Downadup Worm Fooling Vista And Windows 7 Beta

Worm epidemy that has infected over 10,000,000 systems so far doesn't spread using network only. F-Secure warns that Downadup worm uses also sneaky social engineering way to spread itself. Windows Vista and Windows 7 beta users must be careful with removable USB drives now.

F-Secure warns in its blog namely about sneaky USB functionality of Downadup aka Conficker worm. The worm copies autorun.inf file to USB removable drive. If USB drive is plugged into other computer parasite tries to start up from the drive using modified Vista Autoplay notification window.

Normally, when USB drive is plugged in a window opens up asking if user wants to run the program on removable drive. Under that option there's an option that can be used to explore the contents of USB drive. What the worm does is that it modifies the first option. Icon is changed and program name is modified. Instead of showing a question if user really wants to run program named autorun.inf, system shows an icon and name that by first look may fool user to think it's just an option to browse USB memory contents (pic). If user gives permission attacking code on the USB memory will be run.

F-Secure says that it made test on Windows 7 beta and says the trick was successful on it too.

Watch Out For Fake Obama Sites

F-Secure warns in its latest blog entry about fake sites trying to cash in with the inauguration of Barack Obama next week.

As an example F-Secure mentions www.superobamaonline.com. All links on that site point to a file named as speech.exe, which is a Waledec malware variant.

Other seen domains are for example:
www.greatobamaguide.com
www.superobamaonline.com
www.greatobamaonline.com
store.superobamadirect.com
store.greatobamaguide.com

Oracle Releases Bunch of Updates

Oracle has released updates that contains fixes to 41 different vulnerabilities. The fixes are part of the company's quarterly CPU (critical patch update).

Exact list of the vulnerabilities and instructions how to apply the fixes can be read from Oracle's Critical Patch Update Advisory.

Next critical patch update Oracle plans to release in April 2009.

Security Update For January 2009 From Microsoft

Microsoft will release tomorrow, 13.1.2009, its monthly security update packet. This month update contains one update. Affected are all supported Windows operating system versions. Vulnerability that will be patched with this update is critical for Windows 2000, XP and Server 2003. For Windows Vista and Server 2008 the vulnerability is categorized as moderate. According to the correspondent security bulletin advance notification update requires a system restart.

New version of Microsoft Windows Malicious Software Removal Tool will be released too.

More information about the update can be read here.

The easist way to get the update is to use Microsoft automatic update service.

Spammers Take Advantage of Google Code Project

"Google’s code-hosting project is the latest free service to be abused by web spammers", writes Chris Barton, McAfee researcher. According to Barton bad guys are creating plenty of new projects with this type of website that redirects user to fake codec download site.

The assault follows a bout of the same kind of abuse against Microsoft's comparable MSN Spaces beta site dating back a year. Barton states that the difference is that Google appears to automatically index code projects.

Barton's blog post can be read here.

Twitter Warns About Phishing

Twitter warns its users about direct messages and direct message email notifications that redirects to what looks like Twitter.com and which criminals are using trying to steal users' usernames and passwords.

Scam message says something like "hey! check out this funny blog about you..." and provides a link. That link redirects to a site masquerading as the Twitter front page.

Twitter tells that it's proactively resetting the passwords of the accounts.

SMS Vulnerability In Symbian S60 smartphones

There's been found a vulnerability in Symbian S60 platform using smartphones. By exploiting the vulnerability an attacker may prevent the target recieve sms and mms messages. That kind of state can be caused by sending one or more specially crafted sms message to the recipient's phone. Part of S60 phones alert of end of memory after recieving enough of these specially crafted text messages. Other part stops recieving the messages immediately.

Symbian OS is operating system used in many mobile devices. It's S60 platform is used by most mobile phone manufacturers like Nokia, Siemens and Sony Ericsson.

Vulnerable S60 series versions are:
-S60 2nd Edition, Feature Pack 2 (s60 2.6)
-S60 2nd Edition, Feature Pack 3 (s60 2.8)
-S60 3rd Edition, Initial Release (s60 3.0)
-S60 3rd Edition, Feature Pack 1 (s60 3.1)

Phones with S60 version higher than 3.1 are not vulnerable.

Mobile phones can be restored from the vulnerability caused state by doing 'factory reset'. This will reset all settings made by user to the default ones.

It's also possible to protect the phone against these crafted messages by installing S60 suitable antivirus software capable of detecting the exploiting messages.

More information can be read from F-Secure's Blog