DevTopics » Threats

April Fool’s Worm is No Joke

timm — Thu, 26 Mar 2009 14:03:50 +0000

Security experts have joined forces to hunt down the Conficker C computer worm and prevent it from damaging millions of computers on April Fool’s Day. They are motivated in part by a $250,000 bounty from Microsoft for information leading to the arrest and conviction of the responsible hacker(s).

“We love catching bad guys,” said Alvin Estevez, CEO of Enigma Software Group, one of many companies trying to break the Conficker virus. “We’re like former hackers who like to catch other hackers. To us, we get almost a feather in our cap to be able to knock out that worm. We slap each other five when we’re killing those infections.”

The malicious Conficker program has already infected between 5 million and 10 million computers. Those infections haven’t caused many problems yet, but according to the virus code, a master computer is scheduled to gain control of infected machines on April 1.

What happens then is anyone’s guess. The program could delete files on infected computers, orchestrate denial-of-service attacks to shut down websites, or monitor a person’s keystrokes to steal private information like passwords and bank account numbers. Experts say computer hackers have mostly migrated from computer vandalism and now focus on making money. Some security researchers say the Conficker worm will go the way of the Y2K millennium bug, in other words, no big deal.

If your computer did not receive automatic Windows updates in March, it may be infected. Windows users can also visit http://safety.live.com to scan their PC. You should also check your antivirus software to ensure it has received the latest updates, which could have been disabled by Conficker C.

Story at CNN

Virus in Spaaaaaace

timm — Fri, 29 Aug 2008 15:01:16 +0000

A virus has infected some laptop computers aboard the International Space Station. The low-risk virus, designed to swipe passwords from online gamers, was identified as the W32.Gammima.AG worm.

"This is basically a nuisance," said NASA spokesperson Kelly Humphries. An investigation is underway to determine how the virus got on board the space station, which is floating more than 200 miles above the Earth. "We’ll do our best to track down how it got there and close that gateway," Humphries said. "This is not a frequent occurrence but we have had viruses that have made their way on board before."

Only a handful of the 71 laptops currently on board the space station run Windows. Those laptops will likely be updated with the newest patches and anti-virus software, something you think NASA officials would have done long ago.

D’oh! Hackers Take Over Simpson’s Fans’ PCs

timm — Tue, 22 Jul 2008 14:41:53 +0000

If you’re one of thousands of Simpsons fans who added ChunkyLover53 as an AOL Instant Messenger buddy, your computer may be at risk from a Turkish botnet.

This story starts in 2002 in a Simpsons episode called "The Dad Who Knew Too Little." As Homer was accessing his email, his address was revealed on screen as chunkylover53@aol.com. Naturally, thousands of fans attempted to contact the yellow fellow via his AOL email address. Matt Selmon, a Simpsons writer, had thought ahead and registered the email address in the real world. He answered as many of the messages as he could, delighting fans who received responses from "Homer."

Many fans also added ChunkyLover53 to their AIM friends list. No doubt they were disappointed when Homer never signed on, but they likely forgot about it as time went on.

Now six years later, ChunkyLover53 has become active again, sending a message to all his AIM friends. If you view this message, you’ll see a link to a new web episode of The Simpsons. If you foolishly click that link, you get an error message. You also get infected with a Turkish botnet that uses your PC to steal your sensitive data and conduct spam attacks on other PCs.

Turns out the ChunkyLover53 account was hijacked by some very bad people. This nasty attack, first reported by FaceTime Security Labs, employs a solid rootkit, so the only way to remove the infection is to reinstall your PC operating system from scratch. As Homer would say, "D’oh!"