhar, who runs LodgeXcode Inc., a consulting firm for hotels, says his computer and others in his office have been rebooting since morning. His tech staff downloaded a fix, but hasn’t yet been able to get the computers working again. `We’re down hard,` he says.

"McAfee said in a statement that the company was `not aware of significant impact on consumers.` In terms of numbers, it said the incident impacted less than `one half of one percent` of its consumer base and enterprise accounts globally."

More at The Wall Street Journal...

EDITORIAL COMMENT: I can't help but wonder if the McAfee employess who are going to get fired for this will turn to cybercrime.
- Hinky

AV Spending Seen As Pointless

"Following the highly publicized and successful malware attacks on Google, Symantec, Adobe, Dow Chemical, and others, business and government executives are questioning the value of their AntiVirus subscriptions. Their unprecedented skepticism will grow even more intense as more executives learn that all of these successful attacks were easily preventable.

"`In almost every meeting I’ve had since the mainstream media started reporting on these highly visible failures, executives and IT personnel have criticized their AntiVirus computer protection. This Aurora/Hydra outbreak could spark a big change in 2010 enterprise IT security spending, a multi-billion dollar change`, predicts Mike Fumai, CEO of Blue Ridge Networks.

"There’s nothing particularly novel about the exploitable vulnerabilities in Internet Explorer this month, or those in Adobe Acrobat Reader last month. These are merely new entries in a formulaic story re-written almost monthly. Last week’s out-of-cycle security patch from Microsoft is just a less frequently seen plot twist. Until now, these recurring stories only served to increase spending on AntiVirus software from well-known security vendors. However, these targeted organizations with deep pockets and large IT security staffs were successfully attacked because their name-brand AntiVirus software did not have signatures to detect the malware attack code."

More at PRWeb...

"Mystery Virus" Pwns Govt. Nets

"Law enforcement computers were struck by a Mystery computer virus Thursday, forcing the FBI and the U.S. Marshals to shut down part of their networks as a precaution.

"The U.S. Marshals confirmed it disconnected from the Justice Department's computers as a protective measure after being hit by the virus; an FBI official said only that that agency was experiencing similar issues and was working on the problem..."

More at Yahoo Tech...

Conficker Researchers: Still CLUELESS

"The Conficker worm is finally doing something--updating via peer-to-peer between infected computers and dropping a mystery payload on infected computers, Trend Micro said on Wednesday.

"Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.

"The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said."

From cnet.com...

Conficker 2.0 Debuts

"The criminals behind the widespread Conficker worm have released a new version of the malware that could signal a major shift in the way the worm operates.

"The new variant, dubbed Conficker B++, was spotted three days ago by SRI International researchers, who published details of the new code on Thursday. To the untrained eye, the new variant looks almost identical to the previous version of the worm, Conficker B. But the B++ variant uses new techniques to download software, giving its creators more flexibility in what they can do with infected machines..."

Read more at ComputerWorld...

Trojan Knocks Out School Computers

"A nasty virus has been going around the Mounds View public schools, but the only thing it's infecting is computers.

"This particular virus effectively shuts a computer down and renders it useless. Officials say about 3,500 computers in the Mounds View school district have been infected...

"The district is now in the process of erasing the hard drives, and reinstalling the operating system and software on every computer. A 12-person team has been working up to 15-hour days to fix the problems."

Source: Star Tribune...

Government Security Contractor PWN3D

"Employees at federal security agencies are being notified that their personal information may have been compromised after hackers planted a virus on computer networks of government contractor SRA International Inc...

"The breach is embarrassing for SRA, a 6,600-employee technology consulting company that sells cybersecurity and privacy services to the federal government. The company wouldn't say which federal agencies were affected by the breach, but in U.S. Securities and Exchange Commission filings, it lists intelligence agencies and the U.S. Department of Defense, the U.S. Department of Homeland Security and the U.S. National Guard among its clients..."

More at ComputerWorld...

Sad Tale of Government Pwnage

"On October 26, 2006, computer security personnel from across the legislative branch were informed that the Congressional Budget Office had been hit with a computer virus. The news might not have seemed extraordinary. Hackers had been trying for years to break into government computers in Congress and the executive branch, and some had succeeded, making off with loads of sensitive information ranging from codes for military aircraft schedules to design specifications for the space shuttle.

"Employees in the House of Representatives' Information Systems Security Office, which monitors the computers of all members, staffers, and committee offices, had learned to keep their guard up. Every year of late, they have fended off more than a million hacking attempts against the House and removed any computer viruses that made it through their safeguards. House computers relay sensitive information about members and constituents, and committee office machines are especially loaded with files pertaining to foreign policy, national security, and intelligence. The security office took the information from the CBO attack and scanned the House network to determine whether any machines had been compromised in a similar fashion.

"They found one. A computer in one member's office matched the profile of the CBO incident. The virus seemed to be contacting Internet addresses outside the House, probably other infected computers or servers, to download malicious files into the House system. According to a confidential briefing on the investigation prepared by the security office and obtained by National Journal, security employees contacted the member's office and directed staffers to disconnect the computer from the network."

Full story PLUS audio slideshow at the National Journal...

Symantec: Traditional AV is Almost Useless

Then Why Do We Buy This Crap?

"Signature-based scanning is 'static, old school,' says Jerry Egan, director of product management at Symantec's security technology and response division. With 12,000 new malware specimens each day to detect and eradicate, 'we think that technique is reaching the end of its useful life,' Egan says.

Another complication is that malware is now so artfully designed, 'it spreads to 20 or 30 machines before it mutates,' Egan points out. That means 'your neighbor has one variant and you have another. The effectiveness of each signature has gone down.'"

From Network World...

Chinese team mistakenly released IE7 exploit

"Chinese security researchers mistakenly released the code needed to hack a PC by exploiting an unpatched vulnerability in Microsoft's Internet Explorer 7 browser, potentially putting millions of computer users at risk -- but it appears some hackers already knew how to exploit the flaw.

"At one point, the code was traded for as much as US$15,000 on the underground criminal markets, according to iDefense, the computer security branch of VeriSign, citing a blog post from the Chinese team.

"The problem in Internet Explorer 7 means a computer could be infected with malicious software merely by visiting a Web site, one of the most dangerous computer security scenarios. It affects computers running IE7 on Windows XP, regardless of the service pack version.

"Microsoft has acknowledged the issue but not indicated when it will release a patch."

More at NetworkWorld...

Microsoft warns of new Windows bug, says attacks under way

"On the same day that Microsoft Corp. released its biggest batch of security patches in more than five years, the company also warned Windows users of a critical bug that it didn't get around to fixing.

"In an advisory posted yesterday, Microsoft said that 'limited and targeted' attacks are in progress by hackers exploiting an unpatched vulnerability in the WordPad Text Converter, a tool included with all versions of Windows. The flawed converter handles Microsoft Word 97 files on Windows 2000 Service Pack 4 (SP4), XP SP2, Server 2003 SP1 and SP2.

"Newer versions of Windows -- XP SP3, Vista and Server 2008 -- are not vulnerable to the bug, however."

Full article at ComputerWorld...

Koobface computer virus attacks Facebook users

Facebook's millions of users are in the crosshairs of a computer virus dubbed Koobface that is being spread through the social networking site's messaging system.

Users whose computers are infected may have their credit card numbers stolen or their searches on Google, Yahoo and MSN diverted to fraudulent Web sites.

More...

[Hinky NOTE: see also my commentary at the UT Blog -HD]