Comments Off

By Admin, December 12, 2007 08:51

Hot:

I recently came across an article from ‘Information Security’ that reviewed several “Enterprise” class security suites. I have reviewed several here on this blog in the past year and have found very disappointing results. There have been a couple of new comer’s to the land of the personal desktop namely ‘Blink’ by eEye that I have been testing for several months. The tool isn’t ready for personal use, but it’s professional version has been commended for a while. This article compared Blink’s Enterprise tool (at time of writing I haven’t been able to confirm the differences between Pro and Enterprise).

For most readers of this blog, they may dismiss reviews of enterprise class applications but I decided to include it since for most of these vendors the Enterprise version represents the ‘best of the best’ of their offerings. As this review compares all the top providers including Symantec, CA, Trend Micro, ISS, eEye and a few others I decided it was worth while comparing them.

The article can be found here:

(I included the print-friendly version of the article as it is a 15 page review, and 15 pages is ridiculous since every page is barely a screenful on my PC, I prefer reading to clicking links and waiting for advertising to load so…)

A lot of these offerings are strictly for Windows machines, very few have linux offerings or Mac. Something to keep in mind if your network has blended OS’s you will have to seek other options for a network wide protection. However if your network is mostly Windows bases these products will meet your needs.

The offerings were presented and reviewed by many criteria, such as ‘ease of information gathering’ to usage, to malware detection capability.

The most interesting note to this is that NONE of the products had 100% detection. NONE! The best came in around 92% detection.

It’s also important to note that some were plainly incompetent at detecting malware that was present and moving around a machine. This too was a interesting consequence of the article.

Here is the features offered in the product.

The real nice extra feature that only two of the above offer is vulnerability scanning. This is a must to ensure your machines are patched and up to date. However the features can be very valuable in a work environment that can have strict policies, in a home environment its benefits will be less. My experience shows that they typically have inaccurate results so being able to use this as a guideline rather than a definitive state is important. Its still very valuable.

Since we like Blink, it’s also important to note that even the Personal version of their product offers all these features, most of the other vendors are not so accommodating for their lower end versions of the product.

So this review does in fact support our arguments regarding malware. There is NO 100% effective solution, so a multi-tiered approach to malware is wise.

It also proves our case about not relying on a traditional antivirus product alone. This type of product has pretty much no life in todays market. A blended product is what is required which most of these provide. It’s unfortunate that most of these companies cannot improve their offering to be more effective.

Additionally it’s important to note that ‘false positives’ are the #1 problem with most of these packages so it’s critical to compare ‘detection results’ with other products before making a decision to buy. As a lot of spyware vendors like to do with their product offerings is to have LARGE numbers of detection, regardless of it’s importance or even accuracy.

Comments Off

By Admin, November 9, 2007 12:53

Hot:

Really? A FREE YEAR of Broadband?!? Nobody gives away a free year…

Recently I’ve received copies of a Phishing Attempt that looks like it’s from Shaw (a cable/internet/telephone service company in Canada). This phishing attempt is congruous to the Ebay and banking phishes of the recent past, in that it actually does NOT resemble a ‘real’ email, rather a fictional email to get people excited, in this case instead of warning the user it attempts a positive reaction from “getting free internet for a year”. Whoopie! A years worth of internet from Shaw isn’t that expensive. Phishing attempts are typically NOT viral or malware orientated but certainly can and do use such methods. In this case it looks like a standard email spam sent via exploited web sites.

This is a sophisticated method. It uses a similar style as Shaw uses in their correspondence and uses a legit; if inappropriate, email address. The email was generated and sent using multiple methods so tracking it will be harder to accomplish. Additionally, I shall show the details of the spam and my analysis. Our whois data will be included in the rest of the article.

First off, I will advise of the RED FLAGS in this phishing attempt

#1- “A Free Year of Broadband” – This doesn’t make sense. Shaw has trademarks and service marks that it would use to advertise it’s broadband internet service. Only someone ignorant of Shaw’s trademarks would say this. It’s really unlikely anyone who really works for Shaw would make this error.

#2 – Canadian Law states that any ‘contest’ or ‘giveaways’ contain details of said event. In most cases it’s prudent to disclaim whether or not the contest is allowed in Quebec, since the law is vastly different, and Quebec law generally does NOT allow this type of Contest. (disclaimer: I’m in no way a lawyer, but I am aware of consumer rights.). Missing the disclaimer is a definite flag

#3 – The email that is seen in the From: header is not a normal Shaw correspondence email account.

#4 – The link clearly shows a ‘secure’ link, but in no way is it going to a ‘secure’ site.

#5 – Typical email headers (on email from Shaw) missing

So just upon a quick review of this email we can deduce that it’s not a valid email. To get more pertinent details I’ll analyze these email in detail. I won’t paste the email headers in entirety, any ambiguity will be displayed by ‘XXXXXXXX’, to avoid email harvesting, but I will show you what details were more noteworthy.

The return-path was interesting. One was:

apache@utel16.besthosting.com.ua

, the other one was:

nobody@omega.omc.net

This would indicate to me that the web server sent this email, and in typical hosting fashion, it would be doing so via script on one of the hosts or virtual hosts on the system.

None of the received headers would indicate anything unexpected here, “omega” even has SSL/TLS

enabled but verify set to no.

The header in one of the emails is very interesting:

Date: Thu, 08 Nov 2007 20:49:28 +0200

From: “Shaw Communications Inc.” service@shaw.ca

Subject: Win a year of free broadband

To: XXXXXXX@shaw.ca

Reply-to: service@shaw.ca

Message-id: XXXXXXXXXXXXXXXXX@utel16.besthosting.com.ua

MIME-version: 1.0

Content-type: text/html

X-PHP-Script: 213.186.117.120/~loveterra/indexzz.php for 82.208.212.146

Date and time indicates a East European Time zone. I know Shaw doesn’t have any servers in Europe…

The X-PHP-Script header shows a very interesting detail of where this email came from. We’ll come back to this IP in a bit. But this is a key indicator of an exploited web site on a hosting company or something similar. This IP definitely hosts a web server, and with the above mentioned user account, but at time of checking this link generated a error.

The for address 82.208.212.146 is interesting as it resolves to:

whois -h whois.geektools.com 82.208.212.146 …

GeekTools Whois Proxy v5.0.4 Ready.

Final results obtained from whois.ripe.net.

Results:

% This is the RIPE Whois query server #1.

% The objects are in RPSL format.

%

% Rights restricted by copyright.

% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.

% To receive output for a database update, use the “-B” flag.

% Information related to ’82.208.212.0 – 82.208.212.255′

inetnum: 82.208.212.0 – 82.208.212.255

netname: ITSOLUTIONSNET

descr: ITSolutions, Obrenoviceva 124 4/10

descr: 18000 Nis

descr: Serbia and Montenegro

country: CS

admin-c: IS1188-RIPE

tech-c: AZ919-RIPE

status: ASSIGNED PA

mnt-by: PTTSRBIJANET-MNT

source: RIPE # Filtered

person: Ivan Stankovic

address: ITSolutions

address: YU

e-mail: i.stankovic@my-its.net

phone: +38118512796

fax-no: +38118512797

nic-hdl: IS1188-RIPE

source: RIPE # Filtered

person: Aleksandar Zakic

address: ITSolutions NET

address: CS

e-mail: a.zakic@my-its.net

phone: +381-63-222-361

fax-no: +381-18-512-797

nic-hdl: AZ919-RIPE

source: RIPE # Filtered

% Information related to ’82.208.192.0/19AS13091′

route: 82.208.192.0/19

descr: JP PTT Srbija

descr: PTT Srbija Net

origin: AS13091

mnt-by: PTTSRBIJANET-MNT

source: RIPE # Filtered

Results brought to you by the GeekTools WHOIS Proxy

Server results may be copyrighted and are used with permission.

Reviewing the other IP address of the X-PHP-Header gives us this info:

whois -h whois.geektools.com 213.186.117.120 …

GeekTools Whois Proxy v5.0.4 Ready.

Final results obtained from whois.ripe.net.

Results:

% This is the RIPE Whois query server #3.

% The objects are in RPSL format.

%

% Rights restricted by copyright.

% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.

% To receive output for a database update, use the “-B” flag.

% Information related to ’213.186.117.0 – 213.186.117.143′

inetnum: 213.186.117.0 – 213.186.117.143

netname: UTEL-DC5

descr: Utel DataCenter networks. Colocation

country: UA

admin-c: UNOC-RIPE

tech-c: UNOC-RIPE

status: ASSIGNED PA

mnt-by: AS6877-MNT

remarks: INFRA-AW

source: RIPE # Filtered

role: Utel NOC

address: 101, Volodymyrska str.

address: 01033, Kyiv, Ukraine

phone: +380 44 2359001

fax-no: +380 44 2304560

e-mail: noc@utel.net.ua

admin-c: OLE-RIPE

tech-c: BES100-RIPE

tech-c: OLE-RIPE

tech-c: JIM-RIPE

tech-c: ALT-RIPE

tech-c: UHM-RIPE

nic-hdl: UNOC-RIPE

mnt-by: AS6877-MNT

source: RIPE # Filtered

% Information related to ’213.186.112.0/20AS16124′

route: 213.186.112.0/20

descr: Utel DataCenter, Ukraine

origin: AS16124

mnt-by: AS6877-MNT

source: RIPE # Filtered

Results brought to you by the GeekTools WHOIS Proxy

Server results may be copyrighted and are used with permission.

So, it looks like someone possibly in Serbia and Montenegro, ran a cross site script residing on a server in the Ukraine, against utel16.besthosting.com.ua which sent the email. One would actually have to test this out, which I have not done to confirm this. This is a dangerous step I decided to avoid for brevity.

[page_break]

Looking at another similar email we see:

Date: Tue, 06 Nov 2007 23:24:54 +0100 (CET)

From: “Shaw Communications Inc.”

Subject: Win a year of free broadband

To: XXXXXXXXX@shaw.ca

Reply-to: service@shaw.ca

Message-id:

MIME-version: 1.0

Content-type: text/html

X-Authentication-warning: omega.omc.net: Host localhost.omc.net (127.0.0.1)

claimed to be omega.omc.net

But we can see the authentication warning from this server. No detail unfortunately.

Regardless, the viewable content of these two emails is identical, including an ‘offical’ Shaw footer to further reinforce it’s legitimacy, but it’s futile. These are NOT from SHAW.

The content included in plaintext: However to ensure not even ‘google’ browses the evil link from our site I have sanitized it so it breaks. Details to fix will be below the actual email content:

Content-Transfer-Encoding: 8bit

209.85.15.18 is the address removed above with “Removed.example.com”. This address resolves to:

11/09/07 14:19:19 whois 209.85.15.18@whois.geektools.com

whois -h whois.geektools.com 209.85.15.18 …

GeekTools Whois Proxy v5.0.4 Ready.

Final results obtained from whois.arin.net.

Results:

OrgName: Everyones Internet

OrgID: EVRY

Address: 390 Benmar

Address: Suite 200

City: Houston

StateProv: TX

PostalCode: 77060

Country: US

ReferralServer: rwhois://rwhois.ev1servers.net:4321/

NetRange: 209.85.0.0 – 209.85.127.255

CIDR: 209.85.0.0/17

NetName: EVRY-BLK-15

NetHandle: NET-209-85-0-0-1

Parent: NET-209-0-0-0-0

NetType: Direct Allocation

NameServer: NS1.EV1SERVERS.NET

NameServer: NS2.EV1SERVERS.NET

Comment:

RegDate: 2005-12-14

Updated: 2006-11-28

RAbuseHandle: ABUSE477-ARIN

RAbuseName: Abuse Department

RAbusePhone: +1-713-579-2850

RAbuseEmail: abuse@ev1servers.net

RNOCHandle: NOC1445-ARIN

RNOCName: Noc

RNOCPhone: +1-713-579-2850

RNOCEmail: noc@ev1servers.net

OrgAbuseHandle: ABUSE271-ARIN

OrgAbuseName: Abuse

OrgAbusePhone: +1-214-782-7802

OrgAbuseEmail: abuse@theplanet.com

OrgNOCHandle: NOC1445-ARIN

OrgNOCName: Noc

OrgNOCPhone: +1-713-579-2850

OrgNOCEmail: noc@ev1servers.net

OrgTechHandle: VST3-ARIN

OrgTechName: Stinson, Valarie

OrgTechPhone: +1-713-579-2850

OrgTechEmail: admin2@ev1servers.net

# ARIN WHOIS database, last updated 2007-11-08 19:10

# Enter ? for additional hints on searching ARIN’s WHOIS database.

At this point this site seems to be up. Anyone receiving any email similar to this should simply delete it.

If you think it really is legit, call Shaw directly and ask them BEFORE you click on the link. I feel this analysis is accurate and is limited in it’s conclusions. However I hope it serves to help or assist any other who seeks to eliminate phishers, and other scammers.

Comments Off

By Admin, October 23, 2007 12:09

Hot:

Well it appears that ‘supercatalogo.info’ is a HUGE source of spam and malware. I have identified the IP as

89.111.180.225

And the following whois details:

10/23/07 10:15:20 whois 89.111.180.225@whois.geektools.com

whois -h whois.geektools.com 89.111.180.225 …

GeekTools Whois Proxy v5.0.4 Ready.

Final results obtained from whois.ripe.net.

Results:

% This is the RIPE Whois query server #3.

% The objects are in RPSL format.

%

% Rights restricted by copyright.

% See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.

% To receive output for a database update, use the "-B" flag.

% Information related to ’89.111.176.0 – 89.111.191.255′

inetnum: 89.111.176.0 – 89.111.191.255

netname: CENTROHOST-NET

descr: JSC Centrohost

country: RU

org: ORG-JC13-RIPE

admin-c: IA327-RIPE

tech-c: IA327-RIPE

status: ASSIGNED PA

mnt-by: PAN1-RIPE-MNT

mnt-lower: PAN1-RIPE-MNT

mnt-routes: PAN1-RIPE-MNT

mnt-domains: IA327-RIPE-MNT

source: RIPE # Filtered

organisation: ORG-JC13-RIPE

org-name: JSC Centrohost

org-type: OTHER

descr: JSC Centrohost

address: 78, Profsojuznaya str.,

address: Moscow, Russia, 117393

phone: +7 495 3630309

phone: +7 495 3630318

admin-c: IA327-RIPE

tech-c: IA327-RIPE

mnt-ref: PAN1-RIPE-MNT

abuse-mailbox: abuse@hc.ru

mnt-by: PAN1-RIPE-MNT

source: RIPE # Filtered

person: Ivan Albetkov

address: Hosting-Center LTD

address: 22, Litovsky bulvar

address: Moscow, Russia, 117588

phone: +7 495 5445566

remarks: **************************************************

remarks: Please send abuse and spam reports to abuse@hc.ru

remarks: **************************************************

nic-hdl: IA327-RIPE

mnt-by: IA327-RIPE-MNT

source: RIPE # Filtered

% Information related to ’89.111.176.0/20AS41126′

route: 89.111.176.0/20

descr: JSC Centrohost route

origin: AS41126

mnt-by: PAN1-RIPE-MNT

source: RIPE # Filtered

So Mr. Gay can go find another rock to crawl under.

Oh, if your looking for details on supercatalogo.info Click the read more to view.

Domain ID:D15402764-LRMS

Domain Name:SUPERCATALOGO.INFO

Created On:22-Nov-2006 14:39:27 UTC

Last Updated On:21-Jan-2007 20:32:36 UTC

Expiration Date:22-Nov-2007 14:39:27 UTC

Sponsoring Registrar:EstDomains, Inc. (R295-LRMS)

Status:OK

Registrant ID:DI_4743150

Registrant Name:Isaias Stefanski

Registrant Organization:Isaias Stefanski

Registrant Street1:Devon Rd 67 26

Registrant Street2:

Registrant Street3:

Registrant City:BATON ROUGE

Registrant State/Province:Louisiana

Registrant Postal Code:70814

Registrant Country:US

Registrant Phone:+1.5043223563

Registrant Phone Ext.:

Registrant FAX:

Registrant FAX Ext.:

Registrant SuperCatalogo.info

Admin ID:DI_4743150

Admin Name:Isaias Stefanski

Admin Organization:Isaias Stefanski

Admin Street1:Devon Rd 67 26

Admin Street2:

Admin Street3:

Admin City:BATON ROUGE

Admin State/Province:Louisiana

Admin Postal Code:70814

Admin Country:US

Admin Phone:+1.5043223563

Admin Phone Ext.:

Admin FAX:

Admin FAX Ext.:

Admin SuperCatalogo.info

Billing ID:DI_4743150

Billing
Name:Isaias Stefanski

Billing Organization:Isaias Stefanski

Billing Street1:Devon Rd 67 26

Billing Street2:

Billing Street3:

Billing City:BATON ROUGE

Billing State/Province:Louisiana

Billing Postal Code:70814

Billing Country:US

Billing Phone:+1.5043223563

Billing Phone Ext.:

Billing FAX:

Billing FAX Ext.:

Billing SuperCatalogo.info

Tech ID:DI_4743150

Tech Name:Isaias Stefanski

Tech Organization:Isaias Stefanski

Tech Street1:Devon Rd 67 26

Tech Street2:

Tech Street3:

Tech City:BATON ROUGE

Tech State/Province:Louisiana

Tech Postal Code:70814

Tech Country:US

Tech Phone:+1.5043223563

Tech Phone Ext.:

Tech FAX:

Tech FAX Ext.:

Tech SuperCatalogo.info

Name Server:NS1.THEHOSTDIRECT.INFO

Name Server:NS2.THEHOSTDIRECT.INFO

Comments Off

By Admin, October 17, 2007 13:40

Hot:

If you have a web site, chances are you deal with spam in some way. It’s become reality in the last couple years and dealing with it can be either finicky and time consuming or you spend very little time with it, thanks to effective solutions.

Here we get lots of spam even though the traffic here doesn’t warrant it. 90% of the visitors here are bots and only about 2% of those are spammers.

We have a great system for dealing with spam and so far we’ve had great success with it. No spam has been posted on this site that had to be manually removed. However we get an endless number of attempts.

One IP 195.225.177.190 has been particularly mindless in their attempt to spam our site got up to 10 to 15 attempts per day. During the latter part of September 2007, this ONE BOT generated over 100 attempts.

This is the detail of the identified spammer.

10/17/07 11:25:56 whois 195.225.177.190@whois.geektools.com

whois -h whois.geektools.com 195.225.177.190 …

GeekTools Whois Proxy v5.0.4 Ready.

Final results obtained from whois.ripe.net.

Results:

% This is the RIPE Whois query server #1.

% The objects are in RPSL format.

%

% Rights restricted by copyright.

%
See http://www.ripe.net/db/copyright.html

% Note: This output has been filtered.

% To receive output for a database update, use the "-B" flag.

% Information related to ’195.225.176.0 – 195.225.179.255′

inetnum: 195.225.176.0 – 195.225.179.255

netname: NETCATHOST

descr: NetcatHosting

country: PA

admin-c: VR1273-RIPE

tech-c: VR1273-RIPE

status: ASSIGNED PI

mnt-by: RIPE-NCC-HM-PI-MNT

mnt-lower: RIPE-NCC-HM-PI-MNT

mnt-by: NETCATHOST-MNT

mnt-routes: NETCATHOST-MNT

mnt-routes: WZNET-MNT

source: RIPE # Filtered

remarks: ***************************************

remarks: * Abuse contacts: abuse@netcathost.com *

remarks: ***************************************

person: Vladislav Radchek

address: IBC Tower Floor 9 PO Box 901-2389

address: Manuel Espinosa Batista Avenue

phone: +372 7121250

nic-hdl: VR1273-RIPE

source: RIPE # Filtered

% Information related to ’195.225.176.0/22AS31159′

route: 195.225.176.0/22

descr: NETCATHOST (full block)

mnt-routes: WZNET-MNT

mnt-routes: NETCATHOST-MNT

origin: AS31159

mnt-by: NETCATHOST-MNT

remarks: ****************************************

remarks: * Abuse contacts: abuse@netcathost.com *

remarks: ****************************************

source: RIPE # Filtered

% Information related to ’195.225.177.190/32AS31159′

route: 195.225.177.190/32

descr: Mark Stosberg

origin: AS31159

mnt-by: NETCATHOST-MNT

source: RIPE # Filtered

remarks: *******************************

* Mark Stosberg *

* +1 (202) 657-5440 *

* US, 47374, Indiana *

* Richmond, 914 E Main St *

****** Send abuse to: *********

* abuse@myfreepages.org *

*******************************

Results brought to you by the GeekTools WHOIS Proxy

Server results may be copyrighted and are used with permission.’,'This IP is part of the NETCATHOST.COM Domain and is a Web hosting provider. Two IP’s in this block were attributed in the spamming the one noted above and this one 195.225.176.177. This is a RIPE address space from the looks of it being used by an ISP in Europe and further used by this American either intentionally or otherwise. Given it’s a web hosting account I’d say the server has been compromised.

It was interesting that while these bots were spamming me, I received no other spam attempts. [well there were two] Once I blocked this IP block from accessing my site, the other bots started up again. Most curious.

I still average about 3 spam attempts per day and depending on the success of this article I may post further major spammers in the coming months.

Comments Off

By Admin, August 25, 2007 11:05

Hot:

In my area of the world, which is Calgary, Alberta; known for it’s short cool summers; we had one of the hottest in a long time, at least since 1998. I have had two of my PC’s, one being my gaming box hit their temperature ceilings in most cases from the motherboard sensor on three occasions. I don’t have air conditioning so when the temperature hits 30 degrees outside it can hit 36 degrees inside the house. With no airflow everything stagnates and stays hot. Anyone who has a plasma display knows these babies run super hot normally (in the winter I think of it as my fireplace) so imagine the grief one can expect trying to run this display under very hot stagnant conditions. Yes I burnt mine out, but its fixed now.
Anyways, I came across this story today of a kid who nearly killed himself trying to keep his Xbox 360 cool this past summer. Folks this is a lesson on moron proportions. Common sense should dictate you DO NOT do what this guy did, and no one should try this without at least using his head ‘first’

Again, I’m going to tell you that if you wish to kill yourself and maybe even others in your home or business as well as possibly damaging other electronics or even your electrical system, then go ahead and try this. If you would rather LIVE, and not put anything or anyone including yourself in danger ‘DO NOT’ try this.

The story I found on TG Daily and it just makes me wonder what the hell kids are thinking. A 15 year old kid in North Carolina was having problems with his XBox 360 shutting down every five minutes due to overheating.

His mother saw him playing on his box unaware of the troubles and went next door to the neighbors. After several shutdowns of the box the kid decided to take the power supply out of the machine, tape it up in a plastic bag and submerge it in cool water. As a consequence the live electricity contacted the water, and electrocuted the kid. His mother returned from the neighbors finding him unconscious on the floor. He spent the day in the hospital getting treated for minor burns to hands and feet. Lucky for him!

Now the article states that he did this ‘based on information on the internet’. Ok fine, I have done something very similar to this actually we wanted to see if we could run a power supply underwater, we found that this was not very effective, but using a very thick waterproof rubber membrane or gasket we used dry ice and surrounded the power supply and this worked very well. Monitoring the ice constantly to ensure no problems occurred. However it was not practical to run the machine in this state with this power supply in a potentially dangerous situation for any real length of time. The problem with a plastic bag of course is it can melt due to the heat of the power supply creating a poor barrier. Much like water cooling, we don’t want water running ‘in’ our case, we want it simply cooling our special heat sinks. Loose water is dangerous.

So please tell me…who just reads things on the internet and tries them without seriously considering the consequences. I’m sure the average 16 year old is aware that you can die from average voltages when water is in play.

So if anyone thinks this is a grand idea to keep them parts cool in our hot summer, please remember common sense, and don’t try anything without putting safety first!

P.S. If anyone reads this and tries this without a safety plan, you are an idiot.