Video: Watch how easy it to steal an identity on the street

Many of us are concerned about how well companies and organisations are protecting our personally identifiable information - but how good at we at protecting our own details, such as name, date of birth and email address? Sophos went onto the streets, asking people what they thought about identity theft - and also seeing if we could get the public to share their personal information with complete strangers.

http://www.sophos.com/blogs/gc/g/2009/10/19/video

Sophos.com

"The Wrong Browsers"

Aardman Animation, the firm behind plasticine superstars "Wallace and Gromit", asked if we could help them stop Google's Chrome frame plugin from being used with Internet Explorer. The reason? It could have a negative effect on computer security as it can circumvent other security measures. Discover more about why you might want to have greater control over how your users access the web.

http://www.sophos.com/blogs/chetw/g/2009/10/17/wrong-browsers-giving-control-admins

Sophos.com

Victoria's Secret spam slams Twitter

Some Twitter users have found that their accounts have been posting messages without their knowledge, apparently advertising gift cards for the glamorous Victoria's Secret lingerie store. Discover more about the attack now, and ensure you don't click on the spammer's links.

http://www.sophos.com/blogs/gc/g/2009/10/17/victorias-secret-spam

Sophos.com

Balloon Boy throws up on TV - sick hackers take advantage

America has been transfixed with the story of Falcon Heene, the six-year-old boy who was believed to have accidentally hitched a lift in his father's experimental helium balloon on Thursday. Although doubts have been expressed about whether the incident was a publicity stunt or not, there is no doubt that hackers have been quick to take advantage - creating malicious websites preying on interest in the breaking news story. Find out more about the latest attack now.

http://www.sophos.com/blogs/gc/g/2009/10/17/balloon-boy

Sophos.com

Phishing attack heists Hotmail passwords

Newwin.net is reporting that hackers have exposed over 10,000 usernames and passwords from users of hotmail.com, msn.com, and live.com email services. All of the accounts initially posted begin with the letter a or b, suggesting that this may be the tip of the iceberg. Find out more about this attack and Microsoft’s response.

http://www.sophos.com/blogs/chetw/g/2009/10/05/hotmail-passwords-heisted-hackers

Sophos.com

Fake anti-virus virus proclaims to be your Facebook friend

After a small hiatus, it appears that the social media networking site, Facebook is being attacked once again. AVG reports that there is an attack in progress under the guise of anti-virus software. Attackers have found a way to break the captcha's of Facebook accounts and create a mass of new "friends" to try to join your social network. The invites from these friends include a link. Learn more as we replicate this attack in our own SophosLabs.

http://www.sophos.com/blogs/chetw/g/2009/10/01/fake-antivirus-proclaims-facebook-friend

Sophos.com

Job with Google? No, it's a scam on Twitter

Twitter users have found themselves on the receiving end of a widespread spam campaign, claiming to offer them jobs at search engine giant Google. The purpose of the website users are directed to, of course, is not to hire genuine employees for Google, but to sell them a "working from home" kit. Learn more about this attack now.

http://www.sophos.com/blogs/gc/g/2009/09/25/jobs-google-scam-spammed-twitter

Sophos.com

The Partnerka: What it is and why you should care

SophosLabs expert Dmitry Samosseiko presented a technical paper at the Virus Bulletin conference in Geneva last week, investigating the ever-booming spam industry in Russia and beyond. The partnerka are hundreds of well-organised affiliate networks, with thousands of affiliated 'webmasters', who make millions of dollars of profits per year through the online sale of fake watches, fake anti-virus, fake pills, fake love, and much more besides. Learn more and read Dmitry's fascinating paper.

http://www.sophos.com/blogs/duck/g/2009/09/24/money-online

Sophos.com

Earn 43 cents every time you infect a Mac

One of the things Dmitry discovered while investigating the computer underground was that one website was offering $0.43 to its affiliates every time they managed to successfully install malware on users' Apple Mac computers. Read more now.

http://www.sophos.com/blogs/gc/g/2009/09/24/earn-43-cents-time-infect-mac

Sophos.com

Is cloud anti-virus ready for the mass-market?

There was much talk at last week's Virus Bulletin conference about "the cloud" and the part it can play in protecting computer users from security threats. Sophos blogger Chester Wisniewski wonders if those who believe this approach gives complete security actually have their head in the clouds..

http://www.sophos.com/blogs/chetw/g/2009/09/24/cloud-antivirus-ready-mass-market

Sophos.com

Patrick Swayze's death exploited by scareware scammers

The death of Patrick Swayze, star of movies such as "Dirty Dancing", "Point Break" and "Ghost", saddened many film fans around the world. Heartless hackers, however, took advantage of the hot news story by creating malicious webpages that lead to fake anti-virus (also known as scareware or rogue anti-virus) alerts. Find out more and watch our video explanation of what happened.

http://www.sophos.com/blogs/gc/g/2009/09/15/patrick-swayzes-death

Sophos.com

Hackers bought malvertising space directly from New York Times

The hackers who exposed innocent internet users to malicious computer code, bought the advertising space on the New York Times website directly from the newspaper. The hackers posed as a legitimate company, and persuaded NYTimes.com to run ads that initially appeared as legitimate online adverts before turning dangerous. Discover more about this audacious plot to attack innocent users.

http://www.sophos.com/blogs/gc/g/2009/09/15/hackers-bought-ad-space

Sophos.com

The perfect system to beat the roulette wheel? No, it's spam

An email posing as a foolproof betting system to beat casinos is, in reality, designed to drive traffic to a particular gambling website. Find out more about the latest trick being used by online gambling sites, but don't lose your shirt!

http://www.sophos.com/blogs/gc/g/2009/09/14/casino-spam-poses-foolproof-betting

Sophos.com

Adult webcam site promoted via Imeem spam

The social media website Imeem allows its members to share videos, podcasts, photos and blog entries with each other, but it's also being exploited by spammers to spread their unwanted messages too. Learn more about the latest campaign by social media spammers.

http://www.sophos.com/blogs/gc/g/2009/09/14/spammers-promote-adult-webcam

Sophos.com

Fake anti-virus attack hits New York Times

Stop the presses! The website of the New York Times has been found serving up malicious adverts, designed to frighten users into believing they have a malware infection. Find out more about the poisoned pop-ups and how hackers take advantage of third-party advertising networks.

http://www.sophos.com/blogs/gc/g/2009/09/14/fake-antivirus-attack

Sophos.com

Microsoft vs Adobe security smackdown

Vulnerabilities in software from Microsoft and Adobe continue to give companies headaches, as hackers exploit security holes to commit cybercrime. So, how do the two companies stack up against each other?

http://www.sophos.com/blogs/chetw/g/2009/09/13/microsoft-adobe-security-smackdown

Sophos.com

iPhone, iPod Touch, and QuickTime security updates

Multiple security vulnerabilities affecting the QuickTime software widely used by owners of Mac OS X and Windows computers have been patched - but have you installed the fixes? In addition, if you own an iPhone or iPod touch you should update your device to the latest version of Apple's operating system in order to defend against vulnerabilities that could allow hackers to run malicious code.

http://www.sophos.com/blogs/gc/g/2009/09/10/iphone-ipod-touch-quicktime

Sophos.com

Facebook Fan Check Virus scare leads to malware

Beware of searching on the internet for information about something called "Facebook Fan Check Virus", as you're likely to end up on a website hosting malicious code. Watch our video to see how fears of a Facebook application is leading some net users into a hackers' trap.

http://www.sophos.com/blogs/gc/g/2009/09/07/facebook-fan-check-virus

Sophos.com

Sophos Anti-Virus for Linux version 6.6.6 - the number of the beast?

Should we be worried that a new version of our software has reached version 6.6.6? Sophos blogger Paul Ducklin explores the issue in his unique style.

http://www.sophos.com/blogs/duck/g/2009/09/06/number-of-the-beast

Sophos.com

Five things you can do to improve security in Windows 7's XP Mode

XP Mode in Windows 7 has been criticised for not providing proper security. Read this blog post from Chet Wisniewski to learn how you can configure your Windows 7 computers for a higher level of protection from threats.

http://www.sophos.com/blogs/chetw/g/2009/09/05/windows-7-security-5-things

Sophos.com

Upgrading to Apple Snow Leopard downgrades Flash security

The last thing you expect when you upgrade your operating system, is that you will have some of your security silently downgraded. But that's precisely what seems to have happened with Mac OS X Snow Leopard, which ignores that you have been keeping Adobe Flash up-to-date and downgrades it to an earlier version. Learn more and watch a video about this potential security risk.

http://www.sophos.com/blogs/gc/g/2009/09/02/apple-ships

Sophos.com

Essential reading: Two new security blogs from Sophos

Experts Paul Ducklin and Chet Wisniewiski join the ranks of official Sophos bloggers - helping you make sense of the latest security news, and determine what actions you may need to take inside your organization. Can you afford not to read what they have to say?

http://www.sophos.com/blogs/gc/g/2009/09/01/security-blogs
http://www.sophos.com/blogs/duck
http://www.sophos.com/blogs/chetw

Sophos.com

How good is Snow Leopard's built-in anti-virus protection?

Apple shocked the world by building protection against two families of Mac Trojan horse into the latest version of its operating system. However, the company is at pains to underline that the technology is not equivalent to running an anti-virus product (for instance, you can't scan your hard drive or clean-up an infection, and it won't intercept malware downloaded via BitTorrent or introduced via a USB drive). See for yourself how Apple's anti-malware protection performs in a short video from SophosLabs.

http://www.sophos.com/blogs/gc/g/2009/08/28/snow-leopard-malware
http://www.sophos.com/blogs/sophoslabs/post/6269
http://www.sophos.com/blogs/chetw/g/2009/08/29/snow-leopards-bundled

Sophos.com

Sophos Anti-Virus supports Snow Leopard

Sophos product manager Sunil Choudrie comments on Apple's new operating system, our support for Mac OS X 10.6 Snow Leopard and what this mean for users. If you're upgrading to the latest version of Mac OS X, you'll want to read this.

http://www.sophos.com/blogs/gc/g/2009/08/28/guest-blog-sophos-antivirus

Sophos.com

Podcast: Windows 7 in the security spotlight

Find out more about some of the improvements that you'll find if you make Microsoft's dreams come true and upgrade to Windows 7, including the new Action Center, enhancements to the Windows Firewall and the latest about DirectAccess and the controversial XP Mode. Senior technologist James Lyne is interviewed in this podcast which takes a closer look at Windows 7 from the security point of view.

http://www.sophos.com/blogs/gc/g/2009/08/25/podcast-windows-7

Sophos.com

Quick poll: Is your smartphone encrypted?

Are you lucky owner of an iPhone, BlackBerry, HTC Hero or Palm Pre? What steps has your company taken to ensure that the data held on the phone is encrypted? Is the data encrypted at all? Let us know in this quick, anonymous poll.

http://www.sophos.com/blogs/gc/g/2009/08/20/smartphone-encrypted

Sophos.com

Twitter spammers post sexy profile pictures

Spammers have created bogus accounts on Twitter, and embedded racy messages into their profile images. Find out more about the attack, and how it attempts to lure unsuspecting social networkers into a date with an adult website.

http://www.sophos.com/blogs/gc/g/2009/08/20/twitter-spammers

Sophos.com

Delphi W32/Induc virus - what you need to know

A curious piece of malware called W32/Induc is designed to infect applications written using Delphi (a variant of the Pascal language originally developed by Borland, and now used to quickly develop Windows programs such as database applications). The virus inserts itself into the source code of any Delphi program it finds on an infected computer, and then compiles itself into a finished executable. Find out more about why we're seeing lots of reports of this virus, and how it has been discovered on a magazine's free CD ROM. You can even listen to a podcast and learn more straight from the malware experts at Sophos.

http://www.sophos.com/blogs/gc/g/2009/08/19/w32induca-spread-delphi-software-houses
http://www.sophos.com/blogs/gc/g/2009/08/20/magazine-ships-induc
http://www.sophos.com/blogs/gc/g/2009/08/21/podcast-delphi-induc-virus
http://www.sophos.com/blogs/sophoslabs/v/post/6117

Sophos.com

P2P file-sharing banned in Antarctica

Authorities have poured cold water over scientists' desires to run file-sharing software like BitTorrent on their computers in the Antarctic. Find out more about the dangers of uncontrolled P2P usage, and how you can enforce a policy inside your company to prevent users putting security at risk or gobbling up bandwidth.

http://www.sophos.com/blogs/gc/g/2009/08/19/p2p-filesharing-banned-antarctica

Sophos.com

Twilight movie star used as lure by malware-spreading hackers

Malware authors are explotiing interest in revealing pictures of actress Ashley Greene to entrap unwary surfers. Learn more about the attack, and remember to think twice before hunting for nubile snaps of Hollwood starlets online.

http://www.sophos.com/blogs/gc/g/2009/08/14/ashley-greene-dirty-pics

Sophos.com

Video: The danger of trusting Conficker clean-up advice on Twitter

Can all tweets on Twitter be trusted, or are some "helpful" souls actually spreading advice on how to clean up malware without revealing that they are making cash from the click throughs? Watch this exclusive video and find out more now.

http://www.sophos.com/blogs/gc/g/2009/08/13/trust-conficker-cleanup-advice-twitter

Sophos.com

Multiple security updates for Windows and Mac users

Users of Mac and Windows computers are once again being advised to update their systems as Apple and Microsoft have issued multiple security patches in the last week. Make sure you keep yourself informed of the critical patches, and update your computers before hackers have a chance to strike.

http://www.sophos.com/blogs/gc/g/2009/08/12/microsoft-issues-barrage-security-updates
http://www.sophos.com/blogs/gc/g/2009/08/12/security-holes-fixed-safari-403
http://www.sophos.com/blogs/gc/g/2009/08/13/day-security-update-apple

Sophos.com

Free download: New version of Sophos Anti-Rootkit

We've updated our free rootkit detection and removal tool to support 64-bit versions of Windows and the upcoming Windows 7. Make sure you have updated to version 1.5 of Sophos Anti-Rootkit to ensure the highest level of protection.

http://www.sophos.com/blogs/gc/g/2009/08/10/sophos-antirootkit-updated
http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

Sophos.com

Twitter topples under denial-of-service attack

Micro-blogging website Twitter was blasted off the internet last week, after suffering a massive denial-of-service attack. Find out more about the attack, including how an attempt to silence one Georgian blogger actually affected millions of users worldwide.

http://www.sophos.com/blogs/gc/g/2009/08/07/twitter-denialofservice
http://www.sophos.com/blogs/gc/g/2009/08/06/twitter-hit-massive

Sophos.com

Boobytrapped images pose threat to Apple users

Users of Mac computers are being advised to install an important security patch, after Apple acknowledged that a serious flaw existed in its Mac OS X operating system that could be exploited by hackers. Discover more about the flaw and ensure that your Mac computers are properly defended.

http://www.sophos.com/blogs/gc/g/2009/08/06/boobytrapped-images

Sophos.com

US Marines banned from using Twitter and Facebook

The US Marine Corps has banned troops from accessing social networking websites - such as Twitter, Facebook and MySpace - from its networks. Discover how military commanders are becoming increasingly concerned about the threat of hackers spreading malware via the systems.

http://www.sophos.com/blogs/gc/g/2009/08/05/marines-banned-twitter

Sophos.com

Exploiting trust with SSL vulnerabilities

A serious flaw has been found in the way that SSL, browsers and Certificate Authorities work with each other to provide transport security and identity validation on the web. Learn more about the problem, and how Sophos's web appliance can automatically detect malformed certificates and block them before they get to the user or the web browser.

http://www.sophos.com/blogs/gc/g/2009/08/03/guest-blog-internet-identity

Sophos.com

Sophos wins VB100 award for virus protection

Industry magazine Virus Bulletin describes Sophos's anti-virus solution as "a worthy winner" of the VB100 award in a comparative test, with "detection rates very impressive across all the sets." This is the 48th time Sophos has won the VB100 award from the independent testers at Virus Bulletin for its protection capabilities. Read more about the test now.

http://www.sophos.com/blogs/gc/g/2009/08/03/sophos-wins-vb100-award

Sophos.com

iPhone update fixes "SMS of death" vulnerability

Apple has released an update to its iPhone operating system to protect against a vulnerability that could potentially allow criminals to hijack users' phones by sending booby-trapped SMS messages. Although the exploit has not yet been used in anger, make sure you update your iPhone now.

http://www.sophos.com/blogs/gc/g/2009/08/01/iphone-update-fixes-sms

Sophos.com

Michelle Obama's safehouse secrets leaked via P2P

It has been revealed that details of the secret service safe house that would be used by Michelle Obama in the event of the White House being evacuated were accidentally shared via a peer-to-peer file-sharing network. Learn about the risks of uncontrolled use of P2P software, and how you can manage the danger inside your business.

http://www.sophos.com/blogs/gc/g/2009/07/30/michelle-obamas

Sophos.com

Firms braced for emergency patches from Microsoft

Microsoft has announced that on Tuesday it will release two out-of-band security patches designed to fix vulnerabilities in Internet Explorer and Microsoft Visual Studio. Microsoft normally bundles its security updates into a monthly package, and it is relatively unusual for the company to issue a fix for a security vulnerability outside of this cycle. Learn more and discover why considers the situation particularly important.

http://www.sophos.com/blogs/gc/g/2009/07/26/departments-braced

Sophos.com

Emma Watson has NOT died in a car crash

Harry Potter actress Emma Watson has become the subject of a morbid and fast-moving rumor that has struck the internet, claiming that she has been killed in a car crash. Sophos advises computer users to check their facts and show caution when invited to click on unsolicited links.

http://www.sophos.com/blogs/gc/g/2009/07/24/emma-watson-died-car-crash

Sophos.com

BlackBerry users revolt over spyware scandal

It has been revealed that an update sent to BlackBerry users in the United Arab Emirates, which claimed to improve performance of the mobile device, was actually spying on them. Intriguingly, it is a telecoms company that sent the update to their BlackBerry users. Learn more about the spyware scandal making big headlines in the Middle East.

http://www.sophos.com/blogs/gc/g/2009/07/23/blackberry-customers-revolt

Sophos.com

HSBC receives record fine after losing data in post

HSBC has found itself on the receiving end of a record fine of over 3 million pounds, after it was found by the the Financial Services Authority (FSA) to have carelessly handled the data of thousands of customers. Is your company doing enough to keep its customer data confidential?

http://www.sophos.com/blogs/gc/g/2009/07/23/hsbc-fined

Sophos.com

Which is more secure - Internet Explorer or Firefox?

Guest blogger Chet Wisniewski examines the two giants of the web browsing world, and tries to determine - is one safer than the other?

http://www.sophos.com/blogs/gc/g/2009/07/20/guest-blog-secure

Sophos.com

Erin Andrews peephole video: Hackers exploit interest to spread malware

Glamorous female sports reporter Erin Andrews has taken legal action to force websites to remove video footage taken without her permission, but that isn't stopping hackers exploiting interest. Beware of visiting pages claiming to contain the footage of Ms Andrews undressing, as they can infect your Mac or PC with malware. Learn more and watch a video demonstrating what happens.

http://www.sophos.com/blogs/gc/g/2009/07/19/erin-andrews

Sophos.com

Opinion: Security is never Microsoft's first priority

Sophos CTO Richard Jacobs believes that Microsoft's inclusion of XP mode in Windows 7 reveals something very obvious about the operating system giant - it isn't taking security seriously. Learn more in this controversial opinion piece and find out why - without built-in management, XP mode is a security disaster.

http://www.sophos.com/blogs/gc/g/2009/07/17/guest-blog-xp-mode

Sophos.com

Twitter users struck by AddFollowers spam

In their desperate desire for more followers on Twitter, some users are turning to third party websites to help them. But can you trust these sites with your Twitter username and password? Find out more in this video.

http://www.sophos.com/blogs/gc/g/2009/07/14/addfollowers-spam

Sophos.com

Alert: Zero day vulnerability in Microsoft Office Web Components

Microsoft says it has seen a limited number of attacks exploiting a serious vulnerability in software which allows you to embed spreadsheet content on a webpage. The flaw leaves unsuspecting computer users potentially wide open to hackers installing malicious code. Although Microsoft has not yet issued a patch, there is a workaround to defend your PCs. Find out more now.

http://www.sophos.com/blogs/gc/g/2009/07/13/day-vulnerability

Sophos.com

Congressman urges USA to launch cyber attack against USA

Sophos experts believe it's dangerous to jump to conclusions without checking all the facts, and that's certainly true in the case of US politician Pete Hoekstra. He's pointing the finger at North Korea for recent denial-of-service attacks, and believes that America should respond in kind. But is there any evidence of North Korea's involvement?

http://www.sophos.com/blogs/gc/g/2009/07/13/republican-urges-obama

Sophos.com

Twitter warns users of Koobface worm

The Koobface worm has been spreading for some time on sites like Facebook, MySpace and Bebo - but now it's causing problems for Twitter user too. Make sure your computer is protected, or risk being disconnected from the social networking site.

http://www.sophos.com/blogs/gc/g/2009/07/10/twitter-warns-users

Sophos.com

South Korean arrested for denial-of-service attack

Although security headlines have focused on whether or not North Korea is behind a series of DDoS attacks, a South Korean man has been arrested in connection with an unconnected attack which paralysed one of his own government's websites. Learn more in this report from Graham Cluley's blog.

http://www.sophos.com/blogs/gc/g/2009/07/10/south-korean-arrested

Sophos.com

Critical zero-day vulnerability in Microsoft DirectShow

A serious flaw has been found in Windows systems, leaving unsuspecting users potentially wide open to drive-by downloads. Although Sophos can prevent the exploit happening on customer's computers, there is no patch yet from Microsoft. Find out more now.

http://www.sophos.com/blogs/gc/g/2009/07/06/zeroday-vulnerability

Sophos.com

Are your workers safe on Facebook?

The incoming British Secret Service chief found himself in a pickle this weekend, after newspapers reported that his wife had left her Facebook account open for millions of people to view - including family photos and details of the family flat. Learn how your employees can better defend themselves on social networking sites, and check their privacy settings are in order.

http://www.sophos.com/blogs/gc/g/2009/07/05/mi6-chiefs-wife

Sophos.com

Bogus Twitter invites carry dangerous payload

Hackers are exploiting the name of the blossoming micro-blogging website Twitter in their attempt to infect innocent computer users with malware. Make sure that you are familiar with the latest tricks being used by cybercriminals to attack computers in your company.

http://www.sophos.com/blogs/gc/g/2009/07/02/hacker-invitation

Sophos.com

When is a hack not a hack? When's it Sarah Palin's email account

The university student accused of hacking into Sarah Palin's email account is arguing in court that accessing the unsuccessful Vice Presidential Candidate's Yahoo account cannot be classified as identity theft. Find out more about the case, and how Palin's email account was compromised.

http://www.sophos.com/blogs/gc/g/2009/07/01/legal-arguments-sarah-palin

Sophos.com

Is Britney Spears dead or has she been Twitter-hacked?

Tasteless hackers posted a message to Britney Spears's two million followers on Twitter,
saying that the star had died. Experts at Sophos report that a vulnerability in the third
party service TwitPic is likely to be the route by which the hackers were able to plant
their offensive message. Find out more about the attack now.

http://www.sophos.com/blogs/gc/g/2009/06/29/britney-spears-dead-hacked

Sophos.com

Gossip Girl sex tape lure spreads Mac and Windows malware

The Twitter account of former Apple evangelist and celebrity blogger Guy Kawasaki published a link to a webpage claiming to contain an adult video of TV star Leighton Meester on Tuesday.
However, anyone visiting the page could find themselves infected with a Mac or Windows Trojan
horse. Find out more about how Kawasaki's 140,000 followers were put at risk in our video.

http://www.sophos.com/blogs/gc/g/2009/06/24/leighton

Sophos.com

Was Lindsay Lohan's Twitter account hacked?

Was she or wasn't she? That's the question being asked about Hollywood celebrity Lindsay Lohan
who says that a Twitter posting about Justin Timberlake did not come from her fair hands, but from a hacker instead. Read more about the incident, and make sure your own passwords are
properly secured.

http://www.sophos.com/blogs/gc/g/2009/06/22/lindsay-lohans-twitter

Sophos.com

So you want a job? Just hand over your passwords.

The City of Bozeman in Montana found itsel in the media spotlight last week after it was revealed that it had been insisting job seekers must not only reveal if they have accounts with the likes of Facebook, MySpace, Yahoo, Google and YouTube, but must also hand over their user ids and passwords. Discover why that is such a bad idea, and how the city eventually saw sense.

http://www.sophos.com/blogs/gc/g/2009/06/20/job-give-social-networking-passwords

Sophos.com

iPhone OS 3.0 brings 46 security patches

According to an advisory on Apple's website, iPhone OS 3.0 patches 46 vulnerabilities, including some that could potentially allow hackers to run malicious code on a user's iPhone or iPod Touch if they visited a booby-trapped website or viewed a specially-crafted image file. Find out more and ensure your mobile device is properly protected.

http://www.sophos.com/blogs/gc/g/2009/06/18/apple-update-fixes-46

Sophos.com

Is Friends Reunited taking password security seriously?

Popular school reunion website Friends Reunited is disappointing some by exposing portions of users' passwords, and make sure your own websites aren't exhibiting similar behavior.

http://www.sophos.com/blogs/gc/g/2009/06/15/friends-password-security

Sophos.com

Firefox and Google Chrome receive fixes for security vulnerabilities

Google Chrome and Mozilla Firefox have been updated to fix a number of security vulnerabilities which, if exploited, could be used by hackers to run malicious code on your computers. Users of the web browsers are advised to update their systems as soon as possible. Discover more about the threat now.

http://www.sophos.com/blogs/gc/g/2009/06/12/security-updates-chrome-firefox

Sophos.com

Adobe releases its critical security patches

Adobe has released a fix for 13 different vulnerabilities in its Adobe Reader and Acrobat software, widely used to handle PDF files. It's critical that you patch your software as if a hacker exploited the vulnerabilities they could cause your computer to crash or run malicious code that could take over your system. Read more now.

http://www.sophos.com/blogs/gc/g/2009/06/10/adobe-releases-patch-tuesday

Sophos.com

Video: Twitter goes off the rails with the Twittertrain

If someone promised they could get you hundreds of new followers on Twitter every day would you believe them? Would you be prepared to hand over your Twitter username and password to them? Find out how an advert for a website called Twittertrain was spammed out from hundreds of innocent Twitter users' accounts, and how you can avoid it happening to you in future.

http://www.sophos.com/blogs/gc/g/2009/06/05/rails-twitter-passwords

Sophos.com

How to make Windows 7 more secure

Sophos security expert Chester Wisniewski takes an early look at Windows 7's security, and finds it lacking. Find out ways in which Windows 7 could be improved by Microsoft, before it's officially released.

http://www.sophos.com/blogs/gc/g/2009/06/03/guest-blog-windows-7

Sophos.com

9 out of 10 work PCs fail on basic security

Unpatched and unprotected - that's the story being heard loud and clear following the publishing of research by Sophos into the state of security of PCs at thousands of different companies. Find out which security patches your users are least likely to have in place, and how many people have a firewall - but fatally don't have it properly enabled.

http://www.sophos.com/blogs/gc/g/2009/06/02/ten-work-pcs-fail-basic-security

Sophos.com

UPS malware attack bombards inboxes with dangerous attachment

In the early hours of June, computer users were deluged with a malicious spam campaign spreading a Trojan horse. The emails, which claim to come from UPS, lure you into opening an attachment believing it to be information about a failed delivery. Discover more, and ensure that you are defended.

http://www.sophos.com/blogs/gc/g/2009/06/01/week-failed-delivery

Sophos.com

Cracked Windows - Microsoft warns of critical flaw

Microsoft has published a security advisory warning of a critical vulnerability in Microsoft DirectX on older versions of Windows.

The problem is in the way that Microsoft DirectShow handles QuickTime format files - meaning that if a user opened a maliciously crafted QuickTime media file, the hackers could run dangerous code on your computer.

According to Microsoft, all versions of Windows Vista and Windows Server 2008 are not vulnerable but Windows 2000 Service Pack 4, Windows XP, and Windows Server 2003 are affected.

A proper patch for the problem is not yet available, but the company has issued a workaround that can be used by vulnerable Windows users.

The workaround, which disables QuickTime parsing, involves making changes to the Registry. But if the thought of doing that gives you goosebumps, they've produced a natty automated method that will do it for you. All you need to do is click on a "Fix It" button on their site to run the workaround.

More information about the flaw can be found in Sophos's analysis of the problem.

There's no word yet on when Microsoft will make available a proper fix for this problem, or indeed whether it will be included in their regular scheduled "Patch Tuesday" bundle of patches next month or released as an out-of-bound fix.

But I think it's good that they gave the less geeky users of computers a fairly easy way to implement the workaround, rather than leaving them befuddled by complicated instructions.

Posted on May 29th, 2009 by Graham Cluley, Sophos

Sophos.com

Why Geo-tagged Twittering could be bad for security

The web is becoming increasing about where you are, not just what you're doing/saying/reading/writing.

For instance, earlier this week I was standing in a horrendously long queue to be admitted into a recording of the BBC TV show QI, hosted by national treasure and well-known Twitter user Stephen Fry.

It became obvious to me pretty early on that there were many more people in the queue than there were likely to be seats in the studio - but there didn't seem to be any official in charge to ask what our chances of being admitted were. So, I went to Twitter and searched for "QI".

I got a number of results - many of them useless - but some of them were from other people in the queue. Now, wouldn't it have been handy if I could only have seen Tweets from people within - say - 400 yards of me?

Well, if rumoured forthcoming changes coming to Twitter are true then that may soon be possible. At a conference earlier this week, Twitter API guru Alex Payne told attendees that one of the new features that the micro-blogging site might introduce shortly is sharing of your geographic location at the point of your tweeting.

Yuck! I'm not sure I like that.

There's little enough privacy in the way many people are using Twitter right now, without also providing complete strangers with precise details of where you are.

Yes, I can see why marketroids and developers might love to be able to work out where people are at a particular time, in order to advertise to them more precisely or provide location-specific services, but I can also imagine many circumstances when I would want to keep my precise position completely private.

And let's not forget the Twitter celebrities like Ashton Kutcher, Ellen DeGeneres, Oprah Winfrey, Ryan Seacrest have over a million followers. There are bound to be a few bad apples in that bunch who may have a less than healthy interest in the precise coffee bar where their favourite star is currently having a Skinny Caffe Latte.

Just ask Yoko Ono (46,137 followers and counting) about the dangers of obsessed fans.

I'm no celebrity, but I don't want people to know where I am. If nothing else, information like that could be valuable for burglars who want to know when is the best time to raid my house.

So, here's my message to Twitter. Please don't turn on geo-tagging by default. Force people to make a conscious decision that they want their Tweets to reveal where they are at the time they Tweeted.

Otherwise, I think you can expect an almighty backlash.

(By the way, as it was, I didn't get to see QI. It turned out I was about 10 minutes too late joining the queue. Instead I went to see Star Trek. It was pretty good for what it was - but I will always be a Doctor Who fan at heart).

Posted on May 28th, 2009 by Graham Cluley, Sophos

Sophos.com

How to control a Blackberry Enterprise Server with just a PDF

Sorry, I'm not actually going to tell you how to do that.

But Research In Motion (RIM), the company who make the BlackBerry smartphones beloved by corporate workers worldwide, has warned of a vulnerability in the way its devices handles PDF files which could allow hackers to remotely execute code.

According to a security advisory issued by the firm, hackers could send email message with an attached PDF file that, when opened by a BlackBerry mobile user, could cause code to be launched on the computer that hosts the BlackBerry Attachment Service. Of course, this isn't the first time that this kind of problem with RIM's BlackBerry has bubbled up.

RIM is advising that companies disable PDF file processing on the BlackBerry server until the patches are rolled out.

As we've reported umpteen times before, hackers are increasingly exploiting the PDF file format to deliver malicious code to unsuspecting computer users.

As PDFs are so widely used and shared in business, most people wouldn't think twice of clicking on them, making it imperative that corporations keep their security patches and anti-malware defences up-to-date.

Posted on May 27th, 2009 by Graham Cluley, Sophos

Sophos.com

NHS accused of "cavalier attitude" after data security leaks

The British National Health Service (NHS) has been accused of losing almost as much personal data in the first three months of this year, as the entire private sector.

With over 140 security breaches by the NHS logged by the Information Commissioner since January, outranking all local and central government data losses combined, it has been confirmed as the public sector's main loser of personal data.

Richard Thomas, the Information Commissioner, and assistant commissioner Mick Gorrill told the Independent newspaper that NHS workers were demonstrating a "cavalier attitude" and that "there is a complete disconnect between the procedures laid down by managers and what happens on the ground. We need a complete audit to try to change the culture."

Here are some of the security breaches that rang alarm bells at the Information Commissioner's Office:

• A GP downloaded sensitive details of 10,000 patients to an insecure laptop. The laptop was stolen and still remains missing.
• 
  
• Old NHS computers containing the medical notes, names and addresses 2,500 people, which were stolen from a skip.
• A lost memory stick containing medical details of over 6,000 prisoners was encrypted and password-protected, but sadly the password was written on a note attached to the device.

One of the challenges facing the NHS is that it's the largest employer in Europe (in fact, apart from the Chinese Army and the Indian Railway system it's probably the biggest in the world), and trying to ensure that all staff treat data securely and sensibly is always going to be a challenge.

That's why it's essential that full disk encryption becomes a norm inside organisations that are handling sensitive data, such as patient records. Accidents like lost laptops will continue to happen - but something can be done to ensure that any data lost is gobbledygook that will be useless even if it does fall into the wrong hands.

Alongside encryption, organisations need to centrally monitor compliance with internal policies and external regulations through comprehensive logging and reporting.

Other organisations would be wise not to sit smugly and smirk at the NHS's misfortune. These are problems that more and more companies are going to be facing sooner rather than later.

Posted on May 26th, 2009 by Graham Cluley, Sophos

Sophos.com

Fear of blackmail after RAF loses sensitive personal data

Highly personal information about senior officers of the Royal Air Force (RAF) - including details of extra-marital affairs, debt, drug abuse, and the use of prostitutes - is alleged to be amongst the data lost from a base in Innsworth, Gloucestershire.

When I originally reported on the stolen USB drives last September, it was suggested that the information stolen had been names, service numbers, addresses and dates of birth.

Now it seems secrets of a much more sensitive nature were also lost.

Why does the RAF have such information? Because before staff are allowed access to highly sensitive information they are put through a gruelling vetting procedure - to see if they have any skeletons in their cupboards which others may use for blackmail purposes.

A former serving officer in the RAF, who uncovered the memo after reportedly worrying about his own data being lost told the BBC, "They'd ask you questions such as: is there anything unusual about your sex life? Have you had affairs? Used prostitutes? That sort of thing. If the information got into the wrong hands then it could leave people wide open."

An internal email from an unnamed wing commander, seen by the media, says that the lost data "provides excellent material for Foreign Intelligence Services, investigative journalists and blackmailers".

The fact that the RAF did not reveal that vetting data had also been lost has lead some to suggest a cover-up has occurred to save the force's embarrassment. For its part, the RAF is keen to stress that there is no indication that the data has fallen into hostile hands.

Of course, this would probably hardly be a story if the RAF had taken the sensible step in the first place of ensuring that this information was properly and securely encrypted - thus making the lost drives as useful to potential blackmailers as handlebars on a surfboard.

Posted on May 25th, 2009 by Graham Cluley, Sophos

Sophos.com

Acai Berry spammers hack Twitter accounts to spread adverts

Hundreds of innocent user's accounts on the Twitter micro-blogging service appear to have been hacked by spammers.

A typical message posted on the compromised accounts will say something similar to the following:

Howdy my friend! I just lost 13 pounds in 12 days. It only costs me $5. Take a look at this: http://[random].cn

If you do click on the link you get taken to a website with a .cn tld (top level domain) like the following:

Some victims of this latest Twitter hack attack are noticing that their account is sending Acai Berry spam, however. Take this example, for instance, where the user has apologised for the security breach on his account:

The question is - how have these accounts on Twitter been hacked? At the moment, that's not clear. But what is evident is that users need to take more care with their Twitter passwords.

If your account on Twitter has been compromised, make sure you change your password to a non-dictionary word - and be sure to also change any other online accounts where you might be using the same password. Far too many people use the same passwords on multiple sites, which obviously increases your chances of becoming hacked.

Posted on May 24th, 2009 by Graham Cluley, Sophos

Sophos.com

Podcast: Defeating hackers is hard

When I was at the RSA show in San Francisco last month I had the opportunity to spend a little time with Robert Westervelt, news editor at SearchSecurity.com.

Below you'll find a podcast we recorded where Rob lets me ramble on about the anti-virus industry, the threat landscape, the Conficker worm and why it's a struggle to bring international cybercriminal gangs to justice.

Rob had a cameraman with him, but I haven't seen the video of our conversation yet. If it does show up, I'll try and embed it here on the website too.

Posted on May 22nd, 2009 by Graham Cluley, Sophos

Sophos.com

Beware tvviter.com - video of a live Twitter phishing attack

I got an email this morning saying that someone called "3XNJTVJG0SYIKDH (NinaOchoa)" was following my updates on Twitter.

That's rather an odd name, I thought, and investigated further.

Turns out that 3XNJTVJG0SYIKDH (lets call her 3XNJTV for short) was already following nearly 400 people on Twitter, but had only ever posted one update:

check this guy out [followed by a tinyurl address]

Fortunately, I use LongUrl. I've blogged about LongUrl before, but in a nutshell it's a cool add-on for Firefox which converts short urls - like those often used on Twitter - into into their true much longer form.

And I was able to see that 3XNJTV (okay, lets call her "Nina"), was trying to point me towards a website called tvviter.com.

Did you read that right? tvviter.com (Double V, not W)

Yup, it's not the real Twitter site.

But if you do make the mistake of clicking on the link you will be taken to a bogus website which is pretending to be Twitter, and hopes to fall you into handing over your username and password (which could lead ultimately to some painful identity fraud, as well as your account being used for the purposes of spam or spreading malware).

At the time of writing the user and the website are still live - I wouldn't recommend visiting either.
And further analysis suggests that there are many other bogus Twitter users out there telling you to "check this out" and pointing to the same TinyURL link this morning.

Be careful out there.

Posted on May 21st, 2009 by Graham Cluley, Sophos

Sophos.com

Bad news - it's child's play for anyone to recover your deleted Twitterings

Following last night's discussion about British TV celebrity Jonathan Ross accidentally revealing his personal email address on Twitter (and how, despite his attempts to delete the Tweet, it's still available for anyone to read) I've found about an online service which makes it even easier to find those Tweets that all of us would like to retract.

Tweleted is a simple website that allows you to enter anybody's Twitter name and it will then uncover their "deleted" Tweets by comparing the individual's Twitter history to the results from Twitter Search.

The outcome? Anyone can easily find out all they would ever want to know about your deleted Tweets.

The only good news is that it appears it only searches back in the last 1000 of your messages or so, but that'll be scant relief for those who've accidentally pressed a little prematurely.

As I said in the earlier video Twitter really needs to get this problem fixed. Twitter users expect their Tweets to be deleted when they press the delete button, not for strangers to be able to uncover them at will.

At the moment, all Twitter can suggest if you want to really remove a public Tweet you made in error from their search results is that you contact them.

Shouldn't it be simpler than that?

Deleted should always mean deleted, and nothing less.

Posted on May 19th, 2009 by Graham Cluley, Sophos

Sophos.com

BBC film of remote Trojan horse attack

A couple of months ago, the BBC broadcast a film that many people believe showed them breaking the law, by accessing the computers of unsuspecting members of the public without their permission in order to demonstrate how easy it was to send spam.

There was a right royal stink about it.

I must admit that I was disheartened with the way the BBC behaved (as I felt it was completely unnecessary to break the law in order to demonstrate the problem of botnets), and felt even more let-down when they censored me from making my views heard!

Anyway, today the BBC has published another movie - again with assistance from Jacques Erasmus of PrevX.

It's a short and basic video, and doesn't demonstrate anything that anyone who hasn't been following IT security for the last few years doesn't already know. But this time they seem to have gone out of their way to make it clear that they did have the permission from the owner to access the PC.

It's good to see that they seem to have learnt something from the earlier furore.

Posted on May 18th, 2009 by Graham Cluley, Sophos

Sophos.com

Guest blog: Security = safety? Sounds risky!

Graham Lee, is not only a near namesake of mine, but also a senior Mac software engineer at Sophos and the author of "Ten tips to secure Apple Mac laptops". Over to you Graham...

Earlier this week, Dennis Fisher wrote a column for ThreatPost declaring that Snow Leopard security is all relative, which Jon Gruber linked to with a discussion on Daring Fireball, called the difference between security and safety.

I wanted to address both, but realised I was in danger of rambling - so I have decided just to look at Gruber's post.

One thing which annoys me, and which I addressed in my talk to NSConference in April, is this idea that security means something different in the online world than the real world.

No, it doesn't.

If we try to claim that words have different meanings when used about computers then all we end up doing is confusing people. Do any of the keys you lock your doors with have a piece you give away freely to other people? No? Then why do we have public keys in asymmetric encryption?

Anyway, in the Daring Fireball post, we see "Security is about technical measures, like the strength of the locks on your doors and windows."

Those are security measures. Security is being (or feeling) free from threat, both in the real world and online. I saw a definition of security as a state where "things which should happen, do, and things which shouldn't happen, don't" and to me that seems like a good meaning. Notice too that it isn't a technosphere-only definition.

So why has Gruber taken a narrower view?

Maybe he wanted to avoid the "Macs are more secure" canard by giving "the likelihood that you’ll
actually suffer from some sort of attack" another name; safety. So it doesn't matter whether Macs are more secure or not, says he, they're more safe and that's what people are after.

Well, it isn't; it's (along with the cost of such an attack) risk. Safety is the state of not suffering or causing harm.

But even ignoring the lexical games, risks are like stock prices - previous performance isn't always a good indicator of future behaviour. When CISOs write security policies they consider (or at least they should consider) what looks likely to happen - or expensive if it were to happen, or both - in the future. Relying too much on previous personal experiences is a known effect, though. It's a form of the availability heuristic.

Just as people who've never been burgled tend to consider the likelihood of being burgled in the future to be lower than those who have, could it be that the Mac users who've never knowingly experienced a malware attack have an artificially low opinion of the future likelihood?

What we really know is that Macs have a lower historical frequency of being targets of malware attacks.

Risks are also like shares in that there are many of them, and they all perform differently.

In fact, going back to the burglaries, many burglars get in through an unlocked window or door - the real-life analogy to having a guessable or empty password.

That's going to let people in, malware or no malware.

Posted on May 15th, 2009 by Graham Lee, Sophos

Sophos.com

Malicious JSRedir-R script found to be biggest malware threat on the web

Research done by experts in SophosLabs has revealed that a new web-based threat has blown all previous web-based malware out of the water, being found six times more often than its nearest rival.

Troj/JSRedir-R accounts for some 42% of all malicious infections found on websites in the last seven days, massively overshadowing its nearest rival - Mal/Iframe-F - at 7%.

Typically, JSRedir-R is found on legitimate websites, hidden behind obfuscated JavaScript, loading malicious content from third-party sites without the user's knowledge. In the below case, the obfuscated script tries to download dangerous code from a site called gumblar.cn.

High traffic websites which have been hit by the attack include the highly unpleasant 2 Girls 1 Cup viral video site (I've never been there, but its Wikipedia entry tells me that I probably would never want to, and neither should you), as reported by SophosLabs at the beginning of the month.

For JSRedir-R to have overtaken the previously seemingly unbeatable Mal/Iframe-F in the web malware charts is quite an event. Users of Sophos security solutions, including our web appliance, are already protected against this threat - but if you use another vendor's product make sure that you are updated and protecting against JSRedir-R before it drags malicious code onto your desktops.

In addition, if you run a website make sure it is properly hardened to prevent hackers from injecting their malicious code into your pages, or you could be passing an unpleasant pox onto your visitors.

No-one should be in any doubt that the web is the primary vector by which hackers are trying to infect computers today. Our most recent security threat report revealed that we see a new infected webpage every 4.5 seconds - that's three times more than the rate in 2007 - and it doesn't look like things are getting any better.

Update: Read the blog entry from Paul Baccas of Sophos to read more about how this malware is being planted, and how to clean-up your website afterwards.

Posted on May 14th, 2009 by Graham Cluley, Sophos

Sophos.com

Alarm raised over Adobe PDF zero-day vulnerability

If you are one of the world's many users of Adobe's Acrobat PDF Reader software then there's good reason to prick up your ears and listen today, as details emerge of a critical zero-day vulnerability in the software that could allow hackers to run malicious code on computers.

According to a warning from the security response team at Adobe, a serious vulnerability in all currently supported versions of Adobe Reader and Acrobat ((Adobe Reader and Acrobat 9.1, 8.1.4, and 7.1.1 and earlier versions) are affected by the flaw.

The vulnerability, which is not limited to Windows users but also affects Mac and Unix users, means that Adobe users are being advised to disable JavaScript in Adobe Reader and Acrobat until a proper fix is available.

Adobe advises that JavaScript can be disabled by following these instructions:

1. Launch Acrobat or Adobe Reader.
2. Select Edit/Preferences
3. Select the JavaScript Category
4. Uncheck the ‘Enable Acrobat JavaScript’ option
5. Click OK

Of course, this is far from the first time that critical vulnerabilities have been found in Adobe's software, and there is growing concern that the vendor's dominant market share of the PDF reader market is proving extremely attractive for hackers hellbent on infecting as many PCs as possible.

As we predicted in the Sophos 2009 Security Threat Report, hackers are increasingly looking at commonly used browser plugins like Adobe Flash and PDF in their attempts to infect innocent computer users.

In the past I've suggested that computer users may want to use FoxIt, an alternative to Adobe PDF Reader. However, on reflection, I think that advice wasn't that great because if everyone switched en masse to the same alternative to Adobe Reader we'd all be in the same pickle again.

A world of everyone using the same software as everyone else is never healthy for security.

Instead, make your own choice of which PDF reader to use. You can find a helpful list of some suggestions at http://pdfreaders.org/

Posted on April 29th, 2009 by Graham Cluley, Sophos

Sophos.com

Ever been spammed on a social network?

How about received a phishing message? Or sent a malicious link?

It seems occurrences of cybercrime on social networking sites like Twitter and Facebook are becoming more and more commonplace. Today, we've published some research looking into just how common it is to be hit, and how companies are trying to control access to the various Web 2.0 sites.

Our survey quizzed over 700 security professionals - I wonder how much higher the percentages would have been if we had also asked teenagers who typically spend longer on these kinds of sites.

Posted on April 28th, 2009 by Graham Cluley, Sophos

Sophos.com

Guest blog: Canadian anti-spam laws take an important step forward

Guest blogger Michael Argast, director of global sales engineering at Sophos, discusses changes in anti-spam legislation in his home country of Canada. Over to you Michael..

The Conservative government in Canada last week introduced the Electronic Commerce Protection Act to help cull sources of spam and other malicious activity from within Canadian borders.

Although it was introduced as "the Government of Canada protecting Canadians" those of us in the industry recognize that this is a global problem, and the amount of spam and other malicious stuff ending up on Canadian's computers will not likely be significantly impacted as a result.

Our latest threat report had Canadian sources of spam being only 1.1% of the global total, and of course most of that will be from compromised machines forming parts of a botnet.

However, I do think this is a positive step for Canada as a "good neighbour" in the global community. We have seen a lot of previously US-based spam operations move to Canada due to a lack of this type of legislation – hopefully those same people will find it more inconvenient to move further overseas and cease operations.

Another nice thing about this legislation are specific prohibitions on installation of non-desired software such as spyware, keyloggers, adware, etc, during commercial operations.

So, while this is an important step forward, ultimately the spam and malware problem requires a global response.

The person breaking into your house to steal your flatscreen TV likely lives in your community. The one sending you malware via a spam campaign likely lives in Russia, breaks into a site in the US to get you to into the threat tree, delivers the code off a compromised machine in Brazil and fires the spam off a botnet with compromised machines in Canada, China and South Africa. He then sells your credit card number or identity to a mule in your neighbourhood, who may not even be aware they’re part of a global operation.

This sort of problem requires a global response, and the Electronic Commerce Protection Act is a good local step in a global effort.

Posted on April 27th, 2009 by Michael Argast, Sophos

Sophos.com

Salma Hayek's email account is hacked

Acording to reports, Hollywood actress Salma Hayek has fallen victim to hackers, who have broken into her email account and released images of her private communications.

The actress, remembered equally well for her Oscar-nominated role in the biopic of Frida Kahlo as her erotic snake-dancing performance in "From Dusk Till Dawn", had her MobileMe account hacked after hackers reset her account password by correctly entering her date or birth and guessing her secret question (reportedly the name of her most famous film role).

As a result, the world knows details of what iPhone applications Salma Hayek has download from the Apple iTunes Store, when she has arranged to have her Japanese face massage, and that her billionaire French husband François-Henri Pinault pays her bills.

Of course, it's worth remembering that Salma Hayek is the victim of a crime.

Maybe she did choose to protect her online email account with weak security that anyone with access to Wikipedia could probably bypass, but breaking into her MobileMe account is still an offence.

The public should take this as a warning to be very careful about what "secret answers" they choose in case they need to ever reset their passwords. Too many people when they are asked "What was your mother's maiden name?" or "Tell us the name of your favourite pet" choose to answer honestly with information that is a matter of public record, or can be found out by visiting their Facebook profile.

My advice is if you're asked to tell website what your mother's name is, answer something memorable that no-one else will be able to guess, like "Xena Warrior Princess" or "Artichoke Sandwich".

By the way, Salma Hayek isn't the first figure in the public eye to have her email hacked. Watch this video: "Paris Hilton & Sarah Palin - what's the connection?".

Posted on April 25th, 2009 by Graham Cluley, Sophos

Sophos.com

New Zealand websites hijacked

Turkish hackers have managed to break into New Zealand domain registrar Domainz.net, redirecting unsuspecting surfers to defaced versions of popular websites by changing DNS records.

Websites such as www.hsbc.co.nz, www.sony.co.nz, coca-cola.co.nz, www.xerox.co.nz, www.msn.co.nz, www.microsoft.co.nz and hotmail.co.nz as well as security vendors www.f-secure.co.nz and www.bitdefender.co.nz had their traffic redirected to third party servers containing a defaced page after hackes took advantage of a SQL Injection attack.

In the case of the Microsoft site, the usual webpage was replaced with an image of Bill Gates being on the receiving end of a custard pie. (Funnily enough, this isn't the first time the image has been used by hackers.)

The hackers responsible for the attack are believed to members of the Turkish "Peace Crew" defacement gang.

You can't help but feel sorry for the innocent companies affected by this attack. It's not as though they did anything wrong in terms of security - the attack was against the domain registrar looking after their internet records. Rival domain registrars would be wise not to feel too smug at Domainz.net's misfortune, but asking themselves urgently if they might be vulnerable to similar attacks.

Posted on April 23rd, 2009 by Graham Cluley, Sophos

Sophos.com

RBS, Rapport and OITC anti-virus test results

An email from a customer today brought my attention to some anti-virus test results that have been published on the website of RBS (Royal Bank of Scotland).

At first glance, the test results look quite bad for Sophos (and even worse for Symantec and McAfee).

But if you dig a little deeper into the methodology used by OITC to come up with the results - published by RBS on their page promoting a security add-on called Rapport - then you actually find that the methodology is flawed, and that these test scores are about as useful as a chocolate teapot.

As Stuart Taylor describes in a post on the SophosLabs blog, OITC's methodology actually penalises the likes of Sophos for their ability to proactively detect brand new malware using (in our case) behavioral genotype protection. That's because they exclude from their tests any piece of malware which they find 25% or more of security products already detect.

That's bonkers. (They did this I presume in the mistaken hope of determining if a piece of malware was new or not, but in the process penalised products which proactively detected it).

Furthermore, these results don't give any allowance for layers of protection such as run-time suspicious activity or buffer overflow detection, both of which would be defending customers in the real world.

My advice? Check out the independent comparative tests from the likes of AV-Test, AV-Comparatives and Virus Bulletin. They may not always put Sophos top of the class for virus detection, but I sure trust their testing methodology more than OITC.

I hope in the future RBS might link to some of those tests for a more helpful indicator of the performance of anti-virus products in the future.

Posted on April 22nd, 2009 by Graham Cluley, Sophos

Sophos.com

Twitter users swamped by TheSmartECard messages

It seems that Twitter is becoming a major new playground for spammers and malware authors keen to target social networking users. Today we are seeing a new series of messages being posted to the streams of hundreds of unsuspecting Twitterers:

You'll like this one! Check out www.TheSmartEcard.com

and

Retweet: You'll love this one! Check out www.TheSmartEcard.com

Note that the "retweet" isn't really a retweet as it says "love" whereas all the original messages seen so far say "like".

Twitter's security department have described the problem as a "scam/phishing site" rather than a virus problem.

Hopefully it should be obvious from the website's opening page of legalese banning staff from Twitter, MySpace, Facebook, Microsoft and Google, that something odd is afoot - even before it starts to quiz you for personal information. But if not, let me just say that visiting the website is not recommended.

Anyone who has passed on their credentials to a third party website like TheSmartECard would be wise to change their passwords at the earliest opportunity.

Posted on April 20th, 2009 by Graham Cluley, Sophos

Sophos.com

New Mikeyy worm makes jokes at Twitter's expense

Another day, another Twitter worm. After yesterday's attack referencing the likes of Ashton Kutcher and Oprah Winfrey we are now seeing many Twitter users spreading messages on behalf of a new version of the Mikeyy worm, this time their common denominator is that they're all jokes including the (somewhat bizarre) word "womp".

Here are some of the messages that are being sent from compromised accounts on Twitter right now:

Ninety-nine percent of all lawyers give the rest a bad name. Womp. mikeyy.
If your father is a poor man, it is your fate, but if your father-in-law is a poor man, it's your stupidity. Womp. mikeyy.
If you are born ugly blame your parents, if you died ugly blame your doctor. Womp. mikeyy.
Money is not the only thing, it's everything. Womp. mikeyy.
Every man should marry. After all, happiness is not the only thing in life. Womp. mikeyy.
Success is a relative term. It brings so many relatives. Womp. mikeyy.
Be nice to your kids. They'll choose your nursing home. Womp. mikeyy.
'Your future depends on your dreams', So go to sleep. Womp. mikeyy.

Once again, Twitter is left looking amateurish in its response as it clearly hasn't properly hardened its systems from these kind of cross-site scripting attacks. Until they get their act together, users need to remember to turn off scripting (the combination of Firefox and NoScript is a good one) if viewing users' profiles.

One thing's for sure, this just isn't funny.

Posted on April 18th, 2009 by Graham Cluley, Sophos

Sophos.com

Firm hires Twitter worm author Mikeyy Mooney

Mikeyy Mooney, the 17-year old hacker who caused mayhem on Twitter with a series of worms on the micro-blogging website last weekend, has been rewarded with a job in web applications development according to media reports.

Frankly, the news that exqSoft Solutions has approached and hired Mikeyy Mooney, the teenager behind the StalkDaily and Mikeyy worm attacks, has really got my goat.

What did Mikeyy actually achieve with his worms? Okay, so he proved that there was a problem with Twitter. But the other thing he showed was that was irresponsible.

If you find a flaw in a piece of software or website, you don't write a worm to exploit it impacting thousands of innocent users. Instead, you should act responsibly and inform the affected company instead, and work with them to get the problem fixed.

Mikeyy Mooney may be skilled in some areas of computing, but there are many other talented people out there who have never shown such a disregard for established and accepted ways of reporting security flaws, and haven't shown such questionable judgement.

Mikeyy could have gained so much kudos, and proven that he was a responsible security researcher if he had acted more maturely.

Travis Rowland, the CEO and founder of exqSoft Solutions (by the way, I really have a problem with firms who insist on spelling their name with a lower case letter.. what's up with that?) had previously posted a public message to Twitter founder Biz Stone, asking that legal action should not be taken against the young hacker:

Judging by other messages posted by Rowland, his hiring of Mikeyy Mooney is being used at the moment as a publicity stunt, and has got it some cheap exposure in the press:

But lets think about this. ExqSoft Solutions are in effect encouraging other youngsters to behave like irresponsible idiots. The last thing we want is a wave of other kids exploiting software and websites, in the hope that they might be rewarded with a job offer.

Thanks for nothing ExqSoft Solutions.

Do you think the firm was right to hire Twitter worm author Mikeyy Mooney?

Yes
No

View Results

Of course, Mikeyy Mooney isn't the first malware author to be offered a job after publicising their "skills" with an attack.

For instance, the author of the Anna Kournikova worm was told by his town's mayor that he would be welcome to work on their systems, the notorious teenager behind the Sasser and Network worms was hired by a security firm, and the creator of a Chinese worm which displayed pictures of pandas burning incense was offered a job by one of his victims.

* Image source: wonderferret's Flickr photostream (Creative Commons)

Posted on April 17th, 2009 by Graham Cluley, Sophos

Sophos.com