Bank Accounts Vulnerable For Victims of ZeuS Trojan Variant 'Gameover'

tsu doh nimh writes "Organized crooks have begun launching debilitating cyber attacks against banks and their customers as part of a smoke screen to prevent victims from noticing simultaneous high-dollar cyber heists, the FBI is warning. The thefts, aided by a custom variant of the ZeuS Trojan called 'Gameover,' are followed by distributed denial of service (DDoS) attacks against banks and the victim customers. The feds say the perpetrators also are wiring some of the money from victim organizations directly to high-end jewelry stores, and then sending money mules to pick up the pricey items."

Comments

Ha! Stupid criminals

[Baloroth]

I keep all my money in my house! Perfectly safe. No organized crooks gonna steal my money.

Re:Ha! Stupid criminals

[fsckmnky]

Perhaps you have not heard the term "quantitative easing."

Re:Ha! Stupid criminals

[Anonymous Coward]

I'm sure you haven't either.

Re:Ha! Stupid criminals

[ColdWetDog]

I would certainly not describe the current US government as 'organized'.

The Keystone Cops come to mind as a role model.

Re:Ha! Stupid criminals

[Relayman]

Just don't donate the suit with the $13,000 in it to Goodwill.

Re:Ha! Stupid criminals

[Anonymous Coward]

Unless it burns down.

Re:Ha! Stupid criminals

[History's Coming To]

You might be kidding but I keep a 6-month-earnings stash in banknotes nearby for exactly that reason. The banks seem to be all too good at just giving/gambling customer's money away these days.

Re:Ha! Stupid criminals

[Dunbal]

That is not specific to a country. Any government will do.

Re:Ha! Stupid criminals

[Dunbal]

Yep, it's not like you're going to be taking a hit on the lost interest, either. When you factor in service charges, it costs you money to keep your money in a bank. And if they can't even keep your money safe, well, what is the point?

Re:Ha! Stupid criminals

[ZenDragon]

Off topic I know, but that's really weird... why would he have 13k in cash in a suit pocket that he intended to spend on hospital bills? Something doesn't add up there.

Re:Ha! Stupid criminals

[davecason]

And mine is in gold... does anybody have a wheelbarrow I can borrow?

Re:Ha! Stupid criminals

[Anonymous Coward]

This is what happens when you fuck a stranger in the ass.

Re:Ha! Stupid criminals

[Aighearach]

Yep, it's not like you're going to be taking a hit on the lost interest, either. When you factor in service charges, it costs you money to keep your money in a bank.

If you're paying more in charges than you're getting in interest, you're either misusing a debit card, or have too small an amount in the bank for a useful generalization.

Re:Ha! Stupid criminals

[Anonymous Coward]

Yep, it's not like you're going to be taking a hit on the lost interest, either. When you factor in service charges, it costs you money to keep your money in a bank. And if they can't even keep your money safe, well, what is the point?

Then why are you still using a bank? Sure the interest rates are low, but my credit union charges me nothing. And I, like most of the owners, prefer the credit union to be stable instead of taking wild risks for profits. And we're sick of bailing out your accounts too.

Still clicking the links in emails?

[somebodee]

Seriously? People are /still/ clicking the links in shady emails/downloading files from them? What, is this 1998?

Re:Still clicking the links in emails?

[fsckmnky]

Who can resist an important message from Sandra, the topless 3 boobed Nigerian government official charged with distributing $10 million dollars in oil industry windfall profits and free samples of Viagra ?

Re:Still clicking the links in emails?

[gvaness]

Sounds hot, you got a link?

Re:Still clicking the links in emails?

[Archangel Michael]

Think about it this way, then it will make perfect sense. Think about how ignorant the average person is, and realize that about 1/2 of the people are even more ignorant than average (for acceptable levels of average).

So yes, people still are doing stupid stuff on computers.

Re:Still clicking the links in emails?

[Anonymous Coward]

Could you forward me that email?

Re:Still clicking the links in emails?

[amicusNYCL]

Zeus is spread mainly through drive-by downloads and phishing schemes.

Drive-by downloads have been the primary infection vector for a while now.

Re:Still clicking the links in emails?

[Anonymous Coward]

I'm unclear on the term "Drive By Download"...to me it's always meant "Stupid User Clicked Install", I don't mean to be elitist or a jerk, I just want a definition of the phrase

Re:Still clicking the links in emails?

[bmo]

No, "drive by download" means going to google, clicking on a SEO link attached to a malware site, and getting screwed over.

You're being elitist.

--
BMO

Re:Still clicking the links in emails?

[Anonymous Coward]

clicking on a SEO link attached to a malware site

What exactly is an SEO link? Of course it is a malware site, how does the drive by download happen?

Re:Still clicking the links in emails?

[Fluffeh]

I find your comment interesting and would like to subscribe to your newsletter.

Re:Still clicking the links in emails?

[Anonymous Coward]

Think about how ignorant people are they can not program their own space shuttle launch and all the surrounding software that goes with it! Geeze anyone should be able to do that. Yet none never bother.

That is how your post sounds. To *MOST* people computers are just some toy or tool to get things done. Not something they really want to give a crap about.

Re:Still clicking the links in emails?

[LordLimecat]

not to mention ignorant.

Its always the clever ones who think their 1337 skilz will render them immune to exploits for their out-of-date java plugin.

Re:Still clicking the links in emails?

[Anonymous Coward]

You go to a legitimate page which has been compromised, or is hosting adds and the add site has been compromised. The page attempts to exploit your browser, usually with a disclosed vulnerability. If you haven't applied that latest patch you get knocked over without clicking any links.

After any big even there are usually malicious sites near the top of the Google rankings which will attempt to exploit any one who lands on them. After the tsunami in Japan there were fake news results in the top 10 with in 2-3 hours doing this.

Re:Still clicking the links in emails?

[DrgnDancer]

SEO=Search Engine Optimized. So it's like this. Your Flash Player is a month out of date and has a secuity hole. You search for a popular term. Maybe something game related, or porn, or whatever. Bad guy has a carefully crafted page that has been SEOed to appeared fairly high in the rankings for your popular search. The exploit is in the Flash on the page. You don't have to do anything except click the link (which seems perfectly legitimate).

Of course if you've got No-script or Ad Block, you're probably fine, but most people don't use stuff like that. See above for "People expect their computers to be tools" rant. What they did might have been mildly stupid: They should upgrade their plugins, they should read links more carefully, they should use some kind of script blocker, but it falls well within what most normal users would consider reasonable. Still infected though.

Re:Still clicking the links in emails?

[Em Adespoton]

A large attack vector for SEO poisoning is image searches. Unless you're running with NoScript or JS disabled, all you have to do is click on the wrong link in a random image search result, and the rest happens in the background. While you're sitting there looking at images of Martin Luther King, Jr. (and wondering why there's a photo of chocolate cake on the page as well, and one of some puppies), a multi-exploit probe script starts up in the background, quickly figures out what OS, browser and general environment you're using (think malware author's version of 'make'), and then downloads and executes an exploit path custom to your configuration.

Of course, the term "drive-by download" does also include the FakeAV stuff that automatically downloads and sits in your download folder, waiting for you to say, "hey, what's this zipfile doing in here with the 'reallysuperantivirus.exe' inside? I guess I should run it to find out!"

Re:Still clicking the links in emails?

[DeadCatX2]

One day, I was browsing Google Image Search, looking to identify an ambiguous connector. (it ended up being a connector from JST)

Suddenly, I'm greeted with a UAC prompt. Having done nothing to instigate a UAC prompt, I immediately killed firefox. Nonetheless, there was a rogue process on my machine that was attempting to gain root access by desperately popping up anti-virus messages. Being an intelligent user, I discovered what process was responsible and promptly killed and deleted the offending binary from my machine.

I never even clicked anything.

Re:Still clicking the links in emails?

[anubi]

I noticed you posted as AC. I do not like to like to say what I need to say in cases like this, as I do not like hurt feelings.

You are average. You are not a computer "nerd" and are uninformed on the workings of errant programmers.

Programmers with malicious intent prey on people like you.

You could have googled "drive-by download" in less time than it took to post, and got lots of answers.

You didn't.

You wanted someone else to do it for you.

Well, that makes sense in a way.

In the business world, its called "delegation", and people who are good at it make a lot more money than those who just do what they are told.

In the shyster world, they are willing to tell you anything you want to hear in order to get you to admit their shyster code into your machine. Big deal, you might say.

Remember, even the lettering on the buttons is set by the programmer, Once you understand the power of JavaScript, you realize NOTHING your screen tells you can actually be trusted.

Really, no big deal? Its just a computer? How about handing out your checkbook, legal papers, deeds to your house, along with your personal seal of authenticity - to strangers?

Anything YOU can do on your computer, a stranger can do too, in your name, and probably a whole lot more that you didn't know you could do.

Once you have admitted their "agent" into your machine, its as if you have admitted an invisible "housekeeper" into your home, which can rifle through all your personal effects retrieving and sending to its author anything on its agenda.

Many people have not learned yet to take their privacy seriously.

They are led to believe "I am not a criminal - I do not have nothing to hide. If you have something to hide, its only because I have done something wrong which I am trying to keep from you!".

This whole story is about privacy - or what happens when it is breached - in this case by a computer trojan.

This is why we have so many stories and discussion here on Slashdot about how precious our privacy is,

Even "respectable businesses" that spill private information often shy away from cleaning up the mess made in your life by shysters taking advantage of the situation at your expense.

I cringe every time I hear someone accusing me of having something to hide because I must have done something wrong. Although I am not supposed to pray for someone else's woes, I often find myself uttering a silent prayer that their pristine crystal world will be shattered by someone taking their good name for a roll in the pig sty.

If "privacy" is so wrong, then why is our government so adamant on "security clearances".?

Re:Still clicking the links in emails?

[Anonymous Coward]

Anytime somebody says "I don't mean to be .... but" -- They Are

Re:Still clicking the links in emails?

[dissy]

While having out of date software is asking for troubles, lately with the thriving zero-day exploit market, even performing that task is not guaranteed to protect you.

It really requires nothing more than clicking the first link in Google.

Scary world. But aside that, you can't possibly blame the person using the web for a zero day (That's addressed to you Mr GP, not the parent)

Re:Still clicking the links in emails?

[TwilightXaos]

But people do "give a crap about" their money. To imply that parting fools from their money necessitates computers is disingenuous.

Re:Still clicking the links in emails?

[Dunbal]

No one can program their own space shuttle launch. That's why it takes a team - even for NASA.

As for YOUR post - if you drive a car you are expected to know a) how an internal combustion engine works and what oil is for and why you should check it once in a while b) whether your car runs on diesel or gasoline/petrol c) how to change a flat tire and d) when to take your car in for service/repairs. If you don't know the preceeding, then you really shouldn't be driving a car. Likewise with computers.

Re:Still clicking the links in emails?

[Anonymous Coward]

"Not something they really want to give a crap about."

Hence the problem. You(royal you) don't drive your car without knowing WTF you're doing, but you trust your financial information to a device you don't even remotely understand or want to? Why not drive without a steering wheel? Or hold all your money in a pocket that has a hole in it? Sure, you could do that but when you wreck or lose your life savings, some people are gonna say "omg, that's so horrible" and the rest of us are going to laugh until we piss ourselves.

Re:Still clicking the links in emails?

[bmo]

>A large attack vector for SEO poisoning is image searches

I personally ran into this while looking for flooding pictures in Warwick RI a couple of springs back.

Nearly half the Google results on the first page were SEO malware sites.

--
BMO

Re:Still clicking the links in emails?

[f1vlad]

You can see plenty of them here: http://www.419eater.com/ in a Hall of Shame.

Re:Still clicking the links in emails?

[Anonymous Coward]

If he had been identifiable, I would not have used the language I did.

To me, the post was a typical example of the level of education and interest I observe in the general public.

These folks may make great executives and supervisors, but online, they can be sitting tame ducks, used to their laws and etiquette that aren't honored by everyone else on the net.

( I am not on a secure connection now... hence I am posting AC)

Re:Still clicking the links in emails?

[Archangel Michael]

Car Analogy: "I hear, if you put a cup of sugar in your gas tank, you can get double the miles per gallon you get now"

I expect that enough people don't know enough about cars that some idiot might WANT to believe such a statement long enough to put sugar in their gas tank, HOPING to get better mileage because they do care about money.

YES, I do expect people to know about how a ICE works, enough to know that putting sugar in the gas tank is a BAD idea. That is why Social Engineering is the greatest threat to computers, because the whole point of it is proven by how successful it is. And that arises because people are ignorant, trusting, hopeful, greedy ...

Humans are flawed. Most of us tragically so.

Re:Still clicking the links in emails?

[cavreader]

Too many people confuse the right to privacy with the right of anonymity. Personal information on people existed prior to the Internet and IP addresses. Things like phone books, marriage records, birth certificates, home/auto loans, and property deeds which can be obtained at any local government that keeps track of property taxes. Utility bills, drivers licenses, education records, insurance policies, and bank records have been available easily with or without any subpoena for over the past 50+ years. Earn no income that is subject to state or federal taxes otherwise that information will also be available in hard copy. The Internet just makes collecting this information faster. If you really want privacy unplug, store your money in your mattress, use cash and barter for all financial transactions , never enter into any type of agreement that requires more than a handshake, move to the wilderness and be prepared to turn off any anything that shows up in infrared when the satellites make their pass over your place. If this all seems too much of bother you could just stop posting your life story on Face book. If someone wants your information they don't need the Internet to get it. We have finally entered into the era where a lot of people have never had to live without access to the Internet and unfortunately these people are turning out to be the biggest morons on the planet. If you want true facts good luck finding them on the Internet, If you want a real education stop using Internet searches to find your answers and do real research that *gasp* might rely on using hard copy books. The Internet was supposed to herald the age of free and easy information exchange unfortunately the majority of that free information is bullshit and all around mis-information that has only increased the amount of acrimony and animosity in the world.

Re:Still clicking the links in emails?

[Anonymous Coward]

Dear god. It took about 5 posts for someone to actually give the information the GP requested instead of giving some half-baked "you should know this already" snooty reply. I'm glad you're modded +5 so I didn't have to waste my own mod points to raise you up.

Scumbag Slashdot: Bitches that people are uninformed about their computers; refuses to give a straight answer when someone asks a computer question.

Re:Still clicking the links in emails?

[berzerke]

...Of course if you've got No-script or Ad Block, you're probably fine...

Ad Block I love (actually adblock plus), but I've tried No-Script and don't have it any more. It's a great idea, but for most people, it's just too much work. Too many sites don't work properly without javascript. It's stupid and it's wrong, but that's the reality on the web. You wind up just disabling no-script before too long because yet another site doesn't work properly and you're tired of making an exception for every site, or in my case, get tired of the [quite understandable] complaints.

Re:Still clicking the links in emails?

[Anonymous Coward]

sounds like you're the guy that sees the train coming from 10 miles away and still gets hit.

Re:Still clicking the links in emails?

[jahudabudy]

Oh, come off it. Cars are much simpler to maintain and operate than computers. Spotting the square tires that will break my car when I put them on is much much easier than spotting the game with malware embedded in it that will break my computer. The whole point of a computer is to enable me to run multiple third party programs. If every time I wanted to change the dice hanging from my rear view mirror I had to worry about them silently altering my air/fuel injection ratio, then you might have a point.

Re:Still clicking the links in emails?

[Stan92057]

"You could have googled "drive-by download" [google.com] in less time than it took to post, and got lots of answers." 99.9% of the true geeks in the world would have done just that but the rest of us social beings like asking other people questions. Theres 1000,s of thing i could just have used Google for but where the fun in that? What use would Slashdot be if everyone just "Google it" Assumption is the mother of all fuck ups. You assume hes lazy when in fact hes just being social.

Re:Still clicking the links in emails?

[BranMan]

-99% of drivers have no idea how an ICE works (or what that stands for, or even that they have one in their car) -95%+ of drivers don't now anything about oil (and many new cars now have an idiot light to tell you to get it changed) -Only one of the nozzles at the gas pump (gas or diesel) will fit in your car. They needed that for a reason. -95% of drivers have never changed a flat, or know how - There is an idiot light "I need service" on the dash

So by your accounting 95%+ of drivers should not be driving. Yeah, that will happen.

Jewelry stores

[Anonymous Coward]

wiring some of the money from victim organizations directly to high-end jewelry stores, and then sending money mules to pick up the pricey items

There, aiding and abetting cyber crime. Time that ICE officials seize these 'storefronts' and close them down!

Re:Jewelry stores

[macraig]

You and I might see their behavior as hypocritical and double-standardish, but they don't. I doubt we have a pin sharp enough to burst their bubble.

Anonymous?

[MisterMidi]

Could this be related to the recent news about Anonymous?

HAH!

[Anonymous Coward]

Have fun trying to pull more than 10 bucks out of that credit card.

*sigh* debt sucks.

We've just got our ACCOUNTS kicked pal

[Anonymous Coward]

Gameover, man! Gameover!

off topic: Security/Wordpress

[s1d3track3D]

Why is it that every time I see a 'security' oriented blog, it is running on Wordpress?

Re:off topic: Security/Wordpress

[Anonymous Coward]

Because a very high percentage of blogs run Wordpress. I saw somewhere that wordpress sites account for 15% of all sites on the internet.

Microsoft will save us!

[Anonymous Coward]

We just need to get everyone to use M$ antivirus, M$ antispyware, M$ IExplorer and everyone needs to run Winblows. That should prevent this sort of thing.

anonymous?

[Tyrannosaur]

didnt we just have an article about anonymous threatening banks?

Crooks like these are doing it wrong.

[140Mandak262Jamuna]

What is the world coming to nowadays? Why are these crooks looking for holes in the computer servers and steal money? Why can't they steal the money honestly by buying the congress critters and passing legislation that forks over 7.1 trillion dollars? When will these crooks realize the Return on Investment for putting money in campaign contribution is like one million percent. These American Congresscritters are the best money can buy. Instead they go hire script kiddies and money mules. People like these give a bad name to the legitimate thieves of Wall Street.

On the same road

[currently_awake]

The foreign crooks are doing exactly what our local crooks did, just further back on the timeline. First they got a lot of money from prohibition, then they broke into the big time money of politics. The key point is you can't take short cuts on the road to evil wealth and power, you've got to achieve all the sub-quests along the way before you get to fight the final boss. You don't get to bribe the federal gov without large bags of money and knowing the right people to pay off.

"Cyber heist"

[Ltap]

For when you really need to dress something up as dangerous, the type of thing that would star a team of, perhaps, eleven big-name actors and a casino.

My wife handles the banking

[VTEngineer]

and my daughters use her computer. I have little doubt it has been hacked as I've had to re-image it several times. I can not convince my wife to use a live CD for online banking. I guess it will take us getting wiped out to drive home this point. There is an inflection point between prudence and convenience. Woman are especially non prudent (I want to access my bank when I need it, I am not going to reboot) This is a larger problem of identity that needs solving. It is big bucks now. We need a secure solution. As as a professional coder, I do not see one. Anything on the net can be hacked. Voting machines? On the net, consider the election stolen. Heck, just electronic voting, consider the election stolen. Nothing electronic is immune and all of it is vulnerable. Stinks, but that is reality.

Re:My wife handles the banking

[tlhIngan]

and my daughters use her computer. I have little doubt it has been hacked as I've had to re-image it several times. I can not convince my wife to use a live CD for online banking. I guess it will take us getting wiped out to drive home this point. There is an inflection point between prudence and convenience. Woman are especially non prudent (I want to access my bank when I need it, I am not going to reboot) This is a larger problem of identity that needs solving. It is big bucks now. We need a secure solution. As as a professional coder, I do not see one. Anything on the net can be hacked. Voting machines? On the net, consider the election stolen. Heck, just electronic voting, consider the election stolen. Nothing electronic is immune and all of it is vulnerable. Stinks, but that is reality.

Computers are cheap. Buy a cheap one. Do whatever you can to lock it down. And use it ONLY for banking.

A cheapass notebook without flash (gets rid of gaming and crap) and too slow to run anything other than a browser makes a great banking computer. And it's cheap, and thus, you can make it an appliance. Make the default homepage the bank site and have it load the browser on boot.

Have a general "screwing around" computer for games and all that. Then have a nice PC used strictly for banking and only banking.

Rebooting is a pain. Having another PC to conveniently do a bank transaction instead of having to reboot, and she can see her spreadsheets and accounting packages and banking on separate screens? Priceless.

And while you're at it, get some computers for the kids.

It's the best use for netbooks, really.

Re:My wife handles the banking

[Anonymous Coward]

Getting a separate spare computer, that you maintain, that loads a liveCD, for ONLY online banking uses, might be one solution.

Re:My wife handles the banking

[Anonymous Coward]

Easily the best solution! You can lock it down to the ground with encryption, lack of exploitable plugins, password safes and other tools to help keep everything useful. Hell. Go to eBay and buy one of those "lag switches" that kids use on their xbox to easily snip the internet connection when you're done with your banking to take it offline if your family is too stubborn to unplug the cable.

Re:My wife handles the banking

[Anonymous Coward]

Computers are cheap. Buy a cheap one. Do whatever you can to lock it down. And use it ONLY for banking.

Bad solution. VTEngineer is right. Wifey won't use the cheap computer. Trust me on this.

And while you're at it, get some computers for the kids. It's the best use for netbooks, really.

Good solution. Kick the kids off the good computer.

So much for obscurity....

[macraig]

So much for your obscure security... you just put out a press release for the whole world. You couldn't have done worse if you'd painted big bullseyes on your garage and roof - don't wanna exclude yourself from satellite view - with a red $ sign where the dot should be. *snicker*

We're all nerds here

[ctime]

I can hear the booo and hisses already, but this is a large reason why I fucking hate Windows. Let's be real here, everyone getting hacked by these knuckleheads are idiots themselves (to a degree) AND running windows. But what about this: I just imaged and updated my Windows 7 64 system, only use Firefox, and have Microsoft AV (free) enabled. I was minding my own business surfing the web in what I thought was a fairly secure setup, some random popup or link injected code through what I believe was a flash vulnerability (again the box was only a month old) and installed some fucked up rootkit that MS AV actually found the next day. WTF? 0-day exploits CRUSH windows, despite the UAV etc, some how this shit still gets through. Yes, I could have done probably xyz things to protect myself, which I would believe if I were running XP, but this is a 1Mo old version of 7, automatic updates, and I only use firefox. FML.

Web browsers should run in a VM session that is incompatible with the host operating system on a binary level. This kind of aformentioned horseshit rarely if ever happens to everyday average normal guys just browsing the web on their Macs or Ubuntu boxes. Also, fuck it, I'm only browsing the web on a Linux image from now on on this Windows box (and just for reference the box is only used for gaming, occasionally slashdot raging)

Re:We're all nerds here

[ledow]

"Web browsers should run in a VM session"

Or just have proper isolation and not ***execute*** random code at all.

The problem with Windows is not necessarily programmers, it's the design and the expectations of its users. For some reason, if your email client doesn't automatically execute and display that Powerpoint presentation without warnings, people get annoyed. If the Flash/Java sections of a website aren't seamlessly executed as they load people think things are broken. If the executable they download isn't immediately installable, they question it. If their Word macros don't run when they open the documents, they complain.

The "saviour" of other OS is really the culture (because we're not immune to the same things happening on Linux, etc. you know?) - You *can't* execute code without the execute bit set, and users of the system know WHY that is, and they are careful about what they apply the execute bit to (and we don't put up messages that say "Hey, this isn't executable, shall I do it for you?").

Is there an equivalent concept of "non-executable" on Windows that's usable in an everyday environment for random users? Not really. The nearest you get is Software Restriction policies, but they are a nightmare to manage and nobody uses them (and even then it's still possible to execute random code from the Internet if you just pipe it through a trusted program, e.g. a Word macro).

If you use a decent browser with the correct security, Flash/Java apps appear as nothing more than a play button that *YOU* decide to click and ZERO code is executed from that app until you do (and you'd be amazed how many play buttons I see each day just browsing ordinary websites that I *NEVER* click on because I stop noticing they are there unless I've gone to something that I understand NEEDS to execute a Java app for whatever reason).

Why a web browser NEEDS to run executable code to do its job, I'll never understand - it's nothing more than a renderer, like Ghostscript, except you don't see Ghostscript executing in-built shell commands or machine code in the Postscript its trying to render (though even that's had its fair share of problems, they are NOTHING compared to a browser flaw). Does Internet Explorer even have options to let you selectively load Flash/Java? No (and even on Firefox, it's an additional plugin). Opera has it available by default, though.

Hell, Intel, nVidia, Windows Update etc. encourage you to run an ActiveX or Java app so they can "detect your hardware" to choose the best drivers - does that not throw warning bells to people about how much access it would have to the system if you allowed it? And because it's the largest companies (and even the suppliers of the damn OS) that encourage it, people think that's okay.

The problem of viruses is NOT computer related, it's entirely user-related. Not updating software, not running AV (though I'm against the whole idea of AV, personally, when managing your computer properly works so much better), not clicking Yes, inserting untested storage devices, having Autorun enabled, not having the most basic firewall, etc. The holes that are there are there because of the design / choices / implementation of the OS manufacturer, sure, but they get exploited because of the choices of the user.

The systems that OS vendors have deployed against viruses include anti-virus (the biggest scam of our time, as far as I'm concerned), forcing Autorun off after 10 years of OS deployment, running browsers in separate processes to explorer windows and other ridiculous half-measures.

At no point is there a mention of complete isolation (as in a chroot-style environment - why does a browser EVER need to write to anything other than a single downloads directly that the OS won't let you run programs directly from it?), or of just not executing this crap by default. How many programs actually assign Windows ACL permissions to their folders, for example? Hell, historically WMF's were nothing more than a list of GDI-executed

Re:We're all nerds here

[Anonymous Coward]

Well stated - loud and clear thank you

Re:We're all nerds here

[Anonymous Coward]

and what firewall were you using? comodo?

sry windows firewall does not count.

Re:We're all nerds here

[Anonymous Coward]

Getting tired of listening to people thinking firefox is all you need. No. It's the FUCKING PLUGINS that you need.
Adblock and NoScript. If you aren't using them, you are a fucking idiot. The end.

Re:We're all nerds here

[Anonymous Coward]

That's where Mac computers are gaining ground. Everything seemingly just works because Apple plays such a hard game of what's allowed to run on their devices. They push this walled garden approach because when a 3rd party's application the typical user points fingers at the computer itself, not the coop student who wrote buggy code with bad API documentations.

When Vista came out people moaned and complained about how often it blue screened. They said Windows was junk but the reality of it was that Microsoft told driver developers to cut the shit and start building drivers properly. Those who didn't provided faulty software to the users but people still perceived it as Microsoft's fault!

I'm not a Mac fanboy, I've never owned one and will only ever consider it if my Android development takes off enough to warrant a iOS branch. But I still recommend them to family friends and those without computer savvy because Apple has put a considerable effort into the "just works" type of computing. Yes they cost more, but consider that a premium for usability and ease of mind. You'll save 20% going with a PC but I always tell them that I'm not available 100% of the time to resolve issues that can crawl up.

Re:We're all nerds here

[Spodi]

I can hear the booo and hisses already, but this is a large reason why I fucking hate Windows. Let's be real here, everyone getting hacked by these knuckleheads are idiots themselves (to a degree) AND running windows.

Mmm, and it surely isn't because Windows is popular, easy, and familiar, making it much more common among the technologically illiterate. The problem isn't so much the OS, its the user.

Re:We're all nerds here

[jader3rd]

Were you running as admin?

Re:We're all nerds here

[tlhIngan]

I can hear the booo and hisses already, but this is a large reason why I fucking hate Windows. Let's be real here, everyone getting hacked by these knuckleheads are idiots themselves (to a degree) AND running windows. But what about this: I just imaged and updated my Windows 7 64 system, only use Firefox, and have Microsoft AV (free) enabled. I was minding my own business surfing the web in what I thought was a fairly secure setup, some random popup or link injected code through what I believe was a flash vulnerability (again the box was only a month old) and installed some fucked up rootkit that MS AV actually found the next day. WTF? 0-day exploits CRUSH windows, despite the UAV etc, some how this shit still gets through. Yes, I could have done probably xyz things to protect myself, which I would believe if I were running XP, but this is a 1Mo old version of 7, automatic updates, and I only use firefox. FML.
 

That's the problem, you used Firefox. Firefox runs as local user on all Windows systems, while IE and I believe Chrome can run in "low integrity mode" on Windows Vista and higher.

Yes, IE and Chrome end up more secure than Firefox, as hard as it is to believe.

Low integrity mode is a sandbox mode where Windows will disallow all access to the filesystem (except to one well known restricted spot), the registry is virtualized (thorugh UAC), interaction is limited through certain IPC (low integrity processes cannot send window messages to higher integrity processes nor keystrokes/mouse movements) and all processes creates are also low-integrity. Basically, it's the same as running your browser as nobody on Linux.

IE has to jump through hoops in order to download a file - it doesnloads it then kicks off a helper program through IPC to move the file (IE proper only has access to the sandbox filesystem - it cannot read nor write anywhere else and requires a helper to download and upload files). The helper is the one that displays the dialog boxes for the download (and the low-integrity process as no say - keeping drive by downloads from happening).

Your second problem is Flash. The buggiest and most insecure plugin for a browser. It's so bad Firefox has to run it as a separate process, Chrome started the process separation thing, etc. Even worse, there's nothing to prevent that Flash drive-by from infecting a Mac, Android or Linux box.

Shema Jisrael

[Anonymous Coward]

Hello, those cybercriminals are stupid. Defrauding jewellery merchants is highly detrimental to one’s health. Jewellers and dimanond merchants are 95% jewish families. They pick up the red telephone and Mossad comes hunting down the perpetrators, let there be no doubt about that!

Jews learned the hard way during 1933-1945 that they cannot let goyim people take away jewish wealth and jewish lives with impunity and they are now firmly on the opinion that Masada must not fall again!

Mossad was able to remotely blew up secret and massively guarded iranian military sites and with ease, so guess how much it is easier for them to blow up or poison or simply shoot those rogue hackers messing with the Jew-ellery business. They will put the heads on display to deter further e-attacks.

Yeah, but...

[Kamiza Ikioi]

They created something truly devious in the game over trojan. We all just lost.

Reducing effect of Zeus

[derekmelber]

This is a nasty infection and can cause significant damage. From what I have read, Zeus can attack both users who are local admins and those that are non-admins. The difference is that the attack of non-admins is only for that user, where if the user is a local admin, every user is infected! To reduce the attack surface and reduce the overall effectiveness of Zeus, you should make all users non-admins! Software to help with that is PowerBroker Windows Desktops (www.beyondtrust.com), which runs on Windows XP, Vista, and 7, as well as server OSs by microsoft. This software can ensure that users can run all of their required apps, even if they require local admin privileges. Removing the user from being a local admin can also stop the effectiveness of over 95% of all other malicious apps that might attack the computer, according to Microsoft.

Derek Melber, MVP

APK is a cunt.

[bmo]

What is your major malfunction?

--
BMO

Fill firewall rules tables & HOSTS files w/ th

[Anonymous Coward]

That actively tracks ALL zeus C&C servers https://zeustracker.abuse.ch/monitor.php?filter=all & then "security-hardening" your Windows setup via CIS Tool & more (yes, they now have a Vista/Win7/Server2008 capable model of it) via this guide does the rest:

http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22HOW+TO+SECURE+Windows+2000/XP%22&btnG=Search&gbv=1&sei=YU_cTsPxFOrc0QGMhMiKDg

It's been WELL rated on this website (of ALL places, considering it's so "Pro-*NIX" here)

* THE APK SECURITY GUIDE GROUP 10++ THUSFAR (from +5 -> +1 RATINGS, usually "informative" or "interesting" etc./et al):

APK SECURITY GUIDE:2005 -> http://developers.slashdot.org/comments.pl?sid=167071&cid=13931198
APK SECURITY GUIDE:2009 -> http://it.slashdot.org/comments.pl?sid=1361585&cid=29360367
APK SECURITY GUIDE:2009 -> http://yro.slashdot.org/comments.pl?sid=1218837&cid=27787281
APK SECURITY GUIDE:2008 -> http://ask.slashdot.org/comments.pl?sid=970939&cid=25093275
APK SECURITY GUIDE:2010 -> http://tech.slashdot.org/comments.pl?sid=1885890&cid=34358316
APK SECURITY GUIDE (old one):2005 -> http://it.slashdot.org/comments.pl?sid=154868&cid=12988150
APK SECURITY GUIDE:2008 -> http://ask.slashdot.org/comments.pl?sid=970939&threshold=-1&commentsort=0&mode=thread&no_d2=1&cid=25092677
APK SECURITY GUIDE:2008 -> http://tech.slashdot.org/comments.pl?sid=1027095&cid=25747655
APK SECURITY TEST CHALLENGE LINUX vs. WINDOWS:2007 -> http://it.slashdot.org/comments.pl?sid=267599&threshold=1&commentsort=0&mode=thread&cid=20203061

* Yes, that guide's points implementation To "immunize" a Windows system, I effectively use the principles in "layered security" possibles!

http://www.bing.com/search?q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&go=&form=QBRE

I.E./E.G.-> I have done so since 1997-1998 with the most viewed, highly rated guide online for Windows security there really is which came from the fact I also created the 1st guide for securing Windows, highly rated @ NEOWIN (as far back as 1998-2001) here:

http://www.neowin.net/news/apk-a-to-z-internet-speedup--security-text

& from as far back as 1997 -> http://web.archive.org/web/20020205091023/www.ntcompatible.com/article1.shtml which Neowin above picked up on & rated very highly.

That has evolved more currently, into the MOST viewed & highly rated one there is for years now since 2008 online in the 1st URL link above...

Which has well over 500,000++ views

You can do that w/ gpedit.msc policies

[Anonymous Coward]

"To reduce the attack surface and reduce the overall effectiveness of Zeus, you should make all users non-admins! Software to help with that is PowerBroker Windows Desktops (www.beyondtrust.com), which runs on Windows XP, Vista, and 7, as well as server OSs by microsoft. This software can ensure that users can run all of their required apps, even if they require local admin privileges. Removing the user from being a local admin can also stop the effectiveness of over 95% of all other malicious apps that might attack the computer, according to Microsoft." - by derekmelber (2523158) on Friday December 02, @10:47AM (#38238032)

You don't need a custom software to do that though. Gpedit.msc has options that make even a local admin on a system HAVE TO DO THE SAME STUFF a typical end user has to (& more, more "stringently" no less, for all users).

E.G.=> It "enhances" UAC even, by making even admin class users have to "validate themselves" vs. bogus installers & have to "logon" to perform an installation (by logon, I mean sign in your ADMIN level username + password, whereas usually UAC only makes you click a button warning you that you need admin privleges). In fact? It even makes it even MORE STRINGENT than Linux has it setup using sudo by default...

So, anyhow/anyways: The settings to examine & change are as follows in gpedit.msc &/or regedit.exe:

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Admin Approval Mode for the Built-in Administrator account

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken

(Set as ENABLED)

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin

(Set as PROMPT FOR CREDENTIALS)

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Behavior of the elevation prompt for standard users

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorUser

(Set as Automatically deny elevation requests)

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Detect application installations and prompt for elevation

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableInstallerDetection

(Set as ENABLED)

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Only elevate UIAccess applications that are installed in secure locations

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableSecureUIAPaths

(Set as ENABLED)

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Run all administrators in Admin Approval Mode

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA

(Set as ENABLED)

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Switch to the secure desktop when prompting for elevation

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop

(Set as ENABLED)

---

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\User Account Control: Virtualize file and registry write failures to per-user locations

OR

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies