US Treasury Sites Reportedly Infected With Malware

It's never a good sign when your federal government - especially the US Treasury - ends up with compromised web sites that are serving up malicious code. So what's going on?

According to security vendor AVG, three domains associated with the Bureau of Engraving and Printing's home page were infected by malware. The three domains have since been taken offline.

Via Yahoo News:

According to Thompson, hackers had added a small snippet of virtually undetectable iframe HTML code that redirected visitors to a Web site in the Ukraine that then launched a variety of Web-based attacks based on a commercially available attack-kit called the Eleonore Exploit pack. 

Still to come are the details behind how the malicious iframe code got placed on the sites. There have been a large number of hosting providers that have been compromised of late, so perhaps these domains were part of the same attack scenario.

Read More

Beware of Fake Anti-Virus Software

It's an unwritten rule that you never need anti-virus software until you need it badly. The corollary to that edict is that, being signature based, AV programs are only as good as what they already know, and studies have shown that leading anti-malware offerings fail to detect upwards of 50% of malicious code.

If that isn't enough to make you ponder an existence as an internet hermit, then perhaps the concept of fake anti-virus software will push you over the edge.

Researchers are reporting that increasingly, users are tricked by web site pop-ups and bogus warnings of virus infection detections followed by "suggestions" to download readily-available virus removal programs that are themselves malicious code. Once the user willingly runs the program, their machine is immediately compromised and often proceeds to download additional malcode in the background.

What can you do to protect yourself? Here are a couple of key things to remember.

1. Never, ever install a program or run a command unless you are absolutely certain of its source.
2. Ignore pop-ups, warning banners, and browser redirects. Trust me - the Internet is not one big loving community that exists to help you out. Rely only on warnings from programs you've installed yourself.
3. Always have a rescue CD available for virus removal, and don't be shy about using it if you're concerned. Brian Krebs has an excellent post on finding and using rescue CDs at his Krebs on Security blog.
4. Move off of Internet Explorer. I recommend Firefox with the NoScript add-on, but Google Chrome or Opera are other good options.
5. Keep your computer patched. If you're running Windows, enable automatic updates, and use a free product like Secunia PSI to help keep track of updates to popular applications like Adobe Reader, Sun Java, QuickTime, and other frequently overlooked programs.

Let's be careful out there.

Read More