Enter your Keyword, Search here,

Computer Threats Top 10

The nature of computer crime has changed over the years as the technology has changed and the opportunities for crime have changed. Although thrill-seeking adolescent hackers are still common, the field is increasingly dominated by professionals who steal information for sale and disgruntled employees who damage systems or steal information for revenge or profit.

1. Number of password-Stealing Web sites will increase using fake sign-in pages for popular online services

More attacks that attempt to capture a user's ID and password by displaying a fake sign-in page, and increased targeting of popular online services will become more evident in 2007. As evidenced by the phishing attacks that followed natural calamities last year, McAfee Avert Labs also expects more attacks that take advantage of people's willingness to help others in need.

In contrast, the number of attacks on ISPs are expected to decline, while those aimed at the financial sector will remain steady.

2. Volume of spam, particularly bandwidth-eating image spam, will rise

In November 2006, image spam accounted for up to 40 per cent of the total spam received, compared to less than 10 per cent a year ago. Image spam has been significantly increasing for the last few months and various kinds of spam, typically pump-and-dump stocks, pharmacy and degree spam, are now sent as images rather than text.

Image spam is typically three times the size of text-based spam, so this represents a significant increase in the bandwidth used by spam messages.

3. Popularity of video sharing on the Web makes it inevitable that hackers will target MPEG files

The increasing use of video formats on social networking sites such as MySpace, YouTube and VideoCodeZone will attract malware writers seeking to damage a network. Unlike situations involving email attachments, most users will open media files without hesitation. Furthermore, as video is an easy-to-use format, functionality such as padding, pop-up ads and URL redirects become ideal tools of destruction for malware writers.

The W32/Realor worm, discovered in early November 2006 by McAfee, is a recent incident of media malware. The worm could launch malicious Web sites without user prompting, potentially exposing users to bots or password-stealers loaded onto these sites. Other media malware such as Exploit-WinAmpPLS could silently install spyware with very little user interaction.

4. Mobile phone attacks will become more prevalent as mobile devices become smarter

Mobile threats will continue to grow as platform convergence continues. The use of smartphone technology has played a pivotal role in the threat's transition from multifunction, semi-stationary PCs to palm-sized 'wearable' devices. With increased connectivity through BlueTooth, SMS, instant messaging, email, WiFi, USB, audio, video and Web, there are more possibilities for cross device contamination.

2006 saw efforts by mobile malware authors to achieve PC-to-phone and phone-to-PC infection vectors. SMiShing, which involves taking the techniques of phishing by email and porting them to SMS (SMiShing instead of phishing), is also expected to increase in prevalence.

In addition, for-profit mobile malware is expected to increase in 2007. Late 2006 saw a flurry of spy-ware offerings in the mobile world. Most are designed to monitor phone-numbers and SMS call-logs, or to steal SMS messages by forwarding copies to another phone.

One spyware in particular, SymbOS/Flexispy.B, is able to remotely activate the microphone of the victim's device, allowing someone to eavesdrop upon that person. Other spyware can activate the camera. McAfee expects that the offerings of commercial spyware targeting mobile devices to grow in 2007.

5. Adware will go mainstream

In 2006, McAfee saw an increase in commercial Potentially Unwanted Programmes (PUPs), and an even larger increase in related types of malicious Trojans, particularly keyloggers, password-stealers, bots and backdoors. In addition, misuse of commercial software by malware with remotely controlled deployment of adware, keyloggers and remote control software is on the rise.

However, despite the social, legal and technical challenges, there is so much commercial interest in advertising revenue models that McAfee expects to see more legitimate companies using or attempting to use advertising software in ways (hopefully) less objectionable to consumers than most current adware.

6. Identity theft and data loss will continue to be a public issue

According to the US Federal Trade Commission, about 10 million Americans are victims of identity fraud each year. At the root of these crimes is often computer theft, loss of backups or compromised information systems. While McAfee expects the number of victims to remain relatively stable, company disclosures of lost or stolen data, increasing incidents of cyberthefts and hacking into retailer, processor and ATM systems and reports of stolen laptops that contain confidential data will continue to keep this topic of public concern.

McAfee also predicts the unauthorised transmission of information will become more of a risk for enterprises in the area of data loss and noncompliance. This includes loss of customer data, employee personal information and intellectual property from possible data leakage channels -- applications, networks, and even physical channels, like USB devices, printers, fax and removable storage.

7. The use of bots will increase as a tool favoured by hackers

Bots -- computer programmes that perform automated tasks -- are on the rise, but will move away from Internet Relay Chat (IRC)-based communication mechanisms and towards less obtrusive ones. In the last few years, there has been increasing interest within the virus-writing community in IRC threats. This was due to the power afforded by the IRC scripting language and the ease of coordinating infected machines from a chat-room type of structure.

'Mules' will also continue to be an important aspect in bot-related money making schemes. These are work-at-home type jobs which are offered through very professional-looking Web sites, through classified ads, and even through instant messaging (IM). These are a crucial part of the reason so many bots are able to be run from places around the globe. In order to get merchandise (often to resell) or cash with stolen credit card credentials, the thieves have to go through more strict regulations if the goods are going to another country. To get around these regulations, they use mules within those originating countries.

8. Parasitic malware, or viruses that modify existing files on a disk, will make a comeback

Even through parasitic malware accounts for less than 10 per cent of all malware (90 per cent of malware is static), it seems to be making a come back.

Parasitic infectors are viruses that modify existing files on a disk, injecting code into the file where it resides. When the user runs the infected file, the virus runs too. W32/Bacalid, W32/Polip and W32Detnat are three popular polymorphic parasitic file infectors identified in 2006 that have stealth capabilities and attempt to download Trojans from compromised Web sites.

Also important to note is that 80 per cent of all malware is packed, encrypted, or obfuscated, in some attempt to disguise its malicious purpose. Examples of parasitic infectors that are obfuscated include w32/Bacalid and w32/Polip.

9. The number of rootkits on 32-bit platforms will increase

Rootkits will increase on 32-bit platforms -- but protection and remediation capabilities will increase as well. On 64-bit platforms, particularly Vista, malware trends are difficult to predict pending uptake rates for the 64-bit platform, but in general McAfee expects:

A reduction in kernel-mode rootkits, at least in the short-term, while malware authors invent new techniques designed to subvert PatchGuard.

An increase in user-mode rootkits, and user-mode malware in general, or at least higher impact of 64-bit malware, as more advanced heuristic and behavioral techniques provided by most advanced security software is itself hindered by PatchGuard. This state will persist at least until Vista service pack 1, when new APIs are introduced by Microsoft, and likely longer, depending on the amount of re-engineering required by security vendors and the uptake rate of SP1.

10. Vulnerabilities will continue to cause concern fueled by the underground market for vulnerabilities

The number of disclosed vulnerabilities is expected to rise in 2007. Thus far in 2006, Microsoft has announced 140 vulnerabilities through its monthly patch programme. McAfee expects this number to grow due to the increased use of fuzzers, which allow for large scale testing of applications, and due to the bounty programme that rewards researchers for finding vulnerabilities. This year, Microsoft has already patched more critical vulnerabilities than in 2004 and 2005 combined. By September 2006, the combined 2004 and 2005 total of 62 critical vulnerabilities had already been surpassed.

Administrator Account Password in XP Home

In XP Home Edition the administrator account is only accessible from SafeMode. This account have no password by default.

To ensure a more secure system.

1. Turn off your computer.

2. Power on and press F8 just after the BIOS check is complete. Select Safe Mode from the List. Its around the top of the list.

3. On the next page press ENTER.

4. Work you way to the Desktop. Goto Control panel by:
*Clicking on Start|Settings|Control Panel

5. Double Click on Users Accounts

6. Select the Administrators Account from the list.

7. Apply a password.

Then restart the system.

Locking Computer in XP

To lock a computer in XP, as you probably know, you press "L" while holding down "Windows Logo" key on your keyboard. However, if you would like to lock a computer remotely, for example via "Remote Administrator", you don't have this ability.

What you can do instead, is to create a shortcut on remote computer's desktop where

Target %windir%\System32\rundll32.exe user32.dll,LockWorkStation

Start In %windir%

This is a feature to change users but when you lock the system only the administrator can unlock it. This Feature is More Effective at Remote Computers.

Note: Restarting the Computer helps to unlock.

Different Types of Spyware

In this internet World many viruses and spying softwares were introduced and get hacked the users system, So You need to know about the the viruses and other programs to Protect your computer.

ParasiteWare


ParasiteWare is the term for any Adware that by default overwrites certain affiliate tracking links. These tracking links are used by webmasters to sell products and to help fund websites. The controversy is centered on companies like WhenU, eBates, and Top Moxie, a popular maker of Adware applications. These companies have release their software to assist users in getting credit for rebates, cash back shopping, or contributions to funds. To the end user ParasiteWare represents little in the way of a security threat.

Adware
Adware, also known as an Adbot, can do a number of things from profile your online surfing and spending habits to popping up annoying ad windows as you surf. In some cases Adware has been bundled (i.e. peer-to-peer file swapping products) with other software without the user's knowledge or slipped in the fine print of a EULA (End User License Agreement). Not all Adware is bad, but often users are annoyed by adware's intrusive behavior. Keep in mind that by removing Adware sometimes the program it came bundled with for free may stop functioning. Some Adware, dubbed a "BackDoor Santa" may not perform any activity other then profile a user's surfing activity for study.

AdWare can be obnoxious in that it performs "drive-by downloads". Drive-by downloads are accomplished by providing a misleading dialogue box or other methods of stealth installation. Many times users have no idea they have installed the application. Often Adware makers make their application difficult to uninstall.

A "EULA" or End User License Agreement is the agreement you accept when you click "OK" or "Continue" when you are installing software. Many users never bother to read the EULA.

It is imperative to actually read this agreement before you install any software. No matter how tedious the EULA, you should be able to find out the intent BEFORE you install the software. If you have questions about the EULA- e-mail the company and ask them for clarification.

Spyware

Spyware is potentially more dangerous beast than Adware because it can record your keystrokes, history, passwords, and other
confidential and private information. Spyware is often sold as a spouse monitor, child monitor, a surveillance tool or simply as a tool to spy on users to gain unauthorized access. Spyware is also known as: snoopware, PC surveillance, key logger, system recorders, Parental control software, PC recorder, Detective software and Internet monitoring software.

Spyware covertly gathers user information and activity without the user's knowledge. Spy software can record your keystrokes as you type them, passwords, credit card numbers, sensitive information, where you surf, chat logs, and can even take random screenshots of your activity. Basically whatever you do on the computer is completely viewable by the spy. You do not have to be connected to the Internet to be spied upon.

The latest permutations of Spyware include the use of routines to mail out user activity via e-mail or posting information to the web where the spy can view it at their leisure. Also many spyware vendors use "stealth routines" and "polymorphic" (meaning to change" techniques to avoid detection and removal by popular anti-spy software. In some cases Spyware vendors have went as far as to counter-attack anti-spy packages by attempting to break their use. In addition they may use routines to re-install the spyware application after it has been detected.

Read More on Spyware

Malware

Malware is slang for malicious software. Malware is software designed specifically to disrupt a computer system. A trojan horse , worm or a virus could be classified as Malware. Some advertising software can be malicious in that it can try to re-install itself after you remove it.

For the purpose of simplicity Malware is software specifically engineered to damage your machine or interrupt the normal computing environment.

Read More on Malware

Examples of Malware include:

Page Hijackers

Hijackers are applications that attempt to usurp control of the user's home page and reset it with one of the hijackers choosing. They are a low security threat, but obnoxious. Most Hijackers use stealth techniques or trick dialogue boxes to perform installation.

Dialers

A dialer is a type of software used by pornographic vendors. Once dialer software is downloaded the user is disconnected from their modem's usual Internet service provider and another phone number and the user is billed. While dialers do not spy on users they are malevolent in nature because they can cause huge financial harm to the victim.

Tips for Securing your Computer

1. Update / patch ALL your software every now and then!

2. Check / adjust ALL your settings so they are safe, since they AREN'T by default!

3. Use firewall, like Zone Alarm!

4. Use good passwords: at least 13marks long, containing both letters and numbers. Remember to chance your password every few months at least!

5. Get a good anti virus program: F-Secure or Norton Anti virus and keep it updated!

6. Don’t open or execute files that you are not 100% sure are absolutely safe no matter where or how you get them.

7. Wipe your history files (like cookies, internet history and temporary files, etc.), logs and personal files, with specific wiping program (like Eraser) instead of just deleting them.

8. Use encryption to enhance your privacy! Use encrypted email (like Hushmail or Ziplip) and encrypt sensitive files on your computer (PGP).

9. Don’t use public computers for anything you need to type in your logins, they usually have Trojan horses that capture your passwords.

10. Don’t assume anything. If you don’t know, find out! If you cant or don’t understand, ask someone who knows! There’s nothing more dangerous than doing something you don’t really know anything about. That’s the best way to cripple your system or get a Trojan horse on your computer!

How to Detect Spyware Programs

There are different levels of Spying. For example, Alexa, popular software owned by Amazon.com, would be called a “BackDoor Santa” it doesn’t actually log your keystrokes or take system snapshots but it does record some surfing activity. However, programs like Spector are very skilled at stealthily gathering information including passwords, surfing history, and even chat logs and e-mails. If you haven’t done so already take a moment to read the Introduction to Spyware and Malware located here.

Who is Spying your System? How to monitor your system and check for the signs of spy softwares.

1) Work Environment: Assume you are being monitored. Most workplaces have the right to do this so by default get used to the fact that someone is monitoring you. There are several ways employers can monitor employees. Some use activity logging software to see what programs are being accessed and for how long. Naturally many will use spy software programs also known as “snoop ware” or a key-logger to take snapshots and log all keystrokes. An employer may actually monitor internet traffic as it moves across an intranet.

2) Anti-Spy Programs: A popular way to find out if someone is spying on you. Anti-Spy programs look for signatures or traces that are specific to certain spy software. Some simply do text string scanning to find them, and others i.e. (X-Cleaner from Xblock) actually extract and attempt to remove the Spyware. Be careful of the ones that use only text string scanning. Text string scanning can give false positives and in some cases it actually it can accidentally target anti-spy software! You can try a free online scanner.

Anti-Spy software can be a double-edged sword! Many spies will actually buy anti-spy software to scan and check to make sure their Spyware is not being detected. There is a hidden arms race that rages between Spyware vendors and anti-spy companies.

3) System Resources: Poorly written spy software will almost always put a drag on system resources. Watch out for poor system resources, running out of memory, lots of hard disk activity or a screen that “flickers”. This is caused by some spy software programs as they take snapshots of the computer screen that requires system resources.

4) Machine Access: Watch for people trying to gain access to your machine. Many software programs that are designed for spying require physical access to the target machine.

5) Installation Monitors: Currently on the market are software programs that will log every installation that occurs on your machine. It is best to leave these hidden on the system. It is possible to catch the installation of many spies in this way.

6) Anti-Virus: Many anti-virus programs can catch prolific spy software because they are often classified as “Trojan Horses”. Keep spy software up to date and make sure it is running in the background. This might not protect you against from some spy software but it will let you know if any re purposed Trojan horses are installed. Keep in mind that Trojans like NetBus or DeepBO are also classified as spy software because they open up a system to outside connections. Don’t be lulled into a false sense of security because you have one installed. They are helpful but there is no such thing as 100% fool proof protection.

7) Personal Firewall: In today’s treacherous Internet it is very helpful to also run a personal firewall. Firewalls will alert you to both inbound and outbound activity. You can control what is allowed in and out of your system. Watch for suspicious programs you do not recognize trying to send data out of your system.

8) Downloading Smarts: Simply put use common sense when downloading and avoid sources you cannot trust. If you are someone who frequents “warez” or crack sites you will more than likely encounter a Trojan or virus.

9) Common Sense: Be careful about what you install on your system. Don’t run e-mail attachments and read the EULA (end user license agreement). Keep an up to date anti-spy package on your machine.

10) Spy Software: Ironically you can monitor for spy software by installing spy software on your system first! Since spy software can record all keystrokes it can monitor and record the installation of another spy software. Again this turns into a virtual arms race, but keep in mind that many spy programs are vulnerable to anti-spy attacks.

Related: Secure Computer

Basic Network Troubleshooting

If a computer is unable to connect to a network or see other computers on a network, it may be necessary to troubleshoot the network.

A network may not work because of any of the below reasons.

1. Network card not connected properly.
2. Bad network card drivers or software settings
3. Firewall preventing computers from seeing each other
4. Connection Problem
5. Bad network hardware

Because of the large variety of network configurations, operating systems, setup, etc... not all of the below information may apply to your network or operating system. If your computer is connected to a company or large network, or you are not the administrator of the network, it is recommended that if you are unable to resolve your issues after following the below recommendations that you contact the network administrator or company representative.

Note: If you are being prompted for a Network password and do not know the password, Service providers are able to assist users with obtaining a new or finding out the old password.

Verify connections / LEDs

Verify that the network cable is properly connected to the back of the computer. In addition, when checking the connection of the network cable, ensure that the LEDs on the network are properly illuminated. For example, a network card with a solid green LED or light usually indicates that the card is either connected or receiving a signal. Note: generally, when the green light is flashing, this is an indication of data being sent or received.

If, however, the card does not have any lights or has orange or red lights, it is possible that either the card is bad, the card is not connected properly, or that the card is not receiving a signal from the network.

If you are on a small or local network and have the capability of checking a hub or switch, verify that the cables are properly connected and that the hub or switch has power.
Adapter resources

Ensure that if this is a new network card being installed into the computer that the card's resources are properly set and/or are not conflicting with any hardware in the computer.

Users who are using Windows 95, 98, ME, 2000 or XP, verify that Device Manager has no conflicts or errors.

Adapter functionality

Verify that the network card is capable of pinging or seeing itself by using the ping command. Windows / MS-DOS users ping the computer from a MS-DOS prompt. Unix / Linux variant users ping the computer from the shell.

To ping the card or the localhost, type either

ping 127.0.0.1

or

ping localhost

This should show a listing of replies from the network card. If you receive an error or if the transmission failed, it is likely that either the network card is not physically installed into the computer correctly, or that the card is bad.

Protocol

Verify that the correct protocols are installed on the computer. Most networks today will utilize TCP/IP, but may also utilize or require IPX/SPX and NetBEUI.

When the TCP/IP protocol is installed, unless a DNS server or other computer assigns the IPX address, the user must specify an IP address as well as a Subnet Mask. To do this, follow the below instructions.

Click Start / Settings / Control Panel

Double-click the Network icon

Within the configuration tab double-click the TCP/IP protocol icon. Note: Do not click on the PPP or Dial-Up adapter, click on the network card adapter.

In the TCP/IP properties click the IP address tab

Select the option to specify an IP address

Enter the IP address and Subnet Mask address, an example of such an address could be:

IP Address: 102.55.92.1
Subnet Mask: 255.255.255.192


When specifying these values, the computers on the network must all have the same Subnet Mask and have a different IP Address. For example, when using the above values on one computer you would want to use an IP address of 102.55.92.2 on another computer and then specify the same Subnet Mask.

Firewall

If your computer network utilizes a firewall, ensure that all ports required are open. If possible, close the firewall software program or disconnect the computer from the firewall to ensure it is not causing the problem.

Additional time

In some cases it may take a computer some additional time to detect or see the network. If after booting the computer you are unable to see the network, give the computer 2-3 minutes to detect the network. Windows users may also want to try pressing the F5 (refresh) key when in Network Neighborhood to refresh the network connections and possibly detect the network.

If after following or verifying the above recommendations you are still unable to connect or see the network, attempt one or more of the below recommendations.

If you have installed or are using TCP/IP as your protocol you can attempt to ping another computer's IP address to verify if the computer is able to send and receive data. To do this, Windows or MS-DOS users must be at a prompt and Linux / Unix variant users must open or be at a shell.

Once at the prompt assuming, that the address of the computer you wish to attempt to ping is 102.55.92.2, you would type:

ping 102.55.92.2

If you receive a response back from this address (and it is a different computer), this demonstrates that the computer is communicating over the network. If you are still unable to connect or see the network, it is possible that other issues may be present.

Another method of determining network issues is to use the tracert command if you are a MS-DOS or Windows user or the traceroute command if you are a Linux / Unix variant user. To use this command you must be at the command prompt or shell.

Once at the prompt, assuming that the address is again 102.55.92.2, type:

tracert 102.55.92.2

or

traceroute 102.55.92.2

This should begin listing the hops between the computer and network devices. When the connection fails, determine which device is causing the issue by reviewing the traceroute listing.

Related:

More Posts that you may be interested...