Fake Warning Messages:

The message is the same, but the graphics are better!

In 2008 I wrote an article here about False Pop-Ups warning you that you are infected when you are not. There have been articles in the news, in print, in blogs and technical pages that have been republished and re-tweeted - so by now everyone knows about the threats, right? Well, not necessarily. In fact, the ruse is the same as it was in the past, but the graphics are much more convincing than they used to be.

Users Still Being Duped

The process has not changed over the years, but the mechanism has been perfected. A pop-up window says you are infected and offers you the chance to have your machine protected. Even those who have seen this kind of thing and want to say no can fall pray. Why? Because the “X” you click on to close that window (like the one on the right) is not a normal window; the entire window is a link to malicious code that will install it’s payload to your system. In many cases that payload also disables or uninstalls existing anti-virus and anti-malware software, thus giving it free reign over your system.

What Kinds of Threats are there?

Viruses and Trojans are still at the top of the list, accounting for 78% of all threats, according to Microsoft Security Intelligence Report Volume 8. Included in the other 22% of threats are malware, spyware, scum ware, and exploits that can be equally effective on a wide variety of machines and can wreak just as much havoc. There are worms, root kits and many other infection sources out there, but most sources of infection still pray on the ‘social’ infection scenario; they almost always promise you something you want for no cost or promise to clean your machine at no cost. The old adage about ‘getting what you pay for’ comes to mind as well as “there is no free lunch

The fact is that getting that piece of commercial software, that new movie or the latest recording by your favorite artist is not going to be free. Offering something for nothing is just the way to get the door open. Much like the popular Vampire books and movies, they can’t come inside your computer until they are invited. Once invited, either through trickery or on purpose, they are free to move about and suck the life blood from your system!

What Does Each Malware Group Do?

The easiest way to approach this is to provide a concise definition for each type of infection:

Worms – unlike a virus which requires human interaction, can copy themselves automatically. They can even leave artifacts so that once cleaned they can re-infect a system.

Trojan –the most common type of virus infection in the United States. Just as their namesake the Trojan Horse, the Trojan infections hide inside an innocent looking software program you downloaded or received as an email attachment. Trojans can also infect a user who visits an infected web page.

Email Scams – the height of social engineering, most of these now involve advance-fee fraud (often called 419 scams), and are often associated with Nigeria and Gambling web sites.

Spyware – the name given to stealth software that installs without your permission and tracks your activities. Such tracking can follow web movements and keystroke capture, thereby giving the entity to which the spyware “phones home’” access to your usernames, passwords, credit card numbers and banking information.

Phishing – another social engineering threat that dates back to the days of phone calls and getting someone to give you information of a personal or financial nature over the phone. Phishing through emails or pop-ups looks legitimate and asks a user for personal information under the premise that it is required to “validate” your account or provide you with a refund.

Root Kit – software that gains access to your computer at a “root” level with access permissions of the system administrator. Once installed, it can be used to redirect the resources of your hardware to things like Botnets.

Botnet – a way that, without your knowledge, your computer can be “recruited” into a remote control criminal network used for the express purpose of identity theft, extortion, espionage and sending Spam. One of the most prolific Botnet infections was the Mariposa Botnet which affected 11 million unique IP addresses between December 23, 2009 and February 9, 2010 according to Panda Security.

Scareware – the exploit that tells you your system is infected when it is not.

What is the Cost to Business and Consumers?

Well, while it is not close to the national debt, the cost is still astounding. By mid 2010, the estimated cost to U.S. households for viruses, spyware and phishing combined was $4.55 billion. And just as with the infections listed above, this number continues to rise.

The cost to businesses is equally disturbing. Based on recent estimates by the FBI, dealing with viruses, spyware, PC theft and other computer-related crimes costs U.S. businesses a staggering $67.2 billion a year!

What can be done?

Read and pay attention. If you are in the IT department, pass along the differences between real and fake messages to your company. There are a lot of malicious programmers out there who would like nothing better than to add your machine(s) to the pool of those infected with their arrant code. Make Backups for your data, have a Firewall active too. Keep watch for “Fake” warnings, keep system updates applied, use a SPAM blocker, know the difference between Legitimate and Bogus downloads and if in question, do not download it! Beware of email bearing attachments and have Anti-Virus Software installed and keep it updated! Remember, it is only as good as the last update that was loaded. Watch for information about this and other topics here and on security web sites. If you have questions or comments about this article or if there is anything new on the subject, contact me. I would be happy to respond!

All product names / logos, company names / logos are copyrights of their respective holders. John Boline is an MCSE, MCTS, CNE, USE, a member of the Network Professional Association and the Microsoft Partner Research Panel, . The content herein is often based on late-breaking events. Much of the material is based on information from sources that are believed to be reliable. Hagerman & Company, Inc. disclaims all warranties as to the ultimate accuracy or completeness of the information. Hagerman & Company, Inc. and its employees shall have no liability for errors, omissions or inadequacies in the information contained within this article or for any interpretations thereof. The recommendations, positions and best practice policies outlined herein represent Hagerman & Company, Inc. initial analysis and therefore are subject to change as further information which may have bearing on these positions is made available. The reader assumes sole responsibility for the selection of these materials to achieve its intended results. The opinions expressed herein are subject to change without notice. Hagerman & Company, Inc. assumes no obligation to update the forward-looking statements made in this newsletter to reflect any change in circumstances, after the date of publication. Entire contents © 2010, Hagerman & Company, Inc. All rights reserved. Reproduction of this publication in any form without prior written permission is forbidden/span>

This page last edited on Tuesday, June 07, 2011