Home routers can be infected with malware

IT pros  have found a malicious worm that has infected  different home and small office Linksys routers, including the E1000, the E1200, and the E2400.

Then there is also an Asus firmware vulnerability: An IT researcher named Kyle Lovett also found a vulnerability in a number of heavy duty Asus routers that had faulty firmwares.

Rightrdia has recommended DD-WRT firmware enabled routers in the past. However, this vulnerability also affects some routers with DD-WRT firmware. A Netgear Wnd3700V4 router that Rightardia uses appears to have been infected with this malware and firmware upgrades and a configuration default did not eliminate the problem.

Sunbelt Software also reported  that a Buffalo router that provisioned with DD-WRT firmware was pulled out of a retail box and easily infected with the router malware.

A Washington Post article stated:

". . . Sunbelt was able to confirm that the malware successfully changed the DNS settings on a Linksys router (model BEFSX41), pulled straight out of the factory box (with the default username and password). Another test showed that the Zlob variant successfully changed the DNS settings on a Buffalo router running the DD-WRT open source firmware.

Sunbelt also found that if there are multiple machines using the same router, all of the systems connected to that router will have their traffic hijacked."

DD-WRT recommends  to disabling the graphical user interface on the router and change the admin login and use a stronger password. DD-WRT has also suggesting defaulting the config will eliminate the worm.

Rightardia discovered that re-flashing the router or defaulting the configuration did not work.

We did find this information in a forum.
.
"If you got the problem that in every loaded page appears a javascript tag like <script language="javascript" SRC="http://mx.content-type.cn:443/day.js"></script> this is the solution for your problem.

The cause is a trojan horse (virus) on another computer in your network!
This other computer is telling your PC that it is the gateway to the Internet by modifying its hardware address (MAC). Your computer is in consequence sending all traffic to the infected PC which forwards it to the Internet and filters it in order to put its malicious code.

You can find out which computer is the evil one by typing following into your command line:

arp -a

In the appearing table search for a double assigned physical address which is once assigned to the gateway IP address and once assigned to another IP.
 
Find out which computer is the other IP and you will have the virus host.
Scan that one for virus and malware (we are just about to conduct that scan)."

The best option at this point would be to replace an infected  router with Tomato firmware installed. If your home router is not infected, disable remote access and change the login ID and password. Use a complex password that would not respond to a brute force dictionary attack.

You can purchase  a Tomato enabled router form Amazon. The NetGear WNR3500L Rangemax Wireless-N Gigabit Router with Tomato VPN firmware (Refurbished) appears to be a good option. 

Rightardia would expect DD-WRT to release new firmware to fix this problem in the immediate future. 

a

 http://arstechnica.com/security/2014/02/bizarre-attack-infects-linksys-routers-with-self-replicating-malware/

https://www.flashrouters.com/blog/2014/02/19/asus-linksys-router-firmware-hacked-stay-safe-dd-wrt-tomato/

http://voices.washingtonpost.com/securityfix/2008/06/malware_silently_alters_wirele_1.html

http://topfueber.de/2008/07/mxcontent-typecn443-nice-trojan-how-to-get-rid-of-it/#english


Subscribe to the Rightardia feed: http://feeds.feedburner.com/blogspot/UFPYA 

 

Rightardia by Rightard Whitey of Rightardia is licensed under a Creative Commons Attribution 3.0 Unported License.

Permissions beyond the scope of this license may be available at rightardia@gmail.com.

NYTimes.com: How Two Amateur Sleuths Looked for FinSpy Software

" (T)he spyware could grab images of computer screens, records Skype chats, turn on cameras and microphones and log keystrokes.

But what made it especially sophisticated was how well it flew under the radar. Its creators had specifically engineered it to elude antivirus makers like Kaspersky Lab, Symantec, F-Secure and others."

This combination Trojan and keylogger software probably has the blessing of NSA and exploits holes in both Windows and evades well known anit-virus and malware programs.

See How Two Amateur Sleuths Looked for FinSpy Software - NYTimes.com:

'via Blog this'

 Subscribe to the Rightardia feed: http://feeds.feedburner.com/blogspot/UFPYA



Rightardia by Rightard Whitey of Rightardia is licensed under a Creative Commons Attribution 3.0 Unported License.

Permissions beyond the scope of this license may be available at rightardia@gmail.com.

Linux Notes on Codecs and Anti-virus

by Wirehead

My kingdom for the right codecs

First, let's talk about codecs.  If you ever tried to play a movie DVD on a PC, you probably ran into a Codec problem. The video wouldn't play unless you had codecs for both MP3 music and MPEG DVD movies.

Well, in the Linux world, a European company called Fluendo makes a product that provides MP3 codecs for audio and MPEG codecs for video.These codecs will works on both Linux and windows systems.

The MP3 audio format is hard to avoid as it is the format supported by most portable music players. In fact, many people have already converted their audio CD collections into MP3. The Fluendo MP3 plug-in project is a combination of multiple things.

• It is an MIT licensed source code package implementing the MP3 codec.
• It is a fully licensed binary GStreamer plug-in available for download.
• It is a redistribution contract allowing distributions to distribute the binary Fluendo GStreamer MP3 plug-in free of charge.

The Fluendo DVD Player is a software application specially designed to reproduce DVDs on Linux/Unix and Windows platforms, which provides end users with high quality standards.It provides the video MPEG-2 codec and has:

• Full DVD Playback
• DVD Menu support
• Full screen support
• Dolby Digital pass-through
• Dolby Digital 5.1 output and stereo downmixing support

Once I installed the Fleuendo codecs on a laptop that uses Fedora Linux, I could use videos that my wife had taken with my Kodak Z710 camera. Also, Adobe Flash starting worked on Firefox.

Ubuntu provides these third party Fluendo codecs, but Fedora does not. However, we have been unable to get Ubuntu to work on the Rightardia laptop because of a laptop BIOS issue that only Fedora can handle.

We downloaded both the .deb format codecs for Ubuntu/Debian and the .rpm version that works on Fedora and Suse Linux.

The codecs cost $35 and you can order them online form Fluendo: see http://www.fluendo.com/ These codecs work great. Previously, the codec problem had been a major headache.


Yes, Virginia, Linux can now get virii  or viruses

Rightrdia had been detecting vuruses, malware and Trojans since we started using CLAMAV and its CLAMTK front end with Linux two years ago. Many virii were probably leftovers from Windows XP Pro that we had used.

CLAMAV is the actual anit-virus program, but CLAMTK is the graphical front end that makes CLAMAV command line program easy to use.

CLAMAV works perfectly in Ubuntu Linux, but not on Fedora. The AV signature file won't update from 30 Nov 2010. See the graphic above. Red Hat is aware of the problem.

So Wirehead started looking around for another AV program. He found Avast, formerly Alwil, developed in the Czech Republic.

Unfortunately, once you updated the Avast AV signatures, the program locked up and stopped working. According to Avast, this is a Linux kernel issue. Wirehead was able to change a value in a file by going into terminal mode, entering the SU (superuser) command and password, and then entering:

sysctl -w kernel.shmmax=128000000

Afterwards, we were able to upgrade the AV signature without Avast locking up. BTW, you will have to enter this code each time after you reboot.

Avast for Linux has a neat trick. If you have any network shares on your desktop, it will check them for virii. Rightardia uses network attached storage (NAS) so Avast gave us the means to check the folders on the NAS device for virii.

a

We like the Avast program on Linux and had used it in a Windows environment as well. It is faster than CLAMAV, but it can lock up when you scan Linux folders other than your home folder/desktop.

You do have to register the program for a one year license. it takes about 15 minutes to  couple of hours get the key from Avast.  A screen shot of the Avast AV program follows:

Subscribe to the Rightardia feed: http://feeds.feedburner.com/blogspot/UFPYA  

Netcraft rank: 6772 http://toolbar.netcraft.com/site_report?url=http://rightardia.blogspot.com
 
Rightardia by Rightard Whitey of Rightardia is licensed under a Creative Commons Attribution 3.0 Unported License.

Permissions beyond the scope of this license may be available at rightardia@gmail.com.

Newsy.com: State-sponsored Computer Virus Infects Iranian Nuclear Site

Multisource political news, world news, and entertainment news analysis by Newsy.com

A computer virus attacked Iran’s Bushehr Nuclear Power Plant. Though no harm was done, some experts say the Stuxnet worm could mean a new age of cyber warfare. 

Rightardia agrees with Newsy. it is unlikely the US would launch such a complex virus because it could attack the US industrial base as well.

There is a high probability that Israel launched the attack to damage the Siemen's centrifuges used to harvest nuclear material. Such an attack would slow down the Iranian nuclear program. 

Apparently the attack used four undisclosed Windows vulnerabilities. Rightardia has to wonder why Siemen's German engineers would use the Windows Operating System in their industrial controls. Windows is far less secure than Linux.

Sources:Press TV  CNN  Bloomberg  Christian Science Monitor  Forbes

Subscribe to the Rightardia feed: feeds.feedburner.com/blogspot/IGiu

Netcraft rank: 8665

http://toolbar.netcraft.com/site_report?url=http://rightardia.blogspot.com

CNN Data Doctor on using free v. commercial antivirus software

The data doctor makes some good points, but there are other issues. Most viruses and malware are developed to attack the Microsoft Windows operating system (OS). If you are using Linux or a Macintosh OS, you are less likely to get a virus, malware or a Trojan.



Get 30 days of free traffic analysis simply by going to Web-Stat: http://www.web-stat.com/?id=2955

Subscribe to the Rightardia feed: feeds.feedburner.com/blogspot/IGiu

Improve blog traffic with TrafficG http://trafficg.com/splash/splash01.php?uid=eelder1

Netcraft rank: 24118 http://toolbar.netcraft.com/stats/topsites?s=842818698226B7BA4A1D0E313F8F#24118

Microsoft to unveil free anti-virus software

Microsoft announced that they're going to stop selling their consumer security product OneCare, and instead they're going to give away for free an anti-virus (AV) product based on the same technology.

With traditional anti-virus protection perhaps becoming obsolete, maybe it's time that Symantec and McAfee start offering free versions of their own anti-virus products.

A more complete solution is needed to provide complete client side protection. AV, malware and Trojan protection as well as a firewall that is superior to the basic firewall in Windows Vista is what a user really needs.

Windows 7 will have a more robust bi-directional firewall that keeps unwanted incoming traffic from invading your network and also prevent Trojans and zombies from setting up a small server on the your PC that transmits you password and credit card information to criminals.

AVG, Avast and Avira already provide free AV software, but they just provide basic protection.

You need the version you pay for to provide comprehensive protection. As an alternative, you download a free program called Spybot to provide spyware and malware protection and a free firewall called Comodo that is an improvement over the basic XP Pro and Vista unidirectional firewalls. Of course, you now have three different programs you have to mange and update.

Anti-virus vendors certainly were worried when Microsoft entered the AV market. They assumed they would follow the old business practice in which they would drive competition out. That is what they may be now doing with a free AV package that will bundled with Windows 7 or provided with a free download.

The big vendors knew Microsoft could trounce their small office/home office (SOHO) business, but they would not be in a good position to meet enterprise needs because Microsoft does not have a global server AV solution that can handle a large enterprise network and push agents and updates out to desktops automatically.

Symantec began moving into new markets to diversify and improve its enterprise business. While McAfee already had a strong enterprise offering, it protected its consumer market share by striking big OEM pre-install deals with major PC manufacturers like Dell in the hopes of retaining market share. McAfee had invented anti-virus software so it had been in this business for a long time.

 

Microsoft's entry into the AV market flopped. It's not for lack of trying on Microsoft's part. In January 2007, they were struggling to claim just one per cent of the market. There is no evidence that Microsoft has made any strides since then. Its AV business has been a resounding failure.

In short, Microsoft spent the money, and in relatively short order had a product that was just as good as any of their competitors but not really any better. They built a large team. They spent a lot on marketing. But the people never came.

What went wrong? First, the world has long held the perception that Microsoft is bad at security because they are constantly patching their operating systems (OS) and network operating systems (NOS).

When Microsoft was going through anti-trust hearings during the Clinton Administration era, the standard joke was the company would be split into two companies: Microsoft who would give the OS away for free and the second company, Patchsoft, would charge for the innumerable patches that Microsoft produced during the life cycle of an OS.

Microsoft may want to give away a free version is for community goodwill and to prove they are good at security. Rightardia is skeptical about the goodwill motive. In the past Microsoft would reverse engineer the intellectual property of competitors and bundle it with the OS for free to destroy competition. Netscape built on of the first commercial browsers and was selling it to enterprise customers until Microsoft fielded Internet Explorer (IE) and gave it away for free.

This destroyed Netscape, but it had its revenge when it created the open source product called Firefox, which most IT people consider to be a better, more versatile and secure browser than IE.

Even when Microsoft came in at low price points, people still thought that security was important enough that they should go with a more trusted name. For those people that were really concerned by price, they started moving to other cheap options, but ones offered by dedicated security companies like AVG, Avira and Avast. Many Savvy IT people buy AV products on Ebay.

Keep in mind that Microsoft has also lost 15 per cent of its desktop market share to Linux and Apple. There are a variety of free and low cost AV products for Linux. ClamAv is one that that can be used on desktops and servers. It can scan the file system as well as incoming and outgoing email and has many other features. Why buy the new Windows 7 when one can get OpenOffice, a broad selection of firewalls, AV products, an excellent Firefox browser and the Evolution email client for free in Linux?

In addition, after upgrading to Windows 7 in the SOHO environment, all of the XP Pro applications such as Microsoft Office, Adobe Acrobat, a CD/DVD burner such as Nero Burning ROM and other other software that I bought when I installed XP Pro on a PC would have to be upgraded.

If a PC had not been updated to Microsoft Vista, one would have to backup all of the user data and reformat the hard drive to install Windows 7. There is no upgrade path from XP Pro to Windows 7.

Try Ubuntu Linux 9.04 or Fedora 10 before you invest some big bucks in the Windows 7 OS and all the new applications you are going to have to upgrade. This article was written using the OpenOffice 3.0 Word Processor with the Ubuntu 9.04 OS.

Windows is for kids with big wallets who like to play games. Linux rocks!

http://tinyurl.com/mklfmu