Sleepless in Midland

ATM hacks -- Skimming out, Jackpotting in

It seems like only yesterday that thieves were using skimmers to hijack cash from ATM. But the tactic wore thin as more and more ATM card users became aware of it and took measures to make sure they didn't become victims.

However, the crooks have stepped up their game, and ATM manufacturers are playing catch-up. For an overview, see Jackpotting, the hacking scheme where hackers make ATMs spit out cash like slot machines, is here. Here's an excerpt:

Small-scale jackpotting attacks were reported sporadically in many countries over the next few years, according to Reuters. They finally went big time in 2016.

A gang stole $13 million from Japanese ATMs in three hours that spring, Fortune wrote. In the summer, loose cash was spotted fluttering around dozens of First Commercial Bank ATMs in Taipei, Taiwan.

First Commercial subsequently froze withdrawals at more than 1,000 ATMs, according to the BBC. A police investigation revealed masked thieves had been waiting in front of the hacked machines and carried cash away by the bag load - more than $2 million across the country.

The Government Savings Bank in Thailand was hit with a similar attack the next month, the Wall Street Journal reported. As it warned of the potential for attacks in the U.S., the FBI said the jackpotters impersonated ATM vendor employees in phishing emails to gain security access.

The Diebold Nixdorf ATM machines appear to be the most vulnerable. At the dieboldnixdorf blog we find this: Not Just Ploutus: Protection Against ATM Malware Attacks. There we see malware names such as Ploutus Ripper, Alice, Tyupkin, Green Dispenser "and a whole range of others." They can't specify how the thieves get the malware into the machine, but they offer some recommendations. Specifically, limit access to the ATM, harden the software stack, keep up with what's going on with the hardware, software and the physical machines.

The modern day Bonnies and Clydes are out there somewhere writing malware.

------

3:03 PM 2/2/2018

Necurs botnet was used to send out 12.5 million emails with Scarab malware

That was in the past few months. See World's biggest botnet sends 12.5 MILLION emails containing ransomware that could destroy your computer: Here's how to spot one. They were sending out Scarab, the malware that would lock up user date and demand a ransom. If you haven't received one, or if you did and avoided it, then good for you.

It seems easy enough to avoid any damage -- simply don't download any attachment that is in an archive file format. Zip is the one I see most, so I assume that's the most common. However, the above linked article says the Scarab malware was hidden in one called 7zip.

The title said they would tell how to spot one, so here's that part:

HOW TO SPOT ONE

The biggest giveaway of a malware email is that they are sent without being asked for, so it is always best practice to never open an unsolicited attachment.

The subject line of emails in the Scarab attack suggests the image scans they contain were created using printers from a number of reputable firms.

This includes Lexmark, HP, Canon and Epson, giving the scam messages an appearance of legitimacy at first glance.

However, there may be spelling mistakes or other grammatical errors that give the game away.

This might be in the subject line, email address or body text of the message.

Archive files, like the 7zip format used in the attack, are also another warning sign of potentially dangerous content.

These types of file can be used to try and bypass detection by anti-virus scans.

Bottom line: Don't download any archive file attachments. And don't send any, either, if you expect your recipients to open it.

------

1:17 PM 12/27/2017

Would you let a delivery person enter you're house when you're not home?

This product is a little too far ahead of its time. Amazon Key is a new service that lets couriers unlock your front door. Excerpt:

When a courier arrives with a package for in-home delivery, they scan the barcode, sending a request to Amazon’s cloud. If everything checks out, the cloud grants permission by sending a message back to the camera, which starts recording. The courier then gets a prompt on their app, swipes the screen, and voilà, your door unlocks. They drop off the package, relock the door with another swipe, and are on their way. The customer will get a notification that their delivery has arrived, along with a short video showing the drop-off to confirm everything was done properly.

Oh boy. Never mind that the home owners will be allowing a strangers access to the house, they've also got a door lock connected to the internet which is an issue just as big. Hardly a week goes by during which we don't hear about some major hack of a database. Just the other day Sophos disclosed an exploitable weakness in Microsoft Office. See Microsoft Office DDE zero-day: are you protected?.

Never forget that deception is always one step ahead of detection and that all devices connected to the internet are vulnerable.

------

3:32 PM 10/25/2017

Cyber-insecurity -- is anything safe online anymore?

I started this post before the revelation about KRACK and the world wide vulnerability of the WPA2 protocol described in KRACK in Wi-Fi security: Everything you need to know and in articles elsewhere around the 'net. When there is this much attention paid to a tech problem then hopefully a easy fix is right around the corner.

But what about all those companies that get hacked? It seems that hardly a week goes by during which we DON'T hear about some big corporation losing all its customers' personal information to hackers. See, for example, Russian hackers reportedly found using Kaspersky software, Equifax website borked again, this time to redirect to fake Flash update, and get this, Secret files on jets and navy ships stolen in 'extensive and extreme' hack.

Yegads! Not our military secrets too! Apparently so.

Take a gander at this warning from this June 2017 blackhat.com survey: Portrait of an imminent cyberthreat.  Intro: Cyber attacks on US enterprises and critical infrastructure are coming soon, according to some of the industry’s most experienced and highly informed security professionals. And in most cases, defenders are not prepared.

The survey reveals a wide range of insights, including:

1. 60% of respondents believe that a successful cyber attack on US critical infrastructure will occur in the next two years. Only 26% are confident that U.S. government and defense forces are equipped and trained to respond appropriately.
2. 69% of IT security professionals believe that state-sponsored hacking from countries such as Russia and China has made US enterprise data less secure.
3. Only 26% of information security pros believe that the new White House administration will have a positive impact on cybersecurity policy, regulation, and law enforcement over the next four years.
4. About two-thirds of respondents think it’s likely that their own organizations will have to respond to a major security breach in the next 12 months. Sixty-nine percent say they don’t have enough staff to meet the threat; 58% believe they don’t have adequate budgets.
5. IT security professionals’ greatest concerns are around phishing and social engineering (50%) and sophisticated attacks targeted directly at their own organizations (45%).
6. The increased use of ransomware remains the most serious new threat faced by cybersecurity professionals, cited by 36% of respondents.

Take a look at number 5 again. "Security professionals’ greatest concerns are around phishing and social engineering (50%)..." Boy! If there's one thing Hillary Clinton, et al, taught us it's that we shouldn't fall for phishing schemes.

------

10:46 AM 10/17/2017

Democrats are in a losing battle to convince us there is no voter fraud

Democrats in the msm have long contended that voter fraud was non-existent. Then the narrative changed to the claim that it doesn't happen enough to change the outcome of an election. But we really won't know until the Presidential Advisory Commission on Election Integrity finishes its investigation and publishes a report.

Meanwhile, what we have to go on is anecdotal evidence such as this from Hans A. von Spakovsky: New Report Exposes Thousands of Illegal Votes in 2016 Election:

The [Government Accountability] Institute compared the lists using an “extremely conservative matching approach that sought only to identify two votes cast in the same legal name.” It found that 8,471 votes in 2016 were “highly likely” duplicates.

Extrapolating this to all 50 states would likely produce, with “high-confidence,” around 45,000 duplicate votes.

They were able to research only 21 states due to the inability to obtain information from all the states because “others impose exorbitant costs or refuse to comply with voter information requests.” Still, 45,000 doesn't seem like a lot when compared with the millions of votes that is supposed to have given Clinton the popular vote in 2016.

But the question many conservatives have is about non-citizen votes. Anecdotal evidence suggests it's a large number.

Oh, and the voting machines? Hackers breach dozens of voting machines brought to conference:

The DEF CON cybersecurity conference is held annually in Las Vegas. This year, for the first time, the conference is hosting a "Voting Machine Village," where attendees can try to hack a number of systems and help catch vulnerabilities.

The conference acquired 30 machines for hackers to toy with. Every voting machine in the village was hacked.

Knowing about the problems can lead to solutions for those particular problems. However, deception is always one step ahead of detection. We need to remain vigilant.

------

12:55 PM 8/1/2017

Back up your hard drive ahead of the next ransomware offensive

The massive ransomware strike last week is a wake up call. And I'm certainly not going to hit the snooze button.

See An NSA-derived ransomware worm is shutting down computers worldwide. Quote:

The malware, known as Wanna, Wannacry, or Wcry, has infected at least 75,000 computers, according to antivirus provider Avast. AV provider Kaspersky Lab said organizations in at least 74 countries have been affected, with Russia being disproportionately affected, followed by Ukraine, India, and Taiwan. Infections are also spreading through the United States. The malware is notable for its multi-lingual ransom demands, which support more than two-dozen languages.

Bold added so you'll be sure to notice that sentence. It's spreading.

Most of us keep our antivirus software up to date and run them regularly. But that's no guarantee. It's a good idea to make regular back-ups to a portable drive so that if some malware did slip through and some unseen creep demanded money to let you back into your computer, you can say SOD OFF!

There are several programs out there that make backing up easy -- I'm fond of RichCopy myself. I've used it on Windows 7, 8, and 10 but don't know about the earlier versions.

Does the government have a duty to warn us of malware vulnerabilities?

Those agencies warning us of global warming and saturated fats act as if they have such a duty to warn, although there doesn't seem to be any penalty for failure.

Anecdotally, the movies are rife with scenes in which a law enforcement officer warns a mobster under surveillance that there's a contract out on him. Does that really happen? Don't know.

But how about malware vulnerabilities on someone's computer which the government knows about? It could be subverted by the agency into a spy tool. Or they could warn the individual or company of the danger. Apparently, that's an ethical dilemma they are trying to navigate.

This is brought to our attention in The Zero-Day Dilemma: Should Government Disclose Company Cyber Security Gaps?.

In that article Levi Maxey provides both sides of the issue. On one hand, the possibility that the vulnerability is discovered by someone inclined to misuse it isn't that great. On the other hand, an agency with knowledge about it may itself be vulnerable to Snowden like spies. But they have no duty to disclose it to the vulnerable entity.

It's a jungle out there on the net. The best advice is to keep operating systems and software, especially antivirus software, updated.

Laptops preloaded with bloatware may be vulnerable to hackers

This may be a good reason to spend the extra money and buy a laptop from the "business" section of a manufacturer's website rather than the "consumer" side. For an explanation of some of the differences, see Laptops for work and play: the differences that matter. In sum, the business computers cost more but are expected to last longer.

And for some, the customer can choose which software comes pre-loaded. That's an important option. While the pre-loads on the cheaper units help keep the price low, they can be a little sloppy on security. See Pre-Loaded Laptop Software Comes With Security Risks. Excerpt:

Pre-loaded OEM software has serious implications for system security. For example, in early 2015 adware called Superfish pre-installed on Lenovo laptops tampered with the Windows Platform Binary Table, allowing attackers to eavesdrop on unwitting users’ web browser traffic. Later in the year, some Dell computers became vulnerable to man-in-the-middle attacks because of an issue with the eDellRoot certificate authority.

“Every time something like this happens, we are reassured that the offending vendor of the day cares deeply about our security and privacy. Unfortunately, a cursory analysis of most OEM software reveals that very limited, if any security review was performed,” the report states.

“The thing about software updaters is that they are inherently privileged. They have to run with full system permission in order to change and modify anything,” says Darren Kemp, an analyst and author of the Duo Lab report.  “A lot of the vulnerabilities we found were easy to find and easy to exploit; it is a real enticing target for attackers.”

So what does the buyer of a new computer do?

Short of explicitly disabling updaters and removing OEM components altogether, the end user can do very little to protect themselves from the vulnerabilities created by OEM update components. However, Duo Security did provide users with some advice:

-Wipe any OEM system, and reinstall a clean and bloatware-free copy of Windows before the system is used. Otherwise, reducing the attack surface should be the first step in any system-hardening process.
-Identify unwanted, unnecessary software and disable or uninstall it — less complexity generally results in fewer security flaws.
-Purchasing Microsoft Signature Edition systems may be beneficial, but it is not guaranteed to protect end users from flaws in OEM software altogether.
-Dell, HP, and Lenovo vendors (in specific cases) appeared to perform more security due diligence when compared to Acer and Asus.

Hmm. Windows operating systems aren't cheap when starting from scratch. But maybe it would be worth it.

How long before hackers get into the vote counting software

The other day we were treated with news of a hospital in Los Angeles that paid ransom to hackers who hijacked the hospital's computer system. Seems that hardly a week goes by that we don't hear about some newsworthy hack. It's only a matter of time when we don't consider it newsworthy any more, just routine. See The hacked Hollywood hospital is not alone — schools and clinics across the country are increasingly being hacked for ransom and Hospital Hack Spotlights How Medical Devices and Systems Are at Risk.

As the big league bloggers say, it's a feature not a bug.

Anyway, most local election commissioners went to electronic voting very loudly and proudly several years ago. It was fool proof, they said. But honestly, is it really? If some of the most secure government systems are capable of being hacked, then if it hasn't already happened, votes can disappear, appear, or change, and we may not learn about it until long after the wrong person has been sworn into office. That's progress.

All your browsers are belong to us

This is discouraging. Apparently *researchers participating in the latest Pwn2Own contest successfully exploited each of the top four most popular browsers. This is from Your Favorite Browser Just Got Hacked, But Don’t Panic. Here's an excerpt:

This past week marked the 8th annual Pwn2Own, where security researchers come from near and far to flex their talents. The goal? Demonstrate exploits on the latest builds of popular browsers, get a pile of cash in return.

The good news: because of the nature of the competition, none of the specifics of these exploits are made public until the companies behind the browsers get a chance to patch things up. So while the bugs being exploited here might be lurking in your browser, you’re probably not in danger of actually getting nailed by them before they’re cleaned up.

Mozilla, for example, tells me they’ll have Firefox patched by the end of today. None of the other browser makers had responded to our requests for comment at the time this was published.

Sure enough, Mozilla offered up two patches to users because of that. As of the time of this writing, the latest version of Firefox is 36.0.4.

*We would probably call them "hackers" in another setting.

FBI drive-by malware makes it impossible to hide in the internet

Forum users and blog commenters can still remain anonymous to most of the other users. But some of the most serious tools of anonymity look to be easily pierced by determined governments.

After the Edward Snowden revelations about how the US government was spying on US citizens some of the tech gurus were advocating use of Tor to thwart the spies and skip around the internet anonymously.

However, Tor isn't such a good place to conceal one's internet usage after all. The FBI used some dubious tactics to dig out some purveyors of kiddie porn who were hiding in the Tor tunnel. See Visit the Wrong Website, and the FBI Could End Up in Your Computer. It's a good story.

The Netherlands police had a web crawler written which would collect every Tor address it could find in that portion of the web not revealed by the typical search engine. They found one in 2011 with an administrator account without a password and went to work on it to find the owners location. It was in Nebraska, and they turned it over to the FBI.

The FBI watched it for a year while developing malware which would find out who was visiting the site. In 2012 they arrested the operator and and installed drive-by downloads on his three servers. The downloads would infect each computer that visited the sites and reveal their IP addresses, hardware MAC addresses, a Windows host names. They obtained that information on at least 25 visitors to the site, some of whom are currently on trial.

Apparently, just visiting a kiddie porn site is illegal. That's a good reason to keep anyone else from using your computer, and pity the poor person who stumbled on one of those sites accidentally.

As for the FBI malware, apparently it wasn't a one time deal. And as with any new technological tool, there's plenty of opportunity for abuse. combine malware that provides an opportunity to spy on anyone regardless of their attempts to hide and an environment in which political opponents are singled by a government, and there's a problem that should worry us all.

A good reason not to click banner ads

All of the websites we visit are collecting data about our internet usage ostensibly so that they can enhance our internet experience.  That means directing specific advertising at us. OK, we've known that for a long time. But here's a kicker. Yahoo has inadvertently been helping spread CryptoWall ransomware through its ads.

Security researcher Chris Larsen was investigating where CryptoWall comes from and how it continues to spread when he made a surprising discovery: ads.yahoo.com, the server that hosts Yahoo's advertising, sometimes sends users to sketchy Eastern European sites where CryptoWall thrives. ...

Yahoo ads come from a variety of sources, and one of them is a large server called adsmail.us. Despite the URL, adsmail.us actually routes back to the Czech Republic and receives advertisements from malware distributors in India, Myanmar, Indonesia and Russia. This practice is known as "malvertising."

So much for that enhanced internet experience. And it's probably safe to say that nothing on the internet is risk free.

That link came to us by way of fireeye.com, the company that discovered the spikes in malware traffic around the time of the Crimean and Gaza conflicts.

Does anyone besides me suspect that if the U.S. were to get into it with one of the other super powers there's a good possibility that many of our government, business and personal computers will turn into enemy agents?

You're not paranoid if you don't trust public Wi-Fi, but you're still weird because 3/4ths do

Naked Security tells us about a survey in which 77% of respondents expressed no concern for security when using public Wi-Fi. See Most people think public Wi-Fi is safe. Seriously?. It was the British Office of Communications study, but there's no reason to think Americans would be any different. (See page 322 of the report; 326 in PDF.)

Naked Security says:

It's a grievous error to trust Wi-Fi to the degree that these numbers reflect.

What's the harm? Well, companies, people and governments could be spying on you.

They provide some recommendations:

Don't automatically join a network based on its name.

Turn off Wi-Fi and Bluetooth.

Use a VPN.

Turn off geo-tagging for those services like Facebook, Twitter and Instagram that use it.

Do all of those. Also wear a belt and suspenders.

cyber bank robbers succeed in Britain - if the amount is small enough it's a clean steal

Naked Security points to a report the Home Affairs Committee of the U.K. Parliament issued yesterday about the state of cyber crime in Britain. The summary has a gloomy title: UK failing to win the war on e-crime and contains this tantalizing tidbit:

There appears to be a ‘black hole’ where e-crime is committed with impunity. Online criminal activity which defrauds victims of money is often not reported to or investigated by law enforcement. Banks simply reimburse the victims with no pursuit of the perpetrators. Criminals who commit a high volume of low level fraud can still make huge profits. Banks must be required to report all e-crime fraud to law enforcement.

In other words, crimes against banks that net the fraudsters a sum below a certain amount don't get reported, and the banks merely reimburse the victim for the loss to protect the bank's reputation. It doesn't say what that amount is, however the report does say that in 2011 the "Cost of cyber crime to the UK estimated to be £27bn." The number of crimes are growing as the use of social networks grows.

Chapter 4 titled Can web service providers protect our data? is worth a look because it details some of the types of crimes aided by social networks, including identity theft, phishing, theft of personal information, click jacking, advance fee and romance scams, and Twitter direct messages luring victims to an infected website. They throw in cyber bullying and twitter trolling which apparently are crimes in the U.K.

The lesson we should take away from this is that anyone using the net should maintain caution when clicking. At some point banks in the U.K. and the U.S. could try to blame losses on the victims and decline to reimburse them.

In the U.S. the main cyber threat currently, according to an FBI warning, is one whereby the victims somehow allow the Citadel malware platform to load the Reveton ransomware onto their computers which locks the victims' computers and delivers a blackmail message disguised to be from the FBI, DHS or IC3 accusing them of committing a crime and seeking payment for a fine in order to get their computers unlocked.

The FBI's advice: get the computer repaired, report it to IC3, and keep antivirus software updated.

It's a jungle out there.

Ubuntu forum hacked

Linux is the free Unix based anti-Microsoft operating system for people who got frustrated with Windows or who just like to tinker around. And Ubuntu is a very popular version that is supposed to be easy enough to bring comfort to non-geeks. (My own experience is that the frustration level is about the same as with Microsoft, but the software is free, so it has that going for it.)

Moving right along, this afternoon I was doing an Ixquick search to try to find out how vulnerable Ubuntu is to hackers. Lo and behold, some of the first results to pop up said that the Ubuntu users forum had been hacked.

Naked Security explains that it was hacked over the weekend and that users saw a picture of a penguin holding an AK-47. At this time UbuntuForums.org shows an announcement explaining that there was a security breach, and the site is down. Also this:

Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database.

Just what users need to hear. But on the bright side, the breach was on the website, and presumably it doesn't affect any of the individual Ubuntu users' own computers. But who knows what evil lurks in the hearts of hackers?

How to thwart those annoying Yahoo email hackers

Yesterday's complaint was about Yahoo email hackers, and in particular, how two Yahoo email accounts of mine sent spam out to some of my contacts. I noted in that previous post that a mysterious entry from Israel appeared in the log-in history. That wasn't me, that was the hacker who logged in through a "Yahoo Partner's Application." See a screen shot on the right.

Adding to the mystery was the clean bill of health provided by no fewer than two anti-virus programs and two malware detectors. That plus reading opinions of others has convinced me that the problem isn't with my machine but with Yahoo's email program. There's a vulnerability that Yahoo can't seem to get a grip on.

So Yahoo email users have to take matters into their own hands. The Yahoo help pages suggest frequent password changes and all the usual blather. But a suggestion from Molly in a comment to that prior post provides a tactic that will probably more effectively cut off the hackers access -- disable the "Yahoo Partner's Application" feature. (Thanks Molly!)

To get rid of those uninvited "Yahoo Partners" follow these instructions after logging into your email account:

1. For users of the "New" Yahoo email, roll the cursor over the little thing that looks like a gear in the upper right, and a list appears. Click the one on the bottom that says, "Account Info."

2. If it asks, re-enter your password. (Go ahead, we aren't watching.)

3. Then on the page that appears locate the category "Sign-In and Security."

4. Under that heading find and click "Manage Apps and Website Connections."

5. Once there, if "Yahoo Partner's Application" appears, click "Remove."

6. Click "Sign off" and you're done.

If you're lucky enough to still be using the old Yahoo email, click "options" in the upper right to reveal a list which includes "Mail Options." Click that one. Then on the new page, click "Account Information" which appears in the list on the left. That takes you to the screen where you have to re-enter your password. And that takes you to item #2, above, where the rest is the same.

I was using the old Yahoo mail on the two hacked accounts, but another thing that axehole hacker did was irrevocably upgrade them to the crappy new Yahoo mail. Grrrr.

Yahoo mail it too easy to hack

Many of my Yahoo using email acquaintances have gotten hacked in the past few months. By "hacked" I mean that Yahoo email service is sending bogus emails to their contacts. The email appears to be from the right person and the text may even contain their name. The message will be something bland, but there will always be a hyperlink.

I routinely ignore emails like that and never click on the link. However, in spite of my precautions, yesterday afternoon one of my Yahoo email accounts sent out emails to a bunch of my contacts with a bland message and a hyperlink. As soon as I discovered it I sent a real email to all of them telling them not to click on that link.

This morning another of my Yahoo email accounts experienced the same thing at 6:45 AM. The account page showed that someone logged in with "Yahoo! Partner's Application" at that time from Israel.

I changed the passwords and deleted the contact lists for both accounts to deprive them of spammunition. Then I ran two anti-virus programs on my computer, AVG and Avast. Both programs reported that my computer was clean. Then I ran the Sophos virus removal tool and Malwarebytes Anti-malware tool. Both reported a clean computer.

So what was the problem? I still don't know, but I strongly suspect it was Yahoo and not my computer or something I did. That suspicion is shared by others. See Yahoo's Email Hacking Problem Starts To Hurt As Major Telecom Provider Ditches The Service:

A British telecom company says it will no longer make Yahoo Mail the default email service for its 6 million customers due to concerns their accounts are vulnerable to getting hacked.

“We will be switching customers’ email over to BT Mail, which will include the features and functions they expect from a modern email service,” said Nick Wong, online director for British Telecom’s consumer division, according to The Telegraph.

The shift of BT's 6 million customers to another email service represents just a small fraction of Yahoo's overall email customer base of about 280 million people worldwide. But the loss of clients could be a troubling sign for a company that relies heavily on maintaining its email users to generate advertising revenue. Yahoo is now the third-largest email provider after Google’s Gmail and Microsoft’s Outlook.com.

That Yahoo hasn't yet solved the problem suggests it must be a big one.

One of my correspondents asked if it might be NSA. Hmm. Maybe that explains the clean anti-virus reports. Those off-the-shelf anti-virus programs don't know how to detect sophisticated state sponsored viruses. But even if they did, the companies, at least the American ones, might be prohibited from alerting their users.

Update: Molly in a comment pins the problem on "Yahoo Partner Applications." See How to thwart those annoying Yahoo email hackers for a step-by-step on how to get rid of it. Thanks Molly!

Protect your computer from the Adobe Reader vulnerability

There are several brands of free PDF readers available, however many of us who started with Adobe prefer its quirks over some of the others' quirks. But the Adobe PDF reader is so prevalent that the malware writers searched for and found a vulnerability.

Get a detailed explanation of the latest vulnerability at Naked Security and Ghacks.net, among other places.

From what I can tell, the malware doesn't just attach itself to a PDF file floating through the email system but actually has to be built into a program disguised as a PDF file. The bad guys send out spam with the disguised PDF file attached, and some unsuspecting email recipients download the disguised PDF files, then when they open it with the Adobe Reader an executable program goes to work.

However, there's a way to avoid it which is explained at the aforementioned Naked Security site. But it only works on Adobe Reader XI, not on earlier versions. Download Adobe Reader XI (11.0.01) (46.74 MB) at that link.

In Adobe Reader XI click "Edit," "Preferences," then "Security (Enhanced)." The resulting screen shows a new feature called "Sandbox Protections." The default has the "Protected View" turned off which, according to the experts, won't protect the user. So turn it on by clicking the "All files" button. See the screen shots of both Adobe X and Adobe XI readers, below to see the difference.

Let's all hope this works until Adobe can figure out a permanent fix. By the way, the fix pertains to computers using the Windows operating system and not Macs.

Protect your computer from the Adobe Reader vulnerability

There are several brands of free PDF readers available, however many of us who started with Adobe prefer its quirks over some of the others' quirks. But the Adobe PDF reader is so prevalent that the malware writers searched for and found a vulnerability.

Get a detailed explanation of the latest vulnerability at Naked Security and Ghacks.net, among other places.

From what I can tell, the malware doesn't just attach itself to a PDF file floating through the email system but actually has to be built into a program disguised as a PDF file. The bad guys send out spam with the disguised PDF file attached, and some unsuspecting email recipients download the disguised PDF files, then when they open it with the Adobe Reader an executable program goes to work.

However, there's a way to avoid it which is explained at the aforementioned Naked Security site. But it only works on Adobe Reader XI, not on earlier versions. Download Adobe Reader XI (11.0.01) (46.74 MB) at that link.

In Adobe Reader XI click "Edit," "Preferences," then "Security (Enhanced)." The resulting screen shows a new feature called "Sandbox Protections." The default has the "Protected View" turned off which, according to the experts, won't protect the user. So turn it on by clicking the "All files" button. See the screen shots of both Adobe X and Adobe XI readers, below to see the difference.

Let's all hope this works until Adobe can figure out a permanent fix. By the way, the fix pertains to computers using the Windows operating system and not Macs.

Hackers got New York Times passwords - China suspected

This comes to us by way of Graham Cluley at Naked Security:

The New York Times has reported that for the last four months Chinese hackers have been infiltrating its networks, broken into the email accounts of senior staff, stolen the corporate passwords for every Times employee and used those to gain access to the personal computers of 53 employees. ...

Malware was planted on users' computers which opened backdoors for the hackers to gain remote access to connected systems - including a domain controller that contained usernames and hashed passwords for all of the New York Times' employees. ...

In all, 45 custom-written malware samples are said to have been found on the network.

The hacking appeared to have begun after reporters started snooping into the wealth accumulations of Chinese government officials. But they can't prove who actually did it at this time.

Surely the New York Time had top-of-the-line security in place. So their vulnerability in spite of that suggests that everyone with access to the internet is vulnerable. I've often wondered if we all have some form of virus on our computers that's invisible to the off-the-shelf antivirus programs but which just sits there like a sleeper cell waiting for instructions.

Bank robberies -- then and now

Could there be anything more exiting than a good bank heist movie? Well, yes. It's the FBI statistics about bank robberies. Around the middle of each year the FBI issues its annual report of the bank robberies for the previous year. And the 2011 stats are now available. (We looked at the 2010 stats here.)

Once again, a Friday robbery at a branch bank in a commercial center was the most popular day and place. The time of day was spread fairly evenly between 9:00am and 6:00pm with the slot between 9:00 - 11:00 getting a slight edge.

As for the take, here's a little table comparing the last three years:

	2009	2010	2011
total robberies	5,943	5,546	5,014
loot taken	$45,978,048.97	$43,016,099.07	$38,343,501.96
loot recovered	$8,015,546.46	$8,193,065.41	$8,070,886.97
recovery percent	17.4%	19.0%	21.0%

Robberies include commercial banks, mutual savings banks, S&Ls, credit unions and armored cars. (Armored cars not reported in 2009.) Loot includes cash, face value of securities, checks, food stamps and other property.

These days an old fashioned bank robbery with a typical small take and about one in five chances of losing the money is a losing proposition. A few months ago someone robbed a local Bank Of America branch and was on the loose for only a few hours before being nabbed by police. The surveillance cameras banks use these days have undergone a significant upgrade from a few years ago when the best they could produce were grainy images of shadowy characters. In the BOA case an image from the surveillance video led directly to the perp's identification. (See Short spree for this bank robber.)

If/when those new gigapixel cameras become common place outside banks they could track the robber all the way to his hideout.

The bank robbers who are after the big bucks these days are online using malware. Here's the FBI warning about one called Gameover:

Typically, you receive an unsolicited e-mail from NACHA, the Federal Reserve, or the FDIC telling you that there’s a problem with your bank account or a recent ACH transaction. (ACH stands for Automated Clearing House, a network for a wide variety of financial transactions in the U.S.) The sender has included a link in the e-mail for you that will supposedly help you resolve whatever the issue is. Unfortunately, the link goes to a phony website, and once you’re there, you inadvertently download the Gameover malware, which promptly infects your computer and steals your banking information.

An armed robber taking cash over a bank counter is one thing. But the game changes when the money comes out of an individual's account due to malware. Whose loss it is? The bank is certain to contend it's the customer's fault, and a court will get to decide. In at least one case, noted at NakedSecurity, a federal appeals court found for the customer due to shoddy security at the bank.

In any event, bank customers need to try to avoid letting it happen in the first place. Watch out for those suspicious emails with those oh so tempting links.

Beware of spam bearing malware

Oh those cybercriminals are so tricky. They send a legitimate looking email with an attachment, and the Windows user caught off guard decides to download the attachment to see just what it is. As Dorothy Parker said, there's no cure for curiosity.

Sophos' blog Naked Security alerted readers to two such scams this week. One claims to contain an HP Officejet scan. See samples here.

Attached document was scanned and sent
to you using a Hewlett-Packard HP OfficeJet 81998A.
Sent by: BETTYANN
Images: 0
Attachment Type: .HTML [Internet Explorer]
HP Officejet Location: -

The names and numbers vary, and the attachment looks something like this:

HP_Document_02-22_OFCJET84014.htm

Again, the numbers will vary. But the attachment is an HTM document which contains a malicious script which will send the browser to another site which may contain more malware.

A similar malware scam is in the form of an email claiming to be about a Changelog. That one contains an HTM document, too.

Safest bet, don't download attachments with HTM suffixes.