Aldi supermarkets withdraw infected hard disks

The Australian media is full of reports that the local arm of German-headquartered supermarket giant Aldi has been selling removable hard drives complete with a pre-installed virus.

Aldi joins an extensive list of companies which have managed similar snafus in the past, including IBM (pre-infected USB keys, given away at a security conference, no less), Olympus (pre-infected cameras),Samsung (pre-infected phones) and Best Buy (pre-infected digital picture frames).

Oh, and Aldi (pre-infected PCs). That's right - Aldi has done this before.

Last time, back in 2007, the virus it shipped was Angelina - a boot sector virus which relies on floppy disks to spread and was largely considered extinct, but obviously wasn't. This time, I'm afraid we don't yet have a name for the virus.

Someone from SophosLabs in North Sydney is making a dash to the local Aldi to see if he can find one that hasn't been withdrawn from sale yet.

If we find out any more details, I'll update this article; if not, I'm sure he'll take the opportunity to pick up a few 24-packs of potato crisps and a couple of metric dozens of ice-cream cornets whilst he's there, so it won't be a wasted trip.

(Update: our field researcher reports that the afflicted devices have gone without a trace, or perhaps were never offered in stores. He sadly failed to return with any comestibles, but did admit to have been "eyeing the pizza oven and the meat slicing machine like in delis." SophosLabs prosciutto pizza, anyone?)

Apparently, the affected device is an external 4-in-1 hard drive, DVD, USB and card reader device. It's still being offered on-line, and at $99, it sounds like quite a useful peripheral to go with a budget netbook which doesn't have much storage or memory card slots of its own. But if you've bought one, I recommend you give it a thorough virus scan.

Or simply zap the hard drive, removing and recreating all the partitions on it. You'll lose all of the freebie software pre-installed on the hard disk, but that's actually highly desirable since the one thing you now know is that you can't trust any of it.

Aldi, one imagines, will now be shopping for a more reliable supplier of peripherals.

Follow @duckblog

Apple iOS 4.3.4 jailbreak bugfix jailbroken already

Most iPhone and iPad users are perfectly happy with the software on the device as it is shipped by Apple.

A minority, however, prefer to open up their devices. By doing this, they can:

* Run applications and extensions not approved by Apple.

* Download software from alternative appstores, without tying those downloads to an Apple account.

* Access all the files and configuration data on their device directly, in order better to understand and secure it.

Liberating your device sounds like a great idea, but this behaviour has been stigmatised amongst corporate users.

Firstly, the action of removing artificial security restrictions is known as "jailbreaking," making it sound like a doubly-dangerous criminal act. (Since only crooks are supposed to be in jail in the first place, jailbreakers are not only criminals, but recidivists to boot.)

Secondly, jailbreaking opens up the less security-savvy user to additional risks. Some jailbreakers don't take on the additional responsibility which goes with the increased power over their device. That's how the now-infamous iPhone viruses Ikee and Duh were able to spread.

Thirdly, jailbreaking isn't supposed to be possible. So every jailbreak relies on you exploiting a software vulnerability to escape from Apple's artificial strictures. That means you have to trust the creators of the jailbreak not to abuse the exploit you're choosing to run against your device.

The flipside, of course, is that those who don't jailbreak their phones are trusting Apple not to leave the sort of exploitable hole that would permit crooks to break into the internals of their device.

And Apple hasn't been terribly trustworthy on that score. Despite a solid commercial reason for keeping its devices secure - namely, that an unjailbroken device can only shop at the Apple AppStore - few of Apple's operating system versions stay safe for very long.

Early in July, the JailbreakMe site published an automated, on-line method for opening recent iDevices running iOS 4.3.3.

(The jailbreakers also provided a patch by which you could close the remotely exploitable hole, for your own safety, after jailbreaking.)

Apple, to its credit, caught up within two weeks with an iOS update to version 4.3.4, closing the hole used by JailbreakMe.

But the jailbreakers claim to be back in already. By all reports, the latest jailbreak doesn't work for iPad2 users, and it can't be done simply by visiting a website.

You need to plug your device in to a computer, in what's called a "tethered" jailbreak, and you need to re-jailbreak it every time you reboot.

Nevertheless, Apple's latest security fix has been circumvented already.

With this in mind, the tricky question becomes, "Whom should I trust more: Apple or the jailbreakers?"

I can't answer that question - and if your iDevice is provided by your company, you shouldn't try to answer it by yourself.

Perhaps the best way to approach the issue is to rephrase it more equivocally, in the manner of Google, which sets out not to be evil, rather than actually to be good.

So, if you're thinking of jailbreaking, ask yourself, "Do I distrust the jailbreakers." If not, then jailbreaking may be for you. Just be sure to read all the security guidelines associated with the process, and be sure you have the explicit permission of the owner of the device.

PS. I have an iPad. It is jailbroken.

Follow @duckblog

‘Foreign government’ hackers steal secret Pentagon plans

BlueprintThe US Deputy Defense Secretary William Lynn has revealed that a foreign intelligence agency was behind a hack attack that stole classified information about a top secret weapons system.

According to Aviation Week, the weapons system, which is under development, might have to be redesigned after the files were stolen from a military contractor's computer network.

Plans and confidential blueprints were included in the haul of 24,000 files said to have been copied by the hackers.

The revelation came to light as William Lynn gave a speech at the National Defense University (NDU) in Washington DC, outlining his department's "first ever strategy for operating in cyberspace". Recognising that the problem extended beyond its own networks, the Pentagon is piloting a program to share classified intelligence about threats with select military contractors and their ISPs.

NDU was somehow an appropriate venue for the speech - Lynn told his audience that the National Defense University itself had fallen victim to hackers after its "website and its associated server were recently compromised by an intrusion that turned over system control to an unknown intruder."

William Lynn speech

Lynn's speech contained much jaw-jaw about the nature of cyberwar - and how it could vary from destructive attacks to information theft:

"Tools capable of disrupting or destroying critical networks, causing physical damage, or altering the performance of key systems, exist today. The advent of these tools mark a strategic shift in the cyber threat - a threat that continues to evolve. As a result of this threat, keystrokes originating in one country can impact the other side of the globe in the blink of an eye. In the 21st Century, bits and bytes can be as threatening as bullets and bombs."

"But disruptive and destructive attacks are only one end of a continuum of malicious activity in cyberspace that includes espionage, intellectual property theft, and fraud. Although in the future we are likely to see destructive or disruptive cyber attacks that could have an impact analogous to physical hostilities, the vast majority of malicious cyber activity today does not cross this threshold."

"In looking at the current landscape of malicious activity, the most prevalent cyber threat to date has been exploitation - the theft of information and intellectual property from government and commercial networks."

ChessI have always been nervous of the tendency amongst governments to point fingers at foreign nations and blame them for an internet attack. For instance, Lynn claims that a foreign government was involved in the hack, but does not say which one.

You have to ask yourself, why the reluctance to say which country? And if you don't know which country, how do you know it was any country?

Of course, the US Deputy Defense Secretary has shown himself to be tight-lipped on matters to do with internet attacks in the past. For instance, he declined to confirm or deny if the USA had been responsible for the Stuxnet virus.

And we shouldn't be naive. Just because it's hard to prove that a particular country was behind a particular cyber attack, doesn't mean that that country is whiter-than-white when it comes to such things.

My suspicion is that all countries are using the internet to their advantage when engaged in espionage - whether it be for political, economic or military ends.

Nuclear buttonWhat surprises me, however, is that Lynn claims that these sort of "sophisticated capabilities" (the ability to hack into military contractor computer systems and steal files) is almost exclusively within the abilities of nation states, and that the only thing stopping countries from using the internet to destroy their enemies is the risk of a military counter-attack:

"Today, sophisticated cyber capabilities reside almost exclusively in nation-states. Here, U.S. military power offers a strong deterrent against overtly destructive attacks. Although attribution in cyberspace can be difficult, the risk of discovery and response for a major nation is still too great to risk launching destructive attacks against the United States. We must nevertheless guard against the possibility that circumstances could change, and we will have to defend against a sophisticated adversary who is not deterred from launching a cyber attack."

Of course, terrorists probably wouldn't fear a counter-attack like this. Why haven't they launched a destructive strike against the United States? Well, Lynn has an answer for that:

"If a terrorist group gains disruptive or destructive cyber tools, we have to assume they will strike with little hesitation. And it is clear that terrorist groups, as well as rogue states, are intent on acquiring, refining, and expanding their cyber capabilities."

Hmm. So, thank goodness that only governments know how to get their hands on the most dangerous and destructive internet weapons and that the rest of the world just isn't as sophisticated..

The PentagonMarine Gen. James Cartwright, Vice Chairman of the Joint Chiefs of Staff, told the press gathered at NDU that he believed a defensive approach to cyberwar is insufficient, and that the current situation of the Pentagon being 90% focused on defensive measures and 10% on offensive, should be reversed.

One thing is clear amongst all this talk - computer security needs to be taken seriously. Cybercriminals, whether state-sponsored or not, are regularly going beyond damaging and defacing websites to stealing sensitive information which could have more than a financial value. You would be foolish to ignore such a threat, and ensure that you have strong defences in place.

Meanwhile, the US Department of Defense says that it is now treating cyberspace as an operational domain - alongside land, air, sea and space. As such, I think we can expect to see more speeches warning about the perils that the United States faces from other nations and terrorist forces.

Follow @gcluley

Further reading: You can read the full speech by William Lynn on the defense.gov website.


Zeus for Android and fake Kaspersky Antivirus 2011

Android shotOver the weekend I wrote about the discovery of the potential Android component of the Zeus information-stealing toolkit (also known as Zitmo).

I wanted to share an update as there are further developments which have been uncovered about the relationship between the Zeus toolkit and Andr/SMSRep-B.

Thanks to Denis from Kaspersky Labs we can now confirm that the fake Trusteer Rapport application is related to malicious websites set up as command-and-control servers for several Zeus/Zbot botnets.

The server-side Zeus application checks for the User-Agent string of the HTTP requests and delivers the malicious payload based on the browser type.

In the case of Android. the default browser User-Agent string will be similar to "Mozilla/5.0 (Linux; U; Android 2.2)..." and from there the operating system can be easily determined.

On a separate note, it seems that the tradition of malware pretending to be legitimate anti-virus software for Android is extending.

After Trusteer, the next target is Kaspersky Labs. Yesterday, I had a chance to analyse a sample of Android malware which attempts to fool the user into installing the package by looking like a legitimate Kaspersky Antivirus 2011 product.

The application package uses an icon similar to the Kaspersky Lab icon, but the actual functionality is far less useful than the functionality of the legitimate product.

When the package is launched the malware attempts to get the unique device id number and transform it into an "activation code". The fake activation code is then displayed in a standard Android view.

Fake Kaspersky Antivirus 2011

In the background, the application installs a broadcast receiver that attempts to intercept SMS messages and send them to a web server set up by the attacker.

Luckily, in the case of this malware (which Sophos detects as Andr/SMSRep-C), the command-and-control web server IP address is 127.0.0.1 (localhost), which does not make the malware very useful.

Clearly, this is just an early test build and we will have to be on watch for the next version which will be connected with a real malicious server.

Although the functionality of Andr/SMSRep-B and Andr/SMSRep-C is quite similar, the code does not indicate that they have been developed by the same author.


MasterCard.com brought down in apparent Wikileaks-motivated internet attack

MasterCard and WikiLeaksMasterCard's website was knocked offline earlier today following a WikiLeaks-inspired internet attack against it.

In what appears to be the latest salvo by hactivists, the mastercard.com website is thought to have suffered from a denial-of-service attack - where an internet site is bombarded with a large amount of traffic making it impossible for genuine visitors to access it.

A Twitter user called ibomhacktivist seems to be taking responsibility for the attack, and links the action to the WikiLeaks-inspired attack on MasterCard by the Anonymous group last year.

Tweet about Mastercard.com website

MasterCard.com DOWN!!!, thats what you get when you mess with @wikileaks @Anon_Central and the enter community of lulz loving individuals :D

MasterCard angered the hacktivist community after it suspended the ability for WikiLeaks to accept payments via the firm. Police in the Netherlands arrested two teenagers for allegedly playing their part in the attacks last year.

WikiLeaks is a subject which tends to generate strong emotions - whether you're in favour of what the organisation stands for, or against it.

Computer users would be wise, however, to remember that even if you feel WikiLeaks is being persecuted by the authorities or abandoned by online companies, denial-of-service attacks are still illegal.

I'll update this article with more information as it becomes available, or alternatively follow me on Twitter.

Follow @gcluley

Update: The MasterCard.com website appears to be back online. It will be interesting to see if it stays up, or whether it will sporadically disappear again. Fingers crossed.


Fake anti-virus cloaks itself to appear to be Microsoft Update

We are seeing the criminals behind fake anti-virus continuing to customize their social engineering attacks to be more believable to users and presumably more successful.

Last week I wrote about fake Firefox malware warnings leading users to rogue security software. This week they've started to imitate Microsoft Update.

Fake Microsoft Update page. Click for larger version

The page is nearly an exact replica of the real Microsoft Update page with one major exception... It only comes up when surfing from Firefox on Windows. The real Microsoft Update requires Internet Explorer.

The same site was also hosting the traditional Windows XP explorer scanner we have seen for years, as well as a new Windows 7 scanner.

Similar to spam messages that have corrected their grammar and use correct imagery and CSS, the attackers selling fake anti-virus are getting more professional.

They use high quality graphics and are using information from our UserAgent strings that are sent by the browser to customize your malware experience.

Just like visiting your bank you should only trust security alerts in your browser if you initiated a check with Microsoft, Adobe, Sophos or any other vendor for updates to their software.


Adobe Flash security update for Windows, Mac, Android, Linux and Solaris users

Adobe Flash patchIt doesn't matter if you run Windows, Mac, Linux, Solaris or even Android.. if Adobe goes public about a security vulnerability in its Flash product, you better install the patch to protect against the problem.

Adobe's emergency patch was issued over the weekend to protect against a cross-site scripting vulnerability.

Targeted attacks could use the vulnerability to trick users into clicking on a malicious link delivered in an email message.

Adobe says that Adobe Flash Player 10.3.181.16 and earlier are vulnerable on Windows, Macintosh, Linux and Solaris operating systems. On Android, Adobe Flash Player 10.3.185.22 and earlier versions are at risk.

You can visit a page on Adobe's website to determine which version of Adobe Flash you are running.

More information can be found in Adobe's security bulletin APSB11-13.


Strike three: Speculation rises that another US military contractor has been hit by hackers

Military aircraftFox News is reporting that US military contractor Northrop Grumman may have suffered a hacking attack on its networks.

If true, the defense giant will be joining the likes of L-3 Communications and Lockheed Martin who have both been targeted in recent weeks by cyber attacks.

According to Fox News, Northrop Grumman unexpectedly shut down remote access to its network on May 26th, just five days after Lockheed Martin detected that unauthorised persons had infiltrated its systems.

A anonymous source at Northrop Grumman, which is the US's second-largest defense contractor, told Fox News that the sudden lockdown was a shock to staff:

"We went through a domain name and password reset across the entire organization. This caught even my executive management off guard and caused chaos. I've been here a good amount of time and they've never done anything this way - we always have advanced notice."

SecurID tokenSpeculation is rising that what links the L-3, Lockheed Martin and Northrop Grumman security breaches are RSA's SecurID tokens - devices used by many organisations worldwide to provide two factor authentication for remote staff.

In March, RSA admitted that it had been hacked, and some of the information stolen was specifically related to their SecurID two-factor authentication products.

RSA, the security division of EMC, hasn't been forthcoming about the precise details of what was taken when they were hacked - but now that a third military contractor appears to have suffered as a consequence, there will be many firms keen to hear more details of how they should protect themselves.


How to stop your Gmail account being hacked

GmailAs has been widely reported, high profile users of Gmail - including US government officials, reporters and political activists - have had their email accounts hacked.

This wasn't a sophisticated attack against Google's systems, but rather a cleverly-crafted HTML email which pointed to a Gmail phishing page.

Victims would believe that they had been sent an attachment, click on the link, and be greeted by what appeared to be Gmail's login screen. Before you knew it, your Gmail username and password could be in the hands of unauthorised parties.

So, what steps should you take to reduce the chances of your Gmail account being hacked?

  1. Set up Two step verification
  2. Check if your Gmail messages are being forwarded without your permission
  3. Where is your Gmail account being accessed from?
  4. Choose a unique, hard-to-crack password
  5. Secure your computer
  6. Why are you using Gmail anyway?

1. Set up Two step verification

The hackers who broke into high profile Gmail accounts grabbed usernames and passwords. So, an obvious thing to do would be to make Gmail require an extra piece of information before allowing anybody to access your account.

Google provides a facility called "two step verification" to Gmail users, which provides that extra layer of security. It requires you to be able to access your mobile phone when you sign into your email account - as they will be sending you a magic "verification" number via SMS.

The advantage of this approach - which is similar to that done by many online banks - is that even if cybercriminals manage to steal your username and password, they won't know what your magic number is because they don't have your phone.

Google has made two step verification easy to set up.

Setting up 2 step verification

Once you're set up, the next time you try to log into Gmail you'll be asked for your magic number after entering your username and password. Your mobile phone should receive an SMS text message from Google containing your verification number.

Mobile phone receives verification number

Let's just hope the bad guys don't have access to your mobile phone too..

Here's a video from Google where they explain two step verification in greater detail:

You can also learn more about two step verification on Google's website.

By the way, note that two step verification doesn't mean that your Gmail can't ever be snooped on by remote hackers. They could, for instance, install spyware onto your computer which could monitor everything that appears on your screen. But it's certainly a good additional level of security for your Gmail account, and one which will make life much more difficult for any cybercriminal who might be targeting you.

2. Check if your Gmail messages are being forwarded without your permission

Gmail gives you the ability to forward your emails to another email address. There are situations where this might be handy, of course, but it can also be used by hackers to secretly read the messages you receive.

Go into your Gmail account settings, and select the "Forwarding and POP/IMAP" tab.

If your emails are being forwarded to another address, then you will see something like the following:

Gmail forwarding

That's fine if you authorised for your emails to be forwarded to that email address, but a bad thing if you didn't.

If your messages are not being forwarded you will see a screen more like this:

Gmail forwarding

Hackers want to break into your account not just to see what email you've received up until their break-in. Ideally, they would like to have ongoing access to your email, even if you change your password or enable two step verification. That's why it's so important to check that no-one has sneakily asked for all of your email to be forwarded to them.

3. Where is your Gmail account being accessed from?

At the bottom of each webpage on Gmail, you'll see some small print which describes your last account activity. This is available to help you spy if someone has been accessing your account at unusual times of day (for instance, when you haven't been using your computer) or from a different location.

Last account activity

Clicking on the "Details" option will take you to a webpage describing the type of access and the IP address of the computer which logged your email account. Although some of this data may appear nerdy, it can be a helpful heads-up - especially if you spot a computer from another country has been accessing your email.

IP addresses of computers accessing Gmail account

4. Choose a unique, hard-to-crack password

As we've explained before, you should never use the same username and password on multiple websites. It's like having a skeleton key which opens every door - if they grab your password in one place they can try it in many other places.

Also, you should ensure that your password is not a dictionary word, and is suitably complex that it's hard to break with a dictionary attack.

Here's a video which explains how to choose a strong password, which is easy to remember but still hard to crack:

(Enjoy this video? You can check out more on the SophosLabs YouTube channel and subscribe if you like)

Don't delay, be sensible and make your passwords more secure today

And once you've chosen a safer password - keep it safe! That means, don't share it with anyone else and be very careful that you're typing it into the real Gmail login screen, not a phishing site.

5. Secure your computer

Secure PCIt should go without saying, but this list would be unfinished without it. You need to properly secure your computer with up-to-date anti-virus software, security patches and so forth. If you don't, you're risking hackers planting malicious code on your computer which could spy upon you and, of course, your email.

You always want to be certain that your computer is in a decent state of health before you log into a sensitive online account, such as your email or bank account. That's one of the reasons why I would always be very nervous about using a computer in a cybercafe or hotel lobby. You simply don't know what state the computer is in, and who might have been using it before.

6. Why are you using Gmail anyway?

Okay, I don't really mean that. But I do mean, why are you storing sensitive information in your Gmail account?

The news headlines claim that senior US political and military officials were being targeted by the hackers. Surely if they had confidential or sensitive data they shouldn't have that in their webmail account? Shouldn't that be on secure government and military systems instead?

Always think about the data you might be putting on your web email account - because if it's only protected by a username and password that may actually be less security than your regular work email system provides.


Fake Firefox warnings lead to scareware

Nuclear Firefox logoPurveyors of fake security software don't let much grass grow under their feet and continually make improvements to their social engineering lures.

While most of the talk for the past month has been their move to Mac with fake Finder pop-ups that appear to scan your computer, they haven't stopped innovating on Windows either.

Their latest scam? They detect your user-agent string from your web browser and display a fake Firefox security alert if you are using the Mozilla Firefox web browser.

Fake Firefox security alert

Internet Explorer users get the standard "My Computer" dialog that appears to do a system scan inside their browser window.

Taking advantage of detailed information about the person's computer and software allows for a much more specific, believable social engineering attempt.

We are likely to continue to see these criminals targeting each operating system, browser and any other details that can be gleaned from HTTP requests sent from our devices.

If you click the "Start Protection" button you will download the latest, greatest fake anti-virus program which will perform exactly the way you would expect a fake anti-virus program to.

It will faithfully detect fake viruses on your computer until you register it for $80 or more.

If you are a Firefox user and see a warning about viruses on your computer, you will know it is fake. Firefox does not include a virus scanner inside of it and it will only warn you about visiting malicious pages.

If you get a warning about a dangerous website from Firefox you can always play it safe... Close the browser.

Nuclear Firefox image credit: iPholio on DeviantArt