River Great Ouse, Bedford: 19/1/08

I know that it's winter, but in the UK we've had nothing but rain, rain and more rain. Our local river is right up to banks and with nothing but rain forecast for the next few days.. well, I'm just glad I don't live next to it.

"Colls Solution Company" Scam Email

This is a UK-target scam, using email addresses harvested from an online retailer who had a security breach.

This one appears to be more that just the usual advanced fee fraud or money laundering though.

Subject: JOB OFFER
From: "COLLS SOLUTION COMPANY"

Hello

We are offering a temporary job which really do not
require any professional skills.

You really don't have to have any professional skills
for this. All we are looking for right now is Uk based
individual to handle paper work, file documents and
handle payroll administration to our clients in Uk.

What will be required from you is few hours a day and
also to pay very close attention to all instructions
given to you.

Your Job will be; Handling all applications with
regards to new clients that will like to register a
company in uk and what you will be doing is Filing all
papers from these individual companies which will be
sent over to you under that companies name.

Salary terms; 120 pounds per job Get back to
us through the email address below if you are
interested in the job offer.

Please get back to me with the following details.

FULL NAME

FULL ADDRESS

E-MAIL ADDRESS

AGE

SEX

PRESENT EMPLOYMENT

MARITAL STATUS

WHEN WOULD LIKE TO START

All replies should to be forwards to the company e-mail address.

private_solutions@representative.com

Regard,

DEBRA COLLINS

Note that they say the job is "Handling all applications with regards to new clients that will like to register a company in uk and what you will be doing is Filing all papers from these individual companies which will be sent over to you under that companies name." In other words, the victim will be used as a front to create bogus offshore companies. And when those companies do something criminal, then the UK-based victim will be the one to get into trouble.

If you get one of these, forward it to abuse -at- mail.com who handle email for the representative.com domain.

The BBC iPlayer in a corporate environment

The BBC have spent a lot of time and money developing the BBC iPlayer it turns out that it's just another P2P application running on Kontiki.

So, I've written a guide for corporate IT departments giving them a pointer as to what the iPlayer is all about and how to block it - which it turns out should be easy enough!

Blocking BBC iPlayer, 4OD and Sky-by-Broadband

CA PestPatrol false positive - NeoSpy / rarsfx0 directory / WinRAR

Another false positive doing the rounds, this time in CA's PestPatrol software which is incorrectly identifying %profile%\local settings\temp\rarsfx0 as being part of part of the rogue NeoSpy package (see here for CA's description).

In fact, the rarsfx0 directory is just a temporary folder created by RARLAB's WinRAR application - that's a harmless commercial file packager. This folder looks to have been included accidentally in a PestPatrol signature released on 9th January.

Note that if you have PestPatrol installed with the faulty signature, then WinRAR archives may not unpack properly.

Arcanely Worded Scam of the Month Award

OK, so I don't really have an Arcanely Worded Scam of the Month Award, but if I did then this rather bizarre email would count. It is, of course, a standard Advanced Fee Fraud pitch, but the almost Shakespearean wording is something else..

Subject: PLEASE RESPOND ASAP!!
From: "Timms David"

Hello,
It gives me a great deal of pleasure to write you this mail and even when it might
come to you as a surprise, I hope you find it of interest. Let me first introduce
myself. My name is David Timms. I am an Executive Auditor with a Bank here in Europe
, I would like to use this means to ask your assistance in moving some fund over to
your country. I have in the course of my duties come in contact with a good amount
of Fund that have been inactive for some years now and careful investigation proved
the original depositor of the fund died five years ago and all attempt to reach the
suppose beneficiary of the deposit were fruitless and before it is forfeited to the
state I decided to move it. It is of interest to inform you also that I have already
moved this fund out of the Establishment and now in safe keeping with a Finance and
security house, I will like to move it outside now and this is were I need your
assistance. After legal consultation, I have established modalities for!
a secured way for a perfect transaction., but be most assured that for your
assistance and partnership you will get a good percentage of the fund, it is
important to let you know that fifty percent of the rest will be invested over
there under your management for a negotiable period of time and we will open a
fruitful dialog very soon to that effect. I look forward to our working closely in
practically seeing this transaction come to a perfect end. For effective
communication, please kindly include in your reply, your complete Names, Address,
Occupation, Age and most especially your contact number and I will contact you as
soon as I get your reply. I look forward to hearing from you and my gratitude for
your Patience.
Respectfully yours,
Timms David.

Eh? "I have established modalities for a secured way for a perfect transaction"?

eTrust ITM 8.1 fails to update

I've been grappling with a strange problem with eTrust ITM 8.1 for a couple of weeks - the software installs just fine, but the signature updates never apply. The problem occurs on a whole batch of machines that aren't exactly related, but which were all bought in early 2005.

The eTrust Distribution log shows the following:

Completed Time Type Code Description
09-Jan-2008 08:46:11 Information 0 1) Selected component "eTrust Antivirus Arclib Archive Libra...
09-Jan-2008 08:46:11 Information 0 2) Selected component "eTrust Antivirus Base"
09-Jan-2008 08:46:11 Information 0 3) Selected component "eTrust Antivirus Realtime Drivers"
09-Jan-2008 08:46:11 Information 0 4) Selected component "iGateway"
09-Jan-2008 08:46:11 Information 0 5) Selected component "eTrust ITM Common"
09-Jan-2008 08:46:11 Information 0 6) Selected component "eTrust ITM Agent GUI"
09-Jan-2008 08:46:11 Information 0 7) Selected component "CAUpdate"
09-Jan-2008 08:46:11 Information 0 8) Selected component "eTrust PestPatrol Base"
09-Jan-2008 08:46:11 Information 0 9) Selected component "eTrust PestPatrol Clean"
09-Jan-2008 08:46:11 Information 0 10) Selected component "eTrust PestPatrol Engine"
09-Jan-2008 08:46:11 Information 0 11) Selected component "eTrust PestPatrol Realtime"
09-Jan-2008 08:46:11 Information 0 12) Selected component "eTrust PestPatrol Signatures"
09-Jan-2008 08:46:11 Information 0 13) Selected component "eTrust Vet Engine"
09-Jan-2008 08:46:11 Information 0 Checking updates for "eTrust Antivirus Arclib Archive Librar...
09-Jan-2008 08:46:11 Information 0 Downloading from "SERVERNAME:42511"
09-Jan-2008 08:46:09 Information 0 The distribution program started the download process.
Show 10 Show 25 Show 50 Show All Page 1 « ‹ 1-16 of 16 › »

Note that there are always 16 lines in the log.. the update process starts but never completes, and there's no error message.

After working with our reseller we discovered the problem - it's not a problem with eTrust, but instead a very strange permissions issue that has happened with those PCs. What has happened is that the computer's SYSTEM account (which the eTrust services run under) doesn't have access to write to that part of the disk, despite having permissions explicitly set.

In the case of eTrust, the fix is to open up the Services control panel (Start.. Run.. services.msc), and then.

• Double-click on the eTrust ITM Job Service
  
• Click the Log On tab
• Change the credentials from the "Local System account" to the local Administrator account on the PC (i.e. username Administrator, password to whatever you set it to).
• Restart the service
• Either reboot the machine, or terminate the ITMDist service
• Tell the machine to download updates again.

In the cases I have seen, the update works correctly after the Administrator account has been specified. There does seem to be some problem with the SYSTEM service not working properly.

Of course, you can also do this all remotely with the Computer Management tool and something like PSKILL (from PSTools), so you don't have to be sitting at the machine to do it.

As I said, I don't believe that this is an eTrust problem, it looks as though Windows is borked somehow, possibly an issue with SIDs or something. I have a feeling that other software misbehaves, possibly including Active Directory policies. I have no solution other than a complete rebuild, but if you're struggling to get eTrust updating properly, then I would definitely look at the user rights for the service.

CA.com compromised / Zero-day RealPlayer flaw

The ISC reports that several websites have been compromised by a zero-day vulnerability in RealPlayer. The halware is hosted or routed via uc8010.com (currently down).

Surprisingly, one of the compromised web sites (since cleaned up) is ca.com (Computer Associates), who make the eTrust anti-virus product.

A Google search for uc8010.+com site:ca.com comes up with several dozen hacked pages, mostly press releases.



A look at a cached copy of the code shows a link to n.uc8010.com/0.js (don't visit this url) which then loads the exploit.



Note that everything here is a .gif to stop virus scanners freaking out.

To be fair, a lot of sites are compromised including government bodies and large corporations. It just goes to show that there's no such thing as a "safe site" any more.

JS/Exploit-BO false positive in McAfee

In what looks like a re-run of a recent false positive from eTrust, McAfee Anti-Virus is detecting JS/Exploit-BO in a number of innocent javascript applications, including Mootools. It's likely that McAfee is detecting the Dean Edwards Packer Tool as malware, although that's just an innocent application. Pattern 5197 has the problem, upgrading the signatures to pattern 5198 or later should fix it.

Unfortunately I guess this goes to show that packer tools can be a menace. There have been reports of this tool being used to obfuscate malware, so the smart advice to javascript developers is probably to not encode, compress or encrypt your code in any way if you want it to be trusted.