Best Virus Removal

It’s the end of the year, which means it’s time to name the winner of the Best Book Bejtlich Read award for 2009!

Although I’ve been reading and reviewing digital security books seriously since 2000, this is only the fourth time I’ve formally announced a winner; see 2008, 2007, and 2006.

2009 was a slow year, due to a general lack of long-haul air travel (where I might read a whole book on one leg) and the general bleed-over from my day work into my outside-work time.

My ratings for 2009 can be summarized as follows:

• 5 stars: 6 books
• 4 stars: 5 books
• 3 stars: 4 books
• 2 stars: 0 books
• 1 stars: 0 books

Here’s my overall ranking of the five star reviews; this means all of the following are excellent books.

• 6. Vi(1) Tips by Jacek Artymiak; devGuide.net. Every Unix admin should know how to use vi(1), and Jacek’s book provides the right balance of commands and examples.
• 5. Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast by Paco Hope; O’Reilly. Even though I am not a Web developer, I found this book to be very clear and helpful for security analysts trying to understand Web traffic.
• 4. IPv6 Security by Scott Hogg; Cisco Press. When it comes to IPv6 security books, there is really no alternative, and thankfully this book delivers.
• 3. Windows Forensic Analysis DVD Toolkit, Second Edition by Harlan A. Carvey; Syngress. Harlan’s update to the first edition of his book is another winner; you must read this book.
• 2. The Web Application Hacker’s Handbook: Discovering and Exploiting Security Flaws by Marcus Pinto; Wiley. This is an excellent book. I read several books on Web application security recently, and this is my favorite.

And, the winner of the Best Book Bejtlich Read in 2009 award is…

1. SQL Injection Attacks and Defense by Justin Clarke, et al; Syngress. This was a really tough call. Any of the top 4 books could easily have been the best book I read in 2009. Congratulations to Syngress for publishing another winner. SQL injection is probably the number one problem for any server-side application, and this book is unequaled in its coverage.

Looking at the publisher count, top honors in 2009 go to Syngress for 2 titles, followed by Wiley, Cisco Press, O’Reilly, and devGuide.net, each with one.

Thank you to all publishers who sent me books in 2009. I have plenty more to read in 2010.

Congratulations to all the authors who wrote great books in 2009, and who are publishing titles in 2010!

Copyright 2003-2009 Richard Bejtlich and TaoSecurity (taosecurity.blogspot.com and www.taosecurity.com)

Type: Spyware.

We’ve recieved a lot of positive feedback for our three part paper on Koobface (I, II, III) from all parts of the IT industry, but how the malware authors themselves have chimed in.

The Koobface gang (who are attempting to make people believe that they are a legitimate company) have left a Christmas message on each of their infected hosts. Part of this message includes personal messages for several members of the security industry – ourselves included:

Trend Micro (http://trendmicro.com), especially personal thanks to Jonell Baltazar, Joey Costoya and Ryan Flores who had released a very cool document (with three parts!) describing all our mistakes we’ve ever made

This is not the first time cyber criminals have left messages for the security industry, in fact we posted another blog on this last year.

Nice to see we are causing these groups some annoyance, something we definitely plan to continue in 2010.

Happy new year everyone!

Post from: TrendLabs | Malware Blog – by Trend Micro

From Koobface with Love

Trend Micro threat analysts were alerted to the discovery of several compromised websites inserted with a JavaScript. The JavaScript is detected by Trend Micro as JS_AGENT.AOEQ. When executed, JS_AGENT.AOEQ uses a defer attribute, which enables it to delay executing its routine, that is, redirecting the user to several malicious websites. This is done so users will not suspect that they are already infected. In addition, this malicious JS is hosted on PHP servers. If a user visits an infected website, it will display a white screen. On the other hand, viewing the source code will yield the following obfuscated code:

Upon analysis, it was observed that the code (found on most infected sites) begins with /*GNUGPL*/try{window.onload=function(){var or /*CODE1*/ try{window.onload = function(){va.

According to the Unmask Parasites blog, the cybercriminals behind this attack incorporated certain legitimate sites’ names such as Google, Bing, and WordPress, among others, in their code to appear as a legitimate URL.

Trend Micro Smart Protection Network secures users from this attack by blocking all related malicious domains to prevent user access and, consequently, malware infection. It is, however, advisable for users to keep their systems up-to-date and for Web administrators to change their FTP credentials.

Post from: TrendLabs | Malware Blog – by Trend Micro

Malicious JavaScript Infects Websites

Malware: JS_AGENT.AOEQ