<![CDATA[[SecurityRatty] tag: sunbelt]]> http://securityratty.com/tag/sunbelt Thu, 12 Jun 2008 03:12:58 +0000 iRatty Engine http://blogs.law.harvard.edu/tech/rss <![CDATA[AOL Hosted Sites Distribute Malware]]> http://securityratty.com/article/4a3128ea8d000bf53012678213df0d24 http://securityratty.com/article/4a3128ea8d000bf53012678213df0d24 Mon, 13 Oct 2008 23:21:17 +0000 aol rogue antivirus programs antivirus malware alex eckelberry rogue software pages recently visitors AOL Hosted Sites Distribute Malware <![CDATA[Current List Of Zlob Distributiuon Sites And Rogue Anti-virus Products Domains]]> http://securityratty.com/article/920dcaaf490ddab376b087b9f06c94ac http://securityratty.com/article/920dcaaf490ddab376b087b9f06c94ac Wed, 24 Sep 2008 12:35:26 +0000 domains list fake malware anti-virus infect visitors zlob trojan kerio firewall protection software filters clones Current List Of Zlob Distributiuon Sites And Rogue Anti-virus Products Domains <![CDATA[EstDomains & Intercage: A Perfect Couple in Crime]]> http://securityratty.com/article/8490240982532919695d5c4c9231e15f http://securityratty.com/article/8490240982532919695d5c4c9231e15f take on the topic, or search Emergingthreats to come up to speed.
Yesterday, EstDomains posted the most inept, ridiculous response ever issued to the endless and worthy criticism, largely leveled by Brian Krebs at the Washington Post.
Not only can't these morons from EstDomains write, they're either so deeply clueless or flagrantly malicious (likely both), it's beyond laughable. This section sums it up best:
"The company also has a reliable ally in its battle against malware in a face of Intercage, Inc which provides company with the hosting services of the highest quality. But the outstanding performance of hosting services is not the sole reason why EstDomains, Inc appreciates this partnership so greatly. Intercage, Inc generously provides EstDomains, Inc specialists with reports regarding discovered malware vehicles. As the main database for additional domain name management services is located in Intercage Data Center, EstDomains, Inc has the perfect opportunity to get notifications of the slightest mark of malware presence in the shortest time and take measures in advance."
What? Really?
Again, aside from the absolute butchery of the language, did they just say "The company also has a reliable ally in its battle against malware in a face of Intercage, Inc which provides company with the hosting services of the highest quality."? SIGH...yes, they did.

Allow me to exemplify just how ridiculous a claim that is.
Following is content from a packet capture I took during a recent Storm worm analysis.

Using the ip2asn module included in NSM-console availabe in HeX, we find:
27595 | 216.255.189.211 | INTERCAGE - InterCage, Inc.

Using Etherape, also included in HeX, we see:



Using Eric Hjelmvik's NetworkMiner, we see:



See the recurring theme? Intercage, EstDomain's "reliable ally in its battle against malware".
Nice work, guys...keep it up.

I'm submitting this to The Daily WTF as we speak.

del.icio.us | digg]]> Mon, 15 Sep 2008 17:32:00 +0000 intercage estdomains malware malware presence intercage data center track malware issues reliable ally management services malware vehicles EstDomains & Intercage: A Perfect Couple in Crime <![CDATA[Should You Install Messaging Security Software on Your Exchange Server?]]> http://securityratty.com/article/11b169283ed84827dab06cd87ebe699c http://securityratty.com/article/11b169283ed84827dab06cd87ebe699c (Source: Sunbelt Software) Osterman Research shares insights gleaned from a just completed survey that dispel the fears of employing server-based email security solutions. Read this white paper to help you understand the latest Exchange security risks and also learn about reasons why an installed security solution may be the best option for you in countering those challenges.
Add to digg Add to StumbleUpon Add to Twitter Add to Slashdot
]]> Fri, 05 Sep 2008 09:00:00 +0000 email security solutions exchange security risks white paper sunbelt software security solution source challenges reasons dispel Should You Install Messaging Security Software on Your Exchange Server? <![CDATA[Spammers Take A Cheap Shot...]]> http://securityratty.com/article/2bd234de99d23ff4b013abce95e7d324 http://securityratty.com/article/2bd234de99d23ff4b013abce95e7d324
I was surprised to see this posted to the comments section of the Sunbelt Blog:

spgspam1.gif

I was about as surprised as The Dean was!

To quote a further post from The Dean:

"Well, that's weird. Isn't spywareguide Paperghost's blog? I know he wouldn't spam here. And, the link on the first comment goes to a 404 page."

So, we have someone spamming with broken English, dropping links to 404 pages on Spywareguide. Curious.

Now, I did have some suspicions on this - for starters, the recent blogs regarding the pirate movie websites that pop Zango installers just hit a few news websites. As this article mentions, a lot of the sites involved in this are from Asian regions - China, Indonesia etc. I couldn't help but notice the name of the poster was "Tam" - a common name in certain parts of Asia.

Coincidence? Or a possible affiliate not too happy about this being highlighted? Well, a quick email later and the results for the spammer are in:

spgspam2.gif

A potentially forged Reverse DNS aside, it's a strange thing indeed that they just happen to resolve to Vietnam given that a good portion of these sites are in Asia, isn't it?

I think I'll see if any are owned by someone called "Tam".

When I return from my holiday, of course....

]]> Tue, 19 Aug 2008 10:24:05 +0000 holiday pop zango installers sunbelt blog blogs spywareguide paperghost recent blogs blog spywareguide news websites Spammers Take A Cheap Shot... <![CDATA[Beware of Rogue Anti-Malware]]> http://securityratty.com/article/56bc0c383527b10009c2841b8cf095c1 http://securityratty.com/article/56bc0c383527b10009c2841b8cf095c1 XP Antivirus—also known by a plethora of name variants, including Antivirus XP and year variants like Antivirus XP 2008. Click here for a description from Sunbelt Software. Last week, advertisements for this product started appearing on CNET (specifically their Download.com service) through syndicated Google ads. Not to pick on CNET specifically; Google ads are likely to be appearing elsewhere, but we were referred to them on that site. The hallmark of such malware is to start with a free version. This version conducts a fake malware scan that finds lots of malware on the system, and the user is told to pay for the "premium" version in order to remove the malware that doesn't really exist in the first place. Often rogue anti-malware software such as this is not strictly malicious in the sense of spreading itself to other systems or hiding any functions; it is simply a scam. Of course, by buying the product you may also expose personal and credit card details to untrustworthy people. Later last week, GlobalSign, the certificate authority that had issued a code signing certificate for use with Antivirus XP 2008, revoked that certificate after complaints that the software was malicious. They verified that the company existed but couldn't contact them. The investigation is ongoing. The bottom line and moral of the story is that rogue anti-malware vendors are merciless and shameless when it comes to masquerading as legit software. Ads on legit sites don't prove anything, and code-signing certificates don't prove anything. You still need to use common sense and exercise precautions, like running well-known and respected anti-malware, like Sunbelt Software's. They have a lot of special in-house expertise on rogue products like this.]]> Mon, 18 Aug 2008 06:16:04 +0000 anti-malware rogue anti-malware vendors legit software software sunbelt software malware rogue anti-malware software fake malware scan google ads Beware of Rogue Anti-Malware <![CDATA[Should You Install Messaging Security Software on Your Exchange Server?]]> http://securityratty.com/article/d6f642838ae869200ed8a6b770b5bcf1 http://securityratty.com/article/d6f642838ae869200ed8a6b770b5bcf1 (Source: Sunbelt Software) Security is the most single critical task for any email administrator. Starting with a foundation of anti-spam and anti-virus capabilities, organizations should focus on other capabilities, as well, including policy management and a variety of other tasks designed to protect the network and the company from external and internal threats.

There are a number of ways to deploy messaging security, including appliances, software installed on dedicated servers, hosted or managed services and installation of softwaredirectly on the email server itself. While there are proponents and opponents of these approaches, there seems to be relatively strong opposition to the last approach on the part of many email administrators.

Osterman Research shares insights gleaned from a just completed survey that dispel the fears of employing server-based email security solutions. Read this white paper to help you understand the latest Exchange security risks and also learn about reasons why an installed security solution may be the best option for you in countering those challenges.

]]> Mon, 04 Aug 2008 09:00:00 +0000 security security solution email security solutions software exchange security risks capabilities sunbelt software single critical task anti-virus capabilities Should You Install Messaging Security Software on Your Exchange Server? <![CDATA[Customer Satisfaction with Email Archiving Systems]]> http://securityratty.com/article/7e36018f72c647388fbbb0c2576b6241 http://securityratty.com/article/7e36018f72c647388fbbb0c2576b6241 (Source: Sunbelt Software) Osterman Research conducted a primary survey asking organizations about a variety of archiving systems. The purpose of this research was simply to understand the level of satisfaction that customers of Sunbelt Exchange Archiver (SEA) and other email archiving offerings report on a variety of metrics related to product and vendor performance. Among the offerings to which the SEA offering are compared in this white paper are Symantec Enterprise Vault, Autonomy ZANTAZ EAS, Barracuda Message Archiver, EMC EmailXtender and a wide variety of other leading - and very capable - email archiving solutions.

The goal of this white paper is to provide a point of comparison between SEA and other offerings in order to help decision makers in their archiving system evaluation process.

]]> Fri, 18 Jul 2008 09:00:00 +0000 email wide variety white paper offerings variety offerings report autonomy zantaz eas osterman research symantec enterprise vault Customer Satisfaction with Email Archiving Systems <![CDATA[Good move for Sunbelt software]]> http://securityratty.com/article/093c52abe01d0c7d6dd9c0de4c009a56 http://securityratty.com/article/093c52abe01d0c7d6dd9c0de4c009a56 This could work out well for both parties.
Sunbelt products are widely used and customer satisfaction is at a high right now.
Good luck to them both.
clipped from www.webwire.com
Clearswift Partners with Sunbelt Software to Offer Top Class Anti-spyware Solution
This continual monitoring ensures spyware and the websites intentionally or inadvertently delivering malware are identified with a high degree of accuracy.

“The partnership with Clearswift seemed a natural step for both companies since the combination of the MIMEsweeper Web Appliance and our CounterSpy engine brings clear benefits to the end user,” commented Chad Loeven, vice president of business development, at Sunbelt Software. “With our technologies working hand in hand, I can comfortably say that you will not find a more comprehensive web security solution on the market today.”
  blog it
]]> Wed, 25 Jun 2008 10:07:37 +0000 sunbelt software clearswift partners mimesweeper web appliance clearswift counterspy engine brings vice president ensures spyware sunbelt products customer satisfaction Good move for Sunbelt software <![CDATA[Fake YouTube Site Serving Flash Exploits]]> http://securityratty.com/article/05a0a3aecae41b8680c264c36b2e1800 http://securityratty.com/article/05a0a3aecae41b8680c264c36b2e1800 Originally mentioned by the folks at Sunbelt, this fake YouTube site happens to be a bit more interesting than it seems at the first place :

"Clicking on that link then redirects to a different site, youtube-s, which serves exploits to attempt to infect your system. Then, if your browser hasn’t completely crashed at that point, you may ultimately get redirected to the real YouTube, displaying some idiotic video (hence, possibly even helping to continue the infection, by having users forward the spam above)"

Interesting mostly because it not just attempts to serve a online games password stealer through exploiting the ubiquitous MDAC exploit, but is also serving a flash exploit which when analyzed leads us to a web based C&C of new malware kit. And although I've been aware of its existence for a while now, it's the first time I see it in action.

Upon analyzing youtube-r.com (211.95.79.57) a couple of days ago, it's now returning a 403 forbidden message, however, copies of the malware have already been obtained and analyzed. In between attempting to infect with MDAC at youtube-s.com/load.php?id=912; the flash exploit loads from a9rhiwa.cn/update_files/1.swf, and while this is happening the end user is redirected to the real YouTube site. Some sample detection rates :

Scanners result : 7/32 (21.88%)
TR/Crypt.ULPM.Gen; Mal/EncPk-CO
File size: 8704 bytes
MD5...: cb8611db343067e1fb663ab6ee671114
SHA1..: 4497715e0a365863d6ca41ab12254bf591118ed7

Scanners result : 10/32 (31.25%)
SWF:CVE-2007-0071; Exploit:Win32/APSB08-11.gen!A
File size: 593 bytes
MD5...: 5b6b28d4de3df92f48fbe5e8bd565cda
SHA1..: 3123d357d2080d1ee09ee67203275d51332e3397

The password stealer than connects to the C&C, from where an unknown for the time being number of campaigns are coordinated. What's a useless virtual good such as passwords for MMORPGs for malware gangs aiming to steal Ebanking details through banking malware for instance, is a precious and valuable good for others operating on the other side of the world, where a virtual item is more expensive than access to a Ebanking account.
]]> Thu, 12 Jun 2008 03:12:58 +0000 site fake youtube site flash exploit loads flash exploit mdac ubiquitous mdac exploit exploit malware real youtube site Fake YouTube Site Serving Flash Exploits