AVG Blogs | Karel Obluk

Interested in some juicy data?

If you are, then you are definitely not alone! This has become a really hot topic for many Latvians after a hacker nick-named “Neo” (as in Matrix) has released sensitive information about salaries and bonuses of top managers of some state-owned companies, banks and even the police. These companies either received significant subsidies from the state or promised to cut on top management salaries and bonuses because of the economical situation. But as you can guess, unlike regular employees, the management actually received full bonuses and no pay cuts.

From a security perspective, this is also quite interesting story. A story of inadequate security, improper design and systems that can be exploited easily either because of programming bug or or lack of experience and expertise (one can only hope that there was no malicious intent). The data was obtained from an web system called EDS that is used for electronic submission of declarations for the Latvian State Revenue Service. This system is compulsory for all companies in Latvia since the beginning of this year but was optional since 2006. Unfortunately the system allowed even anonymous users to download data because of two serious problems:

1.  document IDs were assigned sequentially, thus allowing the attacker to simply try lots of numbers in sequence

2.  certain links did not have proper access control implemented, so it was possibly to simply request them in a form like this: https://www2.vid.gov.lv/eds/Pages/GetDuf.aspx?id=1

As you can see, to get access to the data was no rocket science. Unfortunately, even an audit of the State Revenue Service IT systems (that cost more than a million EUR) did not discover this issue. “Neo” was apparently much more clever and was taking all the necessary security measures, such as using public WiFi hotspots in the UK, chain of proxies etc. No surprise that he has already been nick-named “New Robin Hood” by some media. “Neo” and his group are even using Twitter to talk to public

Share | |

Rychlejší, chytřejší, oceněný! IT produkt roku 2010

Občas je příjemné trochu se pochlubit. Zejména jedná-li o ocenění jednoho z našich produktů. AVG Internet Security 9.0, který byl nezávislou komisí časopisu Computerworld zvolen IT produktem roku 2010, a to v kategorii Bezpečnostní řešení. Celkově se tak jedná již o páté ocenění, které produkty AVG v průběhu let v soutěži získaly. Díky podobným oceněním mohou i naši zákazníci vidět, že neusínáme na vavřínech a stále pokračujeme ve vývoji spolehlivých produktů, které budou chránit nejen jejich počítače, ale i je samotné.

Čtěte více v českém blogu

Even police is not immune to viruses

Some police officers in Manchester apparently had a bad day - according to this article. Details are not available (if you have any, please, let me know!) but it looks like the most typical attack vector was used - human error. Somebody inserted an infected USB stick (flash memory) into a computer that apparently did not have any anti-virus installed. Or maybe there was some antivirus but it was not updated? Anyway, as you can see, having an anti-virus product really is a must, even if you are not visiting dangerous or illegal web sites and only use legitimate software. 

Yes, of course AVG blocks all the known Conficker variants and the latest version AVG 9 even has an option to scan USB devices automatically as they are connected to the PC. Sorry, I just could not resist that one ;)

Share | |

Facebook applications may not always be your friends

I am not a big Facebook fan myself even though I have a profile myself and use it from time to time. But I do not follow it on a regular basis and do not use all the fancy applications that you can install and have so much fun with. However, I know many people who spend on FB lots of time and install pretty much anything that others recommend and this story is especially for them. Before I start, let me say a big thank you to my colleague Nick Fitzgerald, who collected all the information and is actually the real author of this post ;)

Bill Brenner, editor of CSO magazine, advised that someone was using his name to lure Facebook users to "infect" (his word) their machines with something that would then send notifications to others of new wall posts. This was reputedly all with the aim of getting many Facebookers to accept an app and add it to their profile. Here's a screenshot of Bill's message:

 

Investigating this our analysts did not find any strong evidence of worm-like or viral functionality, but the number of people installing - sorry, "accepting" - the app at the heart of this was increasing rapidly until Facebook security disabled or blocked access to it.

Fortunately, Facebook has disabled the app - if you try to visit a link to it now, instead of the "accept" page you will see:



However, visiting a link from a notification of the kind Bill mentioned or spread through some other means (we reiterate, we saw no evidence that the actual Facebook app at the heart of this was directly involved in generating such messages) would result in Facebook asking you to confirm your acceptance of the app, similar to this:


 
Note that this app was called "News Feed". If you accepted this News Feed app, you were directed to a page with a weird animated GIF that looked (frozen at one frame of the GIF) something like this:



Then, if you checked your Facebook application settings you would see something like:



If you clicked the "Edit Settings" link in the above screenshot, you'd have seen that News Feed was specifically asking for permission to post to your wall. Perhaps the authors of this app expected people to shrug off the ugly, annoying web page it redirected to and hoped that they would forget that they had accepted the app and given it wall-posting rights. This could make a handy "spam tool" for the app's author's in future.

Many people actually don't realize that a Facebook application can be malicious, too. Note one of the responses to the original Bill's post - Ann thinks that she is safe because she has a Mac. Unfortunately for Ann and many others with Mac or Linux (or other systems), this is not necessarily true. Facebook applications are portable, they support all the different systems, including Mac, and once installed, they can obtain access to your profile data. Fortunately, Facebook takes security very seriously and the user has control over what data can an application access. However, social engineering is a powerful weapon and many people fall into traps like the one above. So next time you install a new Facebook application, be careful about where it comes from and what permissions do you grant to it.

Share | |

Haiti earthquake - scammers again

Nothing new, unfortunately, very typical in this world - whenever there is a major disaster, some human hyenas appear, sending scam, trying to trick people. Fake charity sites, infected pages with reports on the disaster, all these start appearing automatically, within hours or days. 

Haiti earthquake was not an exception. So it's good to see that not only security vendors are trying to protect users but also legal authorities became active. If you happen to live in the US, the FBI and the National Center for Disaster Fraud together established a hotline and a dedicated e-mail address to report suspected Haitian earthquake relief fraud. The number is (866) 720-5721 and is staffed by a live operator 24 hours a day. You can also e-mail the info to disaster@leo.gov. 

You can find more info at http://www.ic3.gov/media/2010/100118.aspx. 

Excellent activity, would be great to see other law enforcements follow this example!

P.S. Read more about Haiti earthquake scams in Nick Fitzgerald's blog

Share | |

Aurora - not just the cruiser ship

For some of you, the name Aurora might sound familiar in a context that is not necessarily related to security. It was a cruiser, a Russian one and a gunshot from this cruiser (is said to) start the Great October revolution in Russia back in 1917, causing lots of trouble to many many people all around the world. But recently, you might have heard about Aurora related to China, Google or Internet Explorer.

A sophisticated exploit was created and used to misuse a bug in Internet Explorer. Using this exploit, the attackers were able to infect machines in some really large and otherwise well secured networks, such as Google, Juniper, Adobe and others. The exploit was code-named 'Aurora' and was a typical example of a 0-day exploit attacking systems that could not have a patch for it - it was misused as soon as it has been discovered, giving the vendor no chance to fix the bug. It was sufficient for some users with Internet Explorer to just visit a web page and their systems immediately got infected, no need to download anything or go to suspicious sites. That just illustrates the need for protection against web threats. The malware that was distributed using this attack actually was detected very soon by AV vendors, too (including AVG, of course); however, it is clearly better to block the whole attack vector. Which leads me again to LinkScanner and the advantages of it :)

I am pretty sure that Roger will be posting more details and more info on his blog. And maybe he will also include some thoughts about targeted attacks, where they can come from and how difficult it is even for an experienced user to protect against them without the right tools. So come back and check his blog. And remember that your comments and opinion are more than welcome

Share | |

Secure connections? It depends...

As you probably can guess, I travel a lot. I even have to stay in hotels in the Czech republic, and that is not such a big country. So tonight I arrived in Prague (have you all been to Prague? if not, you should come, such a beautiful city!), decent hotel, not too late in the evening so still time to reply to all the e-mails that reached my inbox in the last three hours. I connected, fired up my VPN, sorted company e-mails and just to close my day, I opened my private mail boxes, too. And here the fun begins.

The minute I wanted to reply to one of the private e-mails, strange things started happening. A dialog like the one below appeared on my screen (the highlights are by me ;) )

 

Can you see the difference? What happened? Why is this? A bit of background first

As a security person, I am a bit paranoid, so all my e-mail accounts connect through secure connections - SSL. The SSL connection means that all the traffic with your e-mail server is encrypted. You can set that up for most e-mail providers and usually, this is a separate setting for incoming and outgoing e-mail. For incoming e-mails, if SSL is used, the connection simply must go to the original, legitimate server, or you will not connect to your mailbox. If, for example, somebody redirects my IMAP connection to another server, it will never download my e-mail. If, however, I am trying to send e-mails, any SMTP server can do that! And that is exactly what was happening here! And not just for GMAIL - as you can see below, other SSL outgoing e-mail connections got hijacked as well!

So what is going on again? When I try to connect to my e-mail server to send e-mail, the ISP redirected my connection to their server! And instead of connecting to smtp.gmail.com or smtp.me.com, the secured connection went to some mikenopa.com mail server. And the server is pretending to be gmail.com or me.com mail server! So my e-mail client was trying to establish a secure, encrypted session with me.com or gmail but instead, the encryption ends at mikenopa.com. Yes, mikenope.com will most likely deliver my e-mail to the addressee, but that server will see the full content of my e-mail! And that also means my e-mail address and the e-mail of all recipient!

Obviously, I have not confirmed the certificate exception and did not connect to any of the servers. My friends can wait for my reply until I get to a more secure location, that does not redirect SSL connections. I do not want to expose my or their addresses to spam harvesters or other suspicious systems. And I bet that you do not want that either! So next time you are in a hotel or some other public place and your e-mail client prompts you with some strange message about certificates - I recommend that you do not connect. And maybe let the Internet provide know? I will...

Have a very happy and secure 2010!

Share | |

Koobface Gang wishing Merry Christmas

Koobface Gang wishing Merry Christmas on their website - with a big thank you to Dancho Danchev for 'analyzing their software' and his dedication to taking down their command and control centers... Now that is irony. Of course, they claim that they have never stolen or misused any personal data or credit card info! If only that was true, that would be a nice Christmas present! :)

Share | |

Does LinkScanner® Scan Links?

One of the AVG components that is probably least understood and causes most confusion is LinkScanner. What does it do? Does it scan webpages, compare URLs against some blacklist, ask the cloud, or what? Actually it partially does all of these things, but the most important piece is the first one.

As you may know, there are currently around 30,000 new viruses and other malware hitting antivirus researchers’ labs each and every day. And most of them spread via the web. The web is really the primary ‘attack vector’ - or distribution medium - for modern malware. But for all these viruses, there are just a few hundred ways for them to attack your computer - infecting your system without you knowing it - either by misusing some bug in the operating system or by using some tricks to persuade you to install the malware (you can read about some of the most interesting tricks in Roger Thompson's blog). This is the aspect of malware detection that LinkScanner is based on. It scans web page content as that content is delivered to your computer and identifies delivery mechanism patterns that indicate potential malware delivery. When it identifies something suspicious, it blocks that page. The beauty of this approach is that LinkScanner does not have to know the virus itself - it blocks the attack no matter what new malware the page is trying to deliver to you! This way, even new variants of rogue spyware products, fake codecs and other similar ‘tricks’ cannot harm your computer. LinkScanner is installed on the network layer, intercepting all web traffic regardless of which browser you use and detecting threats before the browser sees anything. That makes it even more effective. 

Some people think that, if they use a blacklist of “known-bad” web sites, they are safe and don’t need LinkScanner. Unfortunately, they are wrong. Most web threats are served from web sites that exist for less than one day – and often for only a few hours. Even more sneakily, some infected web pages serve malicious content only to certain site visitors, for example only users from particular areas. The bad guys will try anything to avoid detection. But since LinkScanner evaluates the real content of the web page right when it is delivered to your computer, it cannot be tricked in this way. Yet another reason to use 

Another LinkScanner myth is that some people think it actually visits the web page to scan it, which would enable it to be easily identified by malicious code on the web page and spoofed. This is also not true - LinkScanner is installed on the client computer and scans incoming traffic. So the web request comes from the browser and LinkScanner only monitors what has been delivered. There’s no additional traffic and no way for the malware to tell if the client has LinkScanner installed or not.

As you can see, LinkScanner is pretty powerful technology. With modern threats, one technology and one protection layer is not sufficient; LinkScanner serves as a very solid extra layer in the overall AVG security system.
 

Share | |

 

How AVG LinkScanner® works

AVG LinkScanner® protects you from the Data Snatchers and raises your internet security to the next level.

Misbehaving Applications

Hello and welcome to this new “semi-technical blog”. My name is Karel Obluk and as a Chief Technology Officer, I am the one to blame for everything that does not work in AVG (if it works, you should praise the developers or threat researchers) :o)

Let me start this blog by a short discussion about behavior monitoring in malware detection, how it differs from other techniques and what to expect from AVG implementation in the new AVG version 9.

Behavior monitoring is one of the buzzwords that have been used by different people in different contexts. While most experts can agree on definition of what is behavior monitoring and what it can do, there is lots of confusion especially among general public. Theoretically, this is a technique that promises detection of malware by observing its actions – behavior. When some application does a sequence of suspicious or malicious actions, it can be marked as ‘bad’. This might look relatively easy, consider for example the following sequence of actions: an application has been downloaded from the web, unpacks some executable file in a temporary directory, launches it and that program in turn downloads some more data and executable files and registers them as applications that should launch automatically upon Windows startup. Sounds like a malicious Trojan, right? All the bad things… but wait a minute! How about some ‘live installer’ of an instant messaging application? As you can see, it is not that easy. Still, a good behavior monitoring technology can tell the difference. Sometimes, however, it might get it wrong – and that’s when some false alarm prevention must come to place, too.

The above theory looks good, let’s say that the technology can really tell a suspicious activity from a legitimate one and that the false alarm issues are also covered (in AVG, we use a combination trusted apps and cloud services – but more on that in some other post). Still, there are two problems that behavior monitoring cannot solve by itself. It cannot properly detect and heal file infections – all the parasitic viruses could be detected by behavior but not removed from the infected file. And, most importantly, the malicious application must be allowed to run; so chances are, the application has already done some harm, something that cannot be undone completely. And that is why the behavior-based technology is a perfect add-on to traditional ‘signature scanning’ detection. In AVG, we strongly believe in protection layers, with behavior monitoring being one – and very important – of them. The concept of layers and components that work together is actually a very important one. This way, each component is responsible for some part of protection, and at the same time, they cooperate, exchange information, so for example firewall can tell when there is a suspicious network connection, LinkScanner can indicate a suspicious web site etc.

I have already mentioned the issue of false alarms with behavior monitoring technology and how important it is to prevent them. AVG 9 engine is quite clever in distinguishing legitimate applications from malicious ones but still, sometimes, even a perfectly innocent program can do something that would trigger the alerts. For this purpose, AVG can connect online to a backend datacenter and ask ‘for help’. In this datacenter, in the cloud, backend systems are processing hundreds of thousands of files, analyzing them in depth using advanced techniques, validating against our whitelist databases and if necessary, passing some files even to the virus lab for manual analysis. This complex ‘in-the-cloud’ system can then reply back to the behavior engine in AVG 9 and either confirm or veto some detection. 

That’s behavior detection in AVG 9 in summary. Please, feel free to comment or send me an e-mail with any questions or suggestions that you might have. Next time, I would like to spend some time on other layers, such as LinkScanner.

 

Share | |

 

Meet Karel Obluk

What is Behavior Protection
Karel Obluk introducing brand new AVG 9.0 Antivirus and Internet Security suite. Learn what what is behavior protection behavioral detection technology in the latest AVG Identity Protection module, delivering one of the most accurate detection levels of new and unknown threats.

Nevychované programy

Vítejte na mém trochu technicky zaměřeném blogu. Jmenuji se Karel Obluk a působím jako technický ředitel (CTO); pokud tedy v AVG něco nefunguje, můžu za to já (naopak pokud to funguje, je to zásluha kolegů z vývoje nebo z virové laboratoře) :o)

Pro první příspěvek ve svém novém blogu jsem si vybral téma tzv. “behavior monitoring”, tedy sledování a detekce škodlivých aplikací (malware) na základě chování. Na jakém principu tato technologie funguje, jak se liší od jiných metod detekce a samozřejmě také jak je implementována v nové verzi AVG 9.

Detekce škodlivých aplikací na základě chování, tzv. “behavior monitoring” nebo “behavior detection” je v poslední době hodně populární slovní spojení, které různí lidé používají v různém kontextu. 

Čtěte více v českém blogu