New Excel 0-day being exploited in the wild

 

Zero-day malware/virus is something like , a fresh candidate from graduate school !!! It’s just some virus for which antivirus software has not information or in “technical” term … no known virus signature !!!

Symantec is reporting that a new remote vulnerability has been discovered in Microsoft Excel 2007, and that this vulnerability is being exploited in the wild.
Details are sparse, but it looks like Symantec has discovered a code-execution vulnerability in Excel 2007 and Excel 2007 SP1. The issue is beingactively exploited in the wild by a variant of the Mdropper trojan.

There is no patch for the vulnerability yet, so until one arrives, don’t open anything that looks like an Excel document from sources you cannot completely trust and verify !!!

part from Znet …

 

Njoy …

Billions to eavesdrop Skype !!!

 

During old times it was always big problem for Govt. agencies to tape phones of suspected individuals … then technology evolved with time and phone taping became handy tool to keep an “ear” on people … but then age came of mobile phone and satellite phones which became another challenge for agencies to spy on … and now at internet age … new way to communication has been evolved … that we use knowingly or unknowingly … its called VOIP  (Voice Over IP) a.k.a. interne telephone !!! …

Yes, when we make any call using internet it uses internet protocol ,just like we surf internet … and it becomes a bit difficult to watch over all these calls because its very cheap and easy to use … so users using this method of call is very hugeeeeeeeee number … and perhaps its the biggest problem spy agencies facing to tape terrorists who are using modern technology to communicate ( before 9/11 we had never thought that they can use e-Mails’ draft service to communicate ,right ??? ) …

Recently , An industry source disclosed that America's super secret National Security Agency (NSA) is offering "billions" to any firm which can offer reliable eavesdropping on Skype IM and voice traffic. Skype in particular is a serious problem for spooks and cops. Being P2P, the network can't be accessed by the company providing it and the authorities can't gain access by that route. The company won't disclose details of its encryption, either, and isn't required to as it is Europe based. This lack of openness prompts many security pros to rubbish Skype on "security through obscurity" grounds: but nonetheless it remains a popular choice with those who think they might find themselves under surveillance. Rumor suggests that America's NSA may be able to break Skype encryption - assuming they have access to a given call or message - but nobody else.

The NSA may be able to do that: but it seems that if so, this uses up too much of the agency's resources at present.

"They are saying to the industry, you get us into Skype and we will make you a very rich company," said the industry source, adding that the obscure encryption used by the P2Pware is believed to change frequently as part of software updates.

The spyware kingpin suggested that Skype is deliberately seeking to frustrate national listening agencies, which seems an odd thing to do - Skype has difficulties enough getting revenues out of its vast user base at any time, and a paid secure-voice system for subversives doesn't seem like a money-spinner.

But corporate parent eBay, having had to write down $1.4bn already following its $2.6bn purchase of Skype back in the bubble-2.0 days of 2005, might see an opportunity here. A billion or two from the NSA for a backdoor into Skype might make the acquisition seem like a sensible idea.

The spybiz exec, who preferred to remain anonymous, confirmed that Skype continues to be a major problem for government listening agencies, spooks and police. This was already thought to be the case, following requests from German authorities for special intercept/bugging powers to help them deal with Skype-loving malefactors. Britain's GCHQ has also stated that it has severe problems intercepting VoIP and internet communication in general

Njoy …

We will have same confusing versions of 7 too …

 

 

Like M$ offered different Versions for Vista ( for the record , 4 … home basic, home premium , business and ultimate ) … new forthcoming OS of M$ … windows 7 too will have same or may be more flavors … on 3rd of Feb. Microsoft officially announced what versions Windows 7 may be available in market.

according to them , there will be two primary versions … Home Premium and Professional … but in one question they have mentioned that … they will have other flavors too ..

PressPass: So that covers most people. What will you offer for customers at the “poles” of your worldwide market?

Ybarra: Within a customer base of over one billion, there are a lot of important customer niches, or segments, and we want to make sure we have an appropriate product for everybody. Again, for a majority of our customers the choice is really simple: Windows 7 Home Premium or Windows 7 Professional. We understand some of our customers have different needs, like enthusiasts who want every feature in Windows, for example.

For our biggest enterprise customers, we'll continue to have an Enterprise edition. And we will work to make sure there continues to be strong value in Enterprise edition for our annuity customers with Software Assurance agreements. This edition will not be available at retail or by OEMs for pre-installation on a new PC. Windows 7 Enterprise edition offers advanced data protection, lower cost compliance and IT tools to streamline PC management and help save costs, while enabling access to information from anywhere for business users.

We know emerging markets have unique needs and we will offer Windows 7 Home Basic, only in emerging markets, for customers looking for an entry-point Windows experience on a full-size value PC.

We’ll also continue to offer Windows Starter edition, which will only be offered pre-installed by an OEM. Windows Starter edition will now be available worldwide. This edition is available only in the OEM channel on new PCs limited to specific types of hardware.

And certainly there is also a small set of customers who want everything Windows 7 has to offer. So we will continue to have Windows 7 Ultimate edition to meet that specialized need. Windows 7 Ultimate edition is designed for PC enthusiasts who “want it all” and customers who want the security features such as BitLocker found in Windows 7 Enterprise edition.

 

I just don’t understand … why they can’t simply offer one basic version for less $$$ and then offer different paid upgrades like aero theme or bit locker for extra $$$ … or just two versions one for home users and another for professionals just like XP ?? … but if they do this , then how they gonna make more $$$ by confusing people and make them buy something that they really don’t want !!!

 

Njoy …

“Fix It” … from Microsoft

 

It has been always difficult to find help using standard help documents that we get with our Windows … right ?? … even sometimes it is more difficult to find help document on M$ website too … so most of time people like me prefer to ask google then microsoft .. right ??

Over the past six weeks, Microsoft has quietly added a "Fix it" button to a few of the thousands of help documents on its Web site. When clicked, the computer then takes all the recommended steps automatically.

"If we know what those 15 steps are why shouldn't we just script it," said Lori Brownell, Microsoft's general manager of product quality and online support

The "Fix it" option is still fairly rare, showing up in around 100 different help documents. The effort is growing rapidly, though, up from just four such fixes when the program quietly began in December.

Microsoft continues to offer users the option of doing things on their own if they either don't trust Microsoft or just like being in control.

"We're not trying to hide anything," she said.

The first fixes included a number of common issues, including restoring a missing Internet Explorer icon to the desktop, how to enable the DVD library in Vista's Windows Media Center as well as what to do when encountering the error message in Street & Trips 2008 that "Construction information for routes could not be downloaded"

For now, Microsoft is having to go back and search its archives to see which of its problem solving tips can be automated. Eventually, it hopes to create the automated fixes at the same time the help articles are created.

Where it can, Microsoft is also adding the "Fix it" option into the error reporting tool built into Windows. Initially, all users could do when a program crashed was send a report to Microsoft. More recently, the system has started checking to see if there is any information on the issue. Next up, said Brownell, is offering the option to have the issue solved automatically.

another one example can be action center of windows 7 … which pinpoints and fixes issues that it can fix regarding security and maintenance issues with operating system.

Njoy …

Nearly Half the Hard Drives on EBay Hold Personal Data !!!

 

 

EBay … one of my favorite place to buy computer junk online with good price and options … just like many people around the world …

Recently a New York computer forensics firm found that 40% of the hard disk drives it recently purchased in bulk orders from eBay contained personal, private and sensitive information -- everything from corporate financial data to the Web-surfing history and downloads of a man with a foot fetish.

Kessler International conducted the survey over a six-month period, buying up disk drives from the United States and Canada ranging in size from 40GB to 300GB. The firm, which completed its survey about two weeks ago, bought a total of 100 relatively modern drives, the vast majority of them serial ATA.

"With size of the sample, I guess we were surprised with the percentage of disks that we found data on," said Michael Kessler, CEO of Kessler International. "We expected most of the drives to be wiped -- to find one or two disks with data. But 40 drives out of 100 is a lot."

While Kessler's engineers had to use special forensics software to retrieve data from some of the hard drives, others contained sensitive data in the clear, having never been overwritten or erased. The data included personal documents, financial information, e-mails, DNS server information and photographs.

"The average person who knows anything about computers could plug in these disks and just go surfing," Kessler said. "I know they found a guy's foot fetish on one disk. He'd been downloading loads and loads of stuff on feet. With what we got on that disk -- his name, address and all of his contacts -- it would have been extremely embarrassing if we were somebody who wanted to blackmail him."

Kessler said his company specifically avoided buying drives whose sellers indicated they'd been erased.

Kessler International broke down the kind of data it retrieved this way: Personal and confidential documents, including financial information, (36%); e-mails, (21%); photos, (13%); corporate documents, (11%); Web browsing histories, (11%); DNS server information, (4%); Miscellaneous data, (4%).

"We were more concerned with searching for people's identification, which is what we found, but we were surprised by all the corporate spreadsheets and business finance records we found," Kessler said.

The forensics firm even found one company's "secret" French fries recipe, Kessler said.

In recent years, hard drives have shown up on eBay that contain all kinds of sensitive data. In April 2006, Idaho Power Co. learned that drives it thought had been recycled had actually been sold on eBay with data still intact. The Boise, Idaho-based utility had used the drives in servers; when bought on eBay, they still contained proprietary corporate information such as memos, customer correspondence and confidential employee information.

well i think it may be true for all sites that sell old HDDs … it may contain personal information … and i think for this user may need something more then just disk formatting tool say … drive scrubber ?? … which can even re-write tracks and sectors of HDD which makes almost impossible to recover data from formatted HDD !!!

 

Njoy …

Be warned by Police for Botnet infection !!!

 

Police in the Netherlands claim a world's first in warning victims whose computers were infected by a botnet that was shut down last week. The victims will be forwarded to a special Web page offering instructions on cleaning up their systems.

The high-tech crime unit of the police started issuing the warnings on Wednesday. Users with infected systems are automatically sent a special page when they log onto the Internet. The page offers instructions on disabling the botnet, as well as a link to Kaspersky's online virus scanner and a request to file charges against the botnet herder, a 19- year-old man from the Dutch city of Sneek who was arrested last week.

The page, which was created in cooperation with Kaskersky Labs, marks the first time that botnet victims have been proactively warned by authorities, said Eddy Willems, a virus evangelist with Kaspersky Labs in the Netherlands. "This might initiate other actions in neighboring countries, so we can continue doing this in a coordinated fashion throughout the European Union," Willems told Webwereld. "That would be a good way to fight these crimes."

Releasing a computer from the controls of the botnet might not be for the amateur computer user. Users among other things have to dig into the Windows registry and disable a rootkit that prevented detection of the malware by the user and security software. Willems cautions that users should be careful even after they have followed the step-by-step removal instructions, because the computer is likely to contain additional malware and viruses.

Authorities are able to forward victims to the special page because they have taken over control of the botnet. Infected computers will contact a central server in Russia for instructions. Normally this controlling server will order the computers to start malicious tasks such as sending spam, hosting child pornography or launching a distributed denial of service attack. But the server has been reprogrammed to forward the systems to the warning page.

The botnet herder was arrested last week after he tried to sell his network to a man in Brazil for Euro 25,000. At the time, the botnet was estimated to have snared 100,000 computers. Willems claims current estimates peg the number of infections at 140,000 to 150,000.

from computerworld ….

Njoy …

Google mistakenly calls entire Net malicious !!!

 

A typing mistake led search giant Google last weekend to briefly classify the entire Internet as potentially malicious.

On Saturday morning of last day of month , every search result began to display the "This site may harm your computer" link that Google uses to flag potentially malicious sites. The search company quickly fixed the issue and stated in a blog post that human error caused a flawed update to its list of bad sites, resulting in every Internet site being classified as dangerous.

"We periodically update that list and released one such update to the site this morning," Marissa Mayer, vice president of Google's search products and user experience, said in a blog post. "Unfortunately — and here's the human error — the URL of '/' was mistakenly checked in as a value to the file, and '/' expands to all URLs. Fortunately, our on-call site reliability team found the problem quickly and reverted the file."

The StopBadware project, which maintains criteria that Google's uses to create its own filters, clarified a misperception in many media reports that the list used by Google comes directly from StopBadware.

"The mistake in Google’s initial statement, indicating that we supply them with badware data, is a common misperception," the statement said. "We appreciate their follow up efforts in clarifying the relationship on their blog and with the media. Despite today’s glitch, we continue to support Google’s effort to proactively warn users of badware sites, and our experience is that they are committed to doing so as accurately and as fairly as possible."

Google stated that, because its updates are staggered, the problems should have lasted only about 40 minutes for any particular users. However, in a separate blog post, the company added that the block list is also used in its spam filters, so legitimate messages may have been classified as spam. Google is currently reviewing all filtered messages to return legitimate e-mail to its recipients' inbox.

 

Njoy …

Net Neutrality Tools from Google & group !!!

 

Its been in news from long time that IPS were throttling some particular type of network traffic such as BitTorrent …  and also there was many online tools with which’s help you can find out weather your ISP is throttling Torrent Client or not … but i think its an interesting thing to mention that , Google is now it the field !!!

Google and a group of partners have released a set of tools designed to help broadband customers and researchers measure performance of Internet connections. The set of tools, at MeasurementLab.net, includes a network diagnostic tool, a network path diagnostic tool and a tool to measure whether the user's broadband provider is slowing BitTorrent peer-to-peer (P-to-P) traffic. Coming soon to the M-Lab applications is a tool to determine whether a broadband provider is giving some traffic a lower priority than other traffic, and a tool to determine whether a provider is degrading certain users or applications.

"Transparency is our goal," said Vint Cerf, chief Internet evangelist at Google and a co-developer of TCP/IP. "Our intent is to make more [information] visible for all who are interested in the way the network is functioning at all layers."

The tools will not only allow broadband customers to test their Internet connections, but also allow security and other researchers to work on ways to improve the Internet, Cerf said. Current Internet performance tools "are geeky to the extreme," he said during a Washington, D.C., forum on the M-Lab tools.

The M-Lab project, launched Wednesday, comes after controversy over network management practices by Comcast and other broadband providers. Earlier this month, two officials at the U.S. Federal Communications Commission questioned why Comcast, the largest cable modem provider in the U.S., was exempting its own VoIP (voice over Internet protocol) from traffic congestion slowdowns, but not offering the same protections to competing VoIP services.

The set of tools will allow broadband customers to measure their providers' performance, said Michael Calabrese, director of the Wireless Future Program at the New America Foundation, a think tank involved in the M-Lab project. Consumers "deserve to be well-informed" about their broadband performance, he said.

Some of the M-Lab tools have already been released, but participants in the project plan to further develop the tools and host them on servers around the world, added Sascha Meinrath, research director at the Wireless Future Program. All the M-Lab tools will be released under open-source licenses, allowing others to modify and improve them, he said.

People on either side of a debate on whether the FCC or U.S. Congress should develop network neutrality rules should welcome the tools, said Ed Felten, director of the Center for Information Policy and a computer science and public policy professor at Princeton University. It took months for policymakers to gather solid information on Comcast's network management practices, but net neutrality advocates can use the tools if they suspect broadband providers of interfering with traffic.

"If you believe that network neutrality government regulation is not needed, if you believe that the market will handle this ... then you should also welcome Measurement Labs," Felten said. "What you are appealing to is a process of public discussion ... in which consumers move to the ISP [Internet service provider] that gives them the best performance. It's a market that's facilitated by better information."

However, one ISP industry source, who asked not to be identified, questioned whether the tools would accurately point to the cause of broadband problems. Spyware or malware on computers can affect browser performance, and problems with the wider Internet can cause slowdowns, the source said.

The M-Labs partners seemed to bypass broadband providers when putting together their tools, the source added. "It may appear that issues that are occurring off an ISP's network may be the ISP's problem," the source said of the tools. "It's important for groups like this to collaborate, not only among themselves, but also with ISPs."

from … CIO

Njoy …

How do they make all that malware !!!

 

It is hard to believe that a man is telling the truth when you know that you would lie if you were in his place.

-H. L. Mencken

Anti-virus vendors are getting more than 50,000 submissions of new malware per day now. How can the malware business be so productive? It turns out the numbers aren't really as big as all that.

Welcome to the malware generation business model. So you want to be a malware star? Well listen now to what I say. Unfortunately, I will be somewhat vague, but the fact is that anyone who's technically competent and has the will to do so can find the missing pieces of the puzzle I'll lay out.

First, very little malware is lovingly hand-crafted from scratch these days. The name of the game in defeating anti-virus software is volume. You generate huge numbers of slight variants of a malicious program, do things like use different packers on the executable, and some end up different enough that the anti-malware products can't detect them.

So you write or get someone else's malcode generator. These are programs that generate malicious code variants. (No, I won't tell you where to find them.) You can get source to lots of popular malware, make your own changes and make zillions of variants. But the overwhelming majority of these variants will be detected by any decent anti-malware program, and you can't distribute all of then, so how are you to know which are the undetectable ones?

The answer is to use one of the public malware scanning services. The first and most famous one is VirusTotal, but there are several others. You upload a file to these services, and they scan it with a collection of scanners. Here's the list of VirusTotal's scanners, ripped straight off of their site:

• AhnLab (V3)
• Aladdin (eSafe)
• ALWIL (Avast! Antivirus)
• Authentium (Command Antivirus)
• AVG Technologies (AVG)
• Avira (AntiVir)
• Cat Computer Services (Quick Heal)
• ClamAV (ClamAV)
• Comodo (Comodo)
• CA Inc. (Vet)
• Doctor Web, Ltd. (DrWeb)
• Emsi Software GmbH (a-squared)
• Eset Software (ESET NOD32)
• Fortinet (Fortinet)
• FRISK Software (F-Prot)
• F-Secure (F-Secure)
• G DATA Software (GData)
• Hacksoft (The Hacker)
• Hauri (ViRobot)
• Ikarus Software (Ikarus)
• INCA Internet (nProtect)
• K7 Computing (K7AntiVirus)
• Kaspersky Lab (AVP)
• McAfee (VirusScan)
• Microsoft (Malware Protection)
• Norman (Norman Antivirus)
• Panda Security (Panda Platinum)
• PC Tools (PCTools)
• Prevx (Prevx1)
• Rising Antivirus (Rising)
• Secure Computing (SecureWeb)
• BitDefender GmbH (BitDefender)
• Sophos (SAV)
• Sunbelt Software (Antivirus)
• Symantec (Norton Antivirus)
• VirusBlokAda (VBA32)
• Trend Micro (TrendMicro)
• VirusBuster (VirusBuster)

You get a report back saying what scanners found the malware, what they detected it as, and which didn't find it. With new malware, the detections will be overwhelmingly generic/heuristic.

The good news is you can see which variants are undetected enough to be useful. The bad news is that when a product does not detect your sample, VirusTotal and the other scanners submit it to the AV companies so that they can add a signature or adjust their heuristics. You won't go undetected for long. And of those 50,000 submissions, probably no more than a few hundred, perhaps much less than that, are ever seen in the wild. Even fewer do real damage.

This arrangement is what makes it worthwhile for the anti-malware companies to cooperate with VirusTotal. It gets them early access to new malware. It's also how the AV companies are getting 50,000 submissions a day: The malware authors are, in effect, sending the new malware directly to the companies. That they will only have a limited window of opportunity to attack protected users with the new malware is just a cost of doing business.

If you want to spend some money to avoid having to inform the industry about your new code, start your own multiproduct scanning lab. You'll need current subscriptions for as many products as you can get, but I'm not sure it would buy you much time. These companies talk to each other, and if a new, undetectable variant came out from the wild, word would spread pretty quickly; soon someone would feed it through VirusTotal or one of the other services, and the jig would be up.

None of this is news and shouldn't be surprising. The moral of it all, and this too should not be news to you, is that anti-malware should not be your only line of defense. Many people call it useless because some attacks get through, and now you know how, but no line of defense is perfect. Anti-malware needs to be combined with other forms of defense, like a firewall, an intrusion prevention product, running your system with least privileged access and not clicking on links in e-mails (or at least being very careful about doing so).

 

from eWeek.com

Njoy …