Malware in February: Cybercriminals Perfect Drive-By Tactics

03 Mar 2011

Kaspersky Lab’s latest monthly report on malware activity highlights the current popularity of using drive-by attacks to infect users’ computers. These attacks are particularly dangerous because they take place without the user’s knowledge and can be initiated from legitimate websites that have been hacked by cybercriminals. Visitors to infected sites are redirected to web pages containing script downloaders. Various types of exploits that launch script downloaders are quite often used to download malware to users’ computers.
In February, the majority of drive-by attacks made use of Cascading Style Sheets (CSS) to store some of the data for script downloaders. This new, enhanced method makes it much harder for many antivirus solutions to detect malicious scripts and allows cybercriminals to download exploits without them being detected.
Three entries in the Top 20 most malicious programs detected on the Internet in February corresponded to pages containing CSS data and a malicious script downloader. One of them claimed 1st place, while the others came in at 13th and 19th places. The script downloaders on these malicious web pages download two types of exploits. One of them, which targets the CVE-2010-1885 vulnerability in Microsoft Windows Help and Support Center, took 4th place in the same top 20 ranking. On average it was detected on approximately 10 thousand unique computers every day. The second type of exploit uses vulnerability CVE-2010-0840 in Java Virtual Machine and accounted for three entries (3rd, 7th and 9th places) in the rating of Internet-borne threats.
February showed that there are still potentially dangerous PDF vulnerabilities out there. The number of unique computers on which PDF exploits were detected exceeded 58 thousand in February. One such PDF exploit entered the Top 20 malicious programs on the Internet in 8th place.
A malicious packer that is used to help protect the Palevo P2P worm was detected on more than 67 thousand unique computers throughout the month. This worm was responsible for the creation of the Mariposa botnet that was shut down by Spanish police a while ago. It seems likely that the recent spread of this packed worm is linked to an attempt by cybercriminals to create a new botnet or restore the old one.
February saw the discovery of a number of new malicious programs for the Android platform. Malware for the J2ME platform was also popular among cybercriminals, with Trojan-SMS.J2ME.Agent.cd, for example, entering the Top 20 most widespread malicious programs on the Internet at 18th place. Its main function is to send SMSs to premium-rate numbers.
More detailed information about the IT threats detected by Kaspersky Lab on the Internet and on users' computers in February 2011 is available at: http://www.securelist.com/en/analysis/204792166/Monthly_Malware_Statistics_February_2011

source:http://www.kaspersky.com/news?id=207576288

A short story about Microsoft Word 2010 Part 3

Today, I would like to introduce about publishing a new post by Microsoft Word. The step are simply and easy, that is
    Step 1 : Same as the calendar templates, you need go to the page templates and click on the "Blog Post"
    Step 2 : After that, you will move to a new page and ask to register your blog account
    Step 3 : After registration, you can type you post in the word as shown in figure

    Step 4 : Click the button publish at the left-hand side
    Step 5 : Your blog are successful publishing.


*The post are publish by Microsoft Word 2010

A short story about Microsoft Word 2010 Part 2

Did you face problem when you want to do citation on the text you took from web or on the book? Here, the Microsoft Word 2010 had offered the function to help the students making the citation. Here is the step on marking the citation
Step 1 : At the command bar, you select the "References" option
Step 2 : At the  "References" option, you click the "Mark Citation" on right-hand side
Step 3 : A toolbox will be pop up as shown in the figure

Step 4 : Type your text or highlight your texts into "Selected texts" box and then key in your key term you want to citated into "Short citations" box 

Step 5 : Mark all you item that you already citation and finally type your references in the endnote of the article

*Hopefully this informaton can help us to produce more effective words

A short story about Microsoft Word 2010 Part 1

As the Microsoft Office 2010 are introduced by the Microsoft Corporation in the year 2010, the are many new features are install in the Microsoft Word, such as the file extension, templates and so on. Now, i would like to share about the new form of template that are provided by Microsoft Word, that is calendar. Today, many work are needed to scheduling, so Microsoft Corporation offer a easy step to us to set up the time table according the date. Now, i would like to show the step that how download the templates and how to use it.
Step 1 : Open the Microsoft Word, and at the command bar click the "File" button as shown in Figure

Step 2 : Select "new" button and click on the calendar template

Step 3 : Select the calendar you want and then click download on the right hand side

Step 4 : Finally you can scheduling you work on the Microsoft Word

*P.S : You need to online when download the calendar templates



Find trojan horse virus on PC

Q&A: What is DRM?

EMI has announced that it will be offering its back catalogue online without software locks, called digital rights management. The songs will be sold at a higher price to those currently with the digital locks but will also be at double the audio quality.




What is DRM?
Digital Rights Management, or DRM, is a class of technologies that allow rights owners to set and enforce terms by which people use their intellectual property.

Rights owners are typically copyright-holding companies like music, film, book or software publishers. They use DRM to control how documents, entire software programs, or even e-mails are used.

Most often media companies use DRM to curb piracy of their content by restricting users' ability to copy it, though it can also be used to create new business models like subscriptions to a large library of music.


How does DRM work?
DRM is a two-part scheme. It relies on encryption to protect the content itself and authentication systems to ensure that only authorised users can unlock the files.

When applied, DRM scrambles the data in a file rendering it unreadable to anyone without the appropriate unlocking key.

Authentication systems stand between users and the decryption keys, ensuring that only people with the proper permissions can obtain a decryption key.

Without a username and password or if a file has been decrypted too many times, the system will not provide the key. This means music files with DRM, for example, can be swapped over the internet and remain unusable to those who have not paid for them.

It also means only authorised programs and portable players can use the tracks.

Music without DRM, like the popular MP3 music format, retain the ability to be played regardless of the number of times or to whom they have been copied.



Who is using DRM and why?
The most common commercial use of DRM is copy prevention. The technology gives rights holders some assurance that their intellectual property will not be pirated, and helped to create a legal digital download industry.

Film studios were some of the first large companies to adopt DRM.

When the DVD format was launched it included an encryption scheme called the Content Scrambling System, which prevented users from making digital copies of films off the disc.

Recording labels have also adopted DRM to prevent copying.

With the advent of peer-to-peer file sharing networks and the MP3 music compression format in addition to the proliferation of broadband internet access, they claimed music piracy drastically increased.

CD publishers reacted by making discs in a way that lets them play in a regular machine, but not in a computer. This prevents users from copying the music and distributing it over the internet.

Many record labels have also released DRM-protected music for sale and download in online stores like Apple's iTunes and Roxio's Napster. These tracks can play on a set number of computers and portable devices.

DRM video downloads are just beginning in the UK. Channel 4 and Sky have on-demand services that include films.


What are the problems with DRM?
Some consumer groups and internet commentators vociferously argue against the use of DRM.

One of the most often cited problems with the technology is that competing systems are not compatible. For example, users of the Napster service cannot play a track on the iPod.

Changing music download providers or portable players could mean already purchased tracks are unusable.

Because tracks have to be authenticated to play, they may also become unusable if a download company goes out-of-business.

Both cases force purchasers to either forfeit their music or re-purchase it, and for this reason has been characterised as anti-competitive.

Unlike brick-and-mortar shops selling records, cassettes, or CDs, digital download companies can lock consumers into their service.

Critics also argue that many DRM systems go far beyond the rights the law gives rights holders to protect what they create.

DRM is also an imperfect technology. Hackers and software companies engage in a constant back-and-forth battle where any given system is broken, patched, and broken again.

DVD copy prevention was cracked in part by the then 15-year-old Jon Lech Johansen.

Still others object to DRM on philosophical grounds. Art, they contend, is often a collaborative process that builds off the work of others.

For digital media, this is referred to as the "rip, mix, burn" culture.

As music, film, and literature is increasingly expressed in digital form, many worry that restrictions on the use of this content will limit creativity.



Source: http://news.bbc.co.uk/2/hi/technology/6337781.stm

10 Tips for Creating Secure Passwords

If you do anything with computers, you deal with passwords and you probably have a handful of different passwords for different sites and systems. The best password is something that you will never forget, but even your family or closest friend would never guess.

In my experience people either have extremely secure passwords like J!*xurQ1# that are so difficult to remember that they have to write them down (which defeats the security of a password) or extremely unsecure to start with, like Jonny (the name of their spouse). The goal of this post is to give you some ideas on how to generate secure passwords. The tips start out with some simple ways to come up with terms and end with ideas of how to combine these terms into secure passwords.

It should be obvious that you shouldn’t directly use any of the examples shown here. However, some of these ideas should be useful in generating your own secure passwords.

Here are a collection of tips for creating useful passwords.

1. Use Different Character Classes - Many systems require that your password be from a variety of character classes. The letters a to z are one character class, A to Z is another, 0 to 9 is another, and the symbols are a fourth. In general the more character classes you use in your password, the more secure it is. So “guitar” is less secure than GuiTar which is less secure than Gu1T&r. One simple way to add different character classes is to capitalize all vowels or consonants.

2. Use Letters from a Phrase – Use the first letter from each word in a phrase, line from a song, etc. “There’s a hole in the bottom of the sea.” could become Tahitbots.

3. Numbers From Word - Use your phone keypad to convert a word to its numerical equivalent to use as part of your password.

4. Keyboard Patterns – Creating terms from rows of adjacent keys. 12345 is not very good, but \][po combined in the ways specified below can make for a secure password that would be very difficult to guess and is fast to type.

5. Use More Than One Word - Single word passwords are easy to break. If a hacker runs a program to try a bunch of words from the dictionary they shouldn’t be able to figure out your password. Choose words that you will remember, but that someone else won’t be able to guess. So a password like shinynail or flyingrock or tallwater are more secure than single word passwords.

6. Ideas for Passwords – Sometimes coming up with a password can be pretty difficult. Keep in mind you need to choose terms that you won’t often talk about. Here are a list of ideas to help come up with words:
* Choose two objects from a picture that you’ll always remember. For example: a drawing at your grandparents house, the illustration from a children’s book, a painting at an art museum, etc.
* Choose two terms from a memorable purchase. For example: bluev6 (first car), thinibm (first computer), gold3crt (engagement ring), 7ftgrand (piano), pinedoor (first house), sunshore (honeymoon destination).
* Look through a catalog and choose terms based on something you see.
* Look up a random article on Wikipedia and choose a word found or related to a word you find in the article.

7. Separate Your Two Words With Symbols and Numbers- For example: pine&1&door, kit!2!cat, etc.

8. Modify the Password For Each Site- In theory, the most secure password strategy is to use a completely different password for each system. In practice, this means you’ll have to write them down. By choosing a secure password and modifying it based on where it will be used, you can keep from having to write passwords down, but still have a slightly higher level of security. Here are some examples showing how they were created
* blue.Mv6 for Amazon.com – blue and v6 from first car. M from the second letter in site name.
* blue.Av6 for SAP logon – same as above.
* thin!5!ibm for Amazon.com – thin and ibm from first computer. 5 from the number of letters in the site name.

9. Multiple Passwords for Different Types of Sites – Another option to keep from using the same password on every site is to use two or three passwords based on how secure the site is. For example, your banking sites might all use derivations of the bluev6 password. Ecommerce sites might all use a derivation of a different password and community type sites might use a third. The goal is to make sure that a rogue administrator at a forum you frequent isn’t able to get to your 401k.

10. Date Based Component – Some systems require you to change your password every 180, 90, or 60 days. (One client had set up their system to require a password change every 30 days!) If you are familiar with the cycle, you can add a date based component to your password and change it each time it is required. For example J10 could be added when you need to change your password in June of 2010.



Source: http://www.productivity501.com/10-tips-for-creating-secure-passwords/253/