PC World Philippines

Posts Tagged ‘ Koobface ’

Top 10 Tech Scares of the Decade

By Fei on January 12, 2011

By Sarah Jacobsson Purewal
January 12, 2011

SAN FRANCISCO – The dawn of the new millennium prompted fears about the future, but so far reality has not quite matched the predictions of catastrophe. The first ten years passed uneventfully–well, aside from Y2K and a bunch of intelligent computer viruses. Here’s a look back at the past decade, and ten of the most terrifying tech scares.

1. Y2K

Year: 2000

Predicted outcome: End of the world and technology as we know it

Actual outcome: Accidental alarms, slot machine failures, incorrect dates on Websites

If you were around for the turn of the millennium, you undoubtedly heard something about Y2K and its potential outcomes. Then you probably felt like it didn’t live up to the hype when the clock struck midnight on January 1, 2000, and nuclear missiles didn’t start automatically launching themselves.
The “millennium bug” actually could have happened at the turn of any regular ol’ century–not just the millennium. The concern was valid: Many computing systems used two digits to store the year, and so the rollover from 99 to 00 could cause various logic errors (such as recognizing the New Year as 19100) that would cause the system to fail.
Luckily, technicians were aware of the issue (it was first mentioned in print as early as 1984), and made the appropriate corrections. While the fear-mongering media no doubt overhyped Y2K, it was a real problem that would have caused some large-scale issues had your trusty IT guys not been on the ball.
2. Conficker Worm

Years: 2008-2009

Predicted outcome: Not applicable

Actual outcome: An estimated 10 million home/business/government computers under its control

The Conficker worm (also known as Downup, Downadup, and Kido), first detected in 2008, was a virus that targeted Windows operating systems. The worm used advanced malware techniques to take over machines and turn them into zombie/host computers that the worm’s authors could control remotely. The Conficker infection was believed to be one of the largest computer infections since 2003, and analysts have suggested that as many as 10 million machines were affected.

Conficker spread in three ways: It attacked vulnerability in the Microsoft Server service, it guessed administrator passwords, and it infected removable devices with an autorun file that executed as soon as someone plugged the device (such as a USB flash drive) into another machine. The virus was particularly notable for its ability to spread rapidly throughout business networks; home computers were less likely to be infected.
The last known variant of Conficker was effectively quashed in mid-April 2009, but the authors of the worm remain unknown. The threat was so serious that Microsoft and ICANN offered a $250,000 reward for information leading to the arrest and conviction of Conficker’s authors.They are still at large.

3.Mydoom

Years: 2004-2009

Predicted outcome: Not applicable

Actual outcome: The fastest-spreading e-mail worm ever

In January 2004 a new e-mail worm began spreading around the Net, appearing as a transmission-error message with an attachment. If the victim ran the attachment, the worm would not only send itself out to everyone on any address book it could find but also would attach itself to any copies of Kazaa to spread via peer-to-peer networks.
The worm eventually gained the name Mydoom, courtesy of a McAfee employee who was one of the first to discover the virus.

Mydoom has resurfaced intermittently since then, and a variation on the worm was a part of the 2009 cyberattacks on South Korea. The original author of the worm has never been found, but security firms have speculated that it was commissioned by e-mail spammers and that it originated in Russia.

4. Anonymous

Year: Reported in 2007

Predicted outcome: Hackers on steroids, “The Internet Hate Machine”

Actual outcome: Porn on YouTube, DDoS attacks on Scientology
In 2007, KTTV Fox 11 News in Los Angeles ran a sensational report about a group called Anonymous. According to the KTTV report, this “Internet hate machine” was to be feared for such devastating crimes as spoiling the end of the new Harry Potter book. The report was rife with creepy, faceless pictures and lurid phrases such as “hackers on steroids” and “domestic terrorists.”
Unfortunately, KTTV’s fantastic report was wrong: Anonymous is not a specific group at all, just a name for any random collection of users from various online communities and IRC networks working together (rather, in the same direction) at any given time. Wired has more accurately described Anonymous as a group of “supremely bored 15-year-olds.”
Crimes–Internet annoyances, really–that have been attributed to Anonymous include DDoS (distributed denial of service) attacks on various Websites (including that of the Church of Scientology, and, more recently, Websites that withdrew support from WikiLeaks) and assorted cases of Internet vigilantism.

5. RFID Tracking

Years: 2002-Present

Predicted outcome: The government will be able to track your every move

Actual outcome: New passports
Radio-frequency identification, or RFID, is a technology for tracking assorted objects. RFID most commonly appears in the form of tiny chips, or “tags,” which can be attached to an object for identification and monitoring; currently they’re embedded in a variety of things, including passports, security passes, and store inventory. Information stored on the chip is accessible to an RFID reader, which transmits frequency waves that “wake up” the chip.
RFID technology has been heavily criticized, and it’s not hard to see why: Even if manufacturers put chips in products without intending to invade people’s privacy, the technology can be exploited easily. In theory, RFID tags could be used to track everything from shopping and spending habits to someone’s exact location.

6. ILOVEYOU Virus

Year: 2000

Predicted outcome: Not applicable

Actual outcome: Over 50 million computers infected; over $5.5 billion in damages

The ILOVEYOU virus was a computer worm that spread via e-mail. Similar to other e-mail worms, the virus required that users run the executable file (written in Visual Basic Scripting, or VBS). To induce victims to do so, the worm disguised itself as a text file by putting .TXT into its name; when people saw that the file was called “LOVE-LETTER-FOR-YOU.TXT.vbs,” they thought they were opening a harmless text file.
Once the victim opened the file, the worm would send copies of the e-mail to the first 50 contacts in the user’s Windows Address Book, and then make changes to the system (it would overwrite a number of files, including all .JPG and .DOC files, with copies of itself).
The ILOVEYOU virus was particularly effective for two reasons: It was sent from “safe” senders (those already in the recipient’s address book), and the file resembled a text file. As a result, the virus managed to reach an estimated 50 million computers (only Windows computers were affected) and cause an estimated $5.5 billion in damages–the Pentagon, the CIA, and the British Parliament all had to shut down their e-mail systems.
Just a day after the virus started spreading, police in the Philippines arrested two computer programming students. Unfortunately, the authorities were unable to convict the two of any crime, as there was no law, at the time, against writing malicious code.
7. Technology Crashes Planes

Years: 2000-Present

Predicted outcome: Planes falling out of the sky

Actual outcome: Lies

That’s right, the TSA will take away your bottled water and your nail file, but they’ll let you keep your smartphone–despite the fact that the in-flight crew will warn all passengers to turn off their cell phones for the duration of the flight or face dire consequences.
There has never been any documented case of a cell phone causing interference with a plane’s navigation system. Obviously–do you really think that they’d let everybody waltz onto a 500-ton metal aircraft with a potential bomb in their pocket? That would certainly make terrorists’ jobs a lot easier.
8. Witty Worm

Year: 2004

Predicted outcome: Not applicable

Actual outcome: First worm to carry a destructive payload; infected 12,000 machines

The Witty worm, first detected in 2004, was an important, scary computer virus for a number of reasons–namely, it was the first worm to carry a malicious “payload” that slowly destroyed the host computers it infected.
Although Witty infected only about 12,000 machines–none of them home PCs–the worm was still a pretty big deal. It exploited a hole in Internet Security Systems firewall and security software packages, and it spread rapidly just days after the vulnerability was announced. The worm was called the “Witty” worm because the payload featured the phrase “(^.^) insert witty message here (^.^).”
The worm was particularly frightening for network administrators because it infected computers that should have been more secure (because of the ISS software).

9. Koobface

Years: 2008-Present (new variants)

Predicted outcome: Not applicable

Actual outcome: Still not dead

Koobface, introduced in 2008, is a computer worm that targets social networking Websites. It can infect all three of the major operating systems–Windows, Mac OS X, and Linux (to a limited extent)–and can gain username/password information, but not financial information, from infected computers.
“Koobface” infects users via Facebook messages. Unlike some worms, Koobface requires some effort on the part of the user in order for it to infect a computer. First, it delivers a Facebook message with a link from the account of an infected user. The potential victim must then click on the link, download a file (usually disguised as an update to Adobe Flash Player), and then run the file. If they do so, Koobface can infect the computer and use it to send more messages.
Koobface has infected an estimated 500,000 computers, and it spreads easily because it sends messages to “friends” of infected Facebook users, usually with tantalizing, legitimate-sounding subject lines such as “Spring Break Bikini Mud-Jello Wrestling Youtube Video LOL!!!”
10. 2012

Year: 2012

Predicted outcome: End of the world; end of bad movies starring John Cusack
Actual outcome: ???

The year 2012 is (at least, according to some people) the last year in a 5125-year cycle on the Mesoamerican (Mayan) Long Count calendar. More specifically, December 21, 2012, is the last day of the cycle.

The date is not only the final date in a 5125-year cycle, it’s also full of ones and twos–and we know how superstitious the world is when it comes to numbers. So naturally, people speculate that everything from the Apocalypse to a spiritual awakening to absolutely nada will happen in 2012, despite the fact that the Mayans themselves are pretty unconcerned.
If the world does end, that probably means the end of technology as we know it. If it doesn’t, though, we have Windows 8, laser heads-up displays in cars, and maybe a Verizon iPhone to look forward to.

Facebook Invasion: Beware of New ‘Smart’ Worm

By Fei on November 11, 2009

By JR Raphael
November 12, 2009

SAN FRANCISCO – Hot on the heels of a reported hijacking of hundreds of Facebook groups, a new variation on an old worm is crawling its way into the social network’s walls. Attackers have released an updated, more intelligent version of the notorious Koobface virus, security analysts say–and anyone could become its next victim.

The Facebook Hijack

First, the hijacking: An organization called “Control Your Info” apparently took control of as many as 300 Facebook groups over the past several days. Members added their own logo onto the pages, announcing they’d “hijacked” the groups and providing a link back to their own site.

(Facebook maintains no confidential information was ever exposed–the affected groups, representatives say, were abandoned and open for any member to take over.)

The “Control Your Info” Web site states that the organization’s mission was to expose security holes in social media–a fitting segue to today’s new threat.

Facebook’s New Concern

The new threat has a familiar name. Koobface–which, by the way, is an anagram of the word Facebook–first popped up in mid-2008 and has been pestering users ever since.
The worm typically works by taking over your PC, then sending messages or wall postings to your friends. The messages include links to what appear to be funny videos or risqué photos of people you and your friends know. Anyone who follows the links, however, will ultimately end up infected with the malware themselves–usually by way of a bogus software update that pops up on-screen.

The updated Koobface variation, according to the virus-fighting team at Trend Micro, takes things a step further by automating the entire process. Instead of depending solely upon real accounts to spread the malicious links, the attackers have found a way to have bots do their bidding.
Here’s how Trend Micro says it’s happening: Botnets are registering new Facebook accounts and confirming them via accompanying Gmail addresses, all without any human interaction. The zombie accounts are then joining Facebook groups, adding friends, and posting dangerous links onto those people’s walls.

“This new component behaves like a regular Internet user that starts to connect with friends in Facebook,” explains Jonell Baltazar, an advanced threats researcher with Trend Micro. “The details provided about the account are complete such as a photo, birth date, favorite music, and favorite books.”

The system is even advanced enough to monitor maximum friend levels allowed by Facebook, Baltazar says, to avoid drawing any attention to the ill-intended account.

Facebook Protection

So, what can you do to keep yourself safe from this Koob-faced villain? The steps are nothing you haven’t heard before: Keep your antivirus software up to date, and use some common sense.

Antivirus software will alert you if you click onto a site that’s known to host malware — and that’s exactly where these Koobface links want to take you. The easiest way to stay safe, then, is just to be cautious in choosing what you click.

If you see a link that looks questionable, even if it’s from someone whose name you know, don’t follow it. And if you find yourself on a Web page that’s asking you to download a software update, don’t do it. Instead, close the window and go directly to the software vendor’s own Web page to see if the update is the real deal.

Otherwise, you might end up with Koob smeared all over your face–and, suffice it to say, that’s one fate you’d be better off avoiding.

Kaspersky Lab detects over 575 new variants of Koobface

By Jon on July 10, 2009

Kaspersky Lab recently saw an explosion of Koobface modifications throughout the month of June, due to summer and vacations across the northern hemisphere. In just one month, the number of variants detected jumped from 324 at the end of May 2009 to almost 1000 by the end of June 2009.

Koobface, the infamous worm, was first detected by Kaspersky Lab as Net-Worm.Win32.Koobface, and it instantly became popular when it appeared almost one year ago targeting Facebook and MySpace accounts. The Koobface worm is spreading through a legitimate user’s account to their friends’ profiles. Comments and messages sent by the worm contain a link to a fake YouTube-style Web site which invites users to download a “new version of Flash Player”. The worm, rather than a media player, is then downloaded to victim machines. Once a user is infected, he or she will start spreading such messages to his or her friends. In the meantime, the functionality of the worm has been extended. Koobface is now targeting more social networking Web sites like Facebook, MySpace, Hi5, Bebo, Tagged, Netlog and, most recently, Twitter.

As social networks such as Facebook or Twitter are becoming increasingly popular, attacks targeting them are also gaining momentum.

“This sign of increased cybercriminal activity involving social networks in the past month proves that the strategies being used by the bad guys to infect users are much more efficient when adding the social context to their attacks,” says Stefan Tanase, Malware researcher of Kaspersky Lab. “June 2009 marks an important milestone in the evolution of social networking malware — the activity we’ve seen this month exceeds by far any other month in the past.

Kaspersky Lab would like to give a few tips for Users:
Be cautious when opening links coming through suspicious messages, even if the sender is one of your trusted Facebook friends.
Use either Internet Explorer 7 running in protected mode or Firefox with NoScript installed.
Divulge as little personal information as possible. Do not give out your home address, phone number or other private details.
Keep your antivirus software updated to prevent new versions of malware from attacking your computer.

Kaspersky Lab users running any of the Company’s current anti-malware products are fully protected from all known variants of Net-Worm.Win32.Koobface. Kaspersky Lab’s global team of analysts are keeping a close eye on all threats coming from the social networking space, monitoring the malicious activity and constantly updating the protection customers receive.

Kaspersky Lab detects 25 millionth malicious program

By Jon on June 11, 2009

Secure content management solutions developer. Kaspersky Lab, has announced that it has detected its 25 millionth malicious program.

Every year, the number of IT threats increases exponentially. Kaspersky Lab recently forecast a ten-fold increase in malicious programs, from 2.2 million in 2007 to 20 million in 2008. However, the rate of growth demonstrated by the cybercrime industry has surpassed even the most exaggerated predictions.

A new modification of Koobface was detected by the specialists at Kaspersky Lab on 9 June and became the 25 millionth malicious program added to the company’s antivirus databases. Net-Worm.Win32.Koobface targets users of the popular social networking sites Facebook and MySpace. This latest version of Koobface confirms earlier predictions by Kaspersky Lab that social networking sites would be the target of more and more IT threats.

The worm uses a simple propagation method: users of social networking sites receive what appears to be a message from a friend containing a link to a video clip on an unknown site. When users attempt to play the video, they are prompted to update Flash Player. Instead of an update, however, a Koobface worm is installed that contains backdoor functionality allowing instructions from a remote management server to be run on the computer.

The proliferation of the Koobface family confirms what Kaspersky Lab has been saying for some time – malicious programs are becoming more and more numerous and they are using increasingly sophisticated technology. The company’s experts correctly predicted back in early 2008 that web fraudsters would be concentrating more of their efforts on social networking sites. It is also evident that the technical concepts behind these new threats are increasingly complex. In order to effectively combat modern malware such as Koobface, an integrated antivirus solution is needed that provides effective multilayered protection.

All consumers using Kaspersky Lab’s personal or corporate products are fully protected against all known versions of Net-Worm.Win32.Koobface.