Virmansec Event Success!

Elhamdulilah, the presentation I gave on conficker at the Microsoft Innovation Center, Riyadh was a success.

The presentation can be downloaded from here:
http://staff.kfupm.edu.sa/coe/shafei/downadup.zip

The powerpoint slides is mostly pictures and it may not be of much benefit to those who havent attended. However, a lot of the technical information has already been mentioned here this blog. The presentation style was inspired by the best presentation gurus such as:
- bio/intro and overall structure as by Garr Reynolds
- slides and graphics as by Dick Hardt and Seth Godin
- speaking freely as by Guy Kawasaki
- walking freely as by Steve Riley

Running the powerpoint will be a bit heavy on a windows OS. had to optimize my operating system in order for it to run smoothly on a projector with completely no lag. This is what I have done to have a lag-free presentation:
1. Disabled all real-time protection tools including firewall. (assuming you are not connected to the internet)
2. Disabled automatic updates
3. Disabled Task Scheduler via services mmc
4. Disabled screensaver, and all power saving options.
5. Disabled wireless connection and all related processes. (left bluetooth on for my bluetooth mouse/pointer)
6. Disabled all unneccessary processes. In my task manager I had a total of 28 processes left running on an XP machine. I preferred not to disable other OS processes because I had to run a demo on the same machine.

Conficker Presentation at Riyadh

God willing, I will be doing a presentation at the Microsoft Innovation Center on fighting the Conficker worm. This a highly technical presentation mainly targeted towards enterprise environments. The presentation includes live demos on infected machines. Microsoft Corporation (MSFT), Virmansec and R-Tech will be sponsoring the event.
The presentation covers all possible techniques in detecting and removing conficker for enterprises.

Attendance and registration is for free. Snacks and refreshments are also for free. If you are in Riyadh, please take the time to read and register for the event here:
http://www.eventbrite.com/event/472252520

Advanced knowledge about windows NT operating systems and active directory is a must.

Server 2008 RMS Installation Problem

I spent a few days trying to implement a simulation environment to test windows Rights Management Services and some third-party plugins on a server 2008 native. Every time I attempt to install RMS 2008 I was confronted with the following error message:

Error: Attempt to configure Active Directory Rights Management Server failed. An error was encountered while trying to provision AD RMS. Remove and re-install AD RMS to attempt provisioning again.

Despite uninstall/reinstalling the RMS service several times and verifying all the pre-requisites the error message still popped-up. I have followed every single line mentioned in the microsoft guide but yet the error re-appeared. There were absolutely no log files or events to explain the acause of the error. Also I couldnt find any solution on the internet that worked.
Almost giving up, my partner and I resorted to an unexpected solution..... changing the AD domain name.
RMS 2008 seemed to distaste single lettered domain names such as A.com and B.com that we initially tried to use. This was a bit strange since RMS 2003 worked fine using these same test domain names.

So after the changing the domain name to demo.com seemed to work with us in getting rid of the mysterious error message.

With courtesy of Samer Alotaiby.

3,200 Reported Account Hijacking on Facebook,Twitter

If you're on Facebook, Twitter or any other social networking site, you could be the next victim.
That's because more cyberthieves are targeting increasingly popular social networking sites that provide a gold mine of personal information, according to the FBI. Since 2006, nearly 3,200 account hijacking cases have been reported to the Internet Crime Complaint Center, a partnership between the FBI, the National White Collar Crime Center and the Bureau of Justice Assistance

Continue reading:
http://edition.cnn.com/2009/CRIME/10/19/social.networking.crimes/index.html?iref=mpstoryview

From the article:

How to protect yourself against social media scams:
- Change your passwords frequently
- Adjust Web site privacy settings
- Be selective when adding friends
- Limit access to your profile to contacts you trust
- Disable options such as photo sharing
- Be careful what you click on
- Familiarize yourself with the security and privacy settings
- Learn how to report a compromised account
- Use security software that updates automatically

(Information provided by FBI and Internet security experts)

New Variant of Total Security Locks up Applications on Infected PC's

A new variant of scareware has been detected that not only inundates
users with exhortations to purchase phony antivirus software called
"Total Security 2009," but that also locks users out of nearly all
applications until they purchase the disreputable product. Once their
PCs are infected with the malware, the only program users can open is
Internet Explorer, so they can navigate to the site and make a purchase.

More:
http://blogs.usatoday.com/technologylive/2009/10/new-twist-on-scareware-locks-up-your-pc.html
http://www.pcworld.com/article/173765/a_rogue_demands_a_ransom.html

Removing Conficker/Downadup from Your Network Using Active Directory

A couple of security companies have provided some neat freeware tools for network administrators to cleanup the downadup worm within their business networks. Some examples of these tools are:
1. Kaspersky Administration kit
2. Bitdefender Network Removal Tool
3. Sophos Conficker Network Cleanup Tool

These tools provide an automated deployment and disinfection for multiple computers at once.

However, I was called to an enterprise client who was suffering from a Downadup outbreak last May. The client had approximately 4000 computers across 6-8 domains. There was one problem though; since the network tools were not provided by the antivirus vendor they had installed, the client was not comfortable to install any third-party software on their servers. Luckily, they were ok with using the tiny, fast and silent Kaspersky kk.exe program. Now, I had to figure out to run this tool across all the infected machines for each domain. This is how I did it:

Investigating New Trends of Rogue Antiviruses - Part 2

Besides the randomly named sites that host the rogue antivirus pages, I have also noticed a huge amount of legitimate sites that have been compromised to direct traffic to the rogue antivirus domains.

Each compromised website contains a folder with a 5 lettered randomly generated name. The folder also contains another randomly generated folder of the same length that contains hundreds of computer generated infected php web pages.

Examples of the folders found on compromised legitimate sites that I have discovered via google are:
http://kingofthecageskennels.com/hoabe/sueno/
http://trd3tv.net/qiqut/aejpc/
http://markingsstudio.com/ppplc/iyiux/
http://internationalharpmuseum.org/keaeb/qrdaw/
http://romania-ti.com/steuf/sgqrm/
http://bizbuilderswa.org/pmrum/bpakx/
http://mrantasi.com/ljglc/mjqrl/
http://amerilao.org/grano/kpsxm/
http://appliancerepair.tv/bseul/ewsyo/s
http://susancastor.org/czpmf/dihbl/
http://deartes.net/qesbr/sieme/
http://ffseguros.net/zwwzo/ommil/
http://eventsregister.net/cbuga/dykdb/
http://giaitri8x.net/bdrmh/bhusp/
http://alu-vene.com/eiika/zeypc/
http://streetmedia.us/iktdl/ytzcq/
http://butteredhost.com/iwyiw/xdbhc/
http://leadershipsummit.net/tyird/yeirh/
http://vogelrentalproperties.ca/iljqu/daogi/
http://punk-designs.com/uaiyx/tkuif/
http://guard-door.info/fqrna/nyhlh/
http://mortgagecapitalrealty.com/cyzle/ubpnr/
http://endoscopyspecialists.com/kescd/drwiy/
http://californiahistoricalsociety.org/ieeci/skelr
http://uriellaw.com/ilrxb/dxixr
http://elrealsabordecuba.com/lyxei/uolqe/
http://karpovthewreckedtrain.com/epjfw/htgbs/
http://moto-osat.com/npkcg/zuzfj
http://swanjoy.com/ewyqi/fopzi/
http://stevericks.net/yuyrz/tbrdw/
http://costumeoriental.com/lwicu/nghep/
http://kfgroup.net/nbfep/biqni/
http://otroma.com/omhig/flwbi
http://bilikbahasa.com/nsege/olgyf/
http://catasticbritz.com/imgjx/ekquz
http://tomspencerbassin.com/pcuwz/sbous
http://puijonsrknuoret.net/exhcy/sirfa/
http://caflasvegas.org/zeaen/ifpkl/
http://energizardelvalle.com/xisfe/esixm/

Examples of infected php pages taken from one of the above sites:
http://kingofthecageskennels.com/hoabe/sueno/survivors.php
http://trd3tv.net/qiqut/aejpc/pomegranate.php

The list of compromised sites continue to grow every hour.

Investigating New Trends of Rogue Antiviruses - Part 1

After being intrigued by the fact that my user name being used as keywords for developing malicious pages, I started investigating further the rogue antivirus pages the past two weeks whenever I had some free time.

I currently found so far the following main webpages where a lot of infected web pages direct their traffic to:
hxxp://fast-virus-scan7.com
hxxp://myzonesecure.com
hxxp://winfixscanner1.com
hxxp://7removespyware.com
hxxp://onlinesearch-protect.net
hxxp://compurerthreats2.com
hxxp://mytotalscanner.com
hxxp://mytotalscanner17.com
hxxp://mytotalscanner17.com/scan2/video2.php?pid=111
hxxp://protectyourpc-now1.com/pr.cgi?id=2739
hxxp://best-scanpc.net/disk/?code=934
hxxp://check-threats-online.com

The following domains which are likely bot generated sites that redirects traffic to the above malware sites:
jntscxwv.cc
hibqeidh.cc
gmfcmdt.cc
ppsjucknp.cc
cqmilpkl.cc
fymhizm.cc
ockdtsahp.cc
srpantlq.cc

New Smitfraud Variant

I was searching my username today on google and I found a malicious site that uses my username as keywords. The malicious pages includes the following urls:
hxxp://q84.isutv.com/wap715-abuibrahim12.html
hxxp://ps51.isutv.com/wap565-abuibrahim12.html
hxxp://ps51.isutv.com/wap84-cherrytoons.html
hxxp://q84.isutv.com/wap363-query-letter.html
hxxp://ps51.isutv.com/wap780-whippedwomen.html
hxxp://ps51.isutv.com/wap293-dr-emma-starr.html
hxxp://q84.isutv.com/wap561-bnz.html
hxxp://q84.isutv.com/wap895-dmaiv.html
hxxp://q84.isutv.com/wap632-unesco.html

Each of the pages would redirect you tothe following rogue antivirus pages:
hxxp://best-virus-scanner4.com/scan1/?pid=111&engine=pHT3zjjyMjE2Mi4xMzEuMjQmdGltZT0xMjUuMIEMPAZO
hxxp://fast-virus-scan9.com/scan1/?pid=111&engine=pHT22jzyMjE2Mi4xMzEuMjQmdGltZT0xMjUuMkEMPAlO

The web page displays a classic fake explorer page giving an impression that your hard-disk partitions are being scanned and malware was found in the computer.
Clicking anywhere around the page, will prompt you download a new trojan named Antivirus_111.exe which at the time I write this blog entry has no detections by any antivirus.

The file when uploaded on VirusTotal, produced the following results:

Which is the best antivirus out there?

I have been asked this question almost everyday by friends, family, colleagues, businesses and a lot of people I bump to. As a security expert, I find this question is not that easy to answer. In my opinion there is no best antivirus software. Each has its own advantages and disadvantages. Also, I tend not to rely on the various antivirus ratings/comparisons performed by third-party organisations and those found on the internet. Though they do repesent accurate results depending on what testbenches they use, but they do not represent an accurate picture of the overall performance/quality of an antivirus software.

There is so much involved in evaluating an ativirus such as:
1. Detection rates (which most antivirus ratings tend to focus on). For better accuracy, detection rates should depend on the latest or existing malware out there on the internet. It would be pointless to evaluate the detection rate of an antivirus and compare it others using extinct malware samples such as apropos rootkit or even worse using vius samples from the DOS era.
2. Removal capabilities of active malware => an antivirus with a high detection rate does not necessarily mean that it is capable of removing the infection after it detects it. An antivirus would render useless if it is unable to clean or remove a virus it detects. I have seen this quite often with highly rated antiviruses.
3. False positive considerations
4. Memory and CPU resources and Scan times. People will refrain installing an antivirus if it will hog down thier systems regardless on how much you swear this is the best protection.
5. Rootkit, ADS, MBR detection+removal
6. Cleaning malware registry keys. A couple of antiviruses just remove virus files and leaves all associated registry items intact.
7. For businesses: integration with exchange, SAP, sharepoint, file servers, etc. and whatever is required to meet business needs.
8. Dealing with patched system files and file infectors.
9. How quick an antivirus responds to new threats and zero-day malware.
10. Customer experience with thier support system for either businesses or home (Not that important but worth mentioning).
11. Robustness => ideally a malware should not cripple or disable the antivirus or tamper with any of its files.

As a result, you will find the results from one antivirus ratings to another varies at a huge proportions. The top 10 in one rating could be among the last 10 in another rating. For example, NOD32 is rated 3rd best antivirus according to av-comparatives.org. But according, to mtc.sri.com, NOD32 was ranked last from among 30 antiviruses. In AV-test it is ranked 15th.