Recently I had someone come to me with their laptop saying that they had a new anti-virus program that they didn't remember installing and that 'other things' on their laptop didn't seem to work any more. The same thing happened to a corporate desktop machine I was asked about a couple of weeks later, that was originally running McAfee. Finally, two days ago I saw another corporate machine running McAfee that was saying that it had a hard drive failure. A tool, called HDD Tools, then automatically ran to diagnose the problem and stated that if they purchased the full HDD Tools product then it could fix the problem. Each of these was a piece of malware that had infected the machine and was trying to get the user to enter their credit card details into a website so that money can be taken from their account and maybe their card cloned. These malware programs go along with the fake anti-virus software that the APWG have reported a huge rise in recently. These are a coll...

On 27th September the APWG released their First Half 2009 Phishing Trends Report . This provides some interesting/worrying reading. Most notably is the rise and rise of rogue anti-malware programs. Rogue anti-malware programs are programs that run on a user's machine and falsely identify malware infections. They then inform users that the malware can be removed by purchasing their anti-malware program. The installed software, in many cases, does absolutely nothing. The malware author has made their money off the user and doesn't care about them or the fact that their machine is left vulnerable to other malware. However, there is another breed of rogue anti-malware that will install other malware onto the user's machine, often adding them to botnets or adding trojans and spyware. According to Panda Labs' Luis Corrons, rogue anti-malware programs are proliferating with "exponential growth. In the first quarter of 2009 alone, more new strains were created than in a...

The Anti-Phishing Working Group produce two reports a year now on Phishing Activity Trends. I was reminded to look at the report from the second half of last year recently by problems encountered by an organisation I'm involved with(!), which has suffered two successful phishing attacks in the last 9 months. The two incidents both followed the same pattern: a phishing email was sent round purporting to be from the technical staff talking of lack of storage space on the user's account. They asked for the user's password in order to be able to reconfigure the quota. Now, the vast majority of people deleted this email, but on each occasion one person (a different one in each incident) replied with their username and password. This resulted in vast amounts of spam being sent through the users' email accounts, sufficient for the domain to be blacklisted by Message Labs in the first incident. The problem is that people still fall for this type of scam, and it only needs one ...