Microsoft ships free malware cleaner that boots from CD or USB

In a move aimed at cutting down on support call costs, Microsoft has released a malware recovery tool that boots from a CD or USB stick.

The tool, currently in beta, is called Microsoft Standalone System Sweeper, and promises to help start an infected PC and perform an offline scan to help identify and remove rootkits and other advanced malware.

In addition, Microsoft says the System Sweeper utility can be used if you cannot install or start an antivirus solution on your PC, or if the installed solution can’t detect or remove malware on your PC.

The company made it clear that the recovery tool is not a replacement for a full antivirus product.

It is available for both 32-but and 64-bit Windows systems and uses the same antivirus engine as the Microsoft Security Essentials product.

Just last month, the company shipped a free security tool called Microsoft Safety Scanner to offer on-demand scanning to helps remove viruses, spyware, and other malicious software. The safety scanner works with existing antivirus software.

These utilities are a big part in helping Microsoft to cut down on support costs stemming from malware infections.

Android becomes second most popular malware haven in Q1

The first quarter was the most active in malware history and mobile attacks are moving to the forefront, according to McAfee data. Android attacks are also picking up.

McAfee’s first quarter threat report noted that attacks surged in the first quarter, but spam has fallen. In fact, there were 6 million unique malware samples in the first quarter, the highest ever for the first three months of the year. February had the most new malware samples—2.75 million.

Fake anti-virus software—think Mac Defender—reached its highest levels in march with

350,000 unique samples.

As for emerging threats, McAfee noted that Android devices are becoming malware havens. Android was the second most popular environment for mobile malware behind Symbian in the first quarter. Historically, Android remains No. 3.

In its report, McAfee said:

McAfee Labs combats several developing families of malware that attack Android phones. One of the families, Android/DrdDream, comprises a variety of legitimate games and apps that have been injected with malicious code. These threats are unique and quite dangerous due to the use of two root exploits to gain greater control of those phones. The two exploits—Exploit/LVedu and Exploit/DiutesEx—were initially used by users trying to gain legitimate root access to their own devices, a process commonly referred to as rooting.1 In the PC world, malware often uses exploits to enable drive-by downloads that infect machines visiting specially designed or compromised websites. For mobile devices, much of the malware has required user interaction, but in the near future mobile exploits will certainly allow automatic malware installation. Like Android/DrdDream, the Android/Drad family is made up of maliciously modified applications.

This family sends device information to an attacker-controlled site. Just like in the PC malware world, Android/Drad listens for commands from the attacker. The malware can also download additional software, though it stops short of being a full-fledged mobile botnet. It appears that the malware uses blackhat search-engine optimization techniques, a process of manipulating search engine results to place dangerous sites higher than they should appear in lists of hits.

About World IPv6 Day....Future.Today

Happy IPv6 Dya to all.!!!

On 8 June, 2011, Google, Facebook, Yahoo!, Akamai and Limelight Networks will be amongst some of the major organisations that will offer their content over IPv6 for a 24-hour “test flight”. The goal of the Test Flight Day is to motivate organizations across the industry – Internet service providers, hardware makers, operating system vendors and web companies – to prepare their services for IPv6 to ensure a successful transition as IPv4 addresses run out.

The story begins in 1977, when Vint Cerf, the program manager for the ARPA Internet research project (and now one of the driving forces behind Google’s IPv6 efforts), chose a 32-bit address format for an experiment in packet network interconnection. Who would have thought that the experiment would evolve into today’s Internet: a global network connecting billions of people, some using handheld devices faster than the mainframes of the 1970s?

For more than 30 years, 32-bit addresses have served us well, but now the Internet is running out of space. IPv6 is the only long-term solution, but as the chart below shows, it has not yet been widely deployed. With IPv4 addresses expected to run out in 2011, only 0.2% of Internet users have native IPv6 connectivity:

Test your IPv6 Connectivity

Want to find out your IPv6 readiness? Use this test.

Some of Japanese phases..!

ohisashiburi desu
It's been a long time since we met.

dou shita no
what happened?

kura desu ka?
How much is it?

Google Summer of Code: Where are the students?

Google Summer of Code is truly a global program. For this year’s program we received 5,651 applications from 3,731 students in 97 countries.

google accepted 1,115 students from 68 countries. The ten countries with the highest number of accepted students are represented in the pie chart below.

China shuts down cracker website

The Chinese authorities have shut down what they describe as the biggest training website for hackers in China. The China Daily newspaper on Monday reported that three of the people behind the "Black Hawk Safety Net" site have been arrested. The group is said to have offered software and assistance for cracker attacks over the web. Since 2005, the website has acquired 12,000 members, paying out 7 million yuan (approximately £650,000) in membership fees. According to China Daily, 170,000 users were registered with the site.

The police began investigating the site in 2007, when a number of Black Hawk members were connected to an attack on the municipality of Macheng in Hubei province. News of the shutdown comes against the backdrop of a dispute with the USA over an attack on US internet giant Google. Google claims that the attacks originated in China. The Beijing government has rejected the allegations, stating that it is itself the biggest victim of online attacks and takes stern measures against crackers.

China Daily quotes a 23-year old Black Hawk member as saying, "I could download trojan programs from the site which allowed me to control other people's computers." Courses cost between 100 and 2000 yuan (approximately £9 and £187). "I did this just for fun but I also know that many other members could make a fortune by attacking other people's accounts." In Chinese press reports the talk has largely been of attacks on private access data for games and other entertainment websites and on e-mail and chat rooms. A 20-year old student told China Daily, "Basically students were told how to steal accounts and use trojan programs."

Hacker extracts crypto key from TPM chip

An American hacker has, with a great deal of effort, managed to crack a Trusted Platform Module (TPM) by Infineon. He was able to read the data stored on the TPM chip, for instance cryptographic keys (RSA, DES) such as those also used by Microsoft's BitLocker on appropriate motherboards.

TPM hardware incorporates various levels of logical as well as physical measures designed to counter a range of attacks, such as differential electromagnetic analyses (DEMA) and even physical intrusions. Once the keys are retrieved, however, an attacker can read the encrypted data stored on a hard disk without needing a password.

Previously known as the smart card hacker, Christopher Tarnovsky of Flylogic Engineering has presented his work at the Black Hat DC security conference. He apparently managed to suss out a processor in the "SLE 66CLX360PE" family used in the TPM. For this purpose, he extracted the actual chip from the housing in his special lab using various procedures that involved liquids and gases (a video about this is available online).
He then worked his way through the different layers of the chip using, for instance, a Focused Ion Beam microscope and Photoshop to figure out the chip's structure and find a way into the heart of the TPM.

Subsequently, he analysed the on-chip signalling pathways to obtain access to the processor's data bus. This took Tarnovsky the better part of six months and numerous TPM chips. However, retrieving the license key of an XBox 360, which also contains Infineon's TPM, apparently only required an additional six hours.
While Tarnovsky says that Infineon has so far said such attacks just weren't feasible, Peter Laackmann, Infineon's Senior Principal for Chip Cards & Product Security, in an interview with The H's associates at heise Security, denied this is the case.

The executive said that Infineon does not rule out the possibility of successful attacks. Laackmann said that TPM chips are not uncrackable and are not advertised as such. The potential for such an attack was already evident in an earlier evaluation phase and had apparently been carried out successfully by company researchers, quite some time ago.

However, one mustn't neglect the effort involved in such an attack, said Laackmann, adding that even Tarnovsky himself admits that the necessary steps aren't easy to reproduce and require a considerable amount of special equipment. According to Tarnovsky, the required lab equipment represents an investment of about $200,000.
Laackmann also said that the product family has become obsolete, and that the cracked processor was only intended for smart cards. There is a new generation of TPM chips based on the SLE78 family, which apparently offers not only further physical anti-intrusion measures, but also additional cryptographic features. In these chips, recording data bus traffic after breaking into the housing is said to be ineffective because the data is encrypted. Infineon's Integrity Guard concept is designed to avoid the transmission and processing of plain text data altogether. However, so far, few devices incorporate these new chips.

The hack's potential consequences for the many TPM-protected systems in corporate environments, for instance, are difficult to predict. One can hardly assume that criminals will reproduce such attacks on a practical level in the medium term. However, intelligence agencies could use the technology in targeted attacks – perhaps they are doing so already. Tarnovsky does not intend to publish the details of his approach – but he is also a business man. He plans to test the security of other vendors' TPMs in the near future.