Tuesday, 22 September 2009

Conficker worm poses global security threat

According to a report in the Sydney Morning Herald, the 'Conficker worm' remains the biggest security threat to the Internet at the moment, with the spread of the virus being almost impossible to stop. If has already infected more than 5 million computers and could be used to disrupt the Internet in entire countries, according to some experts.

The worm was first detected in November last year and spreads rapidly to computers through a security flaw in the Windows operating system.When machines get infected they are 'co-opted' into a viral network which can potentially be controlled and used by the hackers to launch unprecedented cyber attacks. Those behind the worm can reportedly do anything they want with the infected machines, including stealing users' banking details or flooding government servers to knock them offline.

The particular challenge of Conficker is that it contains built-in mechanisms to prevent people from scanning their computers with anti-virus software. Even for those who wipe their computers clean and start fresh, if they back up any important data on a portable hard drive, the clean machine is reinfected when the drive is connected to the computer. The worm also spreads automatically between computers on a network and infects machines without the user having to do anything other than switch their computers on.

As usual, security experts recommend that people who are not yet infected should ensure that they have installed the latest Windows patches and anti-virus software.

Labels:

0 Comments

Friday, 7 August 2009

Twitter and Facebook subject to hacker attack

Both Twitter and Facebook have been subject to some extreme attacks in the past few days from online hackers who are targeting these high profile social networking sites with the aim of causing disruption to their service. As reported by the BBC, Twitter was taken offline for more than two hours whilst Facebook's service was "degraded" as both sites were subject to so-called denial-of-service attacks.

These attacks can take various forms but often involve a company's servers being flooded with data in an effort to disable them. Such attacks often use networks of computers - known as botnets - which are under the control of hackers, often as the result of previous viral attacks or 'Trojan horses' that have infected computers around the world. The strategy is often employed by protestors against, for example, government websites or to disrupt high profile sites for publicity.

Labels: , ,

0 Comments

Tuesday, 3 March 2009

Facebook under threat from hackers

The BBC website has reported that the popular social networking site, Facebook, is coming under an increasing number of threats from hackers who are trying to obtain personal information about users of the site. Apparently there have been five separate security problems in the last seven days. The hackers are reported to be creating fake messages padded with details of Facebook members in the hope that they can obtain information and access to users' details by capitalising on the trust and social links that drive the network.

They are also taking advantage of the hundreds of applications that have been developed for Facebook's users, with one malicious application has tried to trick people into adding it by claiming that their friends were having trouble looking at their profile. If the application is added it spams itself to every Facebook friend that a member of the site has. So far, however, security experts say that these rogue applications have been scary and a nuisance more than anything else, but this remains a big concern for the operators of Facebook, and their millions of users.

Facebook had also been under attack from a virus with a new version of the 'Koobface' virus targeting members of the site again, with the previous attack at the end of last year. The new variant uses a Facebook message to try to get people to visit a fake YouTube page and install the malware. To make it look more plausible, the virus posts the image from a Facebook member's profile on the video page. Once installed the malicious program hunts for cookies on a victim's computer and uses the details it finds in the small text files to log into other social sites that person may be a member of.

Labels: ,

0 Comments

Monday, 19 January 2009

New computer worm spreads

The BBC website covers the latest 'worm' attack which is threatening PCs around the world. Dubbed the Conficker virus, this worm is spreading rapidly through low security networks, memory sticks, and PCs without current security updates. The malicious program was first reported in October last year although there has been no direct impact yet - security experts say that the spread of the worm appears to be levelling off, although there are fears someone could easily take control of any and all of the 9.5m infected PCs.

PC users should continue to remain vigilant about these type of attacks and have up-to-date anti-virus software, as well as install Microsoft's MS08-067 patch. Some experts are saying that this outbreak is at a scale they had not seen for some time.

The BBC report says that Microsoft have described the worm as one that works by searching for a Windows executable file called "services.exe" and then becomes part of that code. It then copies itself into the Windows system folder as a random file of a type known as a "dll". It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.

Once the worm is up and running, it creates an HTTP server, resets a machine's System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker's web site. Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down. But Conficker does things differently by using a complicated algorithm to generate hundreds of different domain names every day but only one of these will actually be the site used to download the hackers' files. This could make tracing this one site is almost impossible.

Microsoft has said that the malware has infected computers in many different parts of the world, with machines in China, Brazil, Russia, and India having the highest number of victims.

Labels: ,

0 Comments