KOOBFACE guys CAUGHT : FACEBOOK

1. Koobface is not something new for the cybercrime followers.....some thing in brief for those reading about this first timehere :

- is a computer worm that targets users of the Facebook.

- koob is book spelled backwards, making the name koobface an anagram for the word Facebook.

- Koobface targets Facebook users via fake friend messages that encourages people to click on links that installs a malicious worm

- Messages like, "you look funny in this video" or "you look so stupid in this pic" are used to persuade somone to click on the link attached. Once the user clicks on them it takes you to a video which doesn't play and they ask you to download certain codecs which can be a fake 'flash_player.exe' file.

- If this file is downloaded, your computer becomes open to Koobface malware.

- It downloads a file 'tinyproxy.exe' which hijacks your PC.

- It even alters search results from Google, Yahoo etc and redirects to websites selling malicious softwares.

- Kaspersky Labs has estimated the network includes 400,000 to 800,000 PCs worldwide at its height in 2010.

- Victims are often unaware their machines have been compromised.

2. Facebook two days back unmasked the team behind the notorious Koobface virus that hit the social network for two years beginning in 2008.

ABOUT THE GANG

- Five men believed to be responsible for spreading this notorious computer worm on Facebook.

- Have pocketed several million dollars from online schemes.

- Are likely hiding in plain sight in St. Petersburg, Russia, according to investigators at Facebook.

- One member of the group has regularly broadcast the coordinates of its offices by checking in on Foursquare, a location-based social network, and posting the news to Twitter.

- Photographs on Foursquare also show other suspected members of the group working on Macs in a loftlike room that looks like offices used by tech start-ups in cities around the world.

- Ultimately, the Koobface gang was identified by the researchers as Anton Korotchenko, Alexander Koltyshev, Roman Koturbach, Syvatoslav Polinchuk, and Stanislav Avdeik.

3. Thanks http://www.pcmag.com

OIL & GAS : CYBER HACKED

1.    McAfee has recently revealed and confirmed about computer hacking on un-named global oil, gas and petrochemical companies, and individuals and executives in Taiwan, Greece, and the United States, to acquire proprietary and confidential information. This has also been confirmed by five oil and gas companies that had  that the attacks took place, and the attackers were looking for documents about oil and gas exploration and bidding contracts.The source of the attack as usual has been found to be from 'several locations in China'.(Is there any thing new about this ?????)

2.    Oil companies expect such attacks getting more frequent and more meticulously planned. The determination and stamina shown by some modern hackers has increased and there are more multi-pronged, co-ordinated attacks. 

3.    Hackers have started bombarding the world's computer controlled energy sector, conducting industrial espionage and threatening potential global havoc through oil supply disruption.Since Computers control a relatively high percentage distribution in systems,thus are increasingly becoming vulnerable to cyber attacks that could put fuel production technology in the docks!!!

4.    The issue is indeed alarming and needs urgent attention at global level.It is not that my country is not effected or why should I be bothered ?We all are going be effected in the long run because we all r users and part of the last mile chain.Stuxnet,Duqu etc are some of the culprit virus which have been caught doing the action.What about the other thousands and may be millions who are already into action in the background.Japan has recently come up with the good virus ie CYBER WEAPON.Now this one acts like a immunization pill.It resists the virus.About 3 yrs and few billlion dollars have gone into the making.This is just the beginning and I am sure in the rat-cat race aka the good/bad guys of the cyber space there will be moments when the cyber crime over shadows the strengths of cyber power...but its upto the overall cohesive planning that all countries have to work together at the earliest.If late,there will be no other chance.Hackers are already doing it together as one team.....but we all act as teams of different nations.....we should be one GLOBAL TEAM!!!!

5.   Thanks  http://www.mcafee.com 

NATIONAL CYBER SECURITY POLICY : DRAFT

1.    Finally we are working on a national cyber policy....infact late but ...IT'S NEVER TOO LATE....the thing that we have started on this is a good sign.The draft of the subject policy is available at www.mit.gov.in/sites/upload_files/dit/files/ncsp_060411.pdf and is in fact inviting comments in case u have any!!!

2.   The draft is a 21 page report.After going through the same I have given the following points at the desired email address available in the draft report.

PARA 3.3 (I) C
GOVERNMENT SECURED INTRANET :
Addition point :

“ In addition to the emphasis on creation of such kind of intranet, efforts at the design stage should be made to exclude all possible options of internet connectivity with this intranet to avoid any kind of imminent threats. This intranet may need internet for various updates etc ,but this should be a privilege access point and no node should be allowed a free access. Any attempts to connect the same may invite action as a threat to nation. The limited internet connectivity to this is required for the following purpose :

- It is the most common action by any user to browse the net. Once given a opportunity he/she is always eager to access emails and download malware or infected software or any third party application. This is the point where command and control centre of a Botnet can be established by a cyber criminal. To avoid such practices it would always be the endeavor of the designer and the super administrator to ensure physical separation of Intranet and Internet. This Intranet should also be subject to regular cyber /IT audits by govt recognized penetration testers and forensic experts to maintain a cyber secure working environment.

PARA 3.3(D) @ Page 12
OPEN STANDARDS

The strength and power of open standards and applications remains unexploited in our country. Other developed nations who have realized the potential of this standard are already contributing significantly to their positive growth in cyber space. This has largely been possible owing to the lack of exposure of such standards by the new generation who is only exposed to the windows environment. Policy should be in place to ensure growth of open standards at school level curriculum.

PARA 3.5.2
COMBATING HIGH TECH CRIME/CYBER CRIME

Though the cat and mouse race between the good and the bad cyber guy would remain on always,it is worth noting that cyber crime if not controlled at such a nascent stage of induction and growth, has the full potential to become a cyber threat.No single policy would be able to achieve a CYBER CRIME FREE CYBER SPACE.It remains the onus of the common man how he tackles the cime himself.It is here that the National Cyber Policy can contribute in the following manner :

- Cyber Huntsville is a collaborative cyber community with the aim of attracting and developing the brightest minds, attacking the most complex problems, and providing the best solutions of national and international significance. Cyber Huntsville is an integral part of the National Cyber Initiative. Similar establishments should be encouraged at India level. More info at http://www.hsvcity.com/cyber/

4.2.3
Thrust areas of R&D  : 

-  Thrust areas of R&D should majorly focus on inducing maximum SRS and QRs at the DESIGN STAGE. Because, if not done at this stage, whatever work follows is patch work that remains a cover up action.
- Analysis of data flow in a network
- Pentration testing
- Storage solutions with backup, archiving, recovery provisioning of entire data.

5.1.1
ENABLING PEOPLE

Promoting a comprehensive national awareness program to include organizing seminars, events, webinars, guest lecture’s in tie up with established societies like IETE,Institution of  Engineers, Computer Society of India etc

Besides,these points I would suggest to include ensuring information security by managing the flow of information to the citizens as well as on securing its physical information infrastructure.The policy should call for the following :

- Popularize e- government
- Optimize the cyber industry structure.
- Provide a rugged 24x7 nationwide cyber infrastructure.
- Promote innovation of cyber technologies.
- Build a cyber oriented national economy.
- Design way to advanced internet culture.

THE GOOD VIRUS : "CYBER WEAPON" BY FUJITSU,JAPAN

1.   Have u seen the epic movie SHOLAY.....where bad guys are hired to kill bad guys by the good people...its a must watch for those who have not seen this...on the same lines recently Japanese government has done some homework to counter cyber crime.....Outsourcing and working with Fujitsu to fight cyber crime with the help of developing a CYBER wEAPON VIRUS that automatically seeks out and destroys enemy viruses.Cyber Weapon almost acts like a human immune system tracking down and weeding out invading viruses. Systems like these are needed when facing the latest advanced threats.Few additional It is the culmination of a $2.3 million, three-year project to develop a virus and equipment to monitor and analyze attacks.  It is reported U.S and china have already put so-called cyber weapons into practical use.

2.   Tracing the source of cyber-attacks is notoriously difficult, mainly because attackers routinely hide behind botnets and anonymous proxies to launch attacks, such as denial of service assaults.Getting this right is a far from trivial process and the potential for collateral damage, even before hackers develop countermeasures, appears to be considerable. Few more points here about this good VIRUS :

- Currently, the virus is being tested in a “closed environment” to examine its applicable patterns. 

- The project is actually outsourced to Fujitsu Ltd. 

- It is capable to disable the incoming attack and record forensics data.

3.   It would actaully be interesting to know how would this be able to trace the source of cyber-attacks as claimed at times like today when the botnets and anonymous proxies are getting better and stronger by the day.

4.  Thanks http://www.airdemon.net/news2.html

Malware in the name of Kim Jong-il death : BEWARE!!!

1.   A "malicious spam mail" in the name of the dead North Korean leader Kim Jong is doing the rounds of the webosphsere and biting anyone whoever clicks it.The malicious spam carries a fake name as "brief_introduction_of_kim_jong_Ill_pdf.pdf". The subject file exploits vulnerabilities in Adobe reader and leads to remote code execution in the victim PC.

2.   The emails contain a simple line of text announcing the death, likely copied and pasted from the CNN website, and carries an attachment named brief_introduction_of_kim-jong-il.pdf.pdf.Once downloaded and executed, the malicious file opens a non-malicious PDF file containing a picture and information about the deceased man in order to hide its true activity on the victims' computer.In other variants of the same theme, the attached file is named Kim_Jong_il_s_death_affects_N._Korea_s_nuclear_programs.doc and, once opened, it drops backdoor-opening malware into the system, which then connects to a remote Command & Control server for further instructions.After this much code execution...its JAI HIND.....

3.  So don't open this one from ur PC if u have read this much.....

4.  Thanks http://www.net-security.org

WELCOME 2012

HAPPY NEW YEAR 2012..................WELCOME............

HAPPY NEW YEAR WISHES 2012

WISHING EVERY ONE READING ACROSS "MELIORATE" A VERY VERY HAPPY NEW YEAR 2012......

HIDEMYASS saves its own!!!

1.  The month of September 2011 went so full of embarassment for HMA(Hidemyass) that it would probably like October  to  follow  August  ( September  may just  vanish in the smoke....) All  its  claims  of  telling  being anonymous  and safe, maintaining privacy,being completely hidden etc etc hit a serious setback....the story goes like this...

 2.   The case pertains to Lulz Security aka LulzSec,a computer hacker group that claims responsibility for several high profile attacks including SONY,CIA etc.So in the month of September this year an alleged Lulzsec member who had carried out attacks on various organizations including Sony and the UK’s Serious Organised Crime Agency, had used this ‘anonymous’ VPN service supplied by HideMyAss.But his plan failed in the biggest way imaginable. HideMyAss (HMA) keeps all yourlogs and as a UK company when given a court order to cough up information, they did so. After matching timestamps to IP addresses, in the blink of an eye Luzlsec member ‘Recursion’ became 23-year-old Cody Kretsinger from Phoenix. The FBI got their man.....so whats the use.....!!!!

3.   But I feel that anything to do with some serious crime should always be contained....like this way...but what about you and me....our surfing habits will always be known....our info will always be under cloud....:-(

4.   This is what HMA had to say :

“Our VPN service and VPN services in general are not designed to be used to commit illegal activity,” said Hide My Ass. “It is very naive to think that by paying a subscription fee to a VPN service you are free to break the law without any consequences.”

5.  Thanks vpn-reviews.net and  Torrentfreak

PROXY SERVER : ARE THEY LEGAL TO BE USED IN INDIA?

1.   Few days back I was surfing  few sites via proxy server at HIDEMYASS. Just like a that,a thought came to mind that if the Indian Government on one hand is trying all ways out to monitor nefarious activities on net...and in the name of this monitoring they are monitoring u and me as well....what would they be able to do for those actual ones who use proxy servers?.....

2.   Though it is understood that not all proxy server sites are as safe as they claim...most of them have actually a life of not more then 4-5 days...they actually are born to steal and vanish...we call that 9 2 11....But sites like those have been existing for more than 4-5 years like hidemyass,proxy.org etc are actually doing the work they are supposed to do ie PRIVACY!!!

3.   If any of the readers have some idea or can guide to some link w.r.t legality issues of using proxy servers in India...i would be grateful....and lastly if anyone has some disagreements on the comment earlier that INDIAN GOVERMENT IS MONITORING YOU...just check the ANONYMITY CHECKER at https://xerobank.com/.

CAN WE EVER BE SAFE ONLINE?

1.    It is indeed difficult to surf anonymously if u r a normal user....u put on a monkey cap "DISCONNECT" or wear a long coat or do anything u cant remain hidden....the spy ,if he is after you, will come to know who u r?where r u from?....what r u doing ?etc etc....

2.   Recently came across this https://xerobank.com/......and just clicked to know more of what it had to offer....it gave me a sneak preview of what others may know...my IP ADDRESS...MY LOCATION(ok that normal)...but then also told me that "DATA INTERCEPTION DETECTED"....BY THE INDIAN GOVERNMENT...now this was only a sneak peak....to know more visit the site at https://xerobank.com/