Category: News

Important information regarding DNSChanger malware – SSO-AL2012-010

21 March 2012

Software and platform affected

Windows (all versions)
Mac OS X (all versions)

What is the problem?

Malware which alters a computer’s DNS (Domain Name System) settings, known as “DNSChanger” malware, has been in circulation for some time. DNS is an Internet service which translates user-friendly domain names (e.g. ssoalertservice.net.au) into the numerical Internet Protocol (IP) addresses (e.g. 203.15.34.230) which are used by computers to communicate with each other. By infecting a victim’s computer with this type of malware, criminals are able to alter the DNS settings on a user’s computer. By controlling the DNS settings on victim’s computer, criminals force the infected computers to communicate with “bad” or “rogue” DNS servers, rather than legitimate “good” DNS servers. The criminals can then use these “bad” or “rogue” DNS servers to redirect the unsuspecting users to fraudulent websites or interfere with a user’s web browsing. For example, if a user’s computer is infected with the DNSChanger malware, a! nd the user enters “google.com” in their web browser, rather than take the user to the legitimate “google.com” website, they would be taken to a fraudulent website instead.

In November 2011, the FBI uncovered a network of rogue DNS servers and took steps to disable them. However, by disabling the rogue DNS network, victims who are infected by the DNSChanger malware could lose access to DNS services entirely. To address this issue, the FBI developed a private-sector, non-government entity to operate and maintain clean DNS servers for the infected victims for a temporary period. As of July 9th 2012 the FBI will no longer be operating this service; computers that are infected with the DNSChanger malware could lose access to DNS services, preventing access to the Internet, including access to legitimate websites.

What we recommend you do

The Australian Government has created a diagnostic website which will, in most cases, confirm whether or not a user’s computer is infected with DNSChanger malware: Australian Government DNSChanger Diagnostic

The FBI has provided a PDF document with detailed instructions (including screenshots) to manually check the DNS settings on both Windows and Mac OS X based computers: FBI DNSChanger Malware Document

As a minimum step, we recommend that you click on the Australian Government’s diagnostic website and see whether it displays a green box with the words, “You do not appear to be affected by DNSChanger”.

Then, if you want to be more certain that this diagnosis is correct, it is also recommended that you follow the detailed instructions in the FBI’s PDF document to help to determine whether your computer is infected with DNSChanger. You should also perform a thorough virus-scan of your computer using an up-to-date virus scanner to ensure that it is not infected with the DNSChanger malware.

If you do find that have been infected with the DNSChanger malware, you should seek professional assistance to ensure that the malware is removed successfully.

Additionally, this factsheet contains instructions to help detect and remove malware:

Factsheet 11, Parts 1-3, You suspect your computer is infected with malicious software – what should I do?

Where you can find more information

The Australian Government has also provided some additional information regarding the DNSChanger Malware here: DNSChanger Information

The FBI has also provided further information regarding internet fraud associated with the DNSChanger Malware here: Manhattan U.S. Attorney Charges Seven Individuals for Engineering Sophisticated Internet Fraud Scheme That Infected Millions of Computers Worldwide and Manipulated Internet Advertising Business

 

Disclaimer

This Alert has been prepared by AusCERT for the Department of Broadband, Communications and the Digital Economy.

The information is intended for use by home users and small to medium sized businesses and is general information only and not intended as advice and was accurate and up to date at the time of publishing. The material and information in this Alert is not adapted to any particular person’s circumstances and therefore cannot be relied upon to be of assistance in any particular case. In any important matter, you should seek professional advice relevant to your own circumstances.

The Commonwealth, AusCERT, and all other persons associated with this Alert accept no responsibility or liability for information either included or referred to in the Alert. No responsibility or liability is accepted for any damage, loss or expense incurred as a result of the information contained in the Alert, whether by way of negligence or otherwise.

The listing of a person or organisation in any part of this site or Alert does not imply any form of endorsement by the Commonwealth of the products or services provided by that person or organisation. Similarly, links to other web sites have been inserted for your convenience and do not constitute endorsement of material at those sites, or any associated organisation, product or service.

Please note that material in this Alert, as the case may be, includes views or recommendations of third parties, which do not necessarily reflect the views of the Commonwealth, or indicate its commitment to particular course of action. Material on this site or in this Alert may also include information provided by third parties. The Commonwealth cannot verify the accuracy of information that has been provided by third parties.

---

Apple releases iTunes 10.5 – SSO-AD2011-030.

12 October 2011

Software and platforms affected

The following software is affected

Apple iTunes prior to version 10.5

for the following operating system platforms:

Windows XP SP2

Windows Vista

Windows 7

What is the problem?

There is a bug in Apple iTunes software which, if not fixed, could result in your computer being attacked by criminals. Your personal and/or business information may be accessed for fraudulent or illegal purposes (eg, identity theft). Apple iTunes might crash and become unusable.

What we recommend you do

The problem can be easily fixed by updating to the latest version of the Apple iTunes software by starting iTunes, and clicking “Check for Update”. Alternatively, the latest version of Apple iTunes can be downloaded from the following location:

https://www.apple.com/itunes/download

Where you can find more information

More information about these security bugs can be found here:

https://support.apple.com/kb/HT4981

Disclaimer

This Advisory has been prepared by AusCERT for the Department of Broadband, Communications and the Digital Economy.

The information is intended for used by home users and small to medium sized businesses and is general information only and not intended as advice and was accurate and up to date at the time of publishing. The material and information in this Advisory is not adapted to any particular person’s circumstances and therefore cannot be relied upon to be of assistance in any particular case. In any important matter, you should seek professional advice relevant to your own circumstances.

The Commonwealth, AusCERT, and all other persons associated with this Advisory accept no responsibility or liability for information either included or referred to in the Advisory. No responsibility or liability is accepted for any damage, loss or expense incurred as a result of the information contained in the Advisory, whether by way of negligence or otherwise.

The listing of a person or organisation in any part of this site or Advisory does not imply any form of endorsement by the Commonwealth of the products or services provided by that person or organisation. Similarly, links to other web sites have been inserted for your convenience and do not constitute endorsement of material at those sites, or any associated organisation, product or service.

Please note that material in this Advisory, as the case may be, includes views or recommendations of third parties, which do not necessarily reflect the views of the Commonwealth, or indicate its commitment to particular course of action. Material on this site or in this Advisory may also include information provided by third parties. The Commonwealth cannot verify the accuracy of information that has been provided by third parties

 

“Erases” files, icons as lead up to pitch for US$80 to buy worthless utility
Gregg Keizer (Computerworld (US))
17 May, 2011 03:07

Scammers are trying to trick Windows users into paying to fix bogus hard drive errors that have apparently erased important files, a researcher said today.

The con is a variant of “scareware,” also called “rogueware,” software that pretends to be legitimate but actually is just a sales pitch based on spooking users into panicking. Most scareware masquerades as antivirus software.

But Symantec researcher Eoin Ward has found a new kind of scareware that impersonates a hard drive cleanup suite that repairs disk errors and speeds up data access.

Dubbed “Trojan.Fakefrag” by Symantec, the fake utility ends up on a Windows PC after its user surfs to a poisoned site — often because the scammers have manipulated search engines to get links near the top of a results list — and falls for a download pitch, typically because it’s presented as something quite different, like video of a hot news topic.

Fake system or disk cleanup programs aren’t new — Symantec has highlighted the scareware subcategory before — but this malware goes above and beyond the call of counterfeit duty.

“[Trojan.Fakefrag’s] aim is to increases the likelihood of you purchasing a copy of Windows Recovery by craftily convincing you that your hard drive is failing,” said Ward in a company blog Monday, referring to the name of the fake suite that the Trojan shills.

The malware kicks off the scam by moving all the files in some folders to a temporary location, by hiding others and by making desktop icons disappear. All of that is followed by a message that looks like a valid Windows warning of impending hard drive doom.

“An error occurred while reading system files,” the on-screen message reads. “Run a system diagnostic utility to check your hard disk drive for errors.”

If the user clicks “OK,” the fraudulent “Windows Recovery” application launches, runs a series of sham scans that sound technical and legit, then reports multiple problems, including disk read-write errors.

With the hook set, the scammers try to reel in the victim by trying to get them to pay $79.50 for Windows Recovery, which will supposedly fix the make-believe issues.

Since the user has just seen his files and icons vanish, he or she is much more likely to fall for the scheme.

“It does a really convincing job of making it appear as though something is wrong,” said Ward. “When it ‘deletes’ files from your desktop, it does so in a very prominent way.”

No surprise, but the files aren’t deleted; they can be found with a quick local search, said Ward.

Windows isn’t the only operating system targeted by scammers. Last week, for example, Intego Security reported finding the first-ever Mac OS X rogueware .

Scammers have upped their “scareware” game by convincing Windows users that their hard drive is ready to croak.