Tag Archives: resources

Ransomware Recovery and Prevention page

I’ve intended for a while to break out some of the scattered information in the ransomware resource page and sub-pages into its own Ransomware Recovery and Prevention page.

And finally got around to it.

Much of the same information (and more) remains in the Ransomware Resources page and/or sub-pages. (Sorry, but I’m happy to duplicate information where appropriate. If I had more time to spend on this page, there’d probably be less duplication, but I haven’t…)

However, the new(-ish) page is better organized and more immediately useful (I hope) for people who are interested in barebones recovery and prevention information.

David Harley

Advertisements

SANS ‘Ouch!’ Newsletter on Ransomware

The latest SANS ‘Ouch!’ newsletter is dedicated to a description of ransomware and tips on how to counter it.  And no, I have no idea why they chose the name Ouch!

Like other editions, this particular newsletter issue is presumably aimed primarily at home users rather than corporates. (Though it does include a link to the SANS Advanced Cybersecurity Learning Platform.) At any rate, it’s fairly simplistic. However, it’s accurate enough (though I’d take issue with the fact that it seems to suggest that cloud-based backups are safe from ransomware, which isn’t always true).

Anyway, anything that might help raise awareness and understanding of the issue among the general population is worth publicizing.

David Harley

Added to the Ransomware Resources page

A technically not-very-sound article from the BBC on The computer virus that blackmails you. It would be nice if a ‘technology reporter’ knew better than to describe all malware as ‘a virus’. Still, I suppose anything that raises awareness of the problem is at least partially helpful. And while it’s not always the case that files can only be recovered from a backup version, it’s good to reinforce the idea that backups are a Good Thing.

Added to the Ransomware resources page.

David Harley

Ransomware resource page

My first engagement with and introduction to the malware problem was back in 1989. Surprisingly, that first encounter was not a virus, even though through the 80s viruses were the aspect of security that most people were aware of, and Trojans – or trojans, as some of my colleagues in the industry nowadays insist on spelling it – comprised at that time a very small proportion of the virus-dominated malware scene. However, the ‘AIDS Trojan’ was pretty big news at the time in the fledgling anti-virus industry, even though it targeted a fairly specialized sector of the medical research community.

In fact, I still have one of the disks sent out carrying the ‘AIDS Trojan’, sometimes cited as the first ransomware, at the end of the 1980s, retained for purely sentimental reasons.

However, the impact and scale of the ransomware problem seems to have increased dramatically in recent months, so I though perhaps it was time to set up a page somewhat along the lines of our tech support scams page. Unfortunately, it’s not as polished as I’d like, due to pressure to meet other commitments. But I figured this might be one of those ‘something is better than nothing’  moments. Not that there isn’t already good information out there, but I wanted to have some links and commentary in one place.

So here it is, warts and all.

Japan Disaster: Commentary & Resources

[Further links added March 13th 2011 (and a couple more on the same day). Extra links and commentary appended March 14th. More commentary re the Bing chaintweet subsequently added. And yet more  on related scams added March 15th. More miscellaneous resources and commentary on 16th and 17th March. Additional links on 23rd March]

This is an attempt to bring together a number of disparate blogs highlighting resources I’ve been collecting over the past couple of days, relating to the Japanese earthquakes and tsunami. Apologies if there’s nothing here that’s new to you, but I think it’s important to spread this information as far as possible. This will now be my primary resource for putting up any further information I come across. I don’t, of course, claim that it will cover a fraction of the coverage that’s out there.

  • Some blogs of mine:
  • http://blog.eset.com/2011/03/11/japanese-earthquake-inevitable-seo 
  • http://chainmailcheck.wordpress.com/2011/03/12/earthquaketsunami-scam-resources/
  • http://blog.eset.com/2011/03/12/disaster-scams-and-resources
  • http://blog.eset.com/2011/03/11/disasters-getting-involved
  • And one more that I’ve referenced below…
  • Urban Schrott of ESET Ireland on do’s and don’t’s for safe browsing and disaster scam avoidance: http://esetireland.wordpress.com/2011/03/11/security-warning-japanese-earthquake-scams-will-send-tremors-through-the-web/
  • Paul Ducklin at Sophos on clickjacking by ibuzzu.fr: http://nakedsecurity.sophos.com/2011/03/12/japanese-tsunami-video-exploited-by-clickjackers/
  • Norman Ingal at Trend with some detail on observed BHSEO and fake AV: http://blog.trendmicro.com/most-recent-earthquake-in-japan-searches-lead-to-fakea/ 
  • Robert Slade at Securiteam with an older post (from the time of the Haiti earthquake – but still relevant) on training for disaster: http://blogs.securiteam.com/index.php/archives/1346
  • More analysis from Kimberley at stopmalvertising.com: http://stopmalvertising.com/blackhat-seo/recent-japanese-earthquake-search-results-lead-to-fakeav.html
  • Paul Roberts at Threat Post: http://threatpost.com/en_us/blogs/experts-warn-japan-earthquake-tsunami-spam-031111
  • Guy Bruneau at Internet Storm Center: http://isc.sans.edu/diary.html?storyid=10537&rss
  • Sean at F-Secure:  http://www.f-secure.com/weblog/archives/00002119.html 
  • Mike Lennon at Security Week: http://www.securityweek.com/massive-influx-scams-surrounding-japans-earthquake-and-tsunami-expected
  • spamwarnings.com is showing examples of spam related to this event: http://www.spamwarnings.com/tag/devastating-tsunami 
  • IRS online charities search: http://www.irs.gov/app/pub-78
  • Charity Navigator offers independent evaluation of charities: http://www.charitynavigator.org/
  • Google’s crisis response page: http://www.google.com/crisisresponse/japanquake2011.html
  • An old but much-to-the-point article on disaster scams from PC World: http://www.pcworld.com/article/61946/beware_of_online_scams_for_disasterrelief_funds.html
  • Phil Muncaster: http://www.v3.co.uk/v3-uk/news/2033668/google-twitter-facebook-step-help-japan-earthquake-survivors
  • Google’s People Finder service: http://japan.person-finder.appspot.com/?lang=en
  • Bing’s response page including several organizations offering relief initiatives: http://www.microsoft.com/about/corporatecitizenship/en-us/our-actions/in-the-community/disaster-and-humanitarian-response/community-involvement/disaster-response.aspx. A useful page, but there’s an aspect to Bing’s retweeting PR effort (see http://www.twitter.com/bing) that I can’t quite like, as explained at http://chainmailcheck.wordpress.com/2011/03/12/faith-hope-charity-and-manipulation/.
  • US-CERT: Japan Earthquake and Tsunami Disaster Email Scams, Fake Anitvirus and Phishing Attack Warning [Yes, the Anitvirus typo is on the web site: some useful links, nonetheless] 
  • Latest news from NHK World: http://www3.nhk.or.jp/nhkworld/ 
  • Graham Cluley: Japanese Tsunami RAW Tidal Wave Footage – Facebook scammers trick users with bogus CNN video
  • Morgsatlarge on Why I am not worried about Japan’s nuclear reactors
  • Real photos of the damage (hat tip to Rob Slade: http://www.nytimes.com/interactive/2011/03/13/world/asia/satellite-photos-japan-before-and-after-tsunami.html?hp; http://www.cbc.ca/news/interactives/japan-earthquake/index.html. Not exactly security-related, but the sort of thing that’s being used to decoy people onto unsafe sites.
  • One from the Register that I missed at the time, though it’s basically a pointer to the Trend article above: http://www.theregister.co.uk/2011/03/11/japan_tsunami_scareware/
  • World Nuclear News: Battle to stabilise earthquake reactors
  • Lester Haines for The Register: Threat to third Fukushima nuke reactor: Authorities using seawater to battle overheating
  • Apparently I wasn’t the only person upset at Microsoft’s use of the disaster to promote Bing: BingDings* Force Change of Tune.
  • Here’s another clickjack scam brought to my attention by Graham Cluley: as he rightly says, it’s not likely to be the last. Japanese Tsunami Launches Whale Into Building? It’s a Facebook clickjack scam 
  • While Lewis Page describes in The Register how the Fukushima plant is actually performing “magnificently”, given the unexpected scale of the stress to which Japanese nuclear facilities have been subjected in the past few days: http://www.theregister.co.uk/2011/03/14/fukushiima_analysis/ Even if you’re not totally convinced that this is an argument for more nuclear powerplants, it’s certainly a welcome corrective to the FUD-exploiting scareware SEO that I suspect we’ll see over the next few days.
  • Graham Cluley on an SMS hoax: Fukushima radiation hoax SMS message spreads in Philippines (clue: it’s the hoax that’s spreading, not radiation…)
  • Nuclear Energy Institute: Information on the Japanese Earthquake and Reactors in That Region
  • Lester Haines: Fukushima reactor core battle continues: May be heading for meltdown, but no Chernobyl likely
  • Stan Schroeder for Mashable: AT&T, Verizon offer free calls and texts to Japan from US 
  • Ben Parr for Mashable:  Japan Earthquake & Tsunami: 7 Simple Ways to Help
  • Technet Blog: Microsoft Supports Relief Efforts in Japan
  • USA.answers.gov summary: Current Situation in Japan
  • Christopher Boyd, GFI Labs: Another “Whale smashes into building” Tsunami scam on Facebook 
  • Allan Dyer has mentioned that SMS “BBC FLASHNEWS” hoaxes like the one Sophos flagged at http://nakedsecurity.sophos.com/2011/03/14/fukushima-radiation-scare-hoax-text-message-spreads-in-philippines/ have also been circulating in Hong Kong.
  • Urban Schrott with some more scam info from Facecrook and elsewhere
  • Sophos on tsunami charity scams
  • Lots more links suggesting that radiation risk is way overblown, but I think we have enough of those to get the gist. Just be sceptical about alarmist reports that you can’t verify from reputable sites.
  • Business Standard on Cybercrime sets sail on tsunami sympathy
  • Symantec on Phishers Have No Mercy for Japan describing a fake American Red Cross donation site.
  • I’m also seeing a number of posts and articles suggesting that the situation regarding affected nuclear facilities is getting worse: I’m not qualified to separate fact and fiction in many of these cases, so I won’t try to track them here.
  • Allan Dyer describes one of the SMS hoaxes and a donation scam message pretending to be from AT&T: http://articles.yuikee.com.hk/newsletter/2011/03/a.html
  • Graham Cluley describes several Japan-related video links that actually lead to malicious javascript and a Java applet, plus some fake twitter email notifications: Spammed-out Japanese Tsunami video links lead to malware attack. See also Chet Wisniewski’s post SSCC 52 – Twitter HTTPS, net neutrality, car hacking, tsunami scams and Pwn2Own.
  • Jimmy Kuo forwarded a reliable donation link at at http://www.jas-socal.org/, and here’s a post from Tracy Mooney on charitable giving .
  • A series of other blogs from McAfee: http://blogs.mcafee.com/mcafee-labs/world-record-for-disaster-scam-site; http://blogs.mcafee.com/consumer/robert-siciliano/tsunami-scam-warnings-keep-coming-in; http://blogs.mcafee.com/consumer/consumer-threat-alerts/japan-earthquake-scams-spreading-quickly
  • Christopher Boyd on Japan “Miracle Stories” scams on Youtube… and Rogue AV results lurk in contamination comparison searches and ICRC Japan donation scam mails and .tk URLs offering surveys, installs and fake Tsunami footage and Tips for avoiding the endless Japan disaster files and A Japan-themed 419 scam…
  • Crawford Killian is tweeting a lot of more general Japan-related stuff that might be useful to you as background rather than as direct security stuff. http://twitter.com/Crof (hat tip to Rob Slade.)
  • Nicholas Brulez: Japan Quake Spam leads to Malware
  • John Leyden for The Register: Fake Japan blackout alerts cloak Flash malware: Scumbags continue to batten on human misery
  • Not directly security-related, but I can see it being used as a social-engineering hook: Timothy Prickett Morgan on Japanese quake shakes semiconductor biz: Boards and chip packages hit too.
  • An article by Amanda Ripley that has no direct security implication that I can see offhand, but I thought was interesting anyway: http://www.amandaripley.com/blog/japan_and_the_cliche_of_stoicism/
  • I probably won’t continue to add too many resources to this page that don’t have a direct and compelling security dimension, but if you are interested in the sort of footage of exploding reactors, tsunami hits and so on that blackhats use as bait for fake AV and clickjacking, the BBC has quite a few relevant videos: I know that because I watch the news. 🙂 I haven’t looked up individual links, but a quick Google search brings up several at http://www.bbc.co.uk/: no doubt searches of CNN etc. would bring up similar results. There’s lots of this stuff out there: no need to click on dubious links from unknown sources!

    David Harley CITP FBCS CISSP
    AVIEN COO
    ESET Senior Research Fellow