Tag: malware

More companies participate in Confidential Computing Consortium

Article

Facebook, AMD, Nvidia Join Confidential Computing Consortium | SDx Central

AMD, Facebook et Nvidia rejoignent une initiative qui veut protéger la mémoire vive de nos équipements  (AMD, NVIDIA and Facebook join an initiatiative to protect the live memory of our equipment) | O1Net.com (France – French language / Langue française)

From the horse’s mouth

Confidential Computing Consortium

Web site

My Comments

Some of online life’s household names are becoming part of the Confidential Computing Consortium. Here, AMD, Facebook, NVIDIA are part of this consortium which is a driver towards secure computing which is becoming more of a requirement these days.

What is the Confidential Computing Consortium

This is an industry consortium driven by the Linux Foundation to provide open standards for secure computing in all use cases.

It is about creating a standard software-development kits that are about secure software execution. This is to allow software to run in a hardware-based Trusted Execution Environment that is completely secure. It is also about writing this code to work independent of the system’s silicon manufacturer and to work across the common microarchitectures like ARM, RISC-V and x86.

This is becoming of importance nowadays with malware being written to take advantage of data being held within a computing device’s volatile random-access memory. One example of this include RAM-scraping malware targeted at point-of-sale / property-management systems that steal customers’ payment-card data while a transaction is in progress. Another example are the recent discoveries by Apple that a significant number of familiar iOS apps are snooping on the user’s iPhone or iPad Clipboard with their iPhones without the knowledge and consent of the user.

As well, in this day and age, most software implements various forms of “memory-to-memory” data transfer for many common activities like cutting and pasting. There is also the fact that an increasing number of apps are implementing context-sensitive functionality like conversion or translation for content that a user selects or even for something a user has loaded in to their device.

In most secure-computing setups, data is encrypted “in-transit” while it moves between computer systems and “at rest” while it exists on non-volatile secondary storage like mechanical hard disks or solid-state storage. But it isn’t encrypted while it is in use by a piece of computer software to fulfil that program’s purposes. This is leading to these kind of exploits like RAM-scraping malware.

The Confidential Computing Consortium is about encrypting the data that is held within RAM and allowing the user to grant software that they trust access to that encrypted data. Primarily it will be about consent-driven relevance-focused secure data use for the end-users.

But the idea is to assure not just the security and privacy of a user’s data but allow multiple applications on a server-class computer to run in a secure manner. This is increasingly important with the use of online services and cloud computing where data belonging to multiple users is being processed concurrently on the same physical computer.

This is even relevant to home and personal computing, including the use of online services and the Internet of Things. It is highly relevant with authenticating with online services or facilitating online transactions; as well as assuring end-users and consumers of data privacy. As well, most of us are heading towards telehealth and at-home care which involves the handling of more personally-sensitive information relating to our health through the use of common personal-computing devices.

The fact that Facebook is on board is due to the fact the social network’s users make use of social sign-on by that platform to sign up with or log in to various online services. In this case, it would be about protecting user-authentication tokens that move between Facebook and the online service during the sign-up or log-in phase.

As well,  Facebook has two fingers in the consumer online messaging space in the form of Facebook Messenger and WhatsApp products and both these services feature end-to-end encryption with WhatsApp having this feature enabled by default. Here, they want users to be sure that the messages during, say, a WhatsApp session stay encrypted even in the device’s RAM rather than just between devices and within the device’s non-volatile storage.

I see the Confidential Computing Consortium as underscoring a new vector within the data security concept with this vector representing the data that is in the computer’s memory while it is being processed. Here, it could be about establishing secure consent-driven access to data worked on during a computing session, including increased protection of highly-sensitive business and personal data.

Be careful about USB memory keys left in the letterbox

Articles USB memory keys press picture courtesy of Victoria Police

Police warn of malware-laden USB sticks dropped in letterboxes | The Register

Crims place booby-trapped USB drives in letter boxes | IT News

Don’t plug it in! Scammers post infected USB sticks through letterboxes | Naked Security (Sophos blog)

From the horse’s mouth

Victoria Police

Press Release

My Comments

An issue that is being raised concerning data security is people loading data from USB memory keys that they don’t expect.

This has been used as a way to distribute malware to businessmen at conferences because these thumbdrives, like floppy discs and optical discs, have been accepted as a way to distribute conference content or “electronic brochures” and added to participants’ “show-bags” handed out at these events. The typical method of delivering a malware-laded USB stick was to abandon it at the venue, hotel or “watering-hole” bar and it would inspire people’s curiosity to pick up this memory key, plug it in to their laptop and load up what was on the stick.

Newer iterations of the desktop operating systems i.e. Windows or MacOS have made it hard to allow one to run a program off a USB memory key by default. Similarly, most of the desktop security software would implement removable-media scanning routines to automatically check for malware on a USB stick or other removable media. But there have been some USB thumbdrive variants which have had the firmware altered to run keystroke macros or meddle with network settings.

This situation has now been found to occur in a personal-computing context in some of the outer south-eastern Melbourne suburbs like Pakenham. This was where USB memory keys were left on households’ mail boxes and these thumbdrives were full of malware including fraudulent content-streaming offers. Infact Victoria Police even encouraged Australian householders who received these thumbdrives in their mailbox to contact Crimestoppers Victoria by phoning 1-800-333-000 or using the online form.

But the common security advice to deal with USB memory keys that you didn’t expect to receive is not to insert them in your computer. If you do expect to receive one of these sticks such as them being in a show-bag from a vendor or you receiving conference material on one of them, make sure that you have your operating system and desktop security software patched and updated.

Web-page advertising needs to adopt a secure-ads strategy

Article

Beware of Risky Ads on Tumblr | MalwareBytes Unpacked

My Comments

Online ad - to be respected like advertising in printed media

Ads on sites like here need to be secure to obtain the same respect as magazine ads

Most of us who use the Web are making increased use of ad-sponsored Web sites for news, blogs, social media and the like.

In most cases, the banner advertising that appears on these Websites or on advertising-funded mobile-platform apps and is delivered in a tasteful manner provide a similar experience to the display advertising we see, accept and take for granted in newspapers, magazines and other printed media. That is where pop-up or pop-under advertising isn’t used or you don’t hear noisy video commercials playing through. It could be enough to see an animated or slide-show ad appear within the confines of the banner. Here, the advertising doesn’t interrupt the reading experience unlike with TV advertising or online-video advertising where it interrupts the viewing experience.

Such advertising, like the Google AdSense ads you see on this site, is sold on a contract that is based on cost-per-click which the advertiser pays when you click on the ad to follow through with it, or cost-per-impression which is based on simply on the ad being loaded and appearing on the site.

The malvertisement threat

But there is a security problem cropping up here in the form of “malvertisements”. These are online advertisements that are delivered to lead users to Websites that host malware. Typically they use enticing copy and graphics in the advertisements to attract users to view content on these sites and download software of questionable provenance.

Security vendors run a rhetoric that encourages us Web users to use ad-blocking software to keep our computer secure by masking all online advertising. But this can get in the way of honest advertisers and the publications that depend on them for revenue because the software works on an “all or nothing” approach.

But what can the online advertising industry do about this?

If a Website author has control over all of the advertising they admit, they can easily “fence out” malvertisements and distasteful advertising by examining what their potential advertiser is tendering at the start of and through the life of their advertising contract.

But this is not the case for most Websites where they will rely on one or more ad networks like Google AdSense to supply all or the remainder of their ad inventory. These ad networks typically source the advertising themselves and pay publishers a cut for each advertisement that appears or when someone clicks on an advertisement.

Ad networks

Malware sites advertise through these networks on a “pay-per-click-only” contract because it is a “low-risk high-return” option. But the networks could make life harder for them by, for example, vetting the creatives (advertising text, graphics, scripts and links) offered for an ad campaign before accepting them for display and through the life of the campaign. Similarly, they could make it harder to establish or sustain advertising contracts for “fly-by-night” operations like distributing malware such as implementing the ability to break-off ad contracts if the advertiser engages in deceptive conduct or not offering “very-low-risk” advertising options such as “pay-per-click-only” text ads. One way would be to require all ad contracts to be based on the requirement to pay for a particular time length or minimum number of impressions.

Ad networks can also exchange details about advertisers that engage in deceptive business practices so that the advertisers don’t go “shopping around” different ad networks to hawk their wares at the lowest risk. This is similar to a lot of proper business practices where companies are able to exchange details about known credit risks for example.

This could be part of an online advertising code of conduct to protect the validity and legitimacy of the online display advertisement as part of an advertiser’s campaign mix and as a way for Web publishers to raise some income.

Webmasters

Webmasters can work with the ad network’s control panel to reduce the kind of advertising that gets through to their ad spaces. For example, they could opt to keep the advertising that appears to tightly reflect the content and tone of their Website. The Webmaster can also exercise a tight level of control over any advertising they directly sell for their Website such as offering contracts with a minimum level of risk to the advertiser or vetting the creative material tendered by the advertisers.

As well, they can take out security measures over the Website to stop undesireable activity from occurring with their Website. This could include implementing hardened login procedures such as brute-force lockout or two-factor authentication on the critical admin and editor accounts.

Conclusion

Like most online-security issues like Wi-Fi security, it isn’t just up to end-users to do the “heavy-lifting” to keep their Web experience secure. Other stakeholders like advertising networks need to join in the game to keep a secure Web with respected online advertising and avoid exposure to liability.

Google Chrome can now detect loaded downloads

Article

Chrome update to raise alarms over deceptive download bundles | The Register

From the horse’s mouth

Google

That’s not the download you’re looking for …. – Blog post

My Comments

I have helped a few people out with removing browser toolbars and other software from their computers that they didn’t necessarily invite in the first place. What typically happens is that a person looks for software to do a particular task such as a lightweight game, native front-end for an online service, video-codec pack, an “essential” CD-burning tool or an open-source Web browser, but they work through a very confusing install procedure that has them invite software like TubeDimmer to their computers if they aren’t careful.

A lot of this unwanted software ruins the browsing experience by “cluttering” the screen with extra advertisements and data or redirects genuine links to advertising sites hawking questionable products. As well, they are more likely to “bog” the computer down by stealing processor time and RAM memory space.

Mozilla has become aware of the problem with Firefox courtesy of their bug-reporting mechanism and found that it wasn’t about proper software bugs but improper bundling practices. They had found that these bundles were infringing their copyrights and trademarks that they had with the software, especially the open-source concept.

Google has answered this problem at the search phase of the operation by identifying whether a download site is paying to advertise courtesy of its Adwords keyword-driven advertising service and provided a way to highlight that the software is not the official software site. This is typically because a download site may bundle multiple programs in to the install package rather than just having the program you are after.

They are even going to “expose” the detection software to Mozilla and others to allow them to integrate the detection functionality in their “regular-computer” browsers or desktop-security software by virtue of their Safe Browsing application-programming interface.

This may be a step in the right direction towards dealing with “loaded downloads” but desktop security programs could work further by identifying installation packages that have more than what is bargained for.

Public-access computers now being seen as a security threat

Article

The danger of using PCs in hotel business centres | HOT For Security

Data thieves want to track what you type at hotel business centers | Engadget

My Comments

A very common part of the Internet landscape is the availability of public-access computers that are connected to the Internet. These were made available in schools, universities and libraries but then ended up as being part of cafes, bars and the like, including hotel business centres.

But there had to be a level of control over what software ended up on these computers so that they don’t become a conduit for mailware. Even before the Internet, there was the issue of people bringing in software on floppy disks and these were known to be a conduit for viruses. For example, the computer systems that I used at the TAFE college where I studied my computer course were connected to a network but these were set up to boot from the network where the IT department had control over the software that was made available. In some cases, the boot sequence required the computer’s local hard disk to be “swept clean” of data and the locally-required software image to be reinstalled on that hard disk.

A common reality with public-access computers nowadays is that they operate all the time the business is open, surviving the day without being rebooted. In some cases, it becomes feasible to install software on them thus allowing any “Tom, Dick and Harry” to install software off removeable media or the Internet. As well, there is a culture amongst a lot of organisations who run these computers where no-one cares about what goes on with them, usually due to technically-inept or overworked customer-service staff or IT support staff who are distant from the venues.

This has lead to situations like keylogger malware being planted on these machines because users enter personally-identifiable information in to these computers to complete transactions or communicate with others.

What can we do

If you can, use your own computer equipment to perform your sensitive communications or transactions. If you have to use a public-access computer, make sure that the machine you intend to use implements a “wipe-clean-and-install” arrangement where the local hard disks are “wiped clean” and the software reinstated from a known image after every usage session.

What venues can do

Encourage the staff to keep an eye on the public-access computers and respond to issues that the users may have with the systems. As well, they keep an eye out for any physical tampering with these systems such as installation of hardware keyloggers or similar devices.

Another issue worth considering is deploying system-management software that can either restore from a known disk image when the computer is restarted (Faronics DeepFreeze), lock down the computer (Anfibia Deskman) or provide a simple “Web kiosk” environment (Webconverger). These can limit the effect that malware can have on the public-access computers.

At least, they could keep the computers running operating systems, application software and desktop-security software that is kept updated with the latest security patches. In a lot of cases, the software could be set up with “blind updating” where the updates are downloaded and installed automatically. As well, making sure that the computers are restarted on a regular basis to be sure of updates being properly installed and can increase the effectiveness of “wipe-clean” system management software.

General comments

Personally I see the public-access computers becoming the Internet equivalent of the public pay phone – something that we are making less use of and people who use these devices regularly are seen as social pariahs. This is although they become a stop-gap measure for computing tasks when we deal with laptops or smartphones that are out of battery for example.

Macintosh users–keeping your computer secure

Article

Apple users: Try these five tips for better Mac security | Naked Security

My Comments

Just lately, I have heard over the dinner table that a few Apple Macintosh computer users have been facing issues with malware and other software with questionable behaviour. Some of these attacks were mainly “overlay attacks” that worked with the user’s Web experience.

What previously used to happen was that Windows computers were the target for viruses, worms, Trojans and similar malware due to them having a stronger installed base compared to the Apple Macintosh platform. This caused some people to switch to the Apple Macintosh platform because of less malware threats occurring on that platform.

But even in 1989 when I was made aware of the virus issue, the awareness about viruses and similar malware was targeted across all personal-computing platforms that were in operation through that year i.e. the MS-DOS-based IBM PC, the Macintosh, the Commodore Amiga and the Apple II amongst others. At that time, there was awareness about keeping a “clean” system and keeping control over how you shared your files.

Similarly, we started to see the arrival of signature-driven anti-virus programs that could scan hard disks or removable “floppy disks” for viruses. Some of these initially scanned the boot sector but moved towards checking files for these viruses. They became a very important part of every computer user’s software toolkit as the virus activity increased. But through the 1990s as the Internet came on the scene, the malware activity was more focused on the MS-DOS / Windows platform with Apple Macintosh users not having as much of that activity. At that time, the MS-DOS / Windows platform was effectively the computing platform for most personal and business computing applications including gaming with the Macintosh being used by creative types due to its inherent prowess with multimedia.

This lead to a sense of complacency concerning secure computing for the Macintosh platform on both Apple’s and their users’ part. Microsoft took proper steps in updating and patching the Windows computing platform since 2001 with the arrival of Windows XP and hardening that platform with the arrival of Windows Vista and 7. Similarly, Windows users jumped over to the Macintosh platform for their home computing because they saw Windows as being slow and virus-ridden; and also due to the arrival of Apple’s iPod and iPhone products.

Lately, the Apple Macintosh has become the target for various malware campaigns including “write-once run-anyone” attacks based on Adobe Flash and Java software platforms. This is due to the increased new-found popularity that the Macintosh has acquired and, in another context, activities involving the Internet, networks or removeable media are still being seen as vectors where the Mac can share Windows-targeted malware.

Upgrade to Mavericks if you can

To stay secure, Apple Macintosh users need to upgrade to the 10.9.2 Mavericks version of MacOS X, with this version being equipped with various security improvements in a similar way to what Microsoft did with Windows 7. This can be done with newer Macintosh computers and for free with Macs running Lion or Mountain Lion versions.

Keep the operating system and software up-to-date

As well, as part of proper computer housekeeping, it is important to keep the Mac “lock-step” with the latest operating-system updates. Here, you can use the Apple-Menu / System Preferences / App Store option to have the Mac check for and download the updates from Apple by itself; or go to the Apple-Menu / Software Update menu to cause it to check for updates. The latter option can be of use with a MacBook that is used “on-the-road” and you are able to check in at a Wi-Fi hotspot or other Wi-Fi network.

Similarly, keep Adobe Flash and Oracle Java up-to-date by using options in the Apple-Menu / System Preferences menu to check for automatic or manual updating for these programs. If any other “write-once run-anywhere” software-development platforms show up on the Macintosh platform, treat these like you would with Adobe Flash – they can become a path for distributing malware that “hits across all platforms”.

This also applies to the application software and utilities you also run on your Mac and, here, you go to whatever software-option menu there is to check for software updates or cause automatic software updating to occur.

Don’t enable Java if you don’t need it.

As for Java which appeals as a “write once run anywhere” coding system, don’t enable it unless you are intending to run a known trusted program that uses this language or are developing Java software. OS X Mavericks comes with this deactivated by default but you can deactivate this in your Web-browser option menus.

Take advantage of full-disk encryption if you have confidential data

Another practice you could use for all computer platforms is to take advantage of full-disk encryption. Most operating systems provide this as a function that you can use with MacOS X providing it “across the board” for recent iterations in the form of FileVault. Similarly, a commercial or open-source third-party full-disk-encryption tool can do the job better than what the operating system provides.

These tools encrypt and decrypt on an “on-the-fly” basis and mainly protect the local volumes on the computer with some business-tier USB memory keys providing a similar full-disk encryption for their own volumes.

Use a good anti-malware or desktop security program for the Macintosh

Check for and use a good anti-malware program for the Mac platform like Kaspersky, Sophos, AVG or ClamXav . As well, keep the anti-malware program that you run on automatic update in order to keep them ahead of the malware game.

It is also worth noting that the good programs in this field can also keep the Macintosh from being a conduit for spreading Windows-based malware around the Windows platform. This is whether the files are passed through email, message-based file transfers, network-hosted / Internet-hosted file sharing points or removeable media.

Another sign of a good anti-malware program is the ability for it to scan your computer’s primary storage (RAM and paging files) to protect against malware that works on data being held in this space. This is because most data normially encrypted on a secondary storage or in transit is kept “in the clear” in the RAM and is vulnerable to RAM-scraping malware.

Keep stock of what is installed on your Mac

Another way malware gets on to computers is when you load software “in a hurry”. Typically what can happen with some freeware tools is that they can “push” browser extensions and toolbars or utilities of doubtful provenance on to a computer. This can lead to it underperforming or malware creeping in and taking over the system.

If you download from the Mac App Store or similar download locations, check for the app’s reputation by looking at comments, star-ratings and the like. This is something I have raised previously in relation to app stores for mobile-computing platforms along with the newer App stores that are opening up for regular computers and dedicated-purpose devices.

With your browsers and other applications, keep tabs on what plugins, extensions, toolbars and other add-on modules are running and if you notice something being awry about the module since you installed, don’t hesitate to remove it. A good article on this topic concerning uninstalling applications on the Mac is this one on MacRumors.com which highlights that dragging an application bundle to the Trash may not be the only method available.

Conclusion

The main issue here is that the Apple Macintosh is a computing platform vulnerable to malware and will become more so as it be becomes more popular as a mainstream computing platform. So you would need to continue with proper computer-housekeeping practices to keep your Mac from these threats.

The newly-discovered security risk in all-platform runtime environments

Introduction

The recent security scare with the Apple Macintosh platform and its exposure to the Flashback malware was centered around the use of Java on this platform, rather than being targeted directly using native code. But there have been similar risks targeted at this platform but this time using the Adobe Flash runtime environment.

Previously the typical computer’s operating system, desktop-productivity software and default Web-browsing environment has been targeted by malware writers. This has been more so with software that is used by many people, like Microsoft’s Windows XP operating system and Internet Explorer Web browsers.

But Microsoft, Apple and the open-source community have been working lately on hardening their operating-system, desktop-productivity and Web-browsing software against malware. This has been done through releasing software patches that fix vulnerabilities as soon as they are discovered and having such patches delivered using automated software-maintenance systems like Windows Update.

So malware authors are now turning their arrows towards the multi-platform runtime environments like Oracle’s Java and Adobe’s Flash and Air environments. These typically have a runtime component that is user-installed on most computing platforms, or this component is rolled in to some computing platforms.

These runtime environments have appealed to mainstream software developers because they can create their software in a “write once, run anywhere” manner without needing to port the software to the different platforms they want to target. This situation also has appeal to malware authors due to the ability to target multiple platforms with little risk as well as finding that these runtime environments aren’t patched as rigorously as the operating systems.

One main problem – Java and how it is maintained on the Macintosh

The Java runtime environment used to be delivered with the Windows platform until 2004 due to a legal agreement between Sun and Microsoft regarding an anti-trust issue. Now Windows users pick up the runtime code from Oracle’s Java website now that Oracle have taken over the Java environment from Sun.

But Apple still delivers the Java runtime environment to their Macintosh users, either with the operating system until “Snow Leopard” or as a separate download from their Website for subsequent users.

For both platforms, the Java runtime survives operating-system updates, even major version upgrades. As well, it, like the Adobe Flash runtime, has to be updated separately.

Windows and Linux users still have the advantage of going to the Oracle Website to install and update the Java Website and they can set up the Java installer software to implement the latest version automatically or let them know of updated Java runtimes. But Apple don’t pass on new updates for the Java runtime to MacOS users as soon as Oracle release them.

What Apple should do is pass on the Java runtime updates as soon as Oracle releases these updates. This could be involving Apple ceding the management of the MacOS X Java runtime to Oracle and writing any necessary integration code to support co-ordinated maintenance of this runtime the the Macintosh platform.

What users can do with these runtime environments

Users can keep their runtime environments for Flash, Java, Adobe Air and other “write once, run-anywhere” platforms by looking for updates at the developer’s Website. They can also enable automatic deployment of critical updates to these environments through various options offered by the installer.

But do you need to keep any of these runtime environments on your regular computer? You could do without it but some vertical, enterprise and home software requires the use of these runtime environments. In some cases, some developers write parts of their software in native code for the platform the software is to run on while using “write once, run anywhere” code that works with these environments for other parts.

For example, YouTube,  most browser-hosted games or file-transfer interfaces for Websites implement Adobe Flash Player while programs like OpenOffice, Adobe’s Creative Suite and some enterprise / vertical software require Java.

If you are not likely to running any programs that depend on a runtime environment regularly or can avoid needing that particular environment, you could avoid installing the environment at all to keep your computer secure and stable.

What can the industry do

Use of computer security software to protect against runtime-environment attacks

A question that could be raised is whether it is feasible for a computer-security program to be written so that it can inspect the software that is intended to be run in these environments.

This is more so as these environments become ubiquitous for delivering software to multiple computing environments. In the case of Java, this environment is being implemented as a baseline for the Android platform and as the language for writing interactivity in to Blu-Ray Discs.

This could be achieved through the use of plug-in modules for current desktop and appliance-level security applications; or for modules that connect to the runtime environments, observing for abnormalities in the way they handle computer resources.

Development of enhanced runtime environments that work with the host operating system’s security logic

It can also be feasible for the runtime environments to work tightly with the operating-system’s user access management and prevent the programs that work behind them from using resources unless they are explicitly allowed to. This could involve use of sandboxes or privilege levels that mimic the operating system’s privilege levels thus working at the lowest level unless they have to work higher.

Consistent and responsive updating of the runtime environment across all platforms

Adobe, Oracle and others who develop “write-once, run-anywhere” platforms could implement a consistent and responsive update policy for these platforms in response to any discovered bug or exploitable software weakness. The developers of these platforms have to be sure that the updates are delivered as soon as possible and across all platforms that the runtime environment is targeted at.

This includes development of a strategy so that access to the targeted platforms is guaranteed by the runtime-environment developer. For example, it may include immediate propagation of firmware updates for devices or the use of the developer’s own installation routines for all regular computing environments.

Allow design-time native-binary compiling for desktop Java

Another improvement that I would like to see is for software that is written in the Java language to be able to be compiled to native binary (.EXE) code during development. Here, this could allow a desktop-software project that has routines written in Java as well as routines written in other languages like C++ and targeted to one platform to be able to run quickly and securely on that platform.

It will then avoid the need to require the installation of the Java runtime when a program like Adobe’s Creative Suite software is deployed to the end user. It can also allow the developer to deliver the software to many platforms in a binary form that is native to each target platform, thus allowing for efficient use of system resources.

Conclusion

Once we adopt proper standards concerning the management and maintenance of “write-once, run-anywhere” software-development platforms and make them to the same standard as regular-computer operating systems, this can reduce the chance of these platforms being exploited by malware authors.

Criminal legal action now being taken concerning “scareware”

 Articles

Scareware Indictments Put Cybercriminals on Notice – Microsoft On The Issues

Swede charged in US over ‘scareware’ scheme | The Local (Sweden’s News in English) – Sweden

US-Behörden klagen Scareware-Betrüger an | Der Standard (Austria – German language)

From the horse’s mouth

FBI Press release

My comments

What is scareware

Scareware is a form of malware that presents itself as desktop security software. Typically this software uses a lot of emphasis on “flashing-up” of user-interface dialogs that mimic known desktop security programs, whether as add-on programs or functions that are integral to the operating system. They also put up dialogs requiring you to “register” or “activate” the software in a similar manner to most respected programs. This usually leads you to Web sites that require you to enter your credit-card number to pay for the program.

In reality, they are simply another form of Trojan Horse that is in a similar manner to the easy-to-write “fake login screen” Trojans that computer hackers have created in order to capture an administrator’s high-privilege login credentials. Some of the scareware is even written to take over the computer user’s interactive session, usually with processes that start when the computer starts, so as to “ring-fence” the user from vital system-control utilities like Task Manager, Control Panel or command-line options. In some cases, they also stop any executable files from running unless it is one of a narrow list of approved executable files. They are also known to nobble regular desktop anti-malware programs so that they don’t interfere with their nefarious activities. This behaviour outlined here is from observations that I had made over the last few weeks when I was trying to get a teenager’s computer that was infested with “scareware” back to normal operation.

Who ends up with this scareware on their computer

Typically the kind of user who will end up with such software on their computer would be consumers and small-business operators who are computer-naive or computer-illiterate and are most likely to respond to banner ads hawking “free anti-virus software”. They may not know which free consumer-grade anti-virus programs exist for their computing environment. In a similar context, they may have found their computer is operating below par and they have often heard advice that their computer is infested with viruses.

What you should do to avoid scareware and how should you handle an infestation

The proper steps to take to avoid your computer being infested with scareware is to make sure you are using reputable desktop security software on your computer. If you are strapped for cash, you should consider using AVG, Avast, Avira or Microsoft Security Essentials which have the links in the links column on the right of your screen when reading this article on the site.

If you have a computer that is already infected with this menace, it is a good idea to use another computer, whether on your home network or at your workplace, to download a “process-kill” utility like rkill.com to a USB memory key or CD-R and run this on the infected computer immediately after you log in. It may alos be worth visiting the “Bleeping Computer” resource site for further information regarding removing that particular scareware threat that is affecting your computer. This is because I have had very good experience with this site as a resource when I handled a computer that was infested with scareware.

If you are at a large workplace with a system administrator, ask them to prepare a “rescue CD” with the utilities from the “bleeping-computer” Web site or provide a link or “safe-site” option on your work-home laptop to this site so you can use this computer as a “reference” unit for finding out how to remove scareware from a computer on your home network.

How the criminal law fits in to this equation

The criminal law is now being used to target the “scareware” epidemic through the use of charges centred around fraud or deception. Like other criminal cases involving the online world, the situation will touch on legal situations where the offenders are resident in one or more differing countries and the victims are in the same or different other countries at the time of the offence.

This case could raise questions concerning different standards of proof concerning trans-national criminal offences as well as the point of trial for any such offences. 

Conclusion

Once you know what the “scareware” menace is, you are able to know that criminal-law measures are being used to tackle it and that you can recognise these threats and handle an infestation.

Disclaimer regarding ongoing criminal cases

This article pertains to an ongoing criminal-law action that is likely to go to trial. Nothing in this article is written to infer guilt on the accused parties who are innocent until proven guilty beyond reasonable doubt in a court of law. All comments are based either on previously-published material or my personal observations relevant to the facts commonly known.