iPad Users Targeted by Backdoor Dissembled as iTunes Update

An e-mail invitation to an iTunes update gets iPad users’ PCs into backdoor trouble.

Success stories are cybercriminals’ go to sources of victims and the iPad craze couldn’t have been left out of this picture. According to some reports, Apple sold 150.000 iPads in the first 60 hours of presale availability, with almost 100.000 of these coveted devices being pre-ordered in the first 10 hours. The figures make it clear as daylight why malware creators were so keen on crashing this promising party.

The invitation to the “contagious fiesta” comes via the e-mail: an unsolicited message instructs iPad users to download on their PCs the latest version of the iTunes software as a preliminary step to an update of their iPad software.

To carry conviction, the e-mail emphasizes that users should keep their iPad software updated “for best performance, newer features and security”.

It goes on to clarify the multi-step procedure by pointing out that in order for the update to be performed the latest version of iTunes should first be downloaded from the Internet. A direct link to the download location is conveniently provided. As a proof of cybercrime finesse, the webpage the users are directed to is a perfect imitation of the one they would use for legitimate iTunes software downloads.

Unfortunately for these users, following the malicious link means opening up a direct line to their sensitive data as instead of the promised iTunes update they get malware on their systems.

Identified by BitDefender as Backdoor.Bifrose.AADY,the piece of malicious code inadvertently downloaded injects itself in to the explorer.exe processand opens up a backdoor that allows unauthorized access to and control over the affected system.

Moreover, Backdoor.Bifrose.AADYattempts to read the keys and serial numbers of the various software installed on the affected computer, while also logging the passwords to the victim’s ICQ, Messenger, POP3 mail accounts, and protected storage.

It is important to say that Mac users remain unaffected by this piece of malware.

Click Computers – Computer Repair Utah
Click Computers is Utah’s Onsite Computer Repair Specialists for your Home and Business.

Facebook Application Spreading Adware

BitDefender researchers today have uncovered a new scheme that allows cyber-criminals to monetize on unwary users by leading them into installing adware applications. Rather than using hidden vulnerabilities in the social networking platform, this novel approach relies on social engineering in order to trick users into interacting with the attacker.

Chapter I: The Application
The central element of the scheme is the Dance Class Video, application, a third-party extension of Facebook that has neither been developed, nor approved by the social network. The application’s page has been artificially populated with content and friends to increase the victim’s confidence. The application’s main purpose is to send specifically crafted messages and to continue recruiting new victims, as described below.

Chapter II: The Bait
The infection vector is simple yet efficient. Compromised accounts send spammy messages that impersonate a Facebook video: “[victim’s name], this video is from the dance academy i went to last week.. what do u think?”. As soon as the victim follows the link, the application would ask for confirmation to pull out personal data, to send message on users’ behalf, as well as permission to always send these messages without any further confirmations.

Chapter III: The Payload
After all the necessary confirmations have been pulled from the victim, they would be redirected to the application’s page that displays a fake video player (which is in fact a JPEG image hosted outside of Facebook), prompting them to update their FLV player in order to be able to see the video.

The download page even contains an End-User License Agreement and the small provision that the SB 140 Alaska rule expressly forbids an application to engage in deceptive acts or practices described in this subsection using spyware by causing a pop-up advertisement to be shown on the computer screen of a user by means of a spyware program”. The page also triggers the automatic download of a binary file called FLVDirect.exe.

Once downloaded and installed, the binary file would hijack the browser’s start page and search settings without the user’s consent.

Apart from all the trouble a piece of adware may inflict to the average computer user, please remember that your social networking profile may hold sensitive information and granting third parties access to it or to act on your profile may have extremely dangerous repercussions on your privacy.

Click Computers – Computer Repair Utah
Click Computers is Utah’s Onsite Computer Repair Specialists for your Home and Business.

McAfee Update Sends Windows XP Machines into Reboot Loop

Click Computers – Computer Repair Utah
Click Computers is Utah’s Onsite Computer Repair Specialists for your Home and Business.

McAfee perfectly illustrated today why you're supposed to thoroughly test software updates before pushing them out to the general public. Consumers and IT support personnel around the country found themselves in a nightmare situation this afternoon; at best, their Windows XP-based machines simply couldn't connect to a network, but more often than not were stuck in an endless loop of reboots.

The update, labeled 5958, causes McAfee to misidentify svchost.exe (an essential Windows system file) as a piece of malware and delete it. The official statement from McAfee indicates that the flaw only effects Windows XP machines with SP3, and results in "moderate to significant performance issues." Of course, reports from around the Web indicate this affects systems that are only up to SP2. And calling an endless cycle of reboots a "performance issue" is a bit of an understatement.

There are unconfirmed reports that the flaw has taken out banks of systems at Intel and Dish Network, and the New York Times is reporting that dozens of PCs at the Illinois State University in Normal were taken out as well.

McAfee has released a "fix" for the problem that really only suppresses the issue and doesn't directly address the false-positive issue. The fix also requires that a technician individually visit and repair any affected system, meaning that it may be a long night for support staff at companies and institutions who turn to McAfee for their virus protection.

Click Computers Can Help. Facebook Fans flat fee $49.00

Click Computers Mini Notebook Special

Click Computers – Computer Repair Utah
Click Computers is Utah’s Onsite Computer Repair Specialists for your Home and Business.


Through the month of April, Click Computers has on special the Hewlett Packard HP Pavilion 210-1030NR Mini Notebook PC. Retail price is $349.99. This month only $289.99.

Click Computers will optimize the system if you prefer at no extra charge. Remove all unnecessary trail version programs, install Open Office, and install an anti-virus, anti-spyware product absolutely free. For a fee of $37.50, Click Computers will come to your home or business and connect your printer and wifi. Click Computers can also transfer your data from your existing computer to this wonderful HP net book.

Small, slim and stylish, the HP Mini 210 lets you surf the web, stay connected, and be entertained wherever you go. Amp up the fun by playing videos and music or showing off your photos. Exclusive, integrated software keeps you in sync with your life by letting you e-mail, chat, and instantly access your files from anywhere. With bottom case cover that conceals component access points and matches the top cover, the HP Mini 210 looks great from every angle and is protected by world-class support.

SPECS:

•1.66 GHz Intel Atom N450 Processor

•1GB DDR3 Memory

•160GB SATA Hard Drive

*10.1" Active Matrix TFT Color LCD with 1366x768 Resolution

•6 Cell Battery

•Integrated Intel GMA 3150 (256MB Graphics Memory)

•Integrated 802.11b/g Wifi

•Integrated 10/100 BaseTX LAN

•5-in-1 Multi-memory Card Slot (SD,MMC,MemoryStick,MemoryStick PRO,xD-Picture Card)

•Microsoft Windows 7 Starter

•1 Year Manufacturer's Limited Warranty

Facebook Password: T_R_O_J_A_N

A deceptive password change message sent on behalf of Facebook® is used in a Trojan-spreading scheme

Yesterday evening, a malware distribution campaign using Facebook® as bait made some pretty nasty waves. Apparently legitimate e-mails notified Facebook® users that the passwords to their accounts have been changed due to security reasons. The recipients of this fake notification were supposed to open an attached .zip file in order to find out their new allocated password.

Instead of a new password, the zip file hides Trojan.Dropper.Oficla.G. As its name suggests – Trojan Dropper- this piece of malware contains malicious or potentially unwanted software which it ‘drops’ and installs on the system. Frequently, the dropper installs a backdoor which allows remote, clandestine access to the infected system. This backdoor may then be used by cybercriminals to upload and install additional malicious or potentially unwanted software on the system.

Infection rates are expected to boom because the social engineering behind this mechanism proves to be efficient. Facebook® is a highly popular social network and accessing it for discussions or for its popular applications has become a daily habit for very many people. No matter why they access the social network, the e-mail informing them about the alleged password change is likely to drive them towards the same result: open the file to take a look inside and ultimately… get infected.

In order to stay safe, BitDefender recommends you to never open the attachments coming from unknown contacts as well as to install and update a complete antimalware software solution.

Click Computers – Computer Repair Utah
Click Computers is Utah’s Onsite Computer Repair Specialists for your Home and Business

KSL.COM Virus Warning

After receiving reports of a computer virus related to this website, the problem has been identified and it is now safe to browse KSL.com. The virus came through a third party network used to distribute ads on the site, but it has been stopped and measures are being taken to boost security.

Microsoft Hotmail Privacy Breach

A statement issued by Microsoft revealed that the company is looking into reports that some users of its Hotmail service were accidentally shown other users' inboxes when attempting to access their mail through their mobile phone.

The Windows Live sign-in service was down for an hour yesterday; whether the two events are related is as-yet unknown. The sign-in downtime was purportedly due to a server failure, and left many unable to log in to any Microsoft service dependent on Windows Live IDs, including both Hotmail and Windows Live Messenger.
In its statement, the software giant said, "Microsoft takes customers' privacy seriously, and immediately upon learning of these reports, we started an investigation. We will take appropriate action once we have completed the investigation."

Reports of the nature of the security breach suggest that it did indeed coincide with the sign-in service failure. Users with the problem describe being presented with an inbox that was not their own; subsequent logins presented a different inbox each time.

Click Computers – Computer Repair Utah
Click Computers is Utah’s Onsite Computer Repair Specialists for your Home and Business.