Keith's Journal

Microsoft puts bounty on creators of Conficker worm


US software giant Microsoft has placed a bounty of $US250,000 ($360,000) on the heads of those responsible for a tenacious computer worm that is set to evolve on machines worldwide on April 1.

A task force assembled by Microsoft has been working to stamp out the worm, referred to as Conficker or DownAdUP, which is becoming harder to exterminate but not expected to wreak havoc.

It is programmed to modify itself on Wednesday to become harder to stop, according to Trend Micro threat researcher Paul Ferguson, who is part of the Conficker task force.

The worm, a self-replicating program, takes advantage of networks or computers that have not kept up to date with security patches for Windows RPC Server Service.

It can infect machines from the internet or by hiding on USB memory sticks carrying data from one computer to another. Once in a computer it digs deep, setting up defences that make it hard to extract.

Malware could be triggered to steal data or turn control of infected computers over to hackers amassing "zombie" machines into "botnet" armies.

A troubling aspect of Conficker is that it harnesses computing power of a botnet to crack passwords.

Microsoft has modified its free Malicious Software Removal Tool to detect and get rid of Conficker.

Computer users are advised to stay current on anti-virus tools and Windows updates, and to protect computers and files with strong passwords.

Conficker is programmed to reach out to 250 websites a day to download commands from its masters.

On Wednesday, the worm will begin connecting with 50,000 websites a day to better hide where orders originate.

"They basically upped the ante; trying to make our lives more difficult," Mr Ferguson said. "They realised the good guys were starting to intercept their communications."

Infection rate


The infection rate has slowed from a fierce pace earlier this year, but computers that are not updated with a software patch released by Microsoft remain vulnerable, according to security specialists.

Conficker was first detected in November 2008.

Among the ways one can tell if their machine is infected is that the worm will block efforts to connect with websites of security firms such as Trend Micro or Symantec, where there are online tools for removing the virus.

"Once a machine is infected, it becomes very hard to clean up," Mr Ferguson said.

"There is no indication anywhere of [Conficker] doing anything but just sitting there. We don't know whether another shoe is going to drop, or if there is another shoe at all."

Hackers have taken advantage of Conficker hype by using promises of information or cures to lure internet users to websites booby trapped with malicious software.

- AFP

Banned hyperlinks could cost you $11,000 a day

Asher Moses
March 17, 2009 - 11:48AM

The Australian communications regulator says it will fine people who hyperlink to sites on its blacklist, which has been further expanded to include several pages on the anonymous whistleblower site Wikileaks.

Wikileaks was added to the blacklist for publishing a leaked document containing Denmark's list of banned websites.

The move by the Australian Communications and Media Authority comes after it threatened the host of online broadband discussion forum Whirlpool last week with a $11,000-a-day fine over a link published in its forum to another page blacklisted by ACMA - an anti-abortion website.

ACMA's blacklist does not have a significant impact on web browsing by Australians today but sites contained on it will be blocked for everyone if the Federal Government implements its mandatory internet filtering censorship scheme.

But even without the mandatory censorship scheme, as is evident in the Whirlpool case, ACMA can force sites hosted in Australia to remove "prohibited" pages and even links to prohibited pages.

Online civil liberties campaigners have seized on the move by ACMA as evidence of how casually the regulator adds to its list of blacklisted sites. It also confirmed fears that the scope of the Government's censorship plan could easily be expanded to encompass sites that are not illegal.

"The first rule of censorship is that you cannot talk about censorship," Wikileaks said on its website in response to the ACMA ban.

The site has also published Thailand's internet censorship list and noted that, in both the Thai and Danish cases, the scope of the blacklist had been rapidly expanded from child porn to other material including political discussions.

Already, a significant portion of the 1370-site Australian blacklist - 506 sites - would be classified R18+ and X18+, which are legal to view but would be blocked for everyone under the proposal. The Government has said it was considering expanding the blacklist to 10,000 sites and beyond.

Electronic Frontiers Australia said the leak of the Danish blacklist and ACMA's subsequent attempts to block people from viewing it showed how easy it would be for ACMA's own blacklist - which is secret - to be leaked onto the web once it is handed to ISPs for filtering.

"We note that, not only do these incidents show that the ACMA censors are more than willing to interpret their broad guidelines to include a discussion forum and document repository, it is demonstrably inevitable that the Government's own list is bound to be exposed itself at some point in the future," EFA said.

"The Government would serve the country well by sparing themselves, and us, this embarrassment."

Last week, Reporters Without Borders, in its regular report on enemies of internet freedom, placed Australia on its "watch list" of countries imposing anti-democratic internet restrictions that could open the way for abuses of power and control of information.

The main issue raised was the Government's proposed internet censorship regime.

"This report demolished the Communications Minister's contention that Australia is just following other comparable democracies," Greens communications spokesman Senator Scott Ludlam said.

"We are not. The Government is embarking on a deeply unpopular and troubling experiment to fine-tune its ability to censor the internet.

"I agree with Reporters Without Borders. If you consider this kind of net censorship in the context of Australia's anti-terror laws, it paints a disturbing picture indeed."

EFA said the Government's "spin is starting to wear thin" and it could no longer be denied that the ACMA blacklist targets a huge range of material that is legal and even uncontroversial.

The Communications Minister, Stephen Conroy, has repeatedly claimed his proposed mandatory filters would target only "illegal" content - predominantly child pornography.

"As time goes on, pressure will only mount on the Government to expand the list, while money and effort are poured into an enormous black box that will neither help kids nor stem the flow of illegal material," EFA said.

"If the minister truly believes that children are seeking out, or being bombarded with, child pornography, then there's a dearth of both common sense and proper research in the ministerial suites."

Already, the head of the Australian Christian Lobby, Jim Wallace, has said he hopes the sex industry will go broke as a result of the censorship scheme.

Independent Senator Nick Xenophon previous expressed his desire to have online gambling sites added to the blacklist but has since withdrawn his support for the scheme, saying it was dangerous and could be "counter-productive".

The Greens and Opposition also oppose the scheme, meaning any legislation to implement it will be blocked.

The Opposition has obtained legal advice that "legislation of some sort will almost certainly be required", but others have said it may be possible to implement the scheme without legislation.

Speaking at a telecommunications conference last week, Senator Conroy urged Australians to have faith in MPs to pass the right legislation.

Despite previously saying his scheme would be expanded to block "refused classification" content that includes sites depicting drug use, sex, crime, cruelty and violence, he said opponents of his plan were spreading "conspiracy theories".

The Government's internet censorship trials are due to begin shortly but critics have said they may not provide much useful data on the real-world implications because none of the major ISPs were chosen to take part.

As most any user can tell you, Linux systems think of time in terms of the number of seconds, not counting leap seconds, since the beginning of the UNIX epoch: Jan. 1, 1970. For most readers, that number will reach 1,234,567,890 this Fri. the 13th. Psyche!

Apparently, the folks at Bell Labs who decided to count time this way in the first place anticipated this interesting milestone way back in the day. At least, that's the impression I got reading a Linux Magazine article about the "long-anticipated milestone" by Bell Labs vet (where Unix was created) Jon "maddog" Hall. Maddog suggests the following perl command, apparently written by Matias Palomec, for determining your precise local time (in more human-readable form) for the magic moment. Er, second:

perl -e 'print scalar localtime(1234567890),"\n";'

Here near the Sierra-side edge of the U.S. Intermountain West, it'll happen at "Fri Feb 13 15:31:30 2009," my system tells me. Some Australians report that it'll happen there on Valentine's Day.

Google 'gadgets' called gateways for hackers

Hackers turned computer security specialists accuse Google of setting users up for online disasters by letting them personalise home pages with applications that could be tainted.

Software that hackers can trick people into installing on "iGoogle" home pages can track users' activities and control their machines, SecTheory chief executive Robert Hansen has said.

"I could force you to download child porn or send subversive material to China," Mr Hansen said. "The exploitation is almost limitless. Google has to fix it."

Google lets people customise iGoogle home pages with mini-software programs called "gadgets" such as to-do lists, news feeds, currency converters, and calendars.

Hackers can program malicious code into proffered gadgets or break into systems hosted by engineers providing legitimate mini-programs.

"It turns out a lot of people who develop these things aren't good at security," Mr Hansen said, citing research he and Cenzic security analyst Tom Stracener shared at a notorious annual DefCon hacker gathering in Las Vegas.

"We pretty much break into anything we try."

Hackers can resort to a tactic of luring people to websites that trick people into installing applications in iGoogle home pages. A hacker can remotely control a victim's computer as long as the iGoogle page is open.

Gmail users face danger from the same "hole" in security, according to Mr Hansen, whose hacker name is "RSnake".

"We've been telling Google about these vulnerabilities for years and they have not made corrective actions," Mr Hansen said.

"They chose to open the doors and insomuch put a lot of consumers at risk."

Google says it checks gadgets for malicious code, rarely finding any, and that it removes tainted programs.

-AFP