posted 05-25-2005 09:03 PM                    

quote:

---

Trojan holds PC files for ransom
A unique new kind of malicious threat which locks up files on a PC then demands money in return for unlocking them has been identified.

The program, Trojan.Pgpcoder, installs itself on a vulnerable computer after users visit certain websites.

It exploits a known vulnerability in Microsoft's Internet Explorer (IE).

Net security firm Symantec said the program had not spread quickly, but was another example of rising criminal extortion activity on the net.

The malware - harmful software - was first identified by US net security firm Websense.

Ransom note

The program, once it installs itself unbeknown to a user, triggers the download of an encoder application which searches for common types of files on a computer and networked drives to encrypt.

When a file is encrypted, usually for security and privacy purposes, it can only be decrypted with specific instructions.

The trojan replaces a user's original files with locked up ones, so that they are inaccessible. It then leaves a "ransom note" in a text file.

Instructions to release the files are only handed over when a ransom fee is paid, according to Websense.

The electronic note left on the computer gives details of how to meet the demands via an online account.

"This attack is yet another indicator of the growing trend of criminals using technology for financial gain," said Kevin Hogan, senior manager at web security firm Symantec.

"This Trojan horse is certainly an example of using cryptography for malicious purposes.

"It is the equivalent of someone coming into your home, locking your valuables in a safe and refusing to give you the combination."

But because it is classed as a trojan, it does not send itself out to contacts that a user might have stored on a computer, like viruses. This limits its ability spread around to high levels, "in the wild", said Symantec.

Computer users are urged to ensure their anti-virus and security software is up-to-date.

---

posted 05-25-2005 09:52 PM                       

quote:

---

Trojans used for online extortion
Joris Evers
CNET News.com
May 25, 2005, 10:35 BST

In a new type of online attack, extortionists remotely encrypt user files and then demand money for the key to decode the information.

In a case documented by San Diego-based Web security company Websense, the attack occurs after a user visits a Web site containing code that exploits a known flaw in Microsoft's Internet Explorer. The flaw is used to download and run a malicious program that in turn downloads an application that encrypts files on the victim's PC and mapped network drives, according to Websense. The program then drops a ransom note.

Even though this type of attack is not widespread at this point, Internet users should be aware of the threat, said Oliver Friedrichs, a senior manager at Symantec Security Response. "It is certainly concerning. This is the first time that we have seen cryptography used in this type of attack to hold your information hostage," he said.

"I would see this as the equivalent of somebody coming into your house, putting your valuables in a safe and not telling you the combination," Friedrichs said.

Researchers at Symantec have seen the malicious program used in the ransom attack. The "Trojan.Pgpcoder" searches a victim's hard disk drive for 15 common file types, including images and Microsoft Office files. It then encrypts the files, removes the originals and drops a note asking $200 (£109) for the encryption key, Friedrichs said.

A Websense customer fell victim to the attack. Luckily, in this case the encryption wasn't very sophisticated and Websense was able to decode the customer's files, said Dan Hubbard, senior director of security and research at Websense. "In this case we could help, but every variant can be different," he said.

Attackers could use email, a Web site, or other means to distribute the Trojan.Pgpcoder and launch a widespread extortion campaign, Symantec's Friedrichs said.

Websense, however, doesn't see a trend yet. Attackers leave a trail if they ask for money, Hubbard said: "This type of attack is not that difficult to perform. However, in order to collect money the attackers are leaving themselves open to investigation and tracing."

For protection, users should run security software and make sure that their software is patched, Websense and Symantec said. The Internet Explorer flaw exploited to attack the user in the Websense case was patched in July last year.

The Websense customer was victimised two weeks ago. The Web sites involved in the attack have since been taken down.

---

quote:

---

A Black Eye for Firefox Security
by Preston Gralla
May. 10, 2005

Another day, another Firefox vulnerability.

Ho hum. It's starting to feel old hat.

But the way that Firefox has responded to the latest threat (and previous threats) has given those in charge of the browser a black eye.

First, consider the newest vulnerability. This time around, it's serious --- "extremely critical" because the flaw in Firefox and Mozilla could allow malicious code to be executed on someone's machine when they visit a Web site. As I write this, there's no complete fix, but Mozilla is working on the problem.

In the meantime, you can protect yourself by disabling JavaScript by choosing Tools-->Options-->Web Features, and unchecking the box next to "Enable JavaScript". You should also disable Firefox's software installation feature by going to the same screen and unchecking the box next to "Allow web sites to install software". When you're done, click OK.

The problem here is that if you visit the Firefox front page, you'll find not a single word about the vulnerability. No warning. No explanation of the security issue. No details on how to protect yourself. Nothing. If you want to find out about it, you'll have to dig very deep on the Mozilla site to find the security advisory.

This just isn't good enough. Security holes are the price of success --- there will be more of them. But the Firefox team has to start fessing up publicly on its own Web site when there's a vulnerability, and give people instructions on how to protect themselves.

Preston Gralla is a well-known technology expert, and the author of Internet Annoyances and Windows XP Hacks, as well as more than 30 other books. He is also the editor of WindowsDevCenter.com and a freelance journalist and columnist.

---

posted 05-25-2005 11:35 PM                       

quote: Joe Redifer

---

People who use Internet Explorer should be stabbed in one of their eyeballs

---

posted 05-30-2005 05:17 PM                       

quote: Bobby Henderson

---

A friend of mine said I should run a side business rescuing infected PCs, but I laughed at the suggestion. If a person can't even be bothered to download a free anti-virus application or download free security updates, what makes anyone think they'll be willing to pay a respectable fee to get their computer back up and running?

---

posted 05-30-2005 05:59 PM                    

quote: John Walsh

---

if the wireless manufacturers configure their stuff to be 'secure' out of the box, most people wouldn't know enough how to get it to work

---

quote: John Walsh

---

Also, it looks like few in Congress (or the Senate) know much about computers themselves. How can you write a law regulating something you don't understand?

---

posted 05-31-2005 01:51 AM                       

quote: Bobby Henderson

---

The fact some people are getting stung IE hole that was patched nearly a year ago underscores the fact most people are just terribly lazy when it comes to keeping their computer safe.

---