Celebrating Freedomlist!

Websites come and go. Forums either outlive their usefulness or evolve with the times. Ten years ago, Freedomlist was born as -- well -- as a list of free Internet Service Providers (ISPs). In fact, at that time it was the heyday of free ISPs providing Internet access.

As time passed, Freedomlist evolved from providing help and information on Free ISPs to include $10 & Under Cheap ISP's, then Broadband and, along the way, added Help, Tips & Tricks, PC Protection, and more.

As with any Website, the same may be said about the community. New members come and go. However, throughout the evolution at Freedomlist, many of the same original members, including myself, continue calling Freedomlist "home".

Although I have since branched out to provide help at other sites, it was at Freedomlist where I first learned the ropes for securing my computer, where I learned about software firewalls, antivirus and anti-spyware programs and the importance of keeping security updates up-to-date. So it is with great pride that I announce the 10th Anniversary Celebration of Freedomlist.


Please join me in expressing heartfelt appreciation to the following security software vendors who generously donated licenses to be awarded as contest prizes during the celebration.

• Agnitium Outpost Firewall Pro
• ESET Smart Security 4
• Malwarebytes' Anti-Malware
• Online Armor Premium
• SUPERAntiSpyware Professional
• WinPatrol PLUS

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Waledac Botnet Takedown

The Waledac botnet had the capability of sending 1.5 billion spam e-mails per day. During a three-week period in December, 2009, approximately 651 million spam emails attributable to Waledac were directed to Hotmail accounts alone. Waledac also has the ability to download and execute arbitrary files, harvest email addresses from the local machine, perform denial of service attacks (DDoS), steal passwords, and more. Hundreds of thousands of computers have been infected with Win32/Waldac.

What is a botnet? As described by Microsoft Associate General Counsel, Tim Cranton:

"Botnets - networks of compromised computers controlled by hackers known as “bot-herders” - have become a serious problem in cyberspace. Their proliferation has led some to worry that the botnet problem is unsolvable. Under the control of a hacker or group of hackers, botnets are often used to conduct various attacks ranging from denial of service attacks on websites, to spamming, click fraud, and distribution of new forms of malicious software."

With support from the Microsoft Malware Protection Center (MMPC), the Microsoft Digital Crimes Unit used both legal and technical steps to effectively caused the shutdown of the Waledac botnet. The legal result was a federal judge granted a temporary restraining order which cut off 277 Internet domains believed to be run by those known as the Waledac botnet.

The result of the restraining order was described by Tim Cranton as follows:

"This action has quickly and effectively cut off traffic to Waledac at the “.com” or domain registry level, severing the connection between the command and control centers of the botnet and most of its thousands of zombie computers around the world. Microsoft has since been taking additional technical countermeasures to downgrade much of the remaining peer-to-peer command and control communication within the botnet, and we will continue to work with the security community to mitigate and respond to this botnet."

Although the connections to the infected computers has effectively been shut down, that effort has not cleaned the infected computers and they are still infected with the original malware. Below is a copy of map of Waledac infections around the world in a recent 18 day period.


To help make sure your computer is not one of those dots on the map, run Microsoft’s Malicious Software Removal Tool which removes the malware.

Efforts by others involved in the campaign are described by PCWorld in Microsoft Recruited Top Notch Guns for Waledac Takedown.

References:

• The Official Microsoft Blog: Cracking Down on Botnets
• Microsoft On The Issues: Cracking Down on Botnets
  
• Microsoft Malware Protection Center: Dismantling Waledac
• PCWorld Business Center: Microsoft Recruited Top Notch Guns for Waledac Takedown

Clubhouse Tags: Clubhouse, Microsoft, Windows, Security, Vulnerabilities, Information



Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

How-to: Reduce Vulnerability to Drive-by Downloads

Is your computer more vulnerable to drive-by downloads than it needs to be? The type of drive-by download I am referring to is malware that is installed from a Web site without any user intervention through the exploitation of a vulnerable software installed on the computer. That is right. Your computer can be infected merely by landing on a Web page performing drive-by downloads.

In Stopping Stealthy Downloads, Brian Krebs provided statistics from Dasient indicating that "in the fourth quarter of 2009, roughly 5.5 million Web pages contained software designed to foist unwanted installs on visitors". Although, as explained by Brian, there is a government-funded research group that is preparing to release a new free tool designed to block drive-by downloads, what can you do until "BLADE" (Block All Drive-By Download Exploits) is available?

I hope Security Garden readers will recognize what they can do to help reduce their vulnerability to drive-by downloads after reviewing the statistics provided in the graphs by BLADE’s evaluation lab.

The first graph illustrates the browser infection rate per drive-by exploit. We can see at a glance that IE6 is far more susceptible to drive-by downloads than other browsers. The surprise, however, and one I was not expecting, is the high numbers for IE7 compared to Firefox 3 and IE8.

Now, dear readers, here is the big surprise. The BLADE lab provided information on the vulnerable applications most targeted in drive-by attacks. Surprise: Adobe and Oracle SunJava far exceed the figures of Internet Explorer.

The lesson from this information is obvious and one members of the security community have been harping at for a long time: Microsoft security updates are only one piece of the puzzle. It is also critical that other software be kept up to date. To reduce the vulnerability to drive-by downloads, use an up-to-date browser and ensure that other vendor software is also up-to-date.

Update/Upgrade your browser:

• Download IE8.
• Update to Firefox 3.6

Adobe Products:

If you use Adobe products, be certain you have the most recent versions. Go to http://www.adobe.com/ to get the latest versions. Also, if you downloaded either Adobe Reader or Adobe Flash Player for Windows prior to the release of Adobe Security Bulletin APSB10-08, released February 23, 2010, see the instructions here.

Oracle SunJava:

With Java, it is extremely important to check that old, vulnerable installations are no longer resident on your computer. Go to Add or Remove programs and uninstall any item listing J2SE or Java Runtime Environment in the name. Unfortunately, not every version of Java will begin with "Java" so be sure to read each entry in the list. Other versions may begin with JDK, JRE or SDK.

The latest version of Java SE is available from here. Select the JRE version and pay attention when installing the update, unchecking any pre-checked toolbar and/or software options presented with the update. They are not part of the software update and are completely optional.



References:

• BLADE: Hacking Away at Drive-By Downloads
• BLADE Malicious URL Analysis
• Stopping Stealthy Downloads

Graphs from BLADE Malicious URL Analysis

Clubhouse Tags: Clubhouse, How-to, tutorial, Adobe, Internet Explorer, IE6, IE7, IE8, Firefox, Security, Vulnerabilities, Java

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...