January 2009

Conficker Statistics

I just did some work on a report that quotes some of the various statistics – or do I mean guesstimates? – regarding how many machines were likely to have been infected by Conficker. That report has already gone out, but it’s been pointed out to me that the wording makes it sound like we’re

This is a Lie

Well, this actually isn’t a lie, but a lot of what you read on the web are lies designed to steal money or identities. If you go to a web page and it says you need a new codec or new software to view a video or picture, or pretty much anything, the odds are

Conficker Clarified

I just happened upon a blog that made an interesting point about the information that’s been made about Conficker. Essentially, the writer was fulsome in her praise of an article by Gary Hinson here, which gave some simple advice on dealing with Conficker/Downadup. As it happens, I’m familiar with the name Gary Hinson: he also contributes

Trends in Security Software

I got asked "what is the big trend in security software at the moment". It seems to me there are several significant threads to the answer, in terms of anti-malware. Dynamic and/or behaviour analysis. Dynamic analysis as implemented in mainstream antimalware is basically an automated version of dynamic analysis is used in computer forensics. In

Grant Me Your Wallet

The email scam du jour is an email scam promising government grants. One of the highly prevalent ones is from an alleged company called “Rapid Grants Solutions Kit”. I decided to search for them. This time I used Google, Yahoo,, and In al cases the results looked pretty shady. The results with Google

Enough to Break your Heartland: Fraud and Malware

MSNBC put up some interesting comment on the Heartland security breach. Since they’ve put some emphasis on the involvement of malware in the breach, it’s worth making a few points. * Heartland was PCI compliant when the breach occurred. The PCI DSS v1.2 Requirement #5.1.1 states: “Ensure that all anti-virus programs are capable of detecting,

The Hard Facts

I was recently quoted at regarding Google ad words. Actually, ad words matter to advertisers and to some of the bad guys, but I don’t think the average user pays much attention to whether the result is an ad or what the industry calls an “organic” hit, which is anything but organic and is

Money for Nothing…

…no promise of chicks for free, but I did get spam this morning offering me a "Free-Trial kit" for some scheme for "making money through the Internet by doing almost nothing" (probably some sort of pyramid scheme, I guess, updated with a reference to using Google). While I’m not about to take up the offer, I

What Hath God Wrought?

“What hath God wrought?” were the contents of the first ever telegraph message. An ominous message that would seem to reveal that Samuel Morse understood some security implications of technology, except, it was his friend’s young daughter who appears to have suggested the biblical verse. Perhaps “What hath God wrought” would have been a

Confounding Conficker

[Update: Spiegl Online reports (in German!) that the total may be as high as 50 million infected machines: however, this figure seems to be extrapolated from the number of infections picked up Panda’s online scanner. Statistically, I’m not sure it makes any sense at all to try to correlate this self-selecting sample to the total population of

Global Threat Report 2008, other papers, and AMTSO

You may have noticed that I’ve been making a lot of references to this over the past few weeks. You can now download it here. Quite a few people have worked pretty hard to make this project happen, and I’d like to thank them now. I hope some of you will find it interesting and

Is All Lost?

Today is inauguration day in the USA. As I traveled to many countries late last year I was amazed at how joyous people of many cultures were that Obama is to be President of the USA. Working in the security field, we see a lot of disappointment. Sometimes it seems that there is no hope

Top Ten 2008 Threats

The top ten (twenty, twenty-five…) season doesn’t seem to have finished yet: the latest to cross my radar was something like seven ways of surviving the recession, which I’m sure is of interest to all of us, but not really in scope for this blog. So here’s a snippet from our 2008 Global Threat Report,

Conficker: can’t stand up for falling downadup

You might have noticed that Conficker (Downadup) is actually standing up rather well to all the attention it’s receiving at the moment. Heise UK reported that 2.5 million PCs are already infected (links removed, as Heise no longer seems to have a UK site and the articles have disappeared). In The Register, Dan Goodin reports that the

Sunday Miscellany

Here are a few rather disconnected items that I intended to blog about last week, but never had time to write up. First of all, an interview with an adware author from that went up on 12th January. Excerpt: “Matt Knox, a talented Ruby instructor and coder, talks about his early days designing and writing

BCS Blogs

As a *Fellow of the British Computer Society (is that the sound of a self-blown trumpet I hear?) I get daily emails that I often don’t have time to read. Which is a pity, because when I do, I often find an interesting nugget. Sometimes I even get a paper magazine (remember those?) through the post,

Confused about Conficker?

CNN reported that there a new sleeper virus out there. There is nothing sleepy about the Conficker worm, it is wide awake and looking for people who are asleep at the security wheel. CNN reports that Conficker could allow hackers to steal personal and financial data, and they also report that it “it is

You Did Back Up Your Data, Didn’t You?

One of the security best practices is to back up your data regularly. This is sound advice as it helps mitigate the damages from many different threats. Lots of people think of data loss when they think of viruses, but very few viruses actually tried to cause data loss. There have been a few that

Malware Trying to Avoid Some Countries

There are different techniques that can be used by a program to identify in which country it has been installed.  It can check for time zone information, public IP addresses or even domain names.  Lately, we have seen two different malware families trying to discover their geographic location in an effort to avoid infecting PCs

Backscatter and Misdirected Email Alerts

This is bizarre, if slightly nostalgic. I spent a lot of time in the first half of this decade writing and presenting on problems with email filters that assumed that if the “From” field of an email header says that the sender was (apologies to if it actually exists, but I don’t think

Follow us

Copyright © 2017 ESET, All Rights Reserved.