Look Who's Talking Now

Recently, a computer security researcher from Vancouver, Dragos Ruiu, made a very interesting (and alarming) claim. He had begun to notice a high pitched whine in his house. Originally, he thought it was the result of electrical noise from his home wiring, but soon found a different origin. It seemed that his macbook was transmitting the whine, and so he immediately tried to figure out why and for what.

He realized that ever since he started hearing the whine, his computers had started doing weird things. Not malicious things, but just random running of programs or executions. Ruiu was even more interested when he realized that these things were still happening even when the computer was unplugged and the wi-fi was turned off.

This is all a theory, but given the source (a computer security researcher) and the investigation it has set in motion in the computer security community, this new realm of virus, by using sound to transmit and command, is potentially problematic. This could be a dangerous tool if perfected, allowing incredible secure networks to be more vulnerable.

Are we going to start having to disable our microphones on our phones or computers to prevent these kind of viruses? It seems crazy, but might could be commonplace in just a few years.

source: http://www.newscientist.com/article/dn24582-can-a-computer-virus-communicate-via-your-speakers.html#.UozjJpFTQng

image source: http://www.illustrationsource.com/stock/image/31334/computer-heads-talking-to-each-other/?&results_per_page=1&detail=TRUE&page=10

TGIF: Happy Hour Virus

Imagine this. Its Friday afternoon, a beautiful day outside, and you can think of a million other things you would rather be doing than be at work. What can you do to skip out early?

How about create a fake virus?

Say hello to the "Happy Hour Virus". A handy site that will in fact, create a fake technological disaster giving you the excuse to say your computer is on the fritz and you cannot complete your work. How great is this? You can even customize your "virus". Do you want a blue screen panic, simple broken monitor, or an alarming message like the following...

Boom. Work day done.


Sources:
http://laughingsquid.com/happy-hour-virus-a-tool-that-fakes-computer-problems-so-you-can-leave-work-early/
http://newsfeed.time.com/2013/11/15/leave-work-early-today-thanks-to-this-handy-fake-computer-virus/

The Code

This post will elaborate on the topic of computer viruses as tools for cyber attack, such as the case of Stuxnet worm in a previous post. Viruses of the like of Stuxnet are becoming more and more a threat to cyber peace of the world. Developers of these malwares, either an individual, an organization, or even a government, do not seek a massive and random population to attack anymore. The target is of extreme value and well selected. The two incidents below will best help us see this.

"Flame" virus in Iranian government

This virus was detected last year inside Iranian government computers. Iran has long been a target of computer viruses, supposedly released by other countries; however, Flame has been the most complex one ever found. It is "one of the most potent cyber weapons ever spotted" and "marks a new milestone in the escalating digital espionage battle."
It was believed Flame had been in successful operation for at least two years. Flame's resume is impressive: it captures what's on the user's screen, turns on microphone to record audio, identifies network users, steals passwords, transfers files to a destined server, and so on.
Many Iranians said Flame was a product of the U.S. or Israel just like Stuxnet or Duqu worm. Maybe. Maybe not. The bigger and more frightening picture is that weaponized virus like Flame is being developed more often, and it can be "reverse-engineered." What it means is that Flame, Stuxnet, Duqu, and their like all carry codes; these codes can be learnt, recreated by targeted countries like Iran, and turned against its attackers. The U.S. government has been called upon to beware of the inevitability of a "code war."

Attack on Saudi Aramco


Saudi Aramco is a Saudi Arabian government-owned exporter of crude oil, the world's largest exporter of crude oil, to be more precise. The virus arrived through email on August 15, 2012 and affected 30,000 computers of Aramco. Soon after the attack, the company's system was shut down and isolated for a period of time for cleansing and avoiding further attacks. On September 10, 2012, the entire system was announced to be back to normal operation.
The attack aimed to disrupt Aramco's oil production, but it failed ultimately. This incident raised serious concerns for future security any how.
Circumstantial evidence was pointing toward Iranian government; however, no conclusion was ever spoken.

Source: http://money.cnn.com/2012/05/30/technology/flame-virus/
            http://www.bloomberg.com/news/2012-12-09/saudi-arabia-says-aramco-cyberattack-came-from-foreign-states.html
            https://www.google.com/search?q=stuxnet&source=lnms&tbm=isch&sa=X&ei=ffaGUqT5DrXC4APk3YDwDg&ved=0CAcQ_AUoAQ&biw=1092&bih=522#q=code+war&tbm=isch&facrc=_&imgdii=_&imgrc=iVVxbNNj2SzzdM%3A%3BG8pFRCwcmFvryM%3Bhttp%253A%252F%252Fflair13.net46.net%252Fimages%252Fcode-war.jpg%3Bhttp%253A%252F%252Fflair13.net46.net%252F%3B2850%3B1900

How to Reinstall Your Computer's Windows?

Life can be full of frustration: underpaying jobs, bad grades, struggling relationships, gloomy weather, 20-mph traffic,... The list goes on. The Internet is where we head onto to relax and unwind. However, by just a wrong click at "You've been chosen to win an Ipad, because you're awesome," your computer is infected by virus. And my dear fellows, isn't that just !@#$!

Source: https://www.revolutionarylife.org/wp-content/uploads/2011/01/Punch-Computer21.jpgAdd caption

Now, you are faced with two options: removing the viruses or reinstalling your Windows. Several criteria can be considered to make the decision:

1. Types of damage done: are you looking at just a few evolved copies of a program generated by the virus, or a massive loss of data? Reinstalling Windows is recommended for the latter case.
2. Have you backed up your files? Snap! I got you there, right? Not only you have to back your system up, you have to do it to the most recent date. If you have backed it up, hurray, the freedom to choose either alternative is yours. If you forgot to back up and you cared about your files, you'd have to try your best to remove the virus. If you forgot to back up and you did not care about your files, go right ahead and join the New Windows Club.

Let's look at some of the advantages and disadvantages of each alternative:

Reinstalling OP: you can be certain that all viruses are eliminated afterwards, and it can end up being quite time-saving. On the flip side, this is not the most basic task on a computer, so you may not know how to do it! You need all necessary softwares to perform a good reinstallment of your OS.

Removing virus: you can find virus removal kit online to help when not enough softwares are there to reinstall OS. However, there are many downsides of this selection. The most significant one is you can never be sure your system is completely clean. Your action of removing virus could be actually just a "cute" attempt.

Source: http://www.mediastinger.com/wp-content/uploads/2013/02/Jack-the-Giant-Slayer-after-credits-large.jpg

How to reinstall Windows OS: Windows is the most common OS on computers, and I herein choose Windows 7 to base the instruction on:
1. Control Panel -} Advanced recovery method. This is a recovery tool provided by Microsoft to its authentic Windows products. You will be guided step by step through the reinstallment process. If you didn't use an authentic Windows (no judgement:D), this tool might not work. Sometimes, Windows still doesn't run after Advanced Recovery Method is performed. Either way, you'll then have to take step 2.
2. Formatting the hard disk and reinstalling Windows from installation discs/USB:
a) When computer is on, insert Windows 7 installation disc or USB (make sure you have the product key).
b) Restart computer.
c) When prompted, press any key and follow sequential instructions to get on Install Windows page.
d) On Install Windows page, choose your language -} Next -} Click I accept the license terms -} Next
e) Click Custom for Which type of installation do you want?
f) Click Drive options (advanced) for Where do you want to install Windows?
g) Change the partition you want and select your preferred formatting option; then again, follow instructions.

At this point, you basically have finished the formatting process. Next stage is finishing up installing Windows, which is made very simple through step-by-step instructions, such as naming your computer and creating a starting user account.

If you have read our post up to this point, we want to thank you for your time. Hope this information will have chance to serve you in some way. Any questions, any at all, please do not hesitate to let us know!

Source: http://windows.microsoft.com/en-us/windows7/installing-and-reinstalling-windows-7
             http://www.oit.umn.edu/safe-computing/personal-computer/reinstall-removal/

Why do people write computer viruses?

Why do people write viruses to begin with? This group has talked about several destructive virus outbreaks, the anatomy and types of viruses, and how to protect yourself... but that still leaves the most fundamental question, why?

But I suppose before we answer the question why we should first ask who it is that writes viruses. Some people may have the impression that it's just teenage kids who are tech savvy and judgment lacking, but that's not really the case.

The truth is that, while that may have been more the case in the beginnings of the internet, nowadays the virus writers of the world are driven by the motivator that seems to drive much of our lives, good and bad… money. Virus writers are increasingly working with those cyber-criminals that are further up on the “hierarchy”, spammers and hackers, in order to reap financial benefits from their work.

Pictured: Spam (if nobody fell for it we wouldn't still see it…)

http://noiselesschatter.com/2012/03/27/lets-go-to-spam/

The spammers are also reaping the rewards from this pairing, due to the fact that their job has become much harder with the implementation of spam blockers and mail filters. The virus writers provide a way for the spammers to be able to have infected computers spread their spam mails without the knowledge of the computer’s owner, and without intervention on the part of the spammer. The Sobig virus was an example of a virus that aided in spamming other computers with email, which allowed it to spread much farther and faster than if it was a lone spammer sending out emails from his computer.

Of course, while the criminal element of virus writing is more prevalent nowadays, as well as the increasing presence of organized crime syndicates in the virus business. There are still plenty of groups of people that just write viruses because they can. These people belong to internet groups and write viruses largely to impress their fellow peers, or just to prove to themselves that they can. They also do it to “make their mark” in the cyber world, much in the same way that a graffiti tagger or a vandal might think that what they’re doing is “making a mark”.

Some of the virus writers that fall into the latter group make the claims that virus writing is a form of artistic expression and that it is protected speech as well. What do you think? Is the computer virus going to become the web’s “street art”? Is there a virus writer that will someday become the Internet’s Banksy?

Source: http://news.bbc.co.uk/2/hi/technology/3172967.stm

Governments and Viruses: the Stuxnet Worm

Governments and Viruses: the Stuxnet Worm

                While many of the computer viruses that circulate through the web can be explained as the work of scammers or lone individuals looking for profit, some viruses are used to by governments to achieve political ends. One virus that is believed to be more than just a random attack on random computers was Stuxnet. The Stuxnet virus was uncovered in 2010 and, while it was by definition just another Internet worm,  it is believed to have had a very specific target, industrial facilities in Iran, and more specifically the virus “could disrupt the centrifuges used to enrich uranium”.

A uranium centrifuge

Source: http://science.howstuffworks.com/uranium-centrifuge.htm

When Stuxnet was analyzed after being identified, it was found to be a sophisticated and targeted piece of malware that was likely written by one or more nation states for the purposes of targeting the Iranian nuclear program. The worm would infect the systems,the system in this case being an industrial control software by Siemens, and it would also make a note of the name and location of the computer, as well as a time-stamp of when the computer was infected. The analysis discovered that five “industrial processing facilities” in Iran were the computers that ere infected and then spread the virus for the majority of reported Stuxnet infections.

The virus went through numerous variations and had repeatedly infected several of the facilities, with a different variation of the virus in each infection. The virus was found to have been inserted into the system less than 24 hours after being written, and was found in systems that weren't connected to the Internet, thus meaning that the probable method of infection was via USB drive from someone inside the facility.

While some portions of the virus weren't all that advanced, it did exploit several holes in the windows operating system that, before Stuxnet’s discovery, were completely unknown and thus unpatched, and as a whole, was a rather sophisticated piece of malware

This case brings up the questions of whether a government should be able to release a virus geared toward a specific set of goals, or whether computer viruses should be a method of espionage at all. It also raises the question of whether they fully understand what a virus like that could do if one of those systems was connected to the Internet and spread the virus to many corporate systems of that type, thereby possibly crippling some very important industries.

Source: http://www.bbc.co.uk/news/technology-12465688

Virus-related Terms for Dummies (or college students)

In our tech-savvy world, we all generally like to think that we are in the know about technological innovations, uses, and lingo, but sometimes we get stumped when we really think about what certain things mean or don't mean.

This blog is mainly about viruses, but is it solely about that? Maybe not. It's hard to talk about viruses and not mention other words such as "worms" and "trojan horses," for example. What do these three things mean? I think a lot of us, myself included, might be tempted to say that they are one in the same. Although we might not be too far off, there are a couple specific differences that this blog will address. These definitions and explanations will be good to know, especially as knowing what exactly each term means can allow us to protect ourselves better on the web.

So, here we go:

• Viruses: The most common, this term is basically describing what we think of when we refer to different malware terms. The easiest way to identify a virus is seeing if it lines up with 2 main criteria, according to the source used for this article (Symantec Corp.):
1. It must execute itself. It will often place its own code in the path of execution of another program.
2. It must replicate itself. For example, it may replace other executable files with a copy of the virus infected file. 

An example of this is in the previously blogged about "ILOVEYOU" virus. It executed itself when clicked on, with users thinking they were opening a .txt file, and once it did, it replicated itself by overwriting music and media files. 

• Trojan Horse: these, explaining their name, are basically impostors. Trojan's disguise themselves as a desirable file, but are in fact very malicious. They contain malicious code that, when triggered, attacks and steals data. 
• The difference between Trojans and Viruses: unlike viruses, Trojans DO NOT replicate themselves, they just attack when executed, and don't necessarily linger.

• Worms: often, this term is used interchangeably with the term "Viruses," and the reason is because they aren't extremely different. Worms ARE programs that replicate themselves from system to system. The DIFFERENCE is that they don't technically use a host file, but travel in one that the worms themselves release. 
• Worms generally travel in commonly used files like Word or Excel, and what they do is they themselves (the worms) release one of these files with the worm already inside it. This file will then travel computer to computer without the knowledge of the infected. 

Was this helpful? Did it clear up any thoughts or questions? Which of the three worry you most? Let us know!

Source:

• http://www.symantec.com/business/support/index?page=content&id=TECH98539

Looking for Love in all the Wrong Places?

It has been 13 years since the ILOVEYOU virus affected millions of computers by preying on a basic, non-technical human desire: to be loved. I think many of us like to think that we are so much more careful and savvy on the internet today, in 2013, able to spot obvious phonies on the internet, but that wasn't always the case, right?

The year 2000 seems like eons ago, both generally and technologically. Life on the internet has come a long way. Think about this: in 2000, "The Great and Powerful Zuck" was THREE years away from creating "Facemash," the first predecessor to Facebook. Feel old now? I sure do.

The ILOVEYOU virus, created by Filipino student Onel de Guzman, sent millions of emails with the subject line "I love you" and contained nothing but an attached file: "LOVE-LETTER-FOR-YOU.txt." Once that file (in reality an executable-upon-opening .vbs file) was opened, it flooded the computer by overwriting existing music files and multi-media files. Today, this virus is still remembered in two ways:

1. Because of the sheer devastation of the virus.
2. Because of the viruses and spam that still use a similar strategy.

Many of us have probably experienced something similar to this on Facebook: you are perusing your newsfeed, when you see a notice on the side of the page that says something like:

"SOMEONE YOU KNOW HAS A CRUSH ON YOU!!! CLICK HERE TO FIND OUT WHO!!!"

You just encountered the "Secret Crush" application, a widget that, once clicked on, would lead you to download the application and then send an invite to five of your facebook friends. Needless to say, this led to many disappointed, love-hungry teenagers and probably even more disappointed parents who had to get these viruses removed from their home computers.

The Secret Crush virus proved that using the social strategy of preying on the heart is still a viable and successful strategy for virus and malware development. It's true, we're smarter than we were in the ILOVEYOU days, but obviously not smart enough for these strategies to be abandoned.

Can you spot a phony? I would argue that spammers, hackers, and internet fiends are still using the same strategy of preying on human desires in 2013, do you agree?


Sources:

• http://www.pcmag.com/article2/0,2817,2363172,00.asp
• http://www.techradar.com/us/news/software/applications/internet/web/secret-crush-virus-spreading-on-facebook-180422

Do Macs get Viruses?

Yes, but the perception is that they are safer. Is this true or just a myth supported by Apple and their fans? Below is an image from Apple and how they market the safety of their device.

While it claims that Macs don't get PC viruses it fails to mention that Macs do get Mac Viruses. One of the more commonly known reasons that Macs don't get viruses is that there are less of them so it would be less efficient to target them. Also, by the same logic virus writers would have more experience on the Windows OS. But are Macs inherently safer? Some sources say no, the OS has no more security than Windows, while other sources say yes. Lets take a look at some of their arguments. Macs do have security built in such as not allowing files to act in certain ways or access certain parts of their system. They have encryption built in to prevent a hacker from reading your files. Some argue that the UNIX platform upon which Mac OS X is built on is a tried an tested secure system.

So have there been any widespread viruses on Macs? Yes. One such case was the flashback virus. It infected more than 700,000 macs masquerading as a Adobe Flash installer. It would gather usernames and passwords to programs and websites. Apple's own security has been updated to remove this, but the virus developers have been modifying it to bypass this security.

So knowing this, even though Macs are more secure that does not mean that you should be "reckless" with your computer. Just because something is less likely to hurt doesn't mean that you should forgo protection.

Who owns an Apple computer? Did you buy it because of its resistance to viruses? Do you think they are more secure? Is it worth it? Discuss below
References:
http://www.computerhope.com/issues/ch000737.htm
http://news.cnet.com/8301-27076_3-57410050-248/mac-flashback-malware-what-it-is-and-how-to-get-rid-of-it-faq/

Android & iOS Malware

How many of you own smartphones or tablets running Android or iOS? As many believe that we are moving into the post PC world are viruses following the rest of technology over to mobile devices? Apple and Google have taken very different approaches to combating malware on their systems. Apple uses what some call a “walled garden” approach. They only allow certain apps through to get to their app store, testing each one for suitability. So far it has proven to be quite effective with less than 1% of malware on mobile devices is one iOS devices.

Android, meanwhile accounts for more three quarters of mobile malware. Why is this? A few reasons researchers have cited:

1. Android enjoys the highest market share for mobile devices.
2. Android is fragmented with some users on older devices not able to upgrade to the latest and greatest version, missing out on the latest security protections.
3. Google does not subject apps in the Google Play Store to the same scrutiny Apple does with their counterpart. Google allows apps into their store removing them if they have problems whereas Apple checks apps before getting uploaded, making sure they pass certain requirements.

The three most common types of malware affecting Android according to the Dept. of Homeland Security:

1. SMS Trojans- these will send text messages to a certain number which charges the user for the service.
2. Rootkits- Logs keystrokes, passwords, and locations without the users consent
3. Fake Google Play websites- The vast majority of malware in the google play store is weeded out by Google, however downloading apps from outside the Google Play store can present unnecessary risk.

What can you do to prevent malware on your mobile device?

1. Update you device. Unfortunately, many users are using outdated versions of Android many being unable to upgrade. Some people are eligible for a free upgrade to a new smartphone with a later version of Android. Apple has been able to update the vast majority of their users to the latest version of iOS. Google cannot do this as they do not manufacture the hardware.
2. Install a protection program
3. Avoid free Wi-Fi Hotspots, especially those that are not secured.

Its not all bad for Android though. Many of these problems with Android are being worked on by Google and in the future we may have a much more secure mobile operating system. Here is a graphic showing the different layers which malware must pass through. Note that some of the layers can be bypassed through users options.



How many of you use Antivirus on your mobile device? Who has gotten malware on their mobile device?
References:
http://qz.com/131436/contrary-to-what-youve-heard-android-is-almost-impenetrable-to-malware/
http://info.publicintelligence.net/DHS-FBI-AndroidThreats.pdf

You're Infected! -CryptoLocker Ransomware

Have you heard of the form of malware that encrypts your data and literally holds it for ransom? 

This malicious software is capable of withholding your personal information taken from your computer until you pay the writer the ransom they ask for.

This type of malware is not new. In fact it started in 1989 and instructed users to send $378 to an address in Panama in order to get their files back. Fortunately for the users, the perpetrator coded all of his attacks the same and helped track his activity and create ways to stop it.

The new form of this software that has surfaced, “CryptoLocker” has not made the same mistakes and is hard to crack once triggered.

CryptoLocker takes random hacking to a new level. The software is so discrete you most likely wont even notice it during the process. It could be swiping your business files, personal photos, and vital emails.

A 35-year-old woman from London recently received an email, which she thought was from her local bank. She didn’t think twice before clicking on the email, which secretly carried the CryptoLocker software that immediately started encrypting her personal data. She soon received a message saying, “Your personal files has been encrypted and you now have 95 hours to pay us $300”.

CryptoLocker currently only affects PC’s and can be removed with antivirus software but unfortunately its effects cannot. 

Source:http://www.theguardian.com/money/2013/oct/19/cryptolocker-attacks-computer-ransomeware 

Blink Before You Link - 10 Tips To A Less Risky Internet Experience

The internet can be a dangerous place to operate. Computer viruses currently cause billions of dollars worth of damage per year due to system failures, infectious data, increasing maintenance costs, etc.  So, how can we avoid these internet nightmares?

1. Use strong passwords: Give a hacker a password that is hard to hack! Use more than 6 characters, numeric and alphabetic values, as well as a mix of upper and lower case.
2. Read emails in text mode: Everything looks better in HTML mode, but this is a prime mode for spammers to hide malicious scripts.
3. Look at the file extension before you download: Some extensions such as exe, pif, and bat most likely contain some sort of virus.
4. Install anti-virus software and make sure it is up to date: Many users think that free antivirus software, such as those that come with your internet service, are adequate enough for full virus protection. However, these programs most likely will not detect the ever-growing list of threats a computer may face. Instead, users should download professional, business-grade antivirus software.
5. Employ a firewall: Using a firewall is like locking the front door of your house.. it prevents viruses from getting in.
6. Disable autolaunch: Set your computer so it doesn't autolaunch files, programs, emails, etc. without your permission!
7. Check for secure sites: In internet explorer a lock icon will display in the top right of the address bar.
8. Read all security warnings, privacy statements, and license agreements associated with any programs  before downloading or installing. 
9. Take advantage of internet security settings: control how much, or how little information you want to accept from a website.
10. When in doubt, Google it: If you are unaware of a link, warning, file, or anything suspicious, do an online search to see what other's are saying.

Sources:
http://windows.microsoft.com/en-us/windows-vista/how-to-know-if-an-online-transaction-is-secure
http://www.microsoft.com/security/pc-security/antivirus.aspx
http://blogs.comodo.com/pc-security/1289/
http://sbinfocanada.about.com/cs/management/qt/avoidvirusts.htm