Zeus malware found with valid digital certificate

A recently discovered variant of the Zeus banking Trojan was found to use a legitimate digital signature to avoid detection from Web browsers and anti-virus systems.


Security vendor Comodo reported Thursday finding the variant 200 times while monitoring and analyzing data from users of its Internet security system. The variant includes the digital signature, a rootkit and a data-stealing malware component.

"Malware with a valid digital signature is an extremely dangerous situation," the company said in a blog post.

Zeus is typically distributed through a compromised Web page or through a phishing attack in which cybercriminals send email that appear to come from a major bank.

A sample of the latest Zeus variant tried to trick the recipient into executing it by posing as an Internet Explorer document that included an icon similar to the Windows browser.

Because the file is digitally signed with a valid certificate, it appears trustworthy at first glance, Comodo said. The certificate is issued to "isonet ag."


When executed, the malware downloads the rootkit and a program capable of stealing login credentials, credit card information and other data a person keys into a Web form. The rootkit prevents the malicious files from being deleted by either the computer user or AV software.

Zeus malware typically launches a man-in-the-browser attack when a person visits an online banking site. The malware lets hackers create a remote session where they can see what the victim is doing and secretly intercept all data flowing from the activity.

For example, if the victim transfers funds on a banking site, the payment information will display as usual, but behind the scenes the hackers will alter the transaction and send the money to another account.

Zeus is one of the oldest families of financial malware. Also called Zbot, the malware's source code was leaked on the Internet in 2011, resulting in a surge of customized versions. Among the more popular Zeus-based Trojans are Citadel and GameOver.

In December, Kaspersky Lab discovered a 64-bit version of Zeus, an indication that hackers were preparing for the software industry's move away from older 32-bit architectures.

Create strong passwords

 

 Create strong passwords

A strong password is an important protection to help you have safer online transactions. Here are some steps to create a strong password. Consider using some or all to help protect yourself online:

• Length. Make your passwords at least eight (8) long.
• Complexity. Include a combination of at least three (3) upper and/or lowercase letters, punctuation, symbols, and numerals. The more variety of characters in your password, the better.
• Variation. Change your passwords often. Set an automatic reminder to update passwords on your email, banking, and credit card websites every three months.
• Variety. Don't use the same password for everything. Cyber criminals can steal passwords from websites that have poor security, and then use those same passwords to target more secure environments, such as banking websites.

There are many ways to create a long, complex password. Here are some suggestions that might help you remember it easily:

What to do	Example
Start with a sentence or two.	Complex passwords are safer.
Remove the spaces between the words in the sentence.	Complexpasswordsaresafer.
Turn words into shorthand or intentionally misspell a word.	ComplekspasswordsRsafer.
Add length with numbers. Put numbers that are meaningful to you after the sentence.	ComplekspasswordsRsafer2013.

More strategies for strong passwords

Test your password with a password checker

A password checker evaluates your password's strength automatically. Try Microsoft's password checker.

Avoid common password pitfalls

Cyber criminals use sophisticated tools that can rapidly decipher passwords.
Avoid creating passwords that use:

• Dictionary words in any language.
• Words spelled backwards, common misspellings, and abbreviations.
• Common letter-to-symbol conversions, such as changing "and" to "&" or "to" to "2".
• Sequences or repeated characters. Examples: 12345678, 222222, abcdefg, or adjacent letters on your keyboard (qwerty).
• Personal information that could be guessed or easily discovered. Your name, birthday, driver's license number, passport number, or similar information.

Being Mobile: Online Safety and Security

People increasingly connect to the Internet outside of their homes and offices, enjoying technological innovations and the convenience and connectedness it brings. With smartphones and other portable devices giving us the ability to conduct every day activities such as mobile banking, online shopping, teleworking, and social networking, cyber criminals are constantly looking to take advantage of insecure wireless networks, third party applications, and texting to acquire personal information.
According to the U.S. Computer Emergency Readiness Team (US-CERT), many of the safety practices that are used to guard home and work computers apply to your portable devices as well. They include:

• Restricting access to your wireless network, by only allowing authorized users access to your network.
• Changing any pre-configured default passwords to ones that would be difficult for an outsider to guess.
• Keeping your anti-virus software updated.
• Using caution when downloading or clicking on any unknown links.

Password Policy

Password 

• Keep the system screen saver enabled with password protection.
• Dont share or disclose your password. 
• User should not have easily detectable passwords for Network access, screen saver etc. 
• A strong password must be as long as possible, include mixed-case letters, 
• include digits and punctuation marks, not be based on any personal 
• information, not be based on any dictionary word, in any language. 
• Never use the same password twice. 
• Change password at regular intervals. 

The 10 most common security threats explained

It’s a dangerous world out there in the World Wide Web. Just as your mother may have told you to never talk to strangers, the same advice holds true for the virtual world. You may know to be wary of giving strangers your business bank account details. But can you be sure the website you’re logging into is that of your bank and not a forgery created by a cybercriminal?Cybercriminals use many different methods to lure you into parting with your confidential personal or business information. As a small company doing business on the web, you need to be aware of these methods so you can be extra vigilant when online.

Here’s a quick explanation of some of the common security threats you may come across:

Malware: Malware is short for “malicious software.” Wikipedia describes malware as a term used to mean a “variety of forms of hostile, intrusive, or annoying software or program code.” Malware could be computer viruses, worms, Trojan horses, dishonest spyware, and malicious rootkits—all of which are defined below.
Computer virus: A computer virus is a small piece of software that can spread from one infected computer to another. The virus could corrupt, steal, or delete data on your computer—even erasing everything on your hard drive. A virus could also use other programs like your email program to spread itself to other computers.
Rogue security software: Have you ever seen a pop-up window that advertises a security update or alert? It appears legitimate and asks you to click on a link to install the “update” or “remove” unwanted malicious software that it has apparently detected. This could be rogue security software designed to lure people into clicking and downloading malicious software. Microsoft has a useful webpage that describes rogue security software and how you can protect yourself.
Trojan horse: Users can infect their computers with Trojan horse software simply by downloading an application they thought was legitimate but was in fact malicious. Once inside your computer, a Trojan horse can do anything from record your passwords by logging keystrokes (known as a keystroke logger) to hijacking your webcam to watch and record your every move.
In February 2010, a Guardian Analytics and Ponemon Institute study of 500 small businesses in the U.S. found that 55 percent of respondents experienced a fraud attack in the last 12 months. The study reports that “…[w]ell-funded cyber criminals executed a full-scale assault on authentication, leveraging widespread infection of end-user computers with banking Trojans to sneak into online banking accounts completely undetected.”
Malicious spyware: Malicious spyware is used to describe the Trojan application that was created by cybercriminals to spy on their victims. An example would be keylogger software that records a victim’s every keystroke on his or her keyboard. The recorded information is periodically sent back to the originating cybercriminal over the Internet. Keylogging software is widely available and is marketed to parents or businesses that want to monitor their kids’ or employees’ Internet usage.
Computer worm: A computer worm is a software program that can copy itself from one computer to another, without human interaction. Worms can replicate in great volume and with great speed. For example, a worm can send copies of itself to every contact in your email address book and then send itself to all the contacts in your contacts’ address books.
Because of their speed of infection, worms often gain notoriety overnight infecting computers across the globe as quickly as victims around the world switch them on and open their email. This happened with the Conficker worm (also known as Downadup), which, in just four days, had more than tripled the number of computers it infected to 8.9 million.
Botnet: A botnet is a group of computers connected to the Internet that have been compromised by a hacker using a computer virus or Trojan horse. An individual computer in the group is known as a “zombie“ computer.
The botnet is under the command of a “bot herder” or a “bot master,” usually to perform nefarious activities. This could include distributing spam to the email contact addresses on each zombie computer, for example. If the botnet is sufficiently big in number, it could be used to access a targeted website simultaneously in what’s known as a denial-of-service (DoS) attack. The goal of a DoS attack is to bring down a web server by overloading it with access requests. Popular websites such as Google and Twitter have been victims of DoS attacks.
Spam: Spam in the security context is primarily used to describe email spam —unwanted messages in your email inbox. Spam, or electronic junk mail, is a nuisance as it can clutter your mailbox as well as potentially take up space on your mail server. Unwanted junk mail advertising items you don’t care for is harmless, relatively speaking. However, spam messages can contain links that when clicked on could go to a website that installs malicious software onto your computer.
Phishing: Phishing scams are fraudulent attempts by cyber criminals to obtain private information. Phishing scams often appear in the guise of email messages designed to appear as though they are from legitimate sources. For example, the message would try to lure you into giving your personal information by pretending that your bank or email service provider is updating its website and that you must click on the link in the email to verify your account information and password details.
Rootkit: According to TechTarget, a rootkit is a collection of tools that are used to obtain administrator-level access to a computer or a network of computers. A rootkit could be installed on your computer by a cybercriminal exploiting a vulnerability or security hole in a legitimate application on your PC and may contain spyware that monitors and records keystrokes.
Rootkits gained notoriety when, in 2005, a security blogger discovered that a copy-protection tool inside music CDs from Sony BMG Music Entertainment was secretly installing a rootkit when users copied the CD onto their computers. At the time, security expert Bruce Schneier warned that the rootkit could allow a hacker to “gain and maintain access to your system and you wouldn’t know it.”

Change your Password

Do not write your password down and leave it near your computer

 

Do not write your password down and leave it near your computer

Writing your password on a 'sticky-note' and sticking it on your monitor makes it very easy for people who regularly steal passwords to obtain yours. Hiding it under your keyboard or mouse pad is not much better, as these are common hiding places for passwords. However if you must write something down, jot down a hint or clue that will help jog your memory or store the written password in a secure, locked place. 

What is Social Networking

What is Social Networking?

Social Networking sites are websites where you can create a profile all about yourself and contact other people. You can also upload photos, music and videos to share with other people, and on some sites, chat to other people on forums. Popular social networking websites include MySpace, Facebook, Habbo Hotel, and Twitter but there are lots of others. They are used by people of all ages and some people have profiles on more than one website.

What else can I do to stay safe?

Once you have registered and set up your profile you can start adding your friends and sending them messages. As long as you are careful online, you can have a lot of fun with your mates. Don't add anyone you don’t know to your friend list, even if they say they know you. If you don't know them, don't add them.  People can create really great fake profiles, so be aware that even if someone says they are your age and into the same things as you, they might not be telling the truth.  If someone contacts you or one of your friends with weird or nasty messages, don't reply to them and save the messages. Tell someone you trust such as a parent as soon as possible and show them what you have been sent.  If you are writing a blog, be careful what you write in it. Don't give away too many details about yourself.  Don’t arrange to meet someone that you have met online. Some people may not be who they say they are.  If you are contacted by someone that you are unsure of on a forum, contact the forum administrator.  Avoid sites that are meant for adults.