I'm spending the quiet time during the holidays working with my colleagues on FaceTime's end-of-year analysis of how real-time communications, social media, other Web 2.0 applications - and the malware using these channels - have affected organisations over the last 12 months. We'll release the full results next week, but I wanted to share some early insights.

 

This year, for the first time, we collected real-world data taken from our Unified Security Gateway appliances deployed across more than 60 participating global organisations. These companies have opted into a program that sends data back to us, so we can analyze Internet application traffic.

 

So what did we learn?

 

Facebook represented the largest single Web 2.0 destination that we tracked, hands down. Maybe not a big surprise, but what I find compelling is that only about one percent of attempts to access Facebook were blocked. It shows that our customers are forward thinking companies that view the use of social networks as positive to their business environment - 99 percent of Facebook visits were allowed by IT policy.

 

These particular employees accessed 890 different Facebook applications over the past few months. Here are the Top Ten applications that were used during working hours on our customers' networks.

 

1.      Facebook Chat (messaging)

2.      Private Photo Gallery (photo, dating)

3.      Wordscraper (gaming)

4.      Do Not Remember (drinking)

5.      Word Twist (gaming)

6.      Are YOU Interested? (dating)

7.      Bumper Sticker (just for fun)

8.      MindJolt Games (gaming)

9.      Slide FunSpace (messaging)

10.  (Lil) Green Patch (gaming)

 

(Sadly my favourite, WordBubble, didn't make the Top Ten)

 

This is by no means a statistically relevant sample of the world as a whole, but the data gives us a indication of what's really happening out there in the Web 2.0 world. And it supports the findings from our annual Collaborative Internet study: The lines between employees' work and personal lives are increasingly blurred, and employees feel they have a right to download - or access - whatever they choose on their work computers. (I know I wouldn't feel comfortable working for a company that didn't let me do this!)

 

Scarily I have two FashionWars invitations outstanding, as I write this - one of them from a seriously unfashionable, tech geek friend.  Si, you're scaring me. Please don't do this online, you know neither of us understands Jimmy Choos and the like...

I accompanied FaceTime Director of Malware Research Chris Boyd on a trip to BBC Television Centre in London earlier this month for an interview segment.  We'd worked with the BBC Technology group on some footage during the summer and it aired earlier this week on the BBC website.  This led to a rollercoaster week for us with the media here in the UK starting with a front page news story, in the UK's fourth largest daily newspaper, the Metro.  Not long afterwards, we were asked if we'd like to take part in Friday's edition of BBC Newsround.

 

What sparked this media frenzy was the release of footage of Boyd, the leading man in FaceTime Security Labs research team, talking about the phenomenon of kids using the Net, using forums and other social networking sites to share, sell and trade stolen identities, credit cards, game cracks and expensive software license keys.

 

If you grew up in the UK in the 70's or 80's you'll remember John Craven's Newsround.  At 5pm every day John Craven - and the latter teams, once he retired from his 27 year stint on the program, presented a 15 minute new programme, specifically targeted to young people.  I grew up with it, as did many of my peers. Their kids are now watching the noughties version of this real world, real time show.   So, you can imagine the excitement in the FaceTime camp when we arrived at Wood Lane tube station and walked up to the front gates of the BBC.

 

After we'd got through the public facing area - yes there are Daleks (they're much smaller than I imagined.) and the Tardis (just exactly as I imagined) - we noticed that the Newsround offices are very much like any other office, albeit a primary colour oriented office.  The team is young, bouncy (is that a real word to describe people?) and you can visibly see them translating your words into "young person speak," as the target audience for Newsround is the 6-12 year olds.  You can see coverage of this on the BBC website 

 

Chris talked in his video article about how kids of twelve start on the hacker track by finding cracks for games and then, high on the resulting ego trip, show off their prowess to mates.  While it might be fun and may make them the centre of their peer group, it's still illegal, it's still cybercrime, and it's usually the beginnings of lifestyle that may stop them from having a career they would actually want to put on their CV.

 

Whilst Chris was explaining this, Ricky Boleta, our given Newsround presenter, was translating it into pre-teen speak. He was stunned that these young children were actually involved in this kind of criminal activity. Chris detailed some of the techniques these kids used to share, steal and pass on this information. 

 

I'm pretty sure that unless you're in our IT Security Industry, it's nigh on impossible as a parent to understand what kids are up to these days whilst surfing - and I certainly know that most kids these days are more savvy at all the hacks they use to move up to the next level in World of Warcraft. Taking the next step to criminality isn't hard. Perhaps this is the "noughties" version of stealing a penny sweet from the store. Except the life lesson that they're going to learn is a darn sight harsher than a cane across the knuckles. (oo I'm showing my age and education there....)

 

I invite you to watch the BBC video and see what all the fuss is about.

Most people would agree, and Robert Scoble probably said it best, enterprise software isn't sexy. In fact, I'd understand if the words "extensible enterprise productivity suite" put you to sleep.

 

But what if I said a game-changing Web 2.0 entrepreneur and his star engineer are leaving Facebook to launch an extensible enterprise productivity suite. Are you a little more interested?

 

You should be. Since Dustin Moskovitz and Justin Rosenstein announced they were leaving Facebook earlier this month, a buzz has been swirling around the Valley, and everywhere else, about what's next. Why leave Facebook? THE hot property. To outsiders it might seem like the logical path would be to simply expand Facebook with this new enterprise offering, but both have said moving Facebook off course would distract from the company's mission (making the world more open through social software) and would not be good for the company. They claim the new project requires being built around a singular focus, "with the goals of efficiency and group collaboration embedded deeply into its DNA from day 1."

 

They also see the new venture as complimentary to Facebook. Using some of the same authentication technology and user experience modeling they hope the new products will become as familiar to people's work life as Facebook.com is to their social lives.

 

Interesting. Do they mean to imply that Facebook is only meant for social/personal use? At FaceTime the only trend we see more than companies investing in enterprise collaboration and productivity suites, is that these applications are rarely just used for one purpose - business or personal - but for both. Another common trend...no one application rules the roost, enterprise-grade collaborative suites are deployed alongside consumer and other enterprise-class applications all of the time. And our customers continue to tell us this. Facebook has already been adopted by individuals and organizations for collaboration, networking and information sharing. I suspect it will remain in place as a tool for business, even as its extensible enterprise brother joins the family - one very large, loud family of big company competitors including Microsoft, IBM, and Cisco, to name a few.  

 

This probably comes as no surprise, but seeing as FaceTime offers solutions that help manage and secure unified communications and collaborative suites, we like enterprise software. I'll admit it's not Angelina Jolie sexy, but it's certainly not boring. I think it will be interesting to see what two guys with a consumer-based social networking background do for enterprise software and the collaboration market. If you're questioning whether they hitched their wagons to the wrong star, you might consider what Hutch Carpenter had to say:

 

Rosenstein and Moskovitz are deeply ingrained at Facebook. They've been there for a while, and have seen it blossom as the go-to social network. They've were there for the heady valuation of $15 billion. The pre-IPO company still has work in front of it, but surely it's pretty interesting.

So what do they do? They quit to go start a BORING enterprise software company.

What could this possibly tell us?

If you read the full post you'll learn Carpenter's with me on this one - enterprise software, not so boring. So what will the Rosenstein/Moskovitz decision tell us? I don't know yet, but we're listening.

2009 has seen some incredibly diverse and creative attacks - shall we take one last look the scams, hijacks and infections that particularly caught our eye?

January: If someone told you people will pay good money to have a third party create a Botnet designed to DDoS gamers out of Xbox console sessions, you might have wondered what exactly they were talking about. However, this technique (which has remained off radar for quite some time) finally went mainstream with every second script kiddy trying to work out how to do it via endless Youtube tutorials and "What am I doing wrong" posts on hacking forums.

Attacks on games and gamers have been a constant thread in research this year, as scammers realise there's a fair amount of money invested in gaming profiles - and those profiles can be bought and sold, just like any other stolen account. Attacks on consoles provide a bit of a headache for office network admins, who may well be jumping on the "put a net connected console in the office rec room and leave it to its own devices" bandwagon. Not a good idea...

February: Taking the idea of valued gaming accounts one step further, Erik Larkin of PC World explored the attacks on Steam account holders via phishing techniques. Steam accounts can have hundreds (or in some cases thousands) of dollars invested in them, and regular seasonal sales tend to send profits through the roof. Indeed, there's a heavy collection of "ten free games in exchange for your login" phish pages in circulation at the moment. Don't be fooled!

April: You can never be too careful with downloads, as this story readily illustrated. An instant messaging password stealer (that could disguise itself as Yahoo Messenger, Live Messenger or Skype) turned up on Download.com, a trusted source of legit downloads. Rogue elements will sadly always slip through somewhere, but full credit to CNET for removing the offending program quickly.

June: A program surfaced claiming to be a mail bombing extravaganza that would smite all of your enemies. The catch? You had to give them your own email address to use it.

We've seen many, many programs that attempt to punk out people in the hacking / cracking communities and while the majority of those files tend to stay on hacking forums some do occasionally creep outside into the daylight.

July: Oh dear. Targeting twelve year old kids? There's lame - then there's this. Popular social networking / gaming site Neopets came under attack from individuals who decided to offer kids "magical paintbrushes" for their Neopet in return for running an executable file. Of course, those files would be Trojans, password stealers and various other nasties in disguise. Taking advantage of a young child's desire to obtain rare ingame items - then break their computer - is one of the lowest attempts at being "a hacker" we can think of.

There was also a look at Xbox Gamerscore hacking - a technique used by people who want to artificially inflate statistics related to a gaming account then sell it on.

Did we mention the Megan Fox fake sex tape yet? No? Well, here it is (an article about it, anyway). Celebrities will always be used as low hanging fruit as a means for people to infect themselves or fill in surveys and Megan is no exception where that is concerned.

August: Here we arrived at what seems to have been a phishing page linked to from a legit Facebook application URL. There was also this infection, designed to overwrite all the images on your PC with the word "Hacked".  The Facebook attack was fairly inventive, though we haven't seen a repeat performance so that's good news.

September:  Twilight fever. This was always going to be sucked into various scams and sure enough, just before New Moon came out in cinemas sites such as Youtube had videos on them promoting "online versions" of the film. Sure enough, all you got for your trouble was Zango installers and empty pages.

Can't have an end of year summary without a mention of Zango!

October: This particular file hit the streets a little while after Google Wave invites were no longer the hot topic of debate which probably helped to lessen the impact. A fake Google Wave invite generator most certainly did not generate passwords of any kind, but did seem to be a likely candidate for harvesting email passwords. Clever.

We also talked about Gamers Under Fire at SecTor 2009, a security conference held in Canada. You can take in all the conference presentations here - they're well worth checking out.

November: Ah, Facebook applications. Sometimes you get rogue ones - other times, you get scams like this where no applications exist. Someone had the idea of putting together a fake program that claimed to exploit a genuine application by revealing who-said-what about you. Of course, this was all nonsense and the program infected your PC with a horrible file of the attacker's choosing. A simple but effective attack technique.

December:  We'd been writing about various fake "work from home with Google" scams all year long, and it was nice to see some of them finally being tickled with the legal stick. Long may it continue.

We wound up the year with ZBot, in the form of a fake "Your VISA account has been compromised, download this file to see what's been going on" alert.

A wide-ranging set of attacks then, and a good indication (as if any were needed) that social networks, popular culture, videogames and the lives of celebrities will be targets for Botnets, exploits, scams, get rich quick schemes and every fake program you can think of well into 2010. It will be interesting to see how many 2.0 sites maintain a robust privacy policy (if such a thing is even possible) in the face of potential earnings from ad revenue, and how easy (or difficult) those policies will make it for those who want to use that data for nefarious purposes.

I've talked about Botnets used to kick gamers out of sessions before, but I thought it might be interesting to check out some of the current pricing, along with a few other things.

Botnets and Gaming - wha?

People have been using various means to lag people out of games for many years, but it had always been a PC thing. The moment online console gaming took off, somebody realised most console gaming sessions were peer to peer (which meant IP addresses were easy to grab), combined Botnets with moneymaking and rolled out an unstoppable army of teabagging and headshottery.

How?

It all depends on the game. Most online console games offer up rewards for progressing through the ranks, be it additional items, weapons, outfits and / or levels.

Stolen high level accounts in games such as Halo themselves fetch a tidy sum on the black market (would anybody have seriously thought a stolen gaming account could pull in as much as $25 a few years ago?) but the art of "host booting" has turned into a bit of a money spinner.

There are three main types of lagging a game out, and depending on how the game works various types will be deployed or blended to ensure the attacker wins the game and levels up.

1) Lag switching. A lag switch can be picked up for around $20, and if you've ever been in a game that appears to be frozen while the other team happily runs around shooting you this is likely the culprit. Quite common, unfortunately.

2) Host forcing. More often than not, many games come down to who happens to be hosting it. To ensure the hosting advantage (which may or may not be debated endlessly by those who refute being pwned by something as basic as "my connection wasn't as good") the art of "host forcing" was born. Typically, a combination of various programs are used such as Zone Alarm, Commview and custom built programs such as this one:

Last week, I spoke at SecTor 2009, on a subject near and dear to my heart: people messing around with videogame consoles in various horrible ways. Before I go any further, I want to say this - in terms of looking after people who turn up to speak, SecTor wins first prize. It might not sound like much, but it is extremely nice to have some dude waiting for you in a pre-paid car to take you to the hotel from the airport at 1AM when your plane has been delayed for seven or eight hours (cockpit windows fell out, or were about to. Long story).

So, large and appreciative hat tip to the organisers. They looked after me and stuffed me with food and I can't ask for anything more than that. You can also see a collection of photographs here. Some of them are even in focus.

As far as my talk goes - hoo boy. Talking about exploiting videogamers always seems to be a touchy subject, as gamers seem to lock themselves into a protective bubble, dismissing everything with "Nothing to worry about, it's only phishing".

Once it's put into a box like that - sorry man, lights out. Whatever gaming network you're talking about is "safe". No "hacking" is taking place. The "only" way someone can get your login - argh, the assumption that the ONLY thing bad people are looking to do on gaming networks is steal your login! - is by convincing you to put your information into a phishing page or handing it over. While the phishing side of things is accurate - nobody is going to get anything unless you GIVE them it, save for when they try to social engineer support staff - there are many, many steps along the way that involve all manner of hexing, hacking and getting around security systems on the console which lead to that phish being more convincing than it should be.

When it gets to that stage, the people who provide you with that gaming network need to sit up and take notice, because it is most certainly NOT just "about phishing". While gamers obsess over being "safe" in their account-not-phished world, the entirety of their gaming network had drowning in a sea of DDoS attacks, network spam and other junk clogging up their intertubes.

Also: this has been on Slashdot and a bunch of other places, and without having seen the talk (and going off the condensed coverage the talk has had) people are either misreading what went down, or going on about things I never mentioned at all (one guy is talking about "compromised XBox consoles being part of a DDoS Botnet" - what?)

It wasn't just about phishing. I showed some pretty pictures of the tools people use to tamper with files. There were paid-for DDoS Botnets, designed to kick people out of games. How about people messing with files so they could get things for free that the rest of us pay for. There was an examination of people getting around swear filters in a manner that allowed them to impersonate videogame developers. And so on.

Everything in my talk boiled down to one of three areas:

1. People who manage to run open source operating systems and old videogame consoles on an XBox360.

2. People who hex edit files in order to gain some advantage, in order to get things for free that everyone else pays for, to gain the upper hand in a game or to make some money when they come to sell their account on the black markets. Or, you know, EBay.

3. People who wheel out all kinds of malicious activities - DDoS, chat spam, phishing and social engineering - in order to give you a bad hair day. Again, winning the game might be the priority - but there are many other reasons. In the same way that it isn't just about stealing logins, it isn't just about winning games either. Many scams flying around the XBox Live network are nothing more than plain old harassment, bugging you for no good reason, flooding your inbox for the purposes of hilarity.....etc.

The main areas I explored were 2 and 3 - and wrapped up in both of those are two basic ideas: hack yourself, and hack others.

Let's be clear here, because people get way too wrapped up on the word "hack" where consoles are concerned. Spoon fed the idea that consoles are "secure", many people will dismiss any and all activity as "mere phishing". Yes, the ultimate goal for most malicious individuals in console land is to grab your account. Yes, the final roll of the dice when your number comes up (usually) relies on you handing over information to your attacker.

But in the process of obtaining that data, the attacker may well have blended software modding, file hexing and system exploitation to achieve that final headshot. They start with hacking something, and end with phishing. There IS hacking taking place, and it's really irrelevant if the hacking portion comes at the start or the end of the process - all that matters is they gain control of an account. They are hacking the software, the games, getting around the numerous security protocols designed to stop tampering and also using these same techniques to obtain items for free that regular users have to pay for.

I don't know about you, but it certainly sounds to me like someone is hacking something.

 I expand on this a little here, but feel free to keep rolling.

Key areas of console exploitation that I covered in my talk (loosely in the realm of points 1 & 2 above) were:

1) Artificially inflating your Gamerscore, either for kudos from your peers or financial gain by selling on high scoring accounts on various black market sites. If you can bump your own score easily, you don't have to get your feet dirty with that horrible phishing business.

2) Phishing accounts, particularly those with credit cards attached or - of course - those with high gamerscores. Phishes can (of course) be everything from the basic fake webpage, to lame messages sent across the XBox Live messaging system, or those wonderful fake points generator programs. Phishing has become a lot more sophisticated, and nowadays most phishing throw in some file tampering to make the phish more realistic. Speaking of which...

3) Hex editing data created on your console in order to cheat at games, unlock various things you'd otherwise have to pay for (which in many cases ties back to Gamerscore hacking) or perform malicious acts that often form one of the rungs in the phishing ladder. This is a perfect example. As I've said elsewhere, temporarily changing your gamertag in order to assume the identity of a game developer listed on gamerscore rank sites and phish another user is, I think, a pretty smart example of maliciously altering programming in ways it was never meant to be altered, as well as getting around a supposedly rock solid authentication system and throwing in a neat social engineering twist into the bargain.

4) People just want to have fun. And by "fun", I mean "fill up your gaming network with so much junk and rubbish that the whole thing eventually crumples in a heap and starts to cry". I covered Friend Request Spammers, DDoS attacks and a couple of other things such as lag switches that you buy from online stores and glue onto your controller but time was against me. I wanted to also explore things like chain letters (that require you to waste time by inserting a specific game disk to view them!) and other weird / not-so-wonderful items of strangeness, but I guess those will keep for another time.

Why are we at risk?

1) Modern console design is geared towards interactivity, and something working with everything else whether you want it to or not. You can get online with your console via ICS and a hole in the back of your PC, you can wirelessly use Windows Media Center with your XBox, and you can - crucially - take your removable XBox Hard Drive (geared towards digital downloads and eventually buying bigger drives) and use a Microsoft supplied USB wire and plug it into a PC, view all the files on it then start hexing many of them if you're that way inclined.

I'm not quite sure how someone at MS didn't think people wouldn't immediately plug these HDDs into computers and start looking around, but putting features onto gaming consoles that make them resemble mini PCs also makes them rather exploitable. The same features, the same functionality, the same funny shaped holes in the back of them and it all starts to go a bit pear shaped.

2) Dedicated pretexting groups on forums who will happily spend all day phoning Microsoft support reps in attempts to social engineer them into giving them your data. It seems after a number of incidents MS has tightened up in this area; however, people still complain that this has happened to them and these SE groups still exist. Some currently hijack accounts and give tutorials on how to keep them once stolen, which is, uh, a nice touch. I guess.

3) The huge obsession with promoting your gamerscore - an arbitrary numerical value assigned to achievements you earn in a game - as an amazingly cool thing. Witness this guy having a huge hissy fit about me daring to complain about it.

The flipside is that these scores single people out as targets for phishing, social engineering and general abuse. Limited privacy features mean you can only hide your most recently played games and achievements - pointless - but you CAN'T hide your gamerscore.

A common technique for social engineers is to simply go to one of the many sites that provide this data, such as the official XBox forums and make a running total of anybody with a score between 20,000 or 30,000 (or more) on the basis that those accounts will have unlocked more things in the game, or have a higher ranking, or have more shiny blinky things for you to play with.

Remember the "impersonate a game developer" scam I mentioned earlier? Many of the people trying that scam out would potentially have just gone to a site listing game developer Gamertags under "Celebrities" - like here - then writing down their names for future use.

You can bet a lot of people on that list don't know about the scams that are out there, despite them being game developers. Are we painting a big target on people that really should be a little more anonymous? I would argue we might be - phished game developer accounts would no doubt be able to fool a ton of starstuck game fans.

And we really should have the option to hide the Gamerscore, "celebrity" or not, should we choose to do so.

Conclusion

It's not all bad - Microsoft do ban lots of accounts for cheating and tampering, but I'm not kidding when I say the problem is long since out of control - jump onto Youtube or any other site, and there more cheating / hacking / modding videos there than you could ever hope to wade through in one lifetime. For all intents and purposes, we're all stuck with this until a real solution is found.

As for me, I'm going back to playing on my Atari 7800, where the only danger is that the ancient wiring might blow out and burn down my house.

Today we're going to look at a malicious program that seems to take its cue from the Facebook Freezers I've written about previously. In those cases, the aim is to get a Facebook account banned by repeatedly entering an incorrect password into the login form. Here, the intent is to make using your XBox the most annoying thing in the world.

Here is the program in question:

...."choosen"? Oh, this is going to be one of those scam attempts, isn't it?

Stepping up to the plate of fail this time round is

sonybetacommunity.tk

A site that claims to be a "Sony Beta Center", where you can gain special access to upcoming titles such as these....


Click to Enlarge

Quite why the background to a supposed Sony website is some sort of Elf thing from World of Warcraft, I couldn't tell you. Also of note is the wonderfully fictitious "Grand Theft Auto: Boston".

Yeah, right.

Anyway, at this point it normally decends into a phishing farce. Not this time, however:


Click to Enlarge

"1st. Sign up to the website below. Use the link below.
2nd. You need to have one offer confirm.
3rd. You need more than 1 cent, not including the $1 dollar bonus in your July earnings.
4th. You must do the offer for us to send you the a beta code.
Please read everything below!"

and

"Note: If you don't seethe daily jokes offer you can do Arcamax Recipes, or Health Newsletter. Make sure your pending earnings go into July earnings. If you don't do the offer, then it want confirm and you will just be mad at Sony when you don't get a beta code."

Health newsletters? Arcamax recipes? What?

As it turns out, the whole "game beta" thing is nothing to do with phishing at all - rather, they just want you to sign up to about a billion different Cashcrate offers, and if you do, then you'll really really really REALLY be sent Beta keys to your PSN account. Honest.

"When your offer confirms on the site (Meaning your pending earnings has went into your July earnings), go to your message center and reply to the message.

Include your PSN ID name and the 3 betas you want. Example = PS3GAMING500 -PSN ID

Once you reply to the message in the message center, we will check to see if the offer is in your July Earnings. If so, we will send your beta code to the message center on Cashcrate and your PSN ID."

I think I'm going to have to call shenanigans on this one, even if they do have a really official looking Youtube channel...

"Achievements are really just slaps on the back with an assigned point value; the amount of points isn't truly what's important, but it's nice to see." - Ten Achievement Commandments

When Microsoft released their XBox360, they came up with the idea of "Achievements" - unlockable badges that display your prowess in a game. Kill 50 bad guys? Achievement! Run through six levels without dying once and throw the final boss off a cliff with your eyes closed? Achievement! Press the start button? Achievement! (No, seriously).

Some would say it all went horribly wrong when Microsoft decided that achievements should come with "Gamerscore points". These entirely useless numbers assigned to achievements traditionally give little else other than bragging rights and....um....that's it.

However, an unforeseen consequence of gamerscore points is this:

1) Accounts with high gamerscores (generally anything over 30,000GS) become valuable targets for hackers & phishers - a high score generally means lots of valuable ingame items / bonuses are associated with the account such as Level 50 Halo 3 characters, unlocked rare items & skills, high ranking Call of Duty multiplayer characters etc. You can then sell or trade these accounts for other accounts, credit cards or anything else you feel like. Here's an example of someone getting ready to sell a tampered account with a Gamerscore that weighs in over 130,000k:

2) It's incredibly easy to find people with high gamerscores and make them a target - you simply need to browse the official XBox forums and see who has what, or jump over to a site such as Mygamercard or similar sites where it's the easiest thing in the world to line up your bullseye painted victims. If gamerscores didn't exist, it'd be a lot more time consuming to dig out profiles that had a large amount of achievements attached to them because there would be no obvious signifier that the account was worth pursuing.

3) This also means that any method of artificially inflating your gamerscore means a fast track to selling (what appears to be) a high scoring profile. There has been dabbling in this area for some time (here's an article from 2006 where the first shots are being fired by Microsoft in response to cheating; here's another from 2008) and programs used for this cheating have been (for the most part) kept close to the chest of those using them.

One reason for this is that the programs that actually work cost a lot of money - there's one program that can go for anything from $150 to $200 in the right circles.

However, that's all changed in the last month or so as one of the most well known programs (that apparently sells for around $50) has been cracked and made available to all and sundry, for free. It's no coincidence that Youtube is suddenly awash with videos offering Gamerscore tampering services and that EBay sellers are popping up with auctions like these:

Want to see some of the auction details? Of course you do.

"Why pay someone else to do it when you can do it yourself and when you have these programs you can sell 40,0000+ gamertags on ebay and make ????????"

...oh dear. We'll be paying the above EBay seller a visit a little later on, so keep "Da1truehomie" in mind.

The program currently being thrown all over the place on underground sites (and poorly worded EBay auctions) would be this one:

Editing the gamerscore & achievements is simply a case of hooking the XBox up to the PC (with a transfer cable you can obtain free from Microsoft...whoops) then tampering with the data using the required programs.

Once you go looking on sites away from the underground such as Youtube & other video sites, it's clear that this problem is now going mainstream. Is there anything Microsoft can do to stop this? Who knows, but people determined to alter their profile details should know the following:

1) Microsoft are very good at spotting tampered profiles, and swinging the appropriate banhammer. You might get away with it for a while, but eventually it's going to go horribly wrong. Remember EBay seller "Da1truehomie"? Here is his XBox profile, note the message at the bottom:

He can expect to have his score reset and be hit with a possible ban. On reflection, perhaps having the same username for both his XBox and EBay accounts wasn't a smart idea.

2) The program that so many people are sending around went a bit bonkers when it was cracked and made available for everyone to download. Namely, it doesn't unlock the achievements correctly, labels online specific achievements as having been unlocked offline and various other things that fairly scream "shenanigans".

I still say Microsoft should remove Gamerscores altogether, however. For the tiny amount of worth they bring (not much), it's greatly outweighed by the desire of scammers to both obtain it by phishing and inflate it by hacking. Stolen XBox profiles are now big business, and you can typically expect to pick up an account with a credit card attached to it for as little as $4.

The act of Gamerscore tampering also pretty much makes legitimate gamerscores even more worthless than they are now - spent three years building up your total via hours of gameplay? Too bad, that large collection of guys over there unlocked six billion points in a week. It also presumably makes it much more difficult for game developers to keep track of statistics such as these (stats which many companies often use to tweak difficulty settings in future releases), so everybody loses out.

Bragging rights - who'd have thought they'd cause so much trouble?

I regularly see a lot of extremely dubious and rather slimy techniques deployed to get end-users to run horrible things or fall for scams. Generally, the targets tend to be the technologically inept or granny, sitting in the corner. See granny? Sure you do, she's right over there replying to the Third King of Nigeria and helping him out with his cash relocation problem.

However, I've come across a scam rapidly spreading across numerous underground forums and IRC channels that is truly one of the scummiest tactics I've seen in some time.

How bad? Allow the following screenshot to spell it out for you.



Ladies and Gentlemen, allow me to present you with the winner of the Lowest Tactic Used in 2009 award. Do your kids play Neopets? If they do, you might want to read this and gently warn them of the dangers.

Neopets: What is it?

From Wikipedia:

Neopets (originally NeoPets) is a virtual pet website, based around the virtual pets that inhabit the virtual world of Neopia. Visitors can create an account and take care of up to four virtual pets, buying them food, toys, clothes, and other accessories using a virtual currency called Neopoints. Neopoints can be earned through playing games, investing in the game's stock market, trading, and winning contests such as customization and art. Neopets also operates a pay-to-play version known as Neopets Premium, which offers additional features and benefits for a monthly fee of $7.99 (USD).

The scam is based around one of the core mechanics of Neopets: kids love rare items and things that nobody else has. Neopets has magical paintbrushes - stay with me on this - and they're rather hard to get hold of nowadays. As an example of that, here's a petition posted in 2004(!) that people are still posting comments to. In addition, here's a list of current prices - now consider a newcomer to Neopets starts with the rather paltry sum of 1000 Neopoints, and you can see why there's a desire for these items.

This is where we target some 12 year olds with social engineering. Oh dear...

The Method

Neopets is effectively social networking for younger kids and some teenagers. Or, as someone on a hacking forum put it while discussing this particular attack,




...ouch. No surprise, then, that the site has many communal areas where people can chat, hang out, send each other messages and see what's going on. Our hackers will move to the trading areas, where kids can post requests for items they'd like to buy, sell or trade. Then it's just a case of hunting out posts like this....

 

Here we have yet another Steam Phish, this one involving some forum based scammery. Our phishing friend sets up a forum account on the official Steam forums, then sends random people a "scary" message like this:


Click to Enlarge

Assuming the victim is suitably terrified by dire warnings of account hackings, they'll promptly jump over to

valve-ipfix.tk

which is a redirection URL hiding the "real" URL at

steampowerness1.awardspace.us

...and the victim will then enter their Steam login credentials to the phisher.

Here it is in all its phishy glory:


Click to Enlarge

Avoid.

Here's a website called

GamingHarbor.com

which is a site claiming to offer "free games" in return for installing a Toolbar. The site is owned by a company called based in Cheung Sha Wan, Hong Kong.

Aside from the rather suspect "Limited Time" notice on the splash page (does anyone actually believe claims like that?) and the fact that certain links taking you to the page will claim "for your region only" messages despite the fact that anyone can clearly download it from anywhere, the biggest bit of truth stretching is reserved for the large image splash guaranteed to get any gamer salivating:

Oblivion! Dead Rising! Fable 2! Grand Theft Auto 4! You're not actually going to get any of these games, but who cares - if they convinced a passing user to download and install this Toolbar on the strength of that graphic then "Dubious Marketing 101" has done its job.

The program itself comes from

desktopsmiley.com

...and continues to put the idea into the mind of the downloader that there'll be some sort of console related "bonus" at the end of all this by making the Executable look like the buttons on a Playstation 2 joypad:

...we find the Toolbar is indeed installed, and our browser is taking us to a website about bingo. The fact that there's no visible sign anywhere on the desktop in relation to optimizers or cashback assistants doesn't trouble our gamer - he just wants to go PEW PEW a lot. With that in mind, he jumps over to the other side of the Toolbar and clicks what must be the answer to his prayers:

...our confused gamer is taken to

myfreegamespage.com

which (it's fair to say) probably isn't the magical console games factory he was expecting.

What we're left with, is a collection of mind blowingly awful games that in no way, shape or form represent the titles splashed all over the main GameHarbor website. Some require you to download gaming clients then hose 150MB of your bandwidth to play things that are probably bested by free flash games; others will probably make our Toolbar toting gamer rip his hair out as he's installed a Toolbar to "play free games", only to find...



...he has to either play "free" for an hour, or BUY the "unlimited version" for $6.99.

You couldn't make it up. But then you don't have to, as the face punching reality of lame advertising that promises much and delivers little is already with us.

Avoid this harbour like the plague - the real thing is much better, and you don't have to worry about Internet Saving Optimizers, either...

Runescape. I've never played it, but thanks to the handy Wikipedia article I can tell you that:

"RuneScape is a Java-based Massively Multiplayer Online Role-Playing Game operated by Jagex Ltd. Recognised by Guiness World Records as the world's most popular free MMORPG, RuneScape has approximately fifteen million active free accounts and is a graphical browser-based game with a large degree of 3D rendering."

The Runescape creators don't like Bots very much. In fact, a thriving underworld of botting, cheating and leet haxing exists with a wealth of program sharing and information sharing taking place. Along with Habbo Hotel, it's where a lot of wannabe Phishers cut their teeth. With that in mind, I thought we should take a look at the following website



Here's a sample screenshot. Funky advert for powerlevelling aside, check out the text beneath it:


Click to Enlarge

Let's take a look at

Mygamesfile.com

....a website that promises much, and delivers little.

You may have seen these adverts in circulation on ad networks recently:

I realize this might not be new to the WoW community, but there are obvious threats out there that need some attention.  Recently the team here at Facetime Security Labs has seen one threat in particular that we feel is especially evil.  The story begins like most of these stories begin; with someone downloading something without scanning for a virus first.

There are about 10 million players on World of Warcraft - most of which are in China.  The amount of malware coming out of China in the last several years has been staggering.  Its no surprise really that World of Warcraft players would become a target. 

The first thing this trojan does it watch for the user to login to their WoW account and store the information to be sent to the attacker.




The attacker also creates numerous entries in the Image File Execution Options to prevent the victim from removing the application.  This way, the user is forced into removing the application manually, or biting the bullet and reformatting.

The list below is all the programs that are rendered useless by this trojan:

regtool.exe
KPPMain.exe
egui.exe
kpfw32.exe
kwatch.exe
kpfwsvc.exe
kavstart.exe
kaccore.exe
kissvc.exe
kmailmon.exe
esafe.exe
ravtool.exe
ravtask.exe
ravstub.exe
UpLive.exe
UmxPol.exe
UmxFwHlp.exe
UmxCfg.exe
UmxAttachment.exe
UmxAgent.exe
UIHost.exe
TrojDie.kxp
Trojanwall.exe
TrojanDetector.exe
SysSafe.exe
symlcsvc.exe
SREng.EXE
SmartUp.exe
shcfg32.exe
scan32.exe
safelive.exe
Rsaupd.exe
RegClean.exe
QHSET.exe
PFWLiveUpdate.exe
KAV32.exe
mmqczj.exe
mcconsol.exe
MagicSet.exe
KWatchX.exe
KWatch9x.exe
kvupload.exe
KVStub.kxp
KVSrvXP.exe
KVScan.kxp
KvReport.kxp
kvolself.exe
kvol.exe
KVMonXP_1.kxp
KvfwMcl.exe
KvDetect.exe
KVCenter.kxp
KsLoader.exe
KRepair.com
KRegEx.exe
KMFilter.exe
KMailMon.exe
KISLnchr.exe
KAVStart.exe
KAVSetup.exe
KAVPFW.exe
KAVDX.exe
KASTask.exe
KASMain.exe
KaScrScn.SCR
kabaload.exe
isPwdSvc.exe
HijackThis.exe
FTCleanerShell.exe
FileDsty.exe
ccSvcHst.exe
CCenter.exe
AvMonitor.exe
avgrssvc.exe
autoruns.exe
AppSvc32.exe
AgentSvr.exe
IceSword.exe
adam.exe
WoptiClean.exe
nod32krn.exe
mmsk.exe
Ras.exe
vsstat.exe
NPFMntor.exe
webscanx.exe
avconsol.exe
Navapsvc.exe
KPFW32.exe
KAVPF.exe
procexp.exe
safebank.exe
rfwproxy.exeFYFireWall.exe
avp.com
rfwsrv.exe
rfwmain.exe
rfwstub.exe
idag.exe
WinDbg.exe
OllyICE.EXE
OllyDBG.EXE
360safe.exe
qqkav.exe
qqdoctor.exe
safeboxtray.exe
360rpt.exe
360safebox.exe
360tray.exe
qqsc.exe
ati2evxx.exe
Iparmor.exe
PFW.exe
navapsvc.exe
Navapw32.exe
KVwsc.exe
KVsrvXP.exe
KVFW.EXE
rav.exe
ravtimer.exe
RAVmon.exe
RAVmonD.exe
rising.exe
KAVsvcUI.exe
kavsvc.exe
avp.exe
runiep.exe


X-Cleaner.exe isn't on there?!  I'm insulted.  As you can see this threat hinders the ability for several mainstream anti-virus, anti-malware, rootkit detector, and process explorer.

After the trojan blocks access to your security applications, it sits and listens for any kind of Warcraft traffic that it might potentially steal.  The attacker will have the ability to consistently ping the infected PC and take information as needed.



We currently detect this threat as PWS.Game.rnq.  Mind your clicks.

It seems these cookie-cutter sites offering Zango in return for things that can easily be obtained elsewhere are never going to dry up. Case in point - here's an advert I saw a little earlier today on a gaming site:


Click to Enlarge

This advert takes you to the following colourful website:

There's been quite a lot of action going on around here recently, with a fair amount of coverage of some of the things written about. It's also interesting to note that there's been something of a resurgence in dubious Adware affiliate activity lately - companies such as Zango (who I've written very little about over the past few months) have suddenly come to the fore with what seems like an endless procession of really bizarre behaviour.

That seems as good a place as any to start, so get your bookmarking fingers at the ready and you may find a few articles to pass the time on your lunchbreak with.

August 2008: Adware on Pirate Movie Sites: [1],[2],[3],[4]

This is (of course) related to the large network of websites pushing pirated movie files in return for Zango installs. These sites are still being mapped out, with fresh discoveries all the time. The utterly fake claims with regards what a piece of Adware can do for you is one of the remnants of the old "Adware wars" I can't say I'm happy about seeing making a comeback.

August 2008: Precocious Phishers Target Teen World: [1]

Logging you into the target site once you've been phished is a nifty idea, and from what I've seen the person who came up with the idea was a teen himself. There's a surprise...

August 2008: ASCII Art Spam [1],[2]

Every now and again, peculiar spam tactics emerge and (truth be told) can be fun to work out. The above two links are related to a particular run of ASCII art spam that made a little comeback recently.

September 2008: Webcam hackers shock victims with gay porn [1]

I've always had an interest in Memes, but using shock memes to screenshot the victims reaction via webcam is quite the "humorous" tactic. I still love that one guy simply sat there picking his nose while watching one of the shock sites involved though.

September 2008: Fake Batman MMORPG leads to Adware install [1],[2],[3],[4],[5]

This one was particuarly fun to pull apart, as I got to combine two of my favourite things - Batman and videogames. An amazingly brash scam, and you can see more related sites here and here. Curiously, the story had a second wind breathed into it this week, with more coverage on Techdirt and WebProNews. The only conclusion I can draw from this is that Batman is indeed awesome.

September 2008: Fake Twitter Profile Punts Orkut Attack: [1],[2]

There seems to be a little confusion over this, though I'm not entirely sure why - the blog entry clearly references the Malware attack using twitter to promote infection links from a few weeks ago, and this is not the same attack - this one specifically focuses on Orkut users.

Here ends your Link-O-Rama edition of Spywareguide.

This is Newsarama, a site (mostly) geared around comics and other related media:

You may or may not have come across these before, but there seems to be a fresh set of phish messages (most likely from compromised accounts) being fired around XBox Live using the lure of free Microsoft points as bait (gamers can use these points to buy games, amongst other things).

Consequently, if you happen to be sent something like this by one of your contacts:

As an avid fan of retro videogame systems, I spend a lot of time on EBay. One of the side benefits of using EBay so much, is that I regularly come across things like this, this and this. Highlighting these examples of online insanity is always useful to prevent people from being scammed. Indeed, even when hunting down a rare game console I can still find something that falls under the umbrella of "helping people to not lose money in a spectacular fashion", and then throw some light in its general direction. It all helps, and shows that even when you're off-duty, you're still on-duty, somehow.

Recently though, my ability to find (and then talk about) weird and not-so-wonderful things on EBay has run into a bit of a roadblock - sadly, that roadblock is EBay itself.

Previously, you'd type in what you're looking for, expand your search to Worldwide then throw in EBay stores too. It was the best possible way to uncover oddities that needed further exploration from around the globe - and the "worldwide" variable would stick around, so a rapidfire selection of searches could then ensue, from fake mobile phones to sellers listing 100 Wii consoles at a time (usually a sure sign of a hacked account or twelve).

Now? Oh dear, let's see what we have:


Rounded edges...

Bright and colourful...

.....and a completely broken search feature. Every single time you look for something, you have to re-enter the "search worldwide" and "add shop" options because it no longer remembers that you've selected them. Hence, rapidfire searching (with a large set of different search strings and variables) becomes one long slog - especially as you're forced to enter additional information in a slow loading popup box.

Welcome to the wonderful world of Two Point No, where even the most functional of websites needs to be jazzed up with the numbers Two and Zero after it, just to look a little more impressive.

It might not actually work very well after the change, but I think that's only an incidental concern...

Last week I spoke at RSA 2008 on the subject of "Echo Boom Hackers". Long story short, "Echo Boom" kids are supposed to be that generation which has never been without an online world to live and play in, and so their take on the nature of privacy, anonymity and that interface between your public and private worlds don't quite work in the same way as (say) mine does. Yes, I grew up without the Internet. Sue me already. We also talked about how researchers and law enforcement could use their different attitude to our advantage when attempting to shut them down.

Inbetween emergency landings, awards ceremonies and book signings to attend I got the feeling this years RSA wasn't quite as interesting as last years event. The common complaints seemed to be "Too many sessions", "not enough interesting booths" and a general sense of "can't be bothered".

I agree. I don't recall anywhere near the same amount of talks going on last year, and the inevitable result is half empty rooms and speakers wondering where all the people went. I only go to these events to speak or listen to others, and the majority of the talks I went to all suffered from a distinct lack of attendance. I was lucky - speaking with Robert Vamosi of CNet, we were doing our presentation in the Keynote Room 103 (complete with its own videocameras and producer), and so even though we talked on the last day, we still pulled in a good hundred or so people which is pretty decent. I'd have liked more, but then I'm just greedy.

Anyway, if any organisers of RSA just happen to be passing by - because I'm sure they stop by here all the time - then please, REDUCE THE AMOUNT OF SESSIONS. I was informed while there that everyone would have access to the talks they missed, yet I've returned home to see that you now apparently have to have a full session pass to see the recorded highlights / listen to audio / whatever. This is a really bad idea, and simply makes a niche event even less accessible to those that can't attend (and don't want to pay the insane prices to do so).

Rant over.

Robert and I were in town to talk about a subject that probably doesn't get brought up much at RSA (in fact, it doesn't seem to pop up much anywhere) - the new breed of wannabe hackers, the lengths they go to with regards fitting in and the dangers and problems facing both their victims and themselves, and how those dangers can quickly (and irreversibly) bleed into the real world. That all sounds faintly scary, so here's Robert and I looking all smiley at the FaceTime booth.

Phew. Here's a couple of photographs from the talk itself:

The talk was divided into three main sections - a general overview of what I've seen out there over the last 12 months+, tips and tricks for catching hackers on social networking sites, Youtube and various other places using everything from Skype to advertising networks, and (finally) the dangers that these activities produce day in and day out. It was a tricky subject to approach - the idea was to ramp up the punch of the presentation towards the end, but too general an introduction might have resulted in people getting bored and walking out. There wasn't really any way round this, but thankfully people stuck around (I think one guy left halfway through, but that was because his phone was ringing so we'll let him off the hook).

Of course, there was also the added danger that people would be expecting a high level technical presentation - this is RSA, after all - and be baffled at the sight of 70 minutes of anecdotes.

Still, I love a challenge and the presentation seemed to go down really well with the audience. There's been a fair amount of coverage already (links at the end), and a number of people asked me to get involved with a few initiatives aimed at both keeping kids safe online and also trying to steer them away from hacking and cracking which was pretty interesting. I'm just glad people found us at all, because I'm sure we were originally scheduled for the "Hackers & Threats" Track but somehow ended up on the "Industry Experts" sessions. Not really helpful when you're running round half an hour before your presentation starts wondering why nobody knows where your room is!

Just like last year, you can click here and check out some 300+ pictures from my trip, starting with the emergency landing my plane made and finishing off with - er - more aeroplane woes. So many people had issues with aircraft at this conference, maybe that could be next years theme.

As for additional reading, well, there's a fair amount of it and will probably give you a better overview of what went on than I ever could. Eventually RSA are supposedly going to stream the talk we gave in full, but that might take a week or two - as soon as it's online, I'll post a link to it.

Further Reading:

Robert Vamosi: Meet the Echo Boom Hackers
Robert Vamosi: Echo Boom Hackers - A Dangerous Game
Robert Vamosi: Echo Boom Hackers - Shame

Matt Hines: Taking Down Teen Hackers

Tech Talk Radio: RSA 2008. (The Podcast itself is floating round on the main site somewhere, but I couldn't actually find it. If anyone locates it, feel free to pass me the link!)

Consumer Reports: Kids Turned Cybercriminals

Generally, if you employ an outside agency to advertise / promote / generally do things with your site in relation to potential visitors, you need to have a good idea of the methods employed by that company. I've had quite a few emails through from people who received something similar to the following:

"Subject: Advertising Inquiry
From: advertising@polimedia.us

We have reviewed your blogger.com blog on behalf of one of our
clients that would be interested in placing advertising with you.

Client profile :
DoingFine (http://doingfine.org)
New project (<1 month old) Theme A forum dedicated to those things that came out right and worked out fine.

We'd like either a 150x150 button, 160x600 skyscraper or 468x60 full banner (or footer). Alternatively, we may be interested in text-only advertising.

This would be a weekly, monthly or yearly arrangement. In either case we will require a one time, one day (24 hours) free placement in order to test the quality and quantity of traffic your website can actually provide*. Within this interval, we will make a final determination, based on the traffic volume, quality, and your asking price. Should we find your terms acceptable, this trial day will count towards the agreed interval.

Kindly let us know if you would be interested, which arrangement best suits your editorial needs, and what rates you would like to charge. We prefer using PayPal but may be able to accomodate alternative payment methods.

Thank you.

*Please note that we employ software that reliably detects autoclick and autosurf bots, pay per click and paid to surf type traffic, and other such non-human traffic. This may be a concern for you, especially if you are buying "bulk traffic", or employing the services of dubious "SEO experts"

The site in question, doingfine.org, seems to be harmless enough - a forum where people can, quite literally, tell the world that they are indeed "doing fine". However, the methods being used by the company promoting the site are veering on the side of "not doing very fine at all" and appear to be somewhat random and scattershot in their approach to web marketing. The obvious danger here is that people will simply come to associate Doingfine.org with spam-like tactics, strange emails and immediate associations with 419 scams.

For starters, the people behind the campaign are clearly sending these mails out quite randomly. Why? Well, here's someone with a Flickr account who was sent the same email. Anyone who took five minutes to check would realise that Flickr is for hosting photographs - you can't manipulate your pages to insert adverts, banners or buttons.

A quick Google reveals many more people feeling confused and puzzled by these emails - this is NOT a good feeling to generate amongst people online, as word of mouth spreads extremely quickly and these kinds of tactics are usually frowned upon.

Take a quick look at the site doing the promoting, and things don't improve:

Click to Enlarge

...wha? At first glance I thought it was a site related to videogames involving armies and aeroplanes or something. The English version of the site isn't any more enlightening (with phrases such as "There is nobody else", "If you want something done, we'll have to do it ourselves" and "Squeaky wheels? We've got grease" all over the place). Again, all of these factors (no real substance to the information provided, bizarre phrases and a general sense of oddness) are seen in common webscams, and naturally give people pause for thought.

Of course, the negative feedback created by the approach of Polimedia has now started to flow back to Doingfine.org, with threads such as this. There are two key things said by the site owner. One is in response to a post in a thread by a Google Blogger.com employee:

"The notion that "third parties can easily install badware into your computer by asking you to put code into your template" is the sort of nonsense that appeals to otherwise uninformed people. Coming from someone who almost certainly knows better. Not to mention SOMETHING GOOGLE SHOULD BE FIXING, should it actually be true."

This makes no sense to me. There are all sorts of dubious scams out there that involve convincing people to paste code onto their website. It only takes a little bit of malicious code to launch an IFRAME, or run some Javascript, or any number of other things and then you've got a problem on your hands. As for Google somehow being responsible for "fixing" the way in which nefarious people online can use rogue code to push exploits - huh?

The second thing of note that the site owner says is this:

"For the past week or so, we've been employing this Polimedia company to handle our marketing and advertising. So far it is working really GREAT, as far as I understand these things (which admittedly isn't very far)."

This rings warning bells, for me - the site owner seemingly claims he doesn't understand "these things" very well, which presumably means the workings of having someone else handle your marketing and advertising. First of all, if I were him, I'd certainly want to know exactly what a third-party was wanting to place on other peoples websites in my name before committing to such a deal. Secondly, all is not quite as it seems here. Why? Well, here is the owner of Doingfine.org posting to a webmaster forum.

For some bizarre reason, he is posting under the username of Polimedia - more confusion. Why post under the name of the third party company you've hired to promote your site? At any rate, the post reads:

"1000$ in this thread. This is a themed pay by post job. Here's the specs :

VERY IMPORTANT : The theme for this project is "doing just fine". Please stick to it. A story about how you are happy with your computer set-up, how your dog learned a new trick, how you baked a pie and it came out just right are welcome. PRODUCT ENDORSEMENTS ARE NOT, unless the product is really mainstream. Story about how you enjoyed a drink of Coca Cola is fine. Story about some internet-based crapola will get you insta-banned.

You will be paid $10 for every 100 posts you make to my forum at http://doingfine.org. In order for you to collect, you must :

Make 100 posts, not less, using AT LEAST 15 different registered user names, starting AT LEAST 10 new threads.

All new thread posts must be AT LEAST 12 lines, 120 words, 600 characters. These length requirements are CUMMULATIVE, meaning you must satisfy ALL.

All reply posts must be AT LEAST 2 lines, 20 words, 100 characters. These length requirements are CUMMULATIVE, meaning you must satisfy ALL.

You may not copy/paste strings longer than 35 characters or 7 words from ANYWHERE. I actually use scripts to check this.

You may add AT MOST one link per post, provided it's either a completely FREE (no adds, no sale pitch, no revenue method whatsoever) website or an image link. You may NOT add more than 30 links TOTAL.

Your post must be relevant and adequate to the available themes. The forum has a broad "doing just fine" theme. Thus, please contribute posts that describe either a personal experience, or a world event/news item about something THAT'S JUST FINE. Personal experiences are preferred, and probably easier to write.

Your posts must be INTELLIGIBLE, written in ENGLISH. You MUST make sense. Random gibberish will not count. I prefer you use standard spelling and punctuation. If you don't, all the differently named registered users you create that make recognizably the same spelling mistakes WILL be counted as one.

You MUST use the same IP address for all your posts, this is how I will count them.

You must send me (user : Mr. M) one private message when you start posting, stating that you intend to start posting. Mention this board and optionally your user name here.

You must send me (user : Mr. M) one private message when you are done posting 100 posts. It MUST contain your paypal address (you will be paid $10 within the same day) and specify if you intend to start another 100 posts block. If you do, please wait for my ok. That means I will tell you whether I'm happy with your work and you should bother doing another 100.

All people satisfying the above conditions will be paid the above sum. No exceptions.
All people FAILING to satisfy the above conditions will NOT be paid the above sum. No exceptions.

I will respond to any disputes here, should one arise (not sure why it would tho).

My budget for paying posters is 1,000$ (it actually is, yes), so post away and take my money. Good luck."

So, despite the fact that the domain was apparently only registered on the 7th February, the forum itself could appear to be extremely active because a large number of people are being paid to post under 15 different registered usernames, with 100 posts each.

This is a fairly clever idea in terms of making a forum come to life quickly - does the earlier statement regarding not understanding the workings of having a third party handle your advertising still ring true? If you're smart enough to do something like the above, why would you even bother to use Polimedia to send out these random mailshots?

Who knows. What I do know is, their tactics need a serious rethink and fast. Though the buttons and code they're placing on websites appear to be harmless, the techniques they're using to promote the site most definitely aren't - as least with regard the reputation of Doingfine.org.

This is a World of Warcraft Time Card. If you play games online that require payment, you can either pay by direct debit or keep buying these cards which entitle you to x amount of days gameplay.

This was posted to a forum yesterday, and could easily have made the leap from "how about this.." to "currently in operation":

A lot of stores seal these cards in clear wrapped plastic to prevent tampering, but apparently not all, as the poster claims:

"The time cards are kept behind the counter and the boxes out front, you grab the box bring it up to the front and they slip a time card in and throw one of those round plastic dealies over the flap. Even if they are sealed with the plastic stickers fold the pamphlet in half and slip it into the bottom of the box.

On top of that the plastic sticker is put on by employees of the retail store, It is not hard at all to find someone to assist you in this endeavor. I would even go work part time at (store removed) in the evenings if I knew I had someone solid backing me up with a idiot proof phishing site."

If you happen to purchase a World of Warcraft Time Card and a pamphlet falls out inviting you to a closed Beta, contact Blizzard Software to ensure it's legitimate before you hand over your details....

I know it's customary to simply rattle off a "top 10 list" of bullet points related to possible security predictions further along in the year, but I thought I'd rather go into a little more detail with this one. As such, my bullet points are few, but my concerns are many.

What does the year hold? Lots and lots of problems for Myspace, from the looks of it. Don't forget the other Social Networking sites (such as Facebook and Orkut) too. Of course, claiming there will be issues for these sites is perhaps to state the completely and utterly obvious, but we're barely a week into the new year and already we have:

* Fake "friend adds" from someone posing as "Myspace Tom" trying to sell you ringtones;

* Zango in the news regarding an application on Facebook apparently designed to push popup adverts;

* Sites that provide services for Myspace in the line of fire too.

However you look at it, Social Networking is currently where all the action is, and - in the same way that some of the biggest security stories of 2007 were web 2.0 escapades, expect a lot more of the same this year. Although Facebook and Orkut have experienced a surge in recent months with regard malicious (and supposedly "non malicious") attacks, Myspace will clearly remain the breeding ground for new techniques and attacks launched upon end-users.

Myspace shows no indication of locking down the functionality on end-users pages that makes it easy for bad guys to cause trouble, and while the ability to post videos, music and custom backgrounds to your page is appreciated, the problems and security issues these same "bonus features" create is not so welcome.

If there is a major security breach involving Myspace, will they even be able to react in time given the responses I was met with when trying to warn them of an issue recently?

Sadly, it seems like a distant prospect at this point.

Instant Messaging attacks fell under the radar a little bit with regards major breaking stories in 2007, but it's worth remembering that these hijacks are still out there in full force, even if we are all currently dazzled by the slow motion trainwreck that is the world of social networking.

Expect Skype Worms to become more and more commonplace - in fact, these attacks may drop under the radar more than any other, due to the constantly reused infection files by the bad guys. The first part of 2007 brought a flurry of news reports as we discovered a network jumping Skype Worm - however, the current attack of choice continues to be reworked Warezov variants, and this can only mean one thing - lack of coverage and a general sense of "looking for something more interesting" as we all grow tired of Warezov variant number 600,308 rumbling across the Skype network.

Of course, these attacks will still continue to be successful, whether we continue to read about them or not.

With that in mind, it's time to make a few small predictions for the older IM networks - well, one, actually. Expect more custom built infections for geographical areas you wouldn't have previously expected to be exploited. The Singworm (targeting MSN users in the Singapore region) springs to mind. As researchers grow tired of seeing the same old hijacks time after time and start to explore what's lurking in other regions, we'll start to read about new and interesting attacks from further afield. In some ways, that's already happened with regards the area of Adware - as the "old guard" of companies such as Zango, Direct Revenue and DollarRevenue either go out of business or reform, researchers have started to look at the "next generation" of Adware coming out of China.

Sadly, there will be more than enough for us to get to grips with. Indeed, we might start pining for the more straightforward threat landscape we knew and understood as we spend the year being battered by sales pitches in Chinese, EULAs in Korean and hacking forums written in Malay.

We recently came across two Chinese hijacks (one weighing in at around 30MB, the other at 15MB) that can completely destroy your PC. The files that arrive seem to be a little bit random, but a good number of them have the potential to send your CPU usage through the roof and keep it there until your PC keels over. With a whole bunch of them installing at the same time, blue screens and repeated crashes are the order of the day. I briefly mentioned this thing here - well, consider this writeup a sample of the kind of things you can expect if unfortunate enough to be hit by this thing. It goes without saying that there's spyware, adware, malware, rootkits and pretty much everything else you can think of in this payload - in fact, feast your eyes on a sample of some of the files installed:

Click to Enlarge

I'm sure you'll agree, that's one seriously big pile of stuff.

Normally, I'd walk you through an install step-by-step, but in this case there's not much point. When the install starts, your desktop pretty much freezes and the only way to see what's on there is reboot, hope it doesn't crash and start digging (with the CPU at 100% all the way, of course). Doesn't sound pleasant, and it most certainly isn't. With that in mind, here's a more-random-than-usual selection of screenshots from both hijacks...

Click to Enlarge

This isn't going to be good, is it? Here's another random error from the pile:

There were quite a lot of errors generated, as it turned out. When I wasn't looking at error screens, I was beaten down with prompts to install all kinds of things. The below installer prompt wants to install a Toolbar onto the computer:

Click to Enlarge

...and for completeness, here's the inevitable shot of the Toolbar:

I'm guessing you want to see a shot of the Task Manager at this point, yes?

Click to Enlarge

You can see the PC is already at 100% CPU usage, and half the things on there are already "not responding".

Click to Enlarge

You can see a nice selection of browser windows open here, stuffed with rotating adverts (both Firefox and Internet Explorer).

Nope, I have absolutely no idea what I'm being asked either.

Most of the files don't produce any visuals - only a few pop adverts, the rest run silently and kill your machine. However, the other hijack installer (that eventually sucks down roughly 15MB or so of files) was calling a lot of the same stuff and popping the same adverts. For starters, that Toolbar appeared in both bundles. Well, we ran that one (thinking a game of compare and contrast would be fun) and sure enough....

Click to Enlarge

More popups! More silent files that flood your Task Manager and kill off your PC!

Click to Enlarge

The above is an installer prompt for a program we've covered before. Don't worry, you'll see what it is in the next screenshot...

Click to Enlarge

Here, you can see something called "Disk Free" - I'd like to tell you if it's any good or not, but...you know....blue screens etc. Note the bottom right hand corner - that's our old pal Coopen, the desktop-picture changing marvel (come on, you don't think I selected that picture myself, do you?)

While we're on the subject of old friends, remember the CNNIC? Sure you do. I didn't know they had some kind of Messenger program, though:

I found that image along with a bunch of files, though the Messenger itself didn't appear to want to work. Shame.

As I've already mentioned, this second install is a little lighter on the CPU than the first, so it was possible to follow (most) of the install in one go. Imagine my surprise, then, when the following made itself known....

Click to Enlarge

Kubao is some sort of IM / P2P Messaging system, and (as far as I can tell) works a little like Skype...

Click to Enlarge Click to Enlarge

Click to Enlarge

You wouldn't believe how long it took me to create an account and log into the thing, but there's a screenshot of it in action anyway.

Click to Enlarge

...oh, and here's some weirdo Anime RPG game apparently populated with volleyball players or something.

As you may have noticed, neither of these hijacks are things you'd probably want to have on your computer. There seems to be a vague hint of moneymaking involved, but whoever put these things together wasn't thinking straight when they decided how many individual files to install onto the PC. There's an art to concocting a hijack that doesn't kill the PC, and these guys were presumably absent from Hijacker School that day. In terms of bandwidth used to perform these installs, the particularly brutal way your PC is taken over and the complete disregard as to whether or not the thing actually functions properly afterwards, I'd have to rate these as two of the worst computer beatdowns I've yet encountered.

The "brave new world" of Chinese Malware hijacks is truly upon us. I'm just not quite sure we're ready for it...

Research and Summary Write-Up: Chris Boyd, Director of Malware Research
Technical Research: FSL Threat Research Team, WV

Microformat Communications

In case you aren't up on all that is Web 2.0 let me explain "Twitter".

Twitter is a social networking service that allows users to send "updates" (text-based posts, called "tweets", up to 140 characters long) via SMS, instant messaging, e-mail, the Twitter website or any application built using their services.

These updates are displayed on the user's profile page and also instantly delivered to other users who have signed up to receive them. The sender can restrict delivery to members of a circle of friends, or allow delivery to everybody, which is the standard default setting.

Users can receive updates via the Twitter website, instant messaging, SMS, RSS, or through an application. For SMS, currently two gateway numbers are available: one for the USA and a UK number for international use. While the Twitter service itself is free, posting and receiving updates via SMS typically incurs a charge from the wireless carrier- watch your SMS plan carefully! Some people have gotten large bills without thinking before they realized how much volume can pass, so if you do use Twitter, or a service like Jaiku (similiar), you should probably use an all "you can eat plan" of SMS.

According to many, and I agree, Twitter is one of the first iterations of the "microblogging" or "nanoblogging" formats- a form of "micro-chunking". This is because the characters are capped to a certain number and the messages are very small. Twitter has caught on like wildfire because it is a very useful service for influence shaping, information gathering and simple communications. Services like this will change the face of the web, since it lowers the bar to communicate and express or influence opinion.

Twitter- The Cool Aspects

1) It doesn't interrupt you like Instant Messaging or VoIP- you can communicate when and where you want.

2) You can communicate from cell phone, PDA, applications, even games or "metaverses" like Second Life have Twitter Heads Up Displays.

3) Simple to use and simple to get rid of those you don't want updates from. You can keep your Twitter stream private too...meaning only "friends" can see them.

The Not So Cool Aspects of Twitter

With the good news comes some bad news. That is simply how greynets roll. I am not touching on privacy concerns, simply security concerns. They are related but different.

1) No "bullet-proof" authentication- at this time it is pretty easy to impersonate someone because of the lack of authentication. There are a number of "popular people" who are not who they say they are. I have been following a bogus "Steve Jobs" for some time now- at least I think it is a bogus Steve Jobs...I don't really know, and I have no way to make sure. Of course- this can happen with IM too. e.g. someone's account is compromised and the attacker spoofs the trusted user. This has been going on for a decade and usual cause is a weak password susceptible to brute force attacks.

2) Long web addresses, URLS, are wrapped in redirect or compression services like tinyURL- this by itself is not bad and a perfectly legitimate use- remember "Tweets", as the Twitter messages are known, are capped at 140 characters so a compression service makes sense. However, since it is a blind redirect- you don't know where you might end up. An attacker could encode a malicious site on the next hop, inject obfuscated Javascript into the header (as we saw with the World Cup case), or someone might link to a site without knowing it has been compromised or the site might later become compromised. It is not too hard to predict that we might see "Twishing", or phishing via Twitter.

3) As the service gains critical mass it will attract those who seek to exploit the service for gain, mischief or intrusion. This is unfortunate, but history teaches us this almost always happens- where there are people- there will be a few bad apples.

Thanks to the TipsDr who tipped us off to the latest, and a much more sophisticated attack using caller id number spoofing. This is rather alarming since I was looking for the first real attacks to be simple malicious URLs.

For all you people who are just crazy about Twitter, a vulnerability has been posted that will allow you to post to someone else?s twitter account. Since twitter uses caller id to authenticate users, it is very easy to post to someone else?s account since it is so easy to spoof the caller id number. Fakemytext.com is just one example of a site that will help you do just that.

Read more about the spoof here. I do agree. SMS was never designed to be used for authentication. This is like the From: address in email was never designed to be an element to authenticate against.

In short proceed with caution- just as you would any web surfing- never assume communications are 100% safe. Don't click on links and until phone spoofing is resolved, if it can be, - I would be keep your numbers close.

Enterprises will probably want to block this emerging type of greynet for intra-company use, and remain guarded if they use it as a marketing, promotional or communications hub. This is a shame since it is a very handy service that has the ability to transform how a company can communicate, but until there are better locks- or an enterprise intranet version- this is just the type of greynet that highly sophistcated users will bring in the door...because it is very useful, used by influentials and highly communicative and our research shows web traffic moving from simple HTTP to highly communicative traffic.

I imagine as the technology matures and becomes more secure we will see the enterprise adopt similiar mechanisms- perhaps replacing the "dark blog". No doubt customers will force the Enterprise to adopt these emerging microformats to some degree. Until then... Have fun communicating, but proceed with very real caution. Ensure your I.T. policies are up to date with the high velocity field of "social media"- or simply socializing around media. It is moving at an incredible velocity and shows no signs of letting up.

YouTube is probably the hottest of the so-called "Web 2.0" commodities out there right now - and their recent acquisition by Google won't have done any harm to that way of thinking. Of course, the fact that YouTube allows you to share its content raises the possibility that those files might appear in all manner of strange places.

Well, here's a perfect example of people jumping on the Web 2.0 bandwagon, offering up a (frankly bizarre) "media player" that

a) doesn't actually offer up much media and
b) doesn't play them half the time, either.

A group of files have been seen floating around the eDonkey network, and they offer up some surprising results.

Click to Enlarge

No EULA is displayed - depending on which of the two installers you execute, the program will simply run on the desktop or give you a bare bones installation. You'll then see this:

Click to Enlarge

...the introductory splash page might look interesting, but you'll notice that there are very few buttons on the player, and half of what's there isn't actually clickable. When we continually hear a lot about the "value proposition" of installing X in return for Y, this doesn't bode well does it? Pressing the "click here to continue" message brings up a "Locating Videos" message, and you'll note the first advert served up inside the player...in this case, an advert that was apparently for the Wall Street Journal but was eventually revealed to be for GoToMyPc (what you see in the screenshot is all we saw before the YouTube clips started to play. Thanks to a reader for the heads up). I don't personally have (much of) an issue with Adverts served to me inside an application (as opposed to firing all around the outside of it), but some people might take issue with this, especially as there was no EULA and no indication that there would be adverts at all.

Are these targeted ads? Adverts served up based on browsing history? Region specific? Who knows, as nobody told you. At any rate, the supposed "media content" loads up, and you might be surprised to find....

Click to Enlarge

.....YouTube movies!

Completely bizarre YouTube movies, at that - this example is a strange Lute playing session; another notable clip we saw was a 20 second clip of some guy telling us about his new book:

Click to Enlarge

....though the clip is in Italian, the translated version is that he's talking about his new work, "Experiments in Temporary Happiness", a "passionate romantic novel" apparently. Though there's no indication either of these two have any involvement with the player - it seems these are just two random movie files that happened to play more than most - you can learn more about the book writing guys' work here.

Putting aside our foray into the world of romantic literature, you might find yourself disappointed if you're expecting a constant stream of YouTube clips. Apart from the fact that an avid Youtube fan would simply....go to YouTube to watch them in the first place, this program only ever seemed to serve up one of the two clips mentioned above. Sometimes we'd get a flurry of other clips before it died out, but half the time, our research team couldn't even get the movies to play. Geographical targeting, perhaps?

Underneath the movie panel, you'll note three icons - one takes you to an online backgammon site, one takes you to a scratch card game and the other provides you with the option of logging into the Skype website. Why? No idea. That's just the way this thing rolls!

Beside the icons, a banner says "powered by Hobby-Tent.com". However, the truth is a little stranger than that. A site called Zapu.com provides "net acceleration" services, and also offer a toolbar that does much the same thing.

Why is Zapu relevant?

Because they're hosting the text served up by the media player:

Click to Enlarge

In addition, Zapu also hosts some of the smaller image files such as the "powered by hobby-tent" banner.

Exploring Hobby-Tent

This is where it gets really interesting. Hobby-tent is a site that links to a bunch of Youtube movies - aside from that, it's stuffed full of adverts designed to generate income.

Click to Enlarge

The site is currently down, but for some strange reason, there IS one directory still available:

..."Papa Player"? What on Earth could that be? Oh well, let's download it and take a look....

Click to Enlarge

Still no product specific EULA, but this time we do have an agreement for WhenU. Ironically, the version of this media player NOT circulating in P2P networks doesn't actually work, as you can see from the below screenshot. Note the "page not found" message, as the program attempts to pull up the "Thank you for using our hottest web videos personal player" text and fails miserably - again, from Zapu.com:

Click to Enlarge

So far, then, we have THREE different versions of a "media player", THREE websites involved in distribution and / or hosting various pieces that make up the whole (we cover the final site below), TWO YouTube movies that made no sense whatsoever (though they made a lasting impression!) and ONE Adware vendor caught in the middle of it all.

There's still one piece of the puzzle left....

DV-Networks.com

Remember the three clickable links in the Media Player that took you to scratchcard games, Skype and backgammon? Well, clicking those links would redirect you to your destination from a site called DV-Networks.com. Visiting the site gives you a holding page, claiming it will redirect you to a site called "Iportent.com", though this never actually happens.

However, some quick digging later and you'll find the below - a bunch of icons, possibly related to some other program, that take you to sites related to "free international calls" and "PC Tune ups". It's the final image that interests me, though:

Click to Enlarge

...note the link to Zapu.com from the final icon, and the Alt text..."Hottest Web Videos", which is the name of the media player. Clicking that link takes you to this page, which seems to be a holding area for numerous streamed movie clips from sites similar to Youtube:

Click to Enlarge

...are these clips supposed to stream via the Media Player too? It's hard to say, though for now it looks like YouTube is the primary focus.

Why is DV-Networks.com particularly interesting? Well, a quick Google didn't reveal much about the site....however, this link is particularly interesting. It's a forum post on Spamcop relating to some application that caused some consternation amongst the users:

3. There are discrepancies regarding the name of the person behind this software. On the referenced website, his name is given as "Barak Abutbul" and yet in the domain name registration, it appears as "Barak Avitbul." My knowledge of Hebrew is limited, but I don't think that sort of discrepancy is due to transliteration issues...he gave the name differently in different situations. For example, he posted information about another of the "MinuteGroup" programs (VCatch) at Winsite, using the "Avitbul" version of his name:

http://www.winsite.com/bin/Info?4754

4. The two partners listed on the "minutegroup" site apparently have had some other joint projects. Here's a mockup of their "DV Networks" site I found on the site of the company that designed the "minutegroup" site:

http://www.121webdesign.com/customers/dvnetworking/

However, when you go to:

http://www.dv-networks.com/

you'll see that this operation is no longer active at that URL, in that it displays a logo for "IPortent" and says "Formely [sic] DVNetworks."

Now, if you check out the About Us page on the Zapu site, one of the founders is named as...Barak Abutbul. The forum post continues:

"5. If you Google "Barak Abutbul," you'll find some rather disturbing references to this man as being part of a group of hackers (or crackers?) who were charged with breaking into computers at the "Pentagon, US Navy, NASA, MIT, Harvard, Yale, Cornell, Stanford, the Israeli Parliament. Hacked two Israeli ISPs obtaining names and passwords of subscribers." The news articles say that Abutbul reached a plea agreement in exchange for testifying against the others."

...is this the same individual? Certainly, Googling the name does indeed return some incredibly troublesome results. Check out the data from a packet capture as the player installed and phoned home:

Click to Enlarge

...note the name "baraka" highlighted in red.

If it's not the same person, it's certainly a strange collection of chance happenings and coincidences. At any rate, I'd be very wary about using this media player - especially as quite a few other Vendors detect this particular file:

Click to Enlarge

"Experiments in Temporary Happiness"? In this case, I'd say that's an entirely appropriate description...

Research and Summary Write-Up: Chris Boyd, Director of Malware Research
Technical Research: Chris Mannon, FSL Senior Threat Researcher
Technical Research: Peter Jayaraj, FSL Threat Researcher
Supplemental / E-Commerce Research: Wayne Porter, Senior Director Special Research

Proactive research on security threats is the key to catching hidden threats before they can collect confidential data, deliver adware, or take down a network. When researchers grab a threat, it's usually been doing the rounds for some time. Here, we've caught them in early in the act of assembling what looks like a very sophisticated operation - in fact, we've caught it so early that many of the domains called by the first infection file aren't hosting infectious files yet.

How does this infection start off? As always, it begins with a seemingly innocent web address passed to you via Instant Messaging. Click the link and allow the file to execute and your day will quickly go bad.

Click to Enlarge

At this point, the command file downloads a file called csts.exe - and this is where things get interesting.

The file starts making calls to many, many domains - one of which is related to the Cuebot Worm that posed as the Windows Genuine Advantage Validation Notification.

The final port of call is a number of servers located in Korea, which are repeatedly connected to by the infection:

One of these servers has a single mention in Google. As fortune would have it, and we aren't surprised, this server seems to have something of a Spam-related linkfarm going on:

Click to Enlarge

...as you might have guessed, all of those blue links lead to what are effectively spam pages. It's worth mentioning that some of the Korean servers pinged by the various infection files have been blacklisted due to spam. Is there a financial motive at work here? Hard to say, though hopefully they won't be able to get very far as they've been caught out before they could really get things moving.

Eventually, a randomly named executable is created in the System32 Folder and at this point, if the user is running AIM they will fire the following message at their contacts, the hackers using IRC channels to achieve this:

Click to Enlarge

Anyone that clicks the link and runs the file will end up continuing the cycle of infections. This attack is very well structured and "modular" in concept, so the people behind it can shuffle their executables around, download new infections to target PCs and do pretty much anything else they feel like doing.

As an example of the modular behaviour of this attack, here are just three of the many scenarios we encountered during analysis.

Scenario One

1) "hey would it be ok if i upload this picture of you to my blog?" downloads the image18.com file (disguised as a jpeg). Running the file results in csts.exe being created in your system32 Folder. At this point, you may well be part of a Botnet (though not in all cases) and the infection has the potential to call down new files onto your PC, which are randomly selected from the numerous files waiting in "storage" that have been spread around the Net.

Scenario Two

1) "hey would it be ok if i upload this picture of you to my blog?" downloads the image18.com file (disguised as a jpeg). Running the file results in csts.exe being created in your system32 Folder.

2) The infection has the potential to call numerous other files, such as files with fixed, unchanging names and randomly named executables which are constantly being updated. Depending on what files you end up with, the infection may create an unwanted service named RPCDB, opens up smtp port 25 (mail) and attempts to connect to a file upload site. In addition, some files attempt to exploit ADS (alternate data streams).

Scenario Three

1) "hey would it be ok if i upload this picture of you to my blog?" downloads the image18.com file (disguised as a jpeg). Running the file results in csts.exe being created in your system32 Folder.

2) The infection has the potential to call numerous other files, such as d227_seven2.exe and randomly named executables which are constantly being updated. Depending on what files you end up with, the infection may create an unwanted service named RPCDB, opens up smtp port 25 (mail) and attempts to connect to a file upload site. In addition, some files attempt to exploit ADS (alternate data streams). You will also potentially end up with a Rootkit on your PC as a result of this particular scenario.

3) At this point, the infected PC is a Botnet drone and can be commanded to send new infection messages via AIM such as:

"hey is it alright if i put this picture of you on my egallery album? ", which will download the image22.com file (again, disguised as a jpeg).

4) At this point, the cycle begins again and they can look to infect fresh victims with this exploit.

As you can see, the emphasis here is not so much on the files themselves, but on the way these files are deposited onto the system. Previous Instant Messaging attacks have tended to focus on the damage done by the files, with little thought on the method of delivery, save for the quickest way to get those files onto a PC. Here, the thrill for the bad guys seems to be in lining up as many of these "install chains" as possible - I keep thinking of a ten move combo on a fighting game such as Tekken...not a bad way to describe it, actually. What's smart about this attack is that it doesn't matter if you get a file "out of step" - if you start off with a particular file out of sequence, you'll just end up somewhere else in the chain instead. There is no right or wrong place to start with this one - the hackers will make sure you get your fill of infection files! The amount of effort that's gone into this kind of attack hints at a level of planning we've previously only seen here. And we're not done yet...

The Botnet Connection

Some things to note - along with their inventive use of positioning numerous downloads to hit infected machines, they also have a better-than-most idea of how to lock down their Botnet. For one thing, they won't allow you to enter the channel using a "standard" IRC client. This prevents people from snooping around. Nice idea, though there's numerous ways around this if you have an ace or two up your sleeve.

They also have various aspects password protected, though you can still obtain these here by the usual method - simply running the executables and sniffing the traffic. They also force infected machines into various channels on a regular basis - effectively herding them into new channels where they can push new installers, send out new infection messages...pretty much whatever the Botnet owners feel like doing. As always, the only limits are greed and imagination.

Though it's always exciting to catch somebody in the final stages of putting their "Masterplan" together, it's also a touch worrying as you know that they're not quite done yet. Will we see more developments from this case, much like we did with the drawn-out saga of the AIM Rootkit from the tail-end of 2005? That particular story started with Instant Messaging Rootkits, diverted down the path of a group of hackers based in the Middle-East and finished up with fake BitTorrent clients and Mr Bean movies. We think this particular group have many more executable files ready and waiting to go live, so where this one will end up is anyone's guess.

...did I mention this infection would give you a very bad day?

Research Summary Write-Up: Chris Boyd, Director of Malware Research
Technical Research: Peter Jayaraj, Manoj V Nair, FSL Threat Researcher
Technical Research: Chris Mannon, FSL Senior Threat Researcher
E-commerce Evaluation: Wayne Porter, Senior Director Special Research
Technical Research: Tyler Wells, Development Director.

IMPORTANT UPDATE: Google has reacted very quickly to our concerns, and we have been in discussions with their top engineers. As netizens we are encouraged by their quick reaction to our concerns, and willingness to listen thoughtfully to our feedback. Successful companies like Google understand that one must be a part of the conversation, not stand outside the conversation or try to obscure it. Our hats are off!
Stay tuned for more news...(See Addendum At Bottom)

-Wayne Porter
Sr. Dir. Greynets Research, FaceTime Communications

Back to the entry and analysis from Paperghost....

The idea of problems behind "gated" communities is a pretty interesting one, even more so when the idea regularly rolls around that segregating various parts of the Internet to "keep the bad guys out" would be a great idea. But what happens when those bad-guys are already inside the gates?

From Wikipedia:

(Orkut is) run by Google and named after its creator, Google employee Orkut Buyukkokten. It claims to be designed to help users meet new friends and maintain existing relationships. Similar to Friendster and MySpace, orkut goes a step further by permitting "communities" of users. It is also invitation-only: users must be invited to join the community by someone already there.

So, an interesting concept. But as we saw with Myspace not so long ago, people can (and will) game the system. In this case, the targets are (primarily) Brazilian users of Orkut - because for some reason, something like 70% of all users are from Brazil, and Portuguese is the language of choice right now. Of course, Orkut are not to blame here - nor are social networking sites in general. The sad fact is, large concentrations of end-users in a confined space are like the world's biggest honeypot to a social engineer.

It figures, then, that this particular infection - a variant of an older password stealer, which we dubbed Orc.Malware - should contain a message in Portuguese. Following up a hot tip from this guy (FallenHawk, an extremely resourceful Security Researcher), I was able to get a look at something rather nasty. Something that has apparently been nailing Orkut users for at least a month or so, but (until now) has been ultra-elusive with regards trying to pin it down. The early variants (one or two of which I've since obtained) didn't do very much, and there was no direct tie to Orkut, other than this was where the bad-guys were pushing it. Now, however, the infection will pop up a message telling you your data is being mailed off someplace, before sending you to the Orkut site (as you'll see from the video later on. Bring some popcorn).

The source of the problem are these two nasties (disguised as images), created in the System32 folder by a rogue executable file:

Let's have a look at how these things get on board in the first place. We'll start off with the method of delivery...the infection message. The most common one we've seen so far is this:

"Oi... tudo bom? Como o orkut limita a quantidade de fotos que podem ser publicadas na minha conta, eu criei um slide com algumas fotos minhas, pra ver e so clicar clicar no link!!! [link removed] - Sei que vai gostar"

A (very rough!) translation: "As Orkut limits the amount of photos that can be published in my account, I created a slideshow with some photos of mine, please click to see!"

This message is deposited in an Orkut user's "Scrapbook" (similar to a guestbook), and as the Scrapbooks are public, anyone visiting can see the link and click it. As you probably guessed, that's a real bad idea in this case.

The end-user is presented with what looks like an image file - open it up, and covert ops of the nastiest kind are instigated against the PC. Two more files are installed.

They don't look like much, but they're busy trying to drain your pockets of cash and anything else they can get their hands on. One of the files contains references to a pile of specific login pages for Brazilian banks, as well as a whole section devoted to Orkut and its Friends and Scrapbook pages. On the Orkut help site, they mention how automated Scrap sending isn't allowed:

"If you use other sites to log into orkut or send your friends scraps, you will likely be blocked from performing any actions on orkut.com for about 15 minutes and you'll see the message "We're sorry...but your query looks similar to automated requests."

However, there are many examples of people abusing the system - Orkut has had lots of problems previously with people creating Spam scripts. And this particular infection does seem to have at least a (very) basic automated functionality. I first tested this on the Eighth of June, and was more interested in the data-theft aspect at that point. I didn't see anything particularly unusual going on (beyond the keylogging, of course!) and yet when I logged in a few days later, I saw this:

Click to Enlarge

...and this:

Click to Enlarge

During testing, I had two contacts in my "Friends" network. To my surprise, both of those users now had the infection message sitting in their scrapbooks. As you can see, the time / date of both messages is identical: 09:54 AM, 08/06/2006.

Now that's pretty freaky.

Worse still, this infection seems to be amazingly random. During one round of testing, it even deposited me into an XDCC Botnet:

Click to Enlarge

Yay, I'm file-sharing pirated content!

As for how the data is actually sent back to the hacker guy, you'll probably want to check this short movie clip out:

Click here to download movie (2.90 MB)

00:00 to 00:09 seconds: End-user is going about their daily business, logging into Orkut. Note that you could be performing any web-based activity here; it's just a little thing I like to call context. Plus, I don't actually have any Brazilian bank accounts so you'll just have to make do with Orkut.

00:10 to 00:14 seconds: The end-user clicks into "My Computer". Oh dear - an "error message", warning that you have insufficient virtual memory and the application will now close (or words to that effect. I never was very good with Babelfish).

00:17 to 00:27: At this point, the end-user is probably wondering what on Earth is going on, as they see a message telling them their "form has been submitted", and that they will be redirected somewhere in 5 seconds. Can you guess where?

00:28 to 00:34: That's right, Orkut! I mean, he stole all your bank details and website logins, but at least he gives you a chance to get back into Orkut and change your password before he steals that too!

Click image to Enlarge

Make no mistake about it - this infection is a real nasty one. And worse still, it looks like the tip of a very ugly iceberg. I'd insert a really rubbish comment at this point about "how I hope we're not too late to avoid a Spyware-Titanic", but you'd probably hate me for it. Even if it was a nice tie in to the whole iceberg thing. So I'll just leave you with the advice that randomly clicking links to check out pictures, especially when those pictures are from some magical party you've never heard of, is probably not a very good idea.

Many thanks to Peter in our Bangalore office for his incredible sleuth work and the entire team for assisting in pulling this complex case to pieces. Special thanks to Wayne Porter for all night monitoring and revisions.

ADDENDUM: A startling event was discovered during extended testing on an infected machine, which was infected in a lab setting on the 13th of June. The link to the dangerous payload was propogated on the 16th...however the infection message is timestamped as having been sent on the 14th of June:

Click to Enlarge

Click to Enlarge

ADDENDUM Saturday, 17 2006 Happy Endings for Orkut

From CNET:

Google confirmed the worm. "We are aware of this issue and will have a temporary fix in place within the hour," a company representative said in an e-mailed statement. "We are working on a more permanent solution for users to guard against these malicious efforts."

For their protection, Orkut users, just as users of all online services and applications, should always be careful when opening or clicking on anything suspicious, the Google representative said.

-Wayne Porter
Sr. Dir. Greynets Research, FaceTime Communications

Well, not exactly. We don't have any balloons or men in funny hats - however, you may find this article interesting - it deals with the "local traits" of the US, Europe, China, Russia and more, "local traits" meaning "ability to do nasty things to your PC". According to the writeup, Europe is both attacker and victim, America needs to get a firm handle on where the danger is coming from before it's too late and China's ability to man the walls is severely lacking.

Is it just me, or did they base their study on World War 2?

Joking aside, there's some interesting information presented here:

"...the US does certainly harbour some of the most prolific spammers in the world, as well as the world's three worst ISPs for relaying spam, says Spamhaus."

The depth of Spam coming out of the States is not widely known by Joe Public, and it always seems to come as something of a surprise to them. In addition:

"The most recent figures from MessageLabs suggest almost one-fifth (18.1 per cent) of all compromised machines are located in the US - and it's a fair bet, based on recent police investigations, that many of those doing the infecting are also US-based."

Whoops.

China leads the way in attack volume, with the others playing catchup. Meanwhile, Russia slides down the table with less than 2% of attacks last year and the Middle East is mentioned in connection with Spyware. I have some personal experience of this, and I have to say - those guys are a tough nut to crack.

All in all, a good writeup - however, I'd like to have seen more detail. Some specific examples of what each region gets up to, maybe, or how about some anecdotal evidence. I'd also love to know what kind of actvities are going on in Korea, but that's a whole other ball game...!

I got this lovely missive in my mailbox a few days ago:

Tired of being scammed?
Tired of servers downtime?
Tired of high latency?
Being Blocked or Blacklisted too fast?

FORGET ABOUT THAT!
Get rid of asian datacenters and choose a better Spam friendly solution with us.We have the latest development in Bulletproof Webservers that will
handle your high complaint loads.

Contact us for pricing!
-----------------------------
ICQ #:
MSN Messenger:
AIM:
yahoo:

Botnet Hosting Servers
-------------------------------
5 Ips that changes every 10 minutes (with different ISP)
Excellent ping and uptime.
100 percent uptime guarantee. Easy Control Panel to add or delete your domains thru webinterface.
Redhat / Debian LINUX OS.
SSH Root Access.
FTP Access.
APACHE2 PHP CURL ZEND MYSQL FTP SSH.

We have Direct Sending Servers, and we also do Email Lists Mailings.

Spam friendly and Botnet hosting? Oh, dream come true! With that in mind, I decided to check out their website - not a good start, it was offline and the email address kept bouncing. Three of the four IM addresses didn't seem to work and we nearly had no writeup, but with the last address I tried...

Let's Dive Right Into It...

Recently, like my colleague Chris Boyd, I received the Microsoft MVP Award, I thought I might get a raise- instead I received the honor of leading the Greynets Blog! What a task it has been. Imagine having a team of extremely smart and busy analysts, researchers, and engineers from all around the world, many from different cultures, and getting them to settle down to write about their experiences and document some of their findings? Piece of cake right?

Who is This Blog For...

Good question and I have a good answer. The Greynet Blog carries a wide range of information to fit every type of person: the casual PC user, the new PC user, the hard-core technical user, the Enterprise manager, and intermediate users too. We even you use it ourselves!

Rather then try to create a blog that is nothing but complete technical jargon or a blog that caters only to beginners we try to produce a good mix of novice and intermediate material. However, we know there are some hard core programmers, spyware warriors and analysts out there who enjoy a thrill ride all the way into the Matrix and back. Don't worry- we won't leave you out because we like to visit the Matrix too. And if you are a beginner or an intermediate user you can always shoot us a question and we can try to answer it here. That is one of our aims- to educate and help people from all backgrounds understand the impact of the technology and software they use.

Think of the Greynets Blog as a salad bar...you can pick and choose exactly what you want and we never charge for seconds, as a matter of fact we encourage them and you can leave out the bean sprouts if you don't like them.

Haven't I Seen Some of You Guys Before?

Maybe. ..Perhaps in the press or some of you may know me from my Revenews Blog where I bust up the financials on seedy outfits. You may know the infamous Chris Boyd, a.k.a. Paperghost from VitalSecurity.org where he kicks up the action on malware and spyware writers "kung-fu" style and is a recognized CNET Top 100 Blogger as well as a MSFT Security MVP x2! You will soon meet a new legion of bloggers from various disciplines and cultures- Manoj, Deepak, Peter, Charles, Chris, Tyler, Jan (who we call Obijan- which is another story from another galaxy) from across our company.

I promise more individuals will follow as we cover topics from P2P file sharing to securing IM networks and, of course, the ever present threat of spyware, malware and adware and what it means to you. Our goal is to share our experiences deep in the cyber- trenches, to educate both Enterprise users and the home PC user and to do this through opinions backed up by facts and evidence- and hopefully entertain you occasionally. We also intend to drag in some other notables in the security industry, many our colleagues, and get their take on things- and who knows maybe we can drag in an executive or two to get the 10,000 mile (or meter if your from not from the U.S.-assume nothing.) view on the future of security.

So What Is It?

Like many blogs, also known as weblogs, it contains documented experiences from the trenches- often where the real battles happen and we show it to you one bullet at a time, slow motion style, so like Neo, you can avoid the bullets but watch the ripples as they tear up the air.

Some of the experiences are quite comical, some quite sad, but they all carry the message that Internet Security is no longer simply black and white- it comes in various shades of grey. Ultimately it is up to you- the Systems's Administrator of the Home PC User to make decisions on what you want or do not want on your machine or network. Afterall you have that right- it's your property!

Skype, recently acquired by eBay, is becoming a very popular Instant Messenging client. You can text chat, hold conferences, send files and most importantly talk in real time with wonderful clarity. Not only can you talk to just those on your Skype list, but you can also by credits to dial out to real world lines. Skype is a proprietary peer-to-peer Internet telephony (VoIP) network, founded by Niklas Zennstrom and Janus Friis, the creators of KaZaA.

I have been using Skype for sometime but never before had I received an unsolicited commercial message in my months of usage. In terms of e-mail this is commonly called spam but on instant messenging networks this is called SPIM. In short someone contacts you hawking goods and wares, or anything that you don't want. You don't know them, you did not contact them, did not opt-in to be contacted by them, in short they simply hammer out commercial messages in hopes someone will buy.

I found this case particularly interesting because, as I said before, I had never received SPIM through Skype (and fortunately it is easy to block a user.) In this case I decided to "play" with the spammer to gauge their response and have some fun and games.

Would they ignore me? Hit me with more unwanted spam? Or are they truly ignorant? Find below the full transcript of our "conversation". Obviously near the end I was pretending to execute various "commands" on her machines when in reality I was doing nothing but typing in all caps simulating a "look up" of who they were.

This spammer was not harmed in the incident, but let's hope they don't do it again. Read on...

The first part of the transcript is the list of brand new units of phones they sell, below it you will find our "dialogue" and my simulated commands of geolocation as I tried to steer this spammer into the path of not doing it again. I doubt that will work, but it is amusing nonetheless. More below...