I just set up my Raspberry Pi as a Pi-Hole and I couldn't be more pleased.
It was super simple to set up and install the Pi-Hole software. You can read all about it on pi-hole.net. I just updated my Pi and followed their instructions. I set a static IP on my router and even pointed my local network clients to use the Pi-Hole for DNS (IPv4 and IPv6). It was that simple and now everything on my Wifi is "safer". I was especially shocked at all of the legal adware sites that are being "pi-holed".
I like to think that most of the information is anonymous but why risk it when something like this is available for free (I plan to donate) and so easy to set up. Go get yourself a Raspberry Pi and get it done.
Showing posts with label Malware. Show all posts
Showing posts with label Malware. Show all posts
Nov 7, 2018
Nov 27, 2012
Here's all the crapware that comes with new Windows 8 PCs | ITworld
Great little fact that has always bugged me. One more reason to use a Mac.
Here's all the crapware that comes with new Windows 8 PCs | ITworld:
Here's all the crapware that comes with new Windows 8 PCs | ITworld:
Aug 14, 2011
Another Malware Victim
Yesterday I had a visit from a family friend and of course, they brought along an infected laptop. His daughter's new Toshiba laptop was all shiny and fresh out of the box but it just wasn't working like it used to. Of course not; it had over 50 infections of various breeds of malware and trojans.
This was a brand new PC running the latest version of Windows and fully patched. There were two well known AV programs installed not to mention Microsoft Security Essentials. The reason she was infected is simple: "click this box to save the world". No amount of security in the world will protect people from their own infallible minds. We can try to protect people from all sorts of threats in the world; virus, terrorists, crime, even taxes but in the end we are all victims of our own gullible minds. Let's face it, if bad people can design a web page to look legit, they can just as easily make an application look identical to any number of seemingly safe applications. One errant click and "it's goodbye Seattle" --Steve Martin.
Microsoft Security Scanner is a frequently updated tool (it is only valid for 10 days) that can be downloaded and copied to an infected system either in safe mode or from a secondary boot method. This tool should find and remove most malware or virus.
Mar 9, 2011
Dear Mildred...
Here is a blatant cut and paste from PCPro. I love stories like this as they educate PC users around the world.
I was going to contribute to Stewart Mitchell’s request for horror stories about computer repair people; then I was completely diverted by a panic phone call from an old friend, which helped me to realise that I was far more of a repairer than a customer of repairers.
That 72 hours of raw-edged panic was quite enough for me to focus on the sins of those who come and ask for help, which can be every bit as difficult as the sins of the fixers. So pardon me while I abuse the Pro blogs to let my friend know how I felt about her approach to the whole sorry matter.
Dear Mildred (name changed to protect the innocent here),
It was delightful to hear about your holiday in Kuala Lumpur, for 20 minutes, before you got around to mentioning that you had brought back a DVD burned for you by a charismatic local photographer and thrown it in that laptop you obtained from me six months or more ago. It was sadly not surprising to hear that once that DVD had been introduced to the laptop, you had laid yourself wide open to every hacker and script kiddie on the planet. The parts I did find surprising then came so thick and fast that I was barely able to assemble a coherent reply, so let’s unpack all your assumptions and deal with them item by item, now that facts can take precedence over emotional blackmail.
- No, it doesn’t matter how you imagine viruses work: they will not be amenable to persuasion, they will do what they like. Responses like “that seems a bit far-fetched” won’t get your laptop fixed, or keep the hackers away. After the initial, invisible infection has granted the underworld open access to your PC, they are unlikely to steal your personal data – you’re not rich enough – but they will sell off access to your machine, for a relative pittance, to much less accomplished hackers. It’s their lesser efforts you can see, and they’re just evidence of the basic high-quality infection.
- No, you can’t sue AVG. You put a physical piece of storage in your DVD drive and clicked on various dialog boxes, some of which you neither understood, nor can now remember, because you wanted to get at the content on the disk. Once you do that, it’s game over.
- No, I am not responsible for everything that befalls something I once owned. It is now your laptop and your responsibility. Curiously, I am not sitting around at home doing nothing waiting for machines to die, and there is no way that you can cajole, seduce or otherwise influence me to “just spend ten minutes on it”. There are two reasons for this. One is that it’s perfectly clear that if I do touch it, I will never hear the end of the matter for as long as I live. The other is that once you stuck that DVD in there and started saying “yes, OK” to every resulting dialog box, you sank the whole thing. It doesn’t take 10 minutes to sort that out; it requires a complete machine reload to properly guarantee the infection is history.
- No, there is no neat and handy way I’ve been keeping secret that allows you to retain your extensive collection of stolen software licences loaded on that laptop. It’s even possible (but unlikely) that one of those copies you downloaded from total strangers via BitTorrent was actually the source of infection, not the DVD from that far-off and well-known training school for global cybercrime supercriminals. But you don’t believe that possibility either, so that’s me told good and proper. I personally remember all those nights in the 90’s when your standard response to any creative suggestion was “that’s great, but don’t tell anyone else so they can’t steal your idea” – rampant hypocrisy always offends me, especially when the software you’ve stolen is used to maintain your creative business. Perhaps you wouldn’t be in this dire situation if you had actually paid for the things you use (and therefore could reinstall them), even paying for a decent image-based backup program would have saved your bacon. Just because I use one and recommend it to everyone doesn’t mean it must therefore be nerdy and incomprehensible so you shouldn’t touch it.
- Don’t worry. I don’t propose to identify the specific products you don’t have licences for, mainly because I think the whole business of what’s free and what’s not is now so murky and confused that I don’t think you are even doing anything special these days. It’s not something I will involve myself in, though, which is in part why I am more tilted towards the hardware business, than software, these days. I have gone about as far as I can here to make it clear why your approach to the way your laptop drives your business, mixed with your approach to the way that people in the computer business sell things to you, adds up to a disaster waiting to happen. And I do disaster recovery, not disaster participation.
Love and kisses,
Steve
I was going to contribute to Stewart Mitchell’s request for horror stories about computer repair people; then I was completely diverted by a panic phone call from an old friend, which helped me to realise that I was far more of a repairer than a customer of repairers.
That 72 hours of raw-edged panic was quite enough for me to focus on the sins of those who come and ask for help, which can be every bit as difficult as the sins of the fixers. So pardon me while I abuse the Pro blogs to let my friend know how I felt about her approach to the whole sorry matter.
Dear Mildred (name changed to protect the innocent here),
It was delightful to hear about your holiday in Kuala Lumpur, for 20 minutes, before you got around to mentioning that you had brought back a DVD burned for you by a charismatic local photographer and thrown it in that laptop you obtained from me six months or more ago. It was sadly not surprising to hear that once that DVD had been introduced to the laptop, you had laid yourself wide open to every hacker and script kiddie on the planet. The parts I did find surprising then came so thick and fast that I was barely able to assemble a coherent reply, so let’s unpack all your assumptions and deal with them item by item, now that facts can take precedence over emotional blackmail.
- No, it doesn’t matter how you imagine viruses work: they will not be amenable to persuasion, they will do what they like. Responses like “that seems a bit far-fetched” won’t get your laptop fixed, or keep the hackers away. After the initial, invisible infection has granted the underworld open access to your PC, they are unlikely to steal your personal data – you’re not rich enough – but they will sell off access to your machine, for a relative pittance, to much less accomplished hackers. It’s their lesser efforts you can see, and they’re just evidence of the basic high-quality infection.
- No, you can’t sue AVG. You put a physical piece of storage in your DVD drive and clicked on various dialog boxes, some of which you neither understood, nor can now remember, because you wanted to get at the content on the disk. Once you do that, it’s game over.
- No, I am not responsible for everything that befalls something I once owned. It is now your laptop and your responsibility. Curiously, I am not sitting around at home doing nothing waiting for machines to die, and there is no way that you can cajole, seduce or otherwise influence me to “just spend ten minutes on it”. There are two reasons for this. One is that it’s perfectly clear that if I do touch it, I will never hear the end of the matter for as long as I live. The other is that once you stuck that DVD in there and started saying “yes, OK” to every resulting dialog box, you sank the whole thing. It doesn’t take 10 minutes to sort that out; it requires a complete machine reload to properly guarantee the infection is history.
- No, there is no neat and handy way I’ve been keeping secret that allows you to retain your extensive collection of stolen software licences loaded on that laptop. It’s even possible (but unlikely) that one of those copies you downloaded from total strangers via BitTorrent was actually the source of infection, not the DVD from that far-off and well-known training school for global cybercrime supercriminals. But you don’t believe that possibility either, so that’s me told good and proper. I personally remember all those nights in the 90’s when your standard response to any creative suggestion was “that’s great, but don’t tell anyone else so they can’t steal your idea” – rampant hypocrisy always offends me, especially when the software you’ve stolen is used to maintain your creative business. Perhaps you wouldn’t be in this dire situation if you had actually paid for the things you use (and therefore could reinstall them), even paying for a decent image-based backup program would have saved your bacon. Just because I use one and recommend it to everyone doesn’t mean it must therefore be nerdy and incomprehensible so you shouldn’t touch it.
- Don’t worry. I don’t propose to identify the specific products you don’t have licences for, mainly because I think the whole business of what’s free and what’s not is now so murky and confused that I don’t think you are even doing anything special these days. It’s not something I will involve myself in, though, which is in part why I am more tilted towards the hardware business, than software, these days. I have gone about as far as I can here to make it clear why your approach to the way your laptop drives your business, mixed with your approach to the way that people in the computer business sell things to you, adds up to a disaster waiting to happen. And I do disaster recovery, not disaster participation.
Love and kisses,
Steve
Jul 29, 2010
Millions of Android users hit by malicious data theft app
Surprised?
Millions of Android users hit by malicious data theft app: "An app distributed by Google's Android Market has collected private data from millions of users and forwarded it to servers China, validating Apple's uniquely strong stance on mobile security in the iPhone App Store."
Millions of Android users hit by malicious data theft app: "An app distributed by Google's Android Market has collected private data from millions of users and forwarded it to servers China, validating Apple's uniquely strong stance on mobile security in the iPhone App Store."
Jul 21, 2010
Microsoft Zero-Day: Malformed Shortcut Vulnerability
Microsoft Zero-Day: Malformed Shortcut Vulnerability:
"Today Microsoft updated the security advisory that was initially published last Friday (July 16), stating that they’re working on issuing a security patch for this vulnerability. Earlier, malware exploiting this issue was found in the wild. Researchers at McAfee Labs have been busy tracking this issue over the weekend and we have come up with some more quick Q&A’s.
1. What is the issue with .LNK files and how can it be exploited?
A. McAfee Labs researchers analyzed malware that was exploiting a design flaw in parsing shortcut (.LNK) files. This issue gets triggered because the Windows Shell component does not validate parameters sent out in the shortcut. This issue can be exploited via any mechanism that makes the user load the icon of the .LNK file.
2. Does the malware need a payload (shellcode) to exploit this flaw?
A. Since this is a design issue in the way shortcuts are parsed, no malicious payload (shellcode) is required to exploit this flaw. The .LNK file needs to point to a malicious file, the path of which needs to be hardcoded in the shortcut.
3. What are the requirements to successfully exploit this flaw?
A. This flaw can be triggered when Windows Explorer or Internet Explorer tries to render a malformed .LNK file that points to a malicious executable. The user need not double-click on the .LNK file to trigger the vulnerability; just opening the folder containing the malicious shortcut is enough to get infected.
4. What are the most likely attack vectors used to exploit this vulnerability?
A. USB drives are likely to be affected the most. The malware discovered in the wild was exploiting this issue via a USB drive. File sharing over SMB is another likely vector to exploit this flaw and this can lead to widespread malware infections over internal networks. WebDAV shares are equally susceptible to exploitation.
5. What are the affected platforms?
A. Microsoft has acknowledged that all supported platforms are affected. More details are available in the Microsoft security advisory. Windows XP SP2 is not listed in the list of affected platforms from Microsoft, so there is a chance of Windows XP SP2 users might remain vulnerable.
6. How widely is the issue being exploited?
A. The issue is known to be exploited by malware in the wild. Initial attacks were limited. However, an exploit module in metasploit was published today that uses WebDAV shares as an exploit vector. We expect wider exploitation of this issue. Users should keep their anti-virus software updated with the latest DATs (signatures).
We’ll keep our readers updated on this issue as we analyze more malware and techniques used by malware writers to exploit this flaw."
"Today Microsoft updated the security advisory that was initially published last Friday (July 16), stating that they’re working on issuing a security patch for this vulnerability. Earlier, malware exploiting this issue was found in the wild. Researchers at McAfee Labs have been busy tracking this issue over the weekend and we have come up with some more quick Q&A’s.
1. What is the issue with .LNK files and how can it be exploited?
A. McAfee Labs researchers analyzed malware that was exploiting a design flaw in parsing shortcut (.LNK) files. This issue gets triggered because the Windows Shell component does not validate parameters sent out in the shortcut. This issue can be exploited via any mechanism that makes the user load the icon of the .LNK file.
2. Does the malware need a payload (shellcode) to exploit this flaw?
A. Since this is a design issue in the way shortcuts are parsed, no malicious payload (shellcode) is required to exploit this flaw. The .LNK file needs to point to a malicious file, the path of which needs to be hardcoded in the shortcut.
3. What are the requirements to successfully exploit this flaw?
A. This flaw can be triggered when Windows Explorer or Internet Explorer tries to render a malformed .LNK file that points to a malicious executable. The user need not double-click on the .LNK file to trigger the vulnerability; just opening the folder containing the malicious shortcut is enough to get infected.
4. What are the most likely attack vectors used to exploit this vulnerability?
A. USB drives are likely to be affected the most. The malware discovered in the wild was exploiting this issue via a USB drive. File sharing over SMB is another likely vector to exploit this flaw and this can lead to widespread malware infections over internal networks. WebDAV shares are equally susceptible to exploitation.
5. What are the affected platforms?
A. Microsoft has acknowledged that all supported platforms are affected. More details are available in the Microsoft security advisory. Windows XP SP2 is not listed in the list of affected platforms from Microsoft, so there is a chance of Windows XP SP2 users might remain vulnerable.
6. How widely is the issue being exploited?
A. The issue is known to be exploited by malware in the wild. Initial attacks were limited. However, an exploit module in metasploit was published today that uses WebDAV shares as an exploit vector. We expect wider exploitation of this issue. Users should keep their anti-virus software updated with the latest DATs (signatures).
We’ll keep our readers updated on this issue as we analyze more malware and techniques used by malware writers to exploit this flaw."
Dell ships motherboard with malicious code
Apparently this is for the R410 replacement motherboards.
Dell ships motherboard with malicious code:
"Dell has confirmed that some of its PowerEdge server motherboards were shipped to customers with malware code on the embedded server management firmware."
Dell ships motherboard with malicious code:
"Dell has confirmed that some of its PowerEdge server motherboards were shipped to customers with malware code on the embedded server management firmware."
Jul 19, 2010
Scan to email is usually a bad idea
Criminals pushing Rogue anti-Virus disguised as scanned documents: "Email messages masquerading as scanned documents are the latest attack vector being adopted by criminals to push Rogue anti-Virus Malware to the masses. The messages, which appear to have been sent from a Xerox WorkCentre Pro, come with a Zip file that will immediately infect the host system if accessed.
Update:
Since running this story on Friday, we’ve seen more examples of this attack."
Update:
Since running this story on Friday, we’ve seen more examples of this attack."
Mar 3, 2010
More Windows XP Problems, the F1 key?
Even though it's one of the most widely used operating systems on the planet, Windows XP has its problems. It won't be long before it goes the way of IE6 in recent news.
Microsoft Says, Don't Press the F1 Key In XP: "Ian Lamont writes 'Microsoft has issued a security advisory warning users not to press the F1 key in Windows XP, owing to an unpatched bug in VBScript discovered by Polish researcher Maurycy Prodeus. The security advisory says that the vulnerability relates to the way VBScript interacts with Windows Help files when using Internet Explorer, and could be triggered by a user pressing the F1 key after visiting a malicious Web site using a specially crafted dialog box.'
Microsoft Says, Don't Press the F1 Key In XP: "Ian Lamont writes 'Microsoft has issued a security advisory warning users not to press the F1 key in Windows XP, owing to an unpatched bug in VBScript discovered by Polish researcher Maurycy Prodeus. The security advisory says that the vulnerability relates to the way VBScript interacts with Windows Help files when using Internet Explorer, and could be triggered by a user pressing the F1 key after visiting a malicious Web site using a specially crafted dialog box.'
Nov 12, 2009
Microsoft Steady State
For years I have replied upon the Faronic's product, DeepFreeze, for supporting public computer labs. Recently I found Microsoft Steady State and it looks promising. One of the problems I recently ran into with DeepFreeze was the lack of interaction with the operating system. This can be good in some cases but bad in others. I am hoping that Microsoft has solved some of these issues Steady State seeing as they have pretty good access to the code. Hopefully I can post some results here when I get the chance.
Nov 8, 2009
Malware Can Download Child Porn To Your Computer
This is pretty scary stuff. I guess it's nothing we should be surprised about though.
Malware Can Download Child Porn To Your Computer: "2muchcoffeeman writes "The Associated Press tells the story of Michael Fiola, a former Massachusetts government employee who was arrested in 2007 after child porn was found on his state-issued laptop computer. He was eventually cleared of all charges after some digging by the defense found that the laptop was infected with malware that was 'programmed to visit as many as 40 child porn sites per minute — an inhuman feat. While Fiola and his wife were out to dinner one night, someone logged on to the computer and porn flowed in for an hour and a half. Prosecutors performed another test and confirmed the defense findings. The charge was dropped — 11 months after it was filed.' The article also discusses the technical aspects of how it could happen and about similar cases in the United Kingdom in 2003."
Malware Can Download Child Porn To Your Computer: "2muchcoffeeman writes "The Associated Press tells the story of Michael Fiola, a former Massachusetts government employee who was arrested in 2007 after child porn was found on his state-issued laptop computer. He was eventually cleared of all charges after some digging by the defense found that the laptop was infected with malware that was 'programmed to visit as many as 40 child porn sites per minute — an inhuman feat. While Fiola and his wife were out to dinner one night, someone logged on to the computer and porn flowed in for an hour and a half. Prosecutors performed another test and confirmed the defense findings. The charge was dropped — 11 months after it was filed.' The article also discusses the technical aspects of how it could happen and about similar cases in the United Kingdom in 2003."
Read more of this story at Slashdot.
Jul 28, 2009
NoScript to the Rescue, Again
Slashdot is running a scary but true story, 92% of Windows PCs Vulnerable To Zero-Day Attacks On Flash. Now is the time for NoScript to come to the aid of just about everyone.
Apr 13, 2009
Another Conficker Victim
Looks like the University of Utah was hit by the Conficker Worm. According to the Salt Lake Tribune there was minimal damage and no loss of data but the network was definitely affected.
Jul 30, 2008
Facebook and the F.B.I.
The F.B.I. is warning of email spam that mentions “F.B.I. vs. Facebook" and attempts to infect the machine with the Storm Worm if the included link is followed.
They offer a great list of precautions to take when dealing with email.
They offer a great list of precautions to take when dealing with email.
- Do not respond to unsolicited (spam) e-mail.
- Be skeptical of individuals representing themselves as officials soliciting personal information via e-mail.
- Do not click on links contained within an unsolicited e-mail.
- Be cautious of e-mail claiming to contain pictures in attached files, as the files may contain viruses. Only open attachments from known senders.
- Validate the legitimacy of the organization by directly accessing the organization's website rather than following an alleged link to the site.
- Do not provide personal or financial information to anyone who solicits information.
Apr 15, 2008
New Malware Threat Center
The non-profit group SRI has opened a Malware Threat Center that will track the most aggressive malware attacks. It looks to be a great service. I'll be sure to check back for other resources and possible news feeds.
Feb 21, 2008
What is Spyware?
What is it?
Spyware is a very active and dangerous threat to any computer connected to the internet where users browse the web. If new toolbars or multiple popup ads and banners suddenly appear while you are browsing the web, you most likely have some kind of Spyware or Adware. However, even if you don't see this type of behavior you may still be infected. These applications can remain silent in the background collecting information about where you go and what you do on the internet. Then it uploads this information to home servers while your machine is idle. Sometimes this activity takes place while you are trying to use the machine. This can make your internet connection or any type of activity on your machine very slow and almost unresponsive.
What can I do about it?
There are several applications that will clean and remove most Spyware. However, some of the more advanced products require many steps and possibly rebooting your machine several times.
Since most of these nasty applications simply open the door to other nasty applications you rarely have just one. For this reason you need to make sure you remove every part of every application or your machine will simply become re-infected in a matter of seconds. This is why more than one application is recommended when trying to secure against or recover from Spyware infections.
It is important to note that many Spyware applications will disguise themselves as a Spyware removal tool. Make sure to "Google" any application before installing. Most likely, someone has experienced that application before and this will give you a hint on its reputation.
To defend against Spyware I recommend the following steps.
Spyware is a very active and dangerous threat to any computer connected to the internet where users browse the web. If new toolbars or multiple popup ads and banners suddenly appear while you are browsing the web, you most likely have some kind of Spyware or Adware. However, even if you don't see this type of behavior you may still be infected. These applications can remain silent in the background collecting information about where you go and what you do on the internet. Then it uploads this information to home servers while your machine is idle. Sometimes this activity takes place while you are trying to use the machine. This can make your internet connection or any type of activity on your machine very slow and almost unresponsive.
What can I do about it?
There are several applications that will clean and remove most Spyware. However, some of the more advanced products require many steps and possibly rebooting your machine several times.
Since most of these nasty applications simply open the door to other nasty applications you rarely have just one. For this reason you need to make sure you remove every part of every application or your machine will simply become re-infected in a matter of seconds. This is why more than one application is recommended when trying to secure against or recover from Spyware infections.
It is important to note that many Spyware applications will disguise themselves as a Spyware removal tool. Make sure to "Google" any application before installing. Most likely, someone has experienced that application before and this will give you a hint on its reputation.
To defend against Spyware I recommend the following steps.
- Use Firefox for all browsing unless you are at a KNOWN TRUSTED SITE that requires IE.
- Install some or all of the applications below.
- Browse wisely.
- Never click a link in an email. If you must open a link from email, copy then paste it into your browser.
- NEVER click any link or button from a popup window. Popups will appear as a new browser window. Unless you intentionally started that application, do not click on any links or buttons. If in doubt don't click anything, do an "alt-F4" to close the window.
- Keep your eye on the address bar. Make sure you haven't wandered onto an un-trusted or shady site. People browse the web so quickly anymore it is easy to follow links onto a site that should not be trusted. Most reputable sites will not try to hide the site name. If you think you are at USBank.com it should say that in the address bar, not just an IP address.
- Never click a link in an email. If you must open a link from email, copy then paste it into your browser.
- Keep Windows up to date.
- If you are really paranoid you can use the Noscript plugin for Firefox.
- Browse the Internet from behind a Firewall that blocks attacks on certain ports. Make sure this Firewall is checked and updated regularly.
- Spybot-S&D: A freeware program maintained and updated with new spyware information regularly. A great tool to remove Spyware from your PC, also be sure to click on the "Search for Updates" button and then if any new updates are displayed, make sure they are checked and then click "download updates". Additionally after you have updated click the immunization button to prevent many common Spyware instances on your PC in the future.
- Ad-Aware: Another freeware program for searching and removing Spyware. The interface is more user friendly, however the freeware version does not contain any sort of preventative measures against future Spyware infections.
- Webroot's Spy Sweeper is an excellent product with a full-featured demo that is free to download. The free demo allows you to update your Spyware definitions once. Ongoing protection and definition updates are fee-based.
- SpywareBlaster: SpywareBlaster does not clean spyware and Adware from your system, but it can help prevent it. SpywareBlaster does not run in the background, so your system won't take a performance hit if you decide to install it. This program is freeware, however the automatic update feature is fee-based.
- Google Toolbar: Among its other features, the Google Toolbar includes a popup blocking feature. The Google Toolbar is freeware.
- House Call: Not really a download, but an online virus scanner that can bypass problems in Windows that allow certain viruses to prevent themselves from being deleted from your system. Unfortunately it requires ActiveX, an insecure Internet Explorer to run (there is a Netscape only version, but it seems to be very buggy). The advantages outweigh this small problem, however.
- Microsoft's Antispyware: Microsoft's Anti-Spyware solution, which is based on the award-winning Giant AntiSpyware Suite. This product is still in Beta, but it is effective at cleaning certain types of threats (Spyware Agents, for example) that other virus/spyware scanners can't detect/clean.
Subscribe to:
Posts (Atom)