Category Archives: Malware

Definitions, Malware, Things that are bad

What is a worm?

Leave a comment

In computing, a worm is a type of malicious software (malware) that replicates itself and spreads to other computers or networks without the need for human interaction. Unlike viruses, worms do not require a host program to attach themselves to, and can propagate independently through computer networks, usually by exploiting vulnerabilities in operating systems or other software.

Once a worm infects a computer, it can perform various malicious actions, such as stealing sensitive data, sending spam emails, launching distributed denial-of-service (DDoS) attacks, or installing additional malware. Worms can also consume a large amount of network bandwidth, causing network slowdowns or outages.

To protect against worms, it’s important to keep software up-to-date with the latest security patches, use antivirus software, and avoid downloading or opening suspicious attachments or links in emails.

(Ed: written by ChatGPT; verified by jrivett.)

Definitions, Internet, Malware, Privacy, Security, Things that are bad

What is spyware?

Leave a comment

Spyware is a type of malicious software designed to gather sensitive information from a computer system without the user’s knowledge or consent. This information can include personal information such as passwords, credit card numbers, and online browsing habits, as well as system information such as installed software and hardware specifications. Spyware can be installed on a computer through a variety of means, such as email attachments, infected websites, and bundled software. Some spyware is designed to monitor a user’s activities for advertising purposes, while others are used for more malicious purposes such as identity theft and financial fraud. Spyware can cause a number of problems for a computer user, including decreased system performance, slow internet speeds, and a loss of privacy. It is important to protect your computer from spyware by using anti-virus software and avoiding downloading suspicious files from the internet.

(Ed: written by ChatGPT; verified by jrivett.)

Definitions, Internet crime, Malware, Security, Things that are bad

What is a computer trojan?

Leave a comment

A Trojan, or Trojan horse, is a type of malware that is disguised as legitimate software. It is called a Trojan because it typically presents itself as something harmless, like a game or utility program, but once executed, it can perform malicious actions on the infected computer. These actions can include stealing sensitive information, downloading and installing other malware, or allowing unauthorized remote access to the computer. Trojans are often distributed through email attachments, instant messaging, and social media, and they can be very difficult to detect and remove.

(Editor’s note: I’m going to keep posting these definitions as long as ChatGPT is able to generate accurate and useful text. I have no plans to allow ChatGPT to take over all of my writing duties.)

Definitions, Malware, Security, Things that are bad

What is malware?

Leave a comment

Malware, short for malicious software, is any software designed to harm or exploit a computer system. There are many different types of malware, including viruses, worms, Trojans, ransomware, adware, and spyware. Malware can be spread through email attachments, malicious links, infected websites, and other means. It can be used to steal sensitive information, such as login credentials and financial data, disrupt or damage computer systems, and perform other malicious activities. Protecting against malware involves keeping your operating system and antivirus software up to date, being cautious about the emails and links that you open, and avoiding downloading software from untrusted sources.

(Editor’s note: this post was written by ChatGPT, and its veracity checked by me, the human person who runs this site.)

Android, Internet crime, Malware, Mobile, Privacy, Security, Things that are bad

Pegasus spyware

Leave a comment

Pegasus is spyware that can be installed on Apple and Android mobile systems. It’s difficult to detect, and difficult to remove. Pegasus is developed by NSO Group, who deny that the software is being used for anything nefarious, or that if it is, that use has nothing to do with NSO Group.

The methods used to install Pegasus on mobile devices have changed over the years. It can be installed directly, with physical access to the target device, which is presumably how it ends up on devices legitimately. Pegasus can also be installed more surreptitiously. Previously, that involved inviting the user to click a link in an email or SMS message. More recently, it’s being installed using app and O/S exploits that require no interaction from the user, including a very nasty exploit for WhatsApp.

Pegasus is not a virus. It does not spread on its own. Further, it’s important to distinguish between Pegasus and the methods used to install it. Pegasus does not typically arrive on a device at random. Devices are specifically targeted, and those targets are often used by journalists, suspected terrorists, and other people whose activities are tracked by government agencies and criminal organizations.

The main problem here is not Pegasus, but the way security vulnerabilities are discovered and — more importantly — how information about vulnerabilities is disseminated. Unfortunately, some organizations perform this research not for the public good, but for themselves and their partners, legitimate and otherwise. In an ideal world, when a vulnerability is discovered, the vendor is informed privately and then proceeds to develop and release a fix. In reality, vulnerabilities and exploits are often hoarded.

Advice to anyone who operates a mobile device and wants to reduce the likelihood of Pegasus or other unwanted software being installed without their knowledge: stay informed regarding security vulnerabilities in your device’s O/S and any apps you run. When you learn about a zero-click exploit, immediately install a fix if one is available, or uninstall the affected app. If it’s an unpatched O/S vulnerability, all you can do is hope that you’re not being targeted.

Related

Malware, Security, Things that are bad

Flagging software as dangerous for the wrong reasons is idiotic

Leave a comment

There’s a disturbing trend in the world of malware detection: falsely labeling software as malware.

For example, there’s an entire category of software that’s being mislabeled as malware by an increasing number of anti-malware providers: torrent software.

Torrent software is widely used by people trying to get access to cultural material that is otherwise locked away by the gatekeepers of big media (by way of prohibitive pricing, overlapping services, poor or unavailable service, geo-locking, release windows, and other big media fuckery).

Torrent software is used all over the world to legally share media in an extremely efficient, and Internet-friendly way.

But big media doesn’t care about any of that, because torrent software is also used for piracy.

Currently, there are efforts underway by media organizations to discredit and cripple torrent software in any way possible. Apparently they are now leaning on anti-malware software and service providers.

Why would an otherwise reputable anti-malware organization erroneously flag software as malicious? There are a number of possibilities:

  • They are being fed false information
  • Industry/corporate threats
  • Financial incentives

Why is this a problem?

  • It’s an extremely annoying inconvenience for users. Unable to install the falsely-labeled software, or exclude it from malware scans, some users will resort to uninstalling their anti-malware software.
  • It’s increasingly difficult for users to distinguish between actual threats and bullshit.
  • If an actually malicious version of one of these programs comes along, there’s no way to distinguish it from other versions that are erroneously flagged as malicious.
  • A general loss of trust in anti-malware providers and their services.

Big media will keep playing this idiotic game of whac-a-mole in any way their lawyers dream up. Media piracy continues, despite these efforts, and the only people affected are innocent users.

Advice to anti-malware purveryors: stop doing this. It’s short-sighted, dangerous, and stupid.

Hardware, Internet crime, Malware, Security

What you need to know about VPNFilter

Leave a comment

Update 2018Jun11: According to the latest report from security researchers at Talos, the list of routers affected by VPNFilter is now much larger. The malware’s capabilities are now better understood, and include the ability to intercept and modify network traffic passing through affected devices. To see the updated list of devices known to be affected by VPNFilter, scroll to the bottom of this page and look for the heading Known Affected Devices. Bruce Schneier weighs in.

Over the last week or so, you’ve probably noticed several stories about some malware called VPNFilter. For most people — and for a number of reasons — VPNFilter doesn’t pose a significant risk. But it’s a good idea to make sure. Here’s what you need to know:

  • VPNFilter is designed to infect SOHO (Small Office / Home Office, aka consumer-grade) network routers and Network Attached Storage (NAS) devices. It appears to have been active since 2016, and is known to have infected hundreds of thousands of devices worldwide.
  • Only a few specific router models are known to be vulnerable to VPNFilter, but there may be more. The list of vulnerable devices includes several models from Linksys, Mikrotik, Netgear, QNAP, and TP-Link. If you know (or can find) the make and model of your router, check to see whether it’s on the list.
  • On May 23, the US Justice Department announced that they had effectively neutered VPNFilter by taking over one of its command and control domains. But VPNFilter remains on many infected devices, as do the vulnerabilities that allowed infection in the first place.
  • The FBI is asking everyone on Earth who manages or is responsible for any consumer-grade router, to restart it. This will remove the second stage of a VPNFilter infection from a router. It may seem like overkill, but until we have a complete list of vulnerable devices, it’s a risk-free way to disrupt VPNFilter’s activities.
  • If you think your device has been infected — perhaps because it’s on the list of known affected devices — the only way to fully remove the infection is to reset the device to its factory settings. This sounds simple but can actually be problematic. Resetting a router can cause connected devices to lose access to the Internet, and things gets worse from there. If you want to attempt this, you should first log into your device’s web interface and document all important settings, because you’ll need to reconfigure the device after it’s been reset. Disconnect the device from the Internet before resetting it, because its administration password will be reset to a known default. Change that password as soon as possible after the reset.
  • If you manage your own router or NAS device, it’s critically important to configure it sensibly. That means changing its default password, and disabling any features that allow for remote (i.e. from the Internet) administration.
IoT, Malware, Security

Mirai botnet update

Leave a comment

It wasn’t Russia, or China, or any other nation-state. The motive wasn’t political. The IoT-based Mirai botnet was created by three young American men as a tool for crippling Minecraft servers and related services.

Of course, once Mirai’s authors realized the unprecedented power of their creation, they started using it for other things: as a tool for gaining customers for an anti-DDoS service; to kick Brian Krebs’ web site off the Internet as revenge for outing the authors of vDOS; and later as a lucrative click fraud engine.

Last week, in a courtroom in Alaska, Mirai’s creators all pleaded guilty to charges related to Mirai, including conspiracy to violate the Computer Fraud and Abuse Act (CFAA). FBI agents had tracked the botnet’s activities to the trio.

While I’m happy that these assholes have been caught, and are likely to spend significant time behind bars, Mirai is a sobering reminder of the fragility of the Internet. The earliest version of the Internet was ARPANET, which was literally designed to withstand nuclear attack. But even nukes can’t compare with the power of smart, young people with plenty of spare time. Not long after the Internet was born, a college student named Robert Morris brought the nascent network to its knees with a simple software worm.

Meanwhile, because the Mirai authors shared the botnet’s source code (in a futile attempt to confuse investigators), Mirai clones are popping up regularly, and doing a lot of damage.

Still, it’s encouraging to see that the FBI and other agencies are getting better at tracking the perpetrators of these malicious schemes. Other recent arrests include the person behind an attack on Deutsche Telekom that used a Mirai variant; and the operator of the Kelihos botnet. Hopefully these arrests will provide a sufficient deterrent for those similarly inclined.

Malware, Patches and updates, Security, Things that are bad, Windows

CCleaner malware incident

Leave a comment

A recent version of the popular Windows cleanup tool CCleaner contains malware, apparently added by malicious persons who gained access to a server used by the software developer, Piriform.

The malware was found only in the 32-bit version of CCleaner 5.33.6162. No other versions were affected.

Piriform reacted quickly to the discovery, and yesterday released a new version: CCleaner 5.34.

If you have CCleaner installed on any Windows computers, you should make sure you’re running version 5.34, and if not, install it as soon as possible.

Update 2017Sep23: The server that was breached is actually managed by Avast, which purchased CCleaner software developer Piriform in July.

Ongoing analysis of the hack revealed that this may have been a state-sponsored attack, and that it specifically targeted high profile technology companies. Apparently the malware in the compromised version of CCleaner contained a second payload that was only installed on about twenty computers at eight tech companies.

Hacking, Internet crime, Malware, Microsoft, Security, Things that are bad, Windows

Timeline: NSA hacking tool to WannaCry

1 Comment

A recent Washington Post article is helping to answer some questions about Microsoft’s actions in recent months. Here’s a timeline of events:

2012 (or possibly earlier): The NSA identifies a vulnerability in Windows that affects all existing versions of the operating system, and has the potential to allow almost unfettered access to affected systems. A software tool — an exploit — is developed either for, or by, the NSA. The tool is called EternalBlue. People at the NSA worry about the potential damage if the tool or the vulnerability became public knowledge. They decide not to tell anyone, not even Windows’ developer, Microsoft.

EternalBlue finds its way into the toolkit of an elite hacking outfit known as Equation Group. Although it’s difficult to know for certain, this group is generally assumed to be operating under the auspices of the NSA. Equation Group may work for the NSA as contractors, or they may simply be NSA employees. Regardless, the group’s actions seem to align with those of the NSA: their targets are generally in places like Iran, Russia, Pakistan, Afghanistan, India, Syria, and Mali.

Early to mid-2016: A hacking group calling themselves The Shadow Brokers somehow gains access to NSA systems or data, and obtains copies of various NSA documents and tools. Among those tools is EternalBlue.

August, 2016: The Shadow Brokers begin publishing their NSA haul on public services like Tumblr.

January 7, 2017: The Shadow Brokers begin selling tools that are related to EternalBlue.

Late January to early February 2017: The NSA finally tells Microsoft about the vulnerability exploited by EternalBlue. We don’t know exactly when this happened, but it clearly happened. The NSA was Microsoft’s source for this vulnerability.

February 14, 2017: Microsoft announces that February’s Patch Tuesday updates will be postponed. Their explanation is vague: “we discovered a last minute issue that could impact some customers.”

Late February 2017: The Windows SMB vulnerability exploited by EternalBlue is identified publicly as CVE-2017-0144.

March 14, 2017: March’s Patch Tuesday updates from Microsoft include a fix for CVE-2017-0144, MS17-010. The update is flagged as Critical and described as Security Update for Microsoft Windows SMB Server (4013389). Nothing in Microsoft’s output on March 14 calls special attention to this update.

April 14, 2017: The Shadow Brokers release 300 megabytes of NSA material on Github, including EternalBlue.

May 12, 2017: WannaCry ransomware infection wave begins. The malware uses EternalBlue to infect vulnerable computers, mostly Windows 7 PCs in Europe and Asia. Infected computers clearly had not been updated since before March 14, and were therefore vulnerable to EternalBlue.

It’s now clear that the NSA is the real problem here. They had several opportunities to do the right thing, and failed every time, until it was too late. The NSA’s last chance to look at all good in this matter was after the vulnerability was made public, when they should have made the danger clear to the public, or at least to Microsoft. Because, after all, they knew exactly how useful EternalBlue would be in the hands of… just about anyone with bad intent.

Everyone involved in this mess acted foolishly. But whereas we’ve grown accustomed to corporations caring less about people than about money, government institutions — no matter how necessarily secretive — should not be allowed to get away with what the NSA has done. Especially when you consider that this is just the tip of the iceberg. For every WannaCry, there are probably a thousand other threats lurking out there, all thanks to the clowns at the NSA.

Ars Technica’s analysis.

Techdirt’s analysis.