The Computer Clarity Blog

Google has analyzed 240 million web pages over a 13 month period and discovered that fake anti-virus programs account for 15 per cent of malicious software, according to a report by the BBC.

The study expresses surprise that people fall victim to these attacks and even hand over credit card details. The problem is scareware doesn’t always come in one easy to recognize form.

Most users should have an up-to-date anti-virus suite on their computers, and so logically they should realize that they don’t need any more protection, but something obviously gets in the way of the users thought process when confronted with the dreaded dialogue box.

They don’t know the risk – the user may be from a vulnerable group and easily exploited or they may be completely in the dark about computer security.

Apathy -  the user may be at the end of a long day and just want to get on with what they logged on to do – clicking on anything to make the annoying box disappear.

Panic – scareware targets people in the safety and comfort of their own homes. By throwing out alarming warning messages, offering to perform free system scans and bringing back even more alarming results.

Design – most programs aren’t designed to make saying ‘no’ easy. There may be no visible way to close the dialogue box down without clicking on an option.

Sometimes the only choice is to close the browser window down completely or use task manager to kill the process, which makes it more difficult to avoid for those who just want to be left alone.

The tendency is to click first and think later which results in the installation of malware.  So if something pops up on the screen that you’re not expecting to be there – don’t click it.

Computer Clarity

By Daily Mail Reporter
Last updated at 2:11 PM on 11th August 2010

• Trojan is still at large and may strike again, experts warn
• Bank affected has still not been named

Thousands of British online banking customers have fallen victim to a sophisticated attack by cyber criminals who have stolen thousands of pounds from their accounts.

About 3,000 online banking customers have been victims of a computer virus attack that empties their accounts while showing them fake statements so the scam goes undetected.

Experts have described the attack using a ‘Trojan’ virus as the most sophisticated and dangerous malware program ever created.

The cyber criminals stole an estimated £675,000 between July 5 and August 4 and the attack is still progressing, experts warn.

Out of action: The new Trojan virus can empty bank accounts without their owners knowing about the theft as it shows them fake statements

The latest virus is a variant of the Zeus Trojan banking virus which first emerged three years ago and is called Zeus v3. 

M86 Security said: ‘We’ve never seen such a sophisticated and dangerous threat. Always check your balance and have a good idea of what it is.’

The scam was discovered after M86 gained access to the command-and-control server in Eastern Europe running the thefts.

How to protect yourself from Trojans when banking online

• Make sure your anti-virus software is up to date.
• Keep firewalls set to the highest level.
• Never open an e-mail attachment from someone you don’t know.
• Never double-click on an e-mail attachment that ends in .exe. It is an ‘executable’ file and can do what it likes in your system.
• If you think your machine has already been infected, contact your bank immediately. If the bank thinks you are a genuine victim of fraud it will reimburse you.

It collects data such as passwords and even transfers money out of accounts automatically, but only after checking if there is at least £800 available.

Bradley Anstis, M86 vice-president of technology strategy, said: ‘This is an extremely sophisticated version of the virus and it cannot be detected by traditional security software.’

The company said it was the most-sophisticated and dangerous virus yet seen and advised online banking users to check their balances regularly and have a good idea of what it should be. 

British high street banks do not believe they have become victims of the cyber criminals.

A spokesman for HSBC said: ‘There are millions of viruses and other malicious software.

We urge people to take basic measure to protect themselves from virus attacks.

Any customer who is a victim of fraud will be reimbursed by HSBC.’

However, M86 said it believed one high street bank was breached and failed to act quickly after warnings last month.

More than 100,000 PCs in Britain have been infected with other forms of the Trojan virus.

McAfee Inc, the security software maker, said production of software code known as malware, which can harm computers and steal user passwords, reached a new high in the first six months of 2010.

McAfee said total malware production continued to soar and 10 million new pieces of malicious code were catalogued.

What is a Trojan?

• A Trojan is a type of computer virus that infects your PC
• It is called a Trojan because it will disguise itself as a useful application but when installed can take control of a user’s computer
• It can let a hacker take control of your computer or simply wipe the hard drive
• It can also be used to install key logging software which will let the hacker know what you are typing and give him access  to your passwords
• Trojans are now the most popular form of computer virus or ‘malware’

It also warned users of Apple’s Mac computers, considered relatively safe from virus attacks, that they may also be subjected to malware attacks in the future.

‘For a variety of reasons, malware has rarely been a problem for Mac users. But those days might end soon,’ a spokesman said.

‘Our latest threat report depicts that malware has been on a steady incline in the first half of 2010,’ Mike Gallagher, chief technology officer of Global Threat Intelligence for McAfee, said in the report that was obtained by Reuters.

Last year £59.7million was lost to online banking fraud, according to Financial Fraud Action UK.

Another £440million was lost to credit card fraud.

And the problem is said to be on the rise, with criminals attacking banks’ customers rather than the banks themselves as they are seen as softer targets.

A Financial Fraud Action UK spokeswoman said: ‘The idea that criminals are targeting people by using malicious software or Trojans is nothing new.

Bank systems are hard to attack so they have to go through the easier link in the chain, which is the customers.

They’re hoping customers aren’t taking security precautions. We’ve been seeing this for the last few years and we’re constantly urging people to protect their computers to try to mitigate the risk of becoming a victim.’

Victims of online banking fraud are generally refunded the money.

Computer Clarity

Filter Spam

Because most email scams begin with unsolicited commercial email, you should take measures to prevent spam from getting into your mailbox. Most email applications and web mail services include spam-filtering features, or ways in which you can configure your email applications to filter spam. Consult the help file for your email application or service to find out what you must do to filter spam.

You may not be able to eliminate all spam, but filtering will keep a great deal of it from reaching your mailbox. You should be aware that spammers monitor spam filtering tools and software and take measures to elude them. For instance, spammers may use subtle spelling mistakes to subvert spam filters, changing “Potency Pills” to “Potençy Pills.”

Regard Unsolicited Email with Suspicion

Don’t automatically trust any email sent to you by an unknown individual or organization. Never open an attachment to unsolicited email. Most importantly, never click on a link sent to you in an email. Cleverly crafted links can take you to forged web sites set up to trick you into divulging private information or downloading viruses, spyware, and other malicious software.

Spammers may also use a technique in which they send unique links in each individual spam email. Victim 1 may receive an email with the link <http://dfnasdunf.example.org/>, and victim 2 may receive the same spam email with the link <http://vnbnnasd.exaple.org/>. By watching which links are requested on their web servers, spammers can figure out which email addresses are valid and more precisely target victims for repeat spam attempts.

Remember that even email sent from a familiar address may create problems: Many viruses spread themselves by scanning the victim computer for email addresses and sending themselves to these addresses in the guise of an email from the owner of the infected computer.

Treat Email Attachments with Caution

Email attachments are commonly used by online scammers to sneak a virus onto your computer. These viruses can help the scammer steal important information from your computer, compromise your computer so that it is open to further attack and abuse, and convert your computer into a ‘bot’ for use in denial-of-service attacks and other online crimes. As noted above, a familiar “from” address is no guarantee of safety because some viruses spread by first searching for all email addresses on an infected computer and then sending itself to these addresses. It could be your friend’s computer is infected with just such a virus.

Use Common Sense

When email arrives in your mailbox promising you big money for little effort, accusing you of violating the Patriot Act, or inviting you to join a plot to grab unclaimed funds involving persons you don’t know in a country on the other side of the world, take a moment to consider the likelihood that the email is legitimate.

Install Antivirus Software and Keep it Up to Date

If you haven’t done so by now, you should install antivirus software on your computer. If possible, you should install an antivirus program that has an automatic update feature. This will help ensure you always have the most up-to-date protection possible against viruses. In addition, you should make sure the antivirus software you choose includes an email scanning feature. This will help keep your computer free of email-born viruses.

Install a Personal Firewall and Keep it Up to Date

A firewall will not prevent scam email from making its way into your mailbox. However, it may help protect you should you inadvertently open a virus-bearing attachment or otherwise introduce malware to your computer by following the instructions in the email. The firewall, among other things, will help prevent outbound traffic from your computer to the attacker. When your personal firewall detects suspicious outbound communications from your computer, it could be a sign you have inadvertently installed malicious programs on your computer.

Learn the Email Policies of the Organizations You Do Business With

Most organizations doing business online now have clear policies about how they communicate with their customers in email. Many, for instance, will not ask you to provide account or personal information via email. Understanding the policies of the organizations you do business with can help you spot and avoid phishing and other scams. Do note, however, that it’s never a good idea to send sensitive information via unencrypted email.

Configure Your Email Client for Security

There are a number of ways you can configure your email client to make you less susceptible to email scams. For instance, configuring your email program to view email as “text only” will help protect you from scams that misuse HTML in email.

Computer Clarity

Over the last ten years, I have removed close to a half million viruses from thousands of computers.  One of the most common questions that I am asked is: “Why do these people write viruses?”  The answer is that there are several types of people writing different types of malware for several different purposes.  Here are some examples:

Vandals-
These people are like the punks that vandalize property for fun.  They are in small cliques and they try to impress each other by infecting the most computers in the shortest amount of time.  One virus from around seven years ago infected over 250,000 computers in 24 hours.  This one made all of the desktop icons run away from the mouse arrow.  This group of cyber-vandal virus writers wrote most of the early viruses, but as a percentage of all viruses discovered to date, they are less significant than some of the other groups.

People with a grudge-
Another small group of people who wrote many early viruses are the people with grudges against Microsoft, the government, corporations, or specific professions.  One virus from around six years ago called Magistrate targets attorneys.  This virus would infect a computer, search for any document containing legal terms and mail it out to everyone in the address book.  Other viruses would infect as many computers as possible, then tell all of them at the same time to try to access a web site or other internet server causing such high traffic that the server shuts down.

Cyber Warfare against the United States-
Over the last five years, another form of covert warfare has emerged.  Many antivirus companies have reported a high number of viruses originating in China, North Korea, and Iran.  They also report that these viruses seemed to be designed to infect English speaking countries specifically.  This is The Art of War in its perfect modern adaptation: never attack your enemy army directly when you can weaken your enemy infrastructure indirectly.   By infecting home, business, and government computers, the enemies of the United States can decrease our overall productivity, increase our population’s general level of stress and irritation, and possibly steal some secrets along the way.

Info Thieves-
These are the writers of the spyware floating around the internet.  They are looking for passwords, account numbers, social security numbers, and anything else that would give them access to your credit, money, or your identity.  This group and the next are both the fastest growing and the most damaging types of threats.

Viruses for Profit-
This group started out writing the adware that makes all of the popup ads fill a computer screen every time the computer connects to the internet.  They make arrangements with advertisers to get paid a few pennies every time their popup ad hits a desktop.  With a few hundred ads popping up on a few hundred thousand computers every day, these viruses generate income.  But a much more serious threat in this group has emerged.  Rogueware is software that impersonates an antivirus and attempts to entice the computer user to install the virus with warnings of viruses.  This is the biggest and fastest growing type of computer malware that I have seen so far.

<a href=”http://www.computerclarity.com/clarity-blog/?p=6″>See my article
concerning rogueware for more information.</a></p>

As you can see, the question “Why do people write viruses” has a logical answer.  Even if there are several types of virus writers with several motivations, people write malicious software because they are malicious people.

Computer Clarity