Contents in This Issue
Total Page:16
File Type:pdf, Size:1020Kb
NOVEMBER 2005 The International Publication on Computer Virus Prevention, Recognition and Removal CONTENTS IN THIS ISSUE 2 COMMENT Virus Bulletin WHEN IRISH EYES ARE thanks the sponsors Is the boot on the other foot? SMILING of VB2005: A busy conference schedule, 3 NEWS combined with the famous warmth Microsoft assists Nigeria in fight against and hospitality of the Irish and a high-tech crime drop or two of the local ‘water’ were Errata – Windows 2003 Server a recipe for success for VB2005 in comparative review Dublin last month. page 14 3 VIRUS PREVALENCE TABLE LANGUAGE LOGGING 4 VIRUS ANALYSIS Using components of Windows multilingual Criss-cross support, it is possible to create a file that will capture keystrokes on a target system while using FEATURES the OS to protect that file from removal or deletion. Masaki Suenaga explains how an IME could be 6 IME as a possible keylogger used as a keylogger. 11 The false positive disaster: anti-virus vs. page 6 WinRar & co. THE TROUBLE WITH WINRAR 13 LETTERS Andreas Marx reports on his extensive false positive testing of anti-virus software. 14 CONFERENCE REPORT page 11 In Dublin’s fair city 16 PRODUCT REVIEW NOD32 for Windows NT/2000/XP/2003/x64 with centralized management This month: anti-spam news and events and 20 END NOTES & NEWS John Graham-Cumming looks at measuring and marketing spam filter accuracy. ISSN 0956-9979 COMMENT ‘It adds insult to the voices of those of us on the systems administrators’ side, which was equal in its representation on the panel.) injury when the So, putting aside the reporting of the subject, I’d like to major media outlets touch again on why accurate reporting is an issue for misrepresent the those of us on the administration side. facts.’ In the context of the informational problems that face anti-malware administrators, media misreporting is not Gabrielle Dowling the greatest challenge we face. And when incidents Independent author, USA occur, we certainly don’t rely on such reports as primary sources of information. But, in the fog of war, when we are deluged with information – very little of it good, IS THE BOOT ON THE OTHER some of it outright wrong, usually with the most critical FOOT? details missing – and we are trying to process it all as fast as possible, it adds insult to injury when the major Talk about irony. When I finally managed to log into my media outlets misrepresent the facts. Worse, it adds to email at the conclusion of VB2005, I found folks on the administrative load when we’re distracted by queries AVIEWS were hotly discussing some of the media from end users and the boardroom based on reports coming out of the conference. In particular, I was misinformation: it’s the last thing we need in the midst struck by a report written for Silicon.com, entitled of an event (and an ‘event’ does not necessarily mean ‘Security firms put the boot into the media’. It read: ‘At that we have an actual or potential problem on our this week’s Virus Bulletin 2005 conference in Dublin, a network, but rather that there is an outbreak of panel session featuring representatives from IBM, McAfee something significant against which we need to check and Symantec turned nasty for the assembled press with the adequacy of our defences and incursion responses). vendors airing grievances about what they consider to be “a layer of incompetence” in media companies.’ I think there’s another reason this subject stings those in the trenches. As the security field seems increasingly This seemed to allude to the panel I had chaired on the known for folks filled with bravado who like to drop informational problems facing anti-virus administrators. allusions to ‘the coming superworm’ and dilettantes Apparently, I’d hit a sore spot when I threw the following with little experience writing books that simplistically question to the panel (verbatim): ‘Do news reports of liken worms to warheads, I am constantly struck by the virus outbreaks typically misrepresent the facts? If so, lack of such swagger in the anti-virus community. They what are the repercussions of that misinformation?’ are smart people who have been in the trenches and It was not an accusatory question, but a pragmatic one, know better. and I was surprised by how it came to take over the panel Some of the banter that arose at VB was finger-pointing and audience discourse. It was more surprising still to by the media, saying they were merely responding to see how it came to be reported, since I don’t think things press releases issued by the vendors. That seems wrong, ever approached the tenor of ‘ugly’, and in fact the on two fronts. First, fact-checking is part of Reporting vendors on the panel were generally supportive of media 101, and reporters should be aware that press releases are efforts, accurate or not. (Notably, the reporter omitted a marketing tool. Second, and more importantly, most if not all vendors have dropped that habit – some actually advise administrators that they are issuing a particular alert simply because of media attention, not because it is Editor: Helen Martin being seen broadly in the wild. I love that trend! Technical Consultant: Matt Ham Reporters certainly face the same informational Technical Editor: Morton Swimmer challenges as those of us fighting malware, and that’s Consulting Editors: one of the problems that AVIEN/AVIEWS help to Nick FitzGerald, Independent consultant, NZ address by providing a platform for an experience-rich, Ian Whalley, IBM Research, USA marketing-poor exchange of information. But I would Richard Ford, Florida Institute of Technology, USA Edward Wilding, Data Genetics, UK say this, and it applies broadly: if your fundamental information is incomplete or not well understood, refrain from extrapolating from it or you’ll wind up wildly off the mark. 2 NOVEMBER 2005 VIRUS BULLETIN www.virusbtn.com NEWS MICROSOFT ASSISTS NIGERIA IN FIGHT AGAINST HIGH-TECH CRIME Prevalence Table – September 2005 The Nigerian government has signed an agreement with Microsoft under which the two organizations will Virus Type Incidents Reports collaborate in fighting high-tech crime originating in the Win32/Netsky File 12,228 51.36% country. Win32/Bagle File 4,522 18.99% Under the agreement, Microsoft will provide information, assistance and training to the Nigerian government’s Win32/Zafi File 3,048 12.80% Economic and Financial Crimes Commission (EFCC), Win32/Mytob File 1,023 4.30% which was set up in 2002 to address the problem of Win32/Mydoom File 418 1.76% cybercrime in the country. One of the areas Microsoft Win32/Lovgate File 242 1.02% expects to focus on is botnets – for example teaching officials how to extract useful information from Win32/Klez File 211 0.89% compromised PCs, how to monitor computer networks to Win32/Funlove File 185 0.78% detect such attacks and how to identify the perpetrators. Win32/Bagz File 177 0.74% Mallam Nuhu Ribadu, executive chairman of the EFCC Win32/Dumaru File 150 0.63% said: ‘Our economy has lost hundreds of millions of dollars Win32/Bugbear File 140 0.59% in foreign investment because our credibility and the trust of the international community have been affected.’ He Win32/Pate File 121 0.51% added: ‘This agreement will be of great benefit to us. It will Win32/Mabutu File 101 0.42% put us in the proper direction in fighting cybercrime. It will Win32/Valla File 98 0.41% help us to improve our understanding of the technologies Win32/Fizzer File 94 0.39% involved as well as give us new investigative skills to go after the criminals.’ Win32/Mimail File 87 0.37% Win32/Reatle File 86 0.36% Win32/Swen File 83 0.35% ERRATA – WINDOWS 2003 SERVER COMPARATIVE REVIEW Win32/Mylife File 77 0.32% Win32/Bobax File 73 0.31% Regrettably, there were three errors in the latest Win32/Mota File 67 0.28% Windows 2003 Advanced Server comparative review (see VB, October 2005, p.12). In Redlof Script 58 0.24% alphabetical order these were: Win32/Yaha File 44 0.18% CAT Quick Heal: Initially this was flagged as having missed Win32/Agobot File 43 0.18% a sample of W32/Nimda.A in the .EML format. Subsequent Win32/Zotob File 31 0.13% tests revealed that the infected contents of the .EML file Win32/Randex File 26 0.11% were removed, though the file itself remained. This must therefore be considered a detection and a VB 100% award is Win32/MyWife File 25 0.10% due to Quick Heal. Win95/Spaces File 23 0.10% MWI VirusChaser: Due to an administrative error the tests Win32/Gael File 22 0.09% for this product were omitted from the initial review. The Win32/Maslan File 21 0.09% product gained a VB 100% award when tested, with full Win32/Nimda File 18 0.08% detection in the wild and no false positives. Win32/Sobig File 18 0.08% Sophos Anti-Virus: The product submitted by Sophos was Others[1] 250 1.05% that which was available to the public on the company’s website at the time of the review submission. Due to Total 23,810 100% miscommunication, however, the versions downloaded for testing, were an incompatible combination of base scanning [1]The Prevalence Table includes a total of 250 reports across engine and virus database updates. Re-testing with the 56 further viruses. Readers are reminded that a complete listing is posted at http://www.virusbtn.com/Prevalence/. correct combination resulted in full In the Wild detection and a VB 100% award for the product.