In Rogues We Trust: Webroot survey reveals internet users of all skill levels fall for cybercriminals tricky tactics

October 4, 2009 · Filed Under Security Software, Software News · Comment 

Webroot Also Finds 2 Out of Every 10 Threats Detected in August Were Fake Security Alerts & Products

Computer-savvy consumers are more susceptible than novices to “fake alerts” and rogue security products – bogus malware infection warnings and malicious programs masquerading as legitimate security applications – according to a new survey from Webroot, a leading provider of Internet security for the consumer, enterprise and SMB markets.

Surveying nearly 1,200 individuals ranging in age and computer proficiency levels, Webroot explored the risks and consequences of infection by malware associated with fake alerts. Among the key findings:

– Advanced users clicked on suspicious messages at a greater rate than less experienced users
– 20 percent of respondents strongly trust the first page of search results – a common target for fraudulent links
– Nearly one fifth reported varying levels of financial or data loss following infection
– Over half experienced infections consistent with those of fake alert-related malware

“Cybercriminals prey on our curiosity,” said Mike Kronenberg, chief technology officer of Webroot’s Consumer Business Unit. “Links to seemingly real search results and videos — and now even ads on reputable news sites – trigger fake warnings claiming you’re infected or need ‘Home Antivirus 2010′ or another bogus product. And business must be booming for these thieves, judging from the rapid rate at which Webroot is seeing new programs and variants created in an attempt to bypass security technology. But with the right education, vigilance and technology, consumers can take steps to protect themselves.”

The Anatomy of a Fake Alert

Webroot has seen a rise in the incidence of fake alerts and rogue security products. According to the Webroot Threat Research team, two out of every 10 threats detected by Webroot’s products in the month of August were associated with fake alerts and rogue security products.

The appearance of fake alerts changes frequently. Ranging from phony Windows Security Center warnings to notifications for security scans and viewer or codec downloads, each is designed to appear legitimate and urgent. According to the Webroot Threat Research team, Internet users can encounter fake alerts through three main vectors:

– Fraudulent links appearing at or near the top of search results. For example, on Monday Webroot found that a search for news stories about the arrest of film director Roman Polanski yielded links that redirected to a fake security scan and to “Windows PC Defender,” a known rogue security product.
– Phony file links. Webroot recently reported on its Threat Blog that the Koobface worm is now sending phony video links, seemingly from a friend, to members of Facebook, MySpace, Twitter and other social networks. The links trigger viewer download messages that activate infection when clicked.
– Ads on legitimate Web sites. Webroot researchers recently investigated the origins of a bogus ad on NYTimes.com earlier this month which contained code leading to a fake alert and rogue product.

Key Findings

Results from the Webroot survey indicate a general lack of awareness of fake alerts and rogue security products, a higher rate of engagement among advanced and power users, and costly and inconvenient consequences of infection.

Lack of awareness leaves individuals vulnerable:
– 20 percent strongly agree the first page of search results includes trustworthy links
– 40 percent did not know the meaning of “fake alerts,” and 69 percent were unfamiliar with “rogue security products”
– 25 percent clicked on links to unfamiliar sites
– 13 percent clicked on pop-up messages requiring the download of a special viewer or codec

Experienced computer users are more susceptible:
– Over 50 percent of advanced users encountered a fake Windows Security enter alert, versus 33 percent of novice users
– 26 percent of advanced users encountered a fake security scan, compared to approximately 10 percent of less experienced users
– 23 percent of advanced users clicked on a fake alert and in some cases purchased rogue security products; conversely, 10 percent of novice users did the same

Clicking a fake alert can lead to consequences ranging from nuisance to costly:

– 43 percent of respondents experienced ongoing pop-up messages after clicking
– 26 percent had to have their computers repaired
– 11 percent lost files and documents following infection
– 8 percent had to purchase a new computer or experienced unauthorized credit card charges

Tips for Safer Surfing

Webroot recommends the following actions to protect against the risks and consequences of fake alerts:

Be vigilant – Do not click pop-up security alerts from unfamiliar companies, or poorly worded messages from known providers. Only purchase security products from reputable companies. Check for links to familiar sites among search engine results. On social networks, do not follow suspicious video links from “friends,” or emails, friend requests, site links and other items from unknown sources
Even with security programs in place, remain vigilant – Malware authors are continually writing new programs to avoid detection, so pay close attention to suspicious behavior
Always install updates – Equally if not more important, if you’re using antimalware software, be sure to install updates which include the latest malware definitions to protect you from new variants of known threats; do the same with updates to your operating system
If you’re not protected – Scan your machine for dormant viruses with a free scan; and protect your PC with an Internet security suite that includes antivirus, antispyware, and firewall technologies

Webroot offers several comprehensive Internet security solutions for consumers including Webroot® AntiVirus with Spy Sweeper®, and Webroot® Internet Security Essentials. For more information about these and other products, please visit http://www.webroot.com/En_US/consumer.html.

Tags: , , , , , , , , , , , , , , , , , , , , , , ,

U.S. ranks 9th in Global PC Infection Report, according to PandaLabs

September 29, 2009 · Filed Under Security Software, Software News · Comment 

Average number of worldwide infections grew 15 percent over last month – Global infection ratio hits all time high this year at nearly 60 percent

PandaLabs, Panda Security’s malware analysis and detection laboratory, announced that it has detected a 15 percent increase in the total number of malware-infected computers in September in comparison to the previous month of August. According to data gathered from users that scanned and disinfected their computers with the free Panda ActiveScan online antivirus, the average infection ratio rose to 59 percent, the highest rate this year.

In comparison to the infection rates of 29 countries, the U.S. ranks ninth with an infection ratio of 58.25 percent, just below the worldwide average. Taiwan has the most infected PCs, with a 69.10 percent corruption, followed by Russia and China at 67.99 percent and 61.97 percent, respectively. The country with the least infections is Norway at 39.60 percent. To view a table that outlines the percentage of infected computers by country, please visit: http://www.flickr.com/photos/panda_security/3963144168/.

According to Luis Corrons, Technical Director of PandaLabs, “There is a false sense of security, as users perceive there to be no real danger at the moment. When their computers get infected, they rarely notice any symptoms.”

Panda’s study revealed that U.S. computers are infected by the most dangerous malware strains: Trojans, followed by adware, worms and viruses. To see the number and types of malware on infected computers in the U.S., please visit: http://www.flickr.com/photos/lithium-/3963437003/sizes/o/.

“This is a clear sign that hackers are becoming more and more sophisticated,” explains Corrons. “Cybercriminals have found news ways to spread their creations, frequently exploiting the latest news stories to launch attacks through social networks, videos, and email. The huge amount of Trojans in circulation is due to the spectacular increase in the number of banker Trojans aimed at stealing user data.”

Tags: , , , , , , , , , , , , , , , , , , , , , , , ,

PandaLabs Predictions of Conficker’s Minimal Impact on April Fools Day Ring True

April 2, 2009 · Filed Under Downloads, Internet Software, Security Software, Software News · Comment 

The Much-Feared Re-activation of Conficker on April 1st Goes Off Without a Bang

PandaLabs, Panda Security’s malware detection and analysis laboratory, predicted in a recent blog post that the malicious Conficker worm won’t cause major upheaval on April 1st and advised consumers not to “get taken in by the Conficker panic“. As predicted by PandaLabs, the much-feared reactivation of the Conficker virus, forecasted for Midnight on April 1, has yet to cause massive infections.

According to Luis Corrons, Technical Director of PandaLabs, “The ultimate aim of the virus is to obtain money. With the alarm generated by the media attention, security vendors have been working to avoid a potentially widespread epidemic. Evidently though, if someone is going to steal money, they are not interested in being headline news. That’s why we believe that its creator is trying to find a new zero-day vulnerability to exploit in order to spread the infection. But it will happen at a moment when our guard is down, not when everyone is on the alert.”

At Midnight on April 1, Conficker started to generate 50,000 new URLs from which, supposedly, the malware would be able to update itself to a new version, starting a massive series of infections. However, until now, no new versions or additional infections have been detected other than those already associated to the previously active variants.

“It is still possible that at any moment one of these URLs could be activated and the worm could download an update to its code or new malware. In any event, this would only affect users who are unprotected against Conficker, although there are still many of them,” says Corrons.

Although there has been much speculation as to why the creators are trying to draw attention to Conficker, Corrons adds, “The reality of today’s malware is that it is created with a financial motive. At PandaLabs we believe that the cyber-criminals behind this worm are still aiming to infect as many unprotected computers as possible. This way, with a critical mass of infected computers, they can then start to profit by renting out the network for sending spam, downloading Trojans to steal data and other fraudulent activities.”

Ironically, one of the main dangers associated with Conficker, as described on the PandaLabs blog is not the worm itself, but the fact that cyber-crooks are exploiting the notoriety of this malware to distribute other malicious code from domains ranked highly in Internet searches for the word ‘Conficker.’

To avoid falling victim to Conficker and other malicious code, PandaLabs advises:

  • Having an up-to-date anti-malware solution installed
  • Installing the patch that fixes the vulnerability exploited by Conficker
  • Having a solution to prevent malicious code spreading through USB devices (pen drives, MP3 players), etc. With this in mind, Panda has developed the free Panda USB Vaccine, which can be downloaded from here
  • Not opening emails from unknown sources and never clicking links or running files attached to such emails

Source: Panda Security

Tags: , , , , , , , , , , , , ,