Tintucso virus, removal

Tintukso virus - Very little is known about this virus as of now. It comes to you through Yahoo messenger as a link when one of your friend’s pc gets infected. Once you click the link, it installs itself at attaches itself with the OS to keep you bugging :d It sends the link to all your active contacts once it infects. This was found (on a friend's pc) just today, 09th October 2006.

Symptoms

You cannot change your homepage (options for changing homepage are disabled).

You cannot launch regedit; PC re-boots as soon as you try to edit registry.

Cause
Virus/trojan not yet explained in detail on the net yet. it sends a message saying test the site and shows up the folowing url
http://tintucso.com/luke/
Please do not launch the above url unless you have a good firewall and antivirus (and enough courage to open it).

My official PC categorized it as a dating/unwanted site and blocked it. Didnt take a chance on my Home pc.

Remedy

Scan with your antivirus or adware , if it can detect it; chances are that it will also clear it.

If above fails, on a windows box, restore your PC to the last known good configuration. here are the detailed steps to restore your operating system on a XP system.
http://www.microsoft.com/windowsxp/using/helpandsupport
/learnmore/systemrestore.mspx

Update from Symantec as on 12th October 2006
Symantec Japan has confirmed the virus and documented the details of the virus here
http://translate.google.com/translate?
hl=en&sl=ja&u=http://www.symantec.com/region/jp/avcenter/
venc/data/jp-w32.imaut.b.html&sa=X&oi=translate&resnum=4
&ct=result&prev=/search%3Fq%3Dtintucso%26hl%3Den%26lr
%3D%26rls%3DGGLG,GGLG:2006-26,GGLG:en

Thanks Arvind for your valuable feedback on this virus.

I shall keep updating this post with the new findings on the virus.

Have a safe computing :)

Sql Injection - Protect your applications

Sql Injection. Whats it it?
Its injecting sql server with scripts that can potentially break the security barriers of the application/server.
SQL injection is a security vulnerability that occurs in the database layer of an application, Its is not a SQL Server problem, but a problem with improperly written applications.

Audience:
Any one who develops/test applications that use sql statements.
Hey developers check it on all your applications that you have written so far (i checked it.. fortunately it didnt break any of my code)


What can it do?
One or more of the following based on your application implementation

Hackers easily get authenticated on your application.

Hackers (even a simple db aware guy can do this) can read most of your table data.

Change most of the data of your DB.

Delete records from your tables.

Restart your webserver.

Shutdown your database. Can you think of anything worse than this for your application?

Very simple example of Sql injection.
Most of the applications have login screen, try entering following as
login name: test' or 1=1 --
password: anything
An example of sql string created by any simple application vulnarable to sql injection is

select * from users where username='test' or 1=1 -- and password='anything'

This is how its evaluated to true, and the first level of entry.. successful.
Curious to know other ways of injecting sql server? Read the article

How to avoid sql injection?

Limit access to admin account by creating seperate applcation account.

Restrict user input lengths.

Strip off all quotes(if they are not expected).

Filter out sensitive db keywords (potential threats) from your inputs (Like select, drop, _xp etc).

With such few additional validations/coding you can make your application safe from sql injection attacks. Happy coding.

Cyber crimes on the high. Don’t be the prey.

Cyber crimes are finding new targets everyday, be very careful if you are one of those users using credit cards or bank accounts online.

Sample of how this works.
You receive an email that looks like this...
----------------------------------------------------------

PayPal is committed to maintaining a safe environment for its community of customers. To protect the security of your account, PayPal employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the PayPal system for unusual activity.

We are contacting you to remind you that on 5 March 2005 our Account Review Team identified some unusual activity in your account. In accordance with PayPal's User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved.

To secure your account and quickly restore full access, we may require some additional information from you for the following reason:

We have been notified that a card associated with your account has been reported as lost or stolen, or that there were additional problems with your card.

This process is mandatory, and if not completed within the nearest time your account or credit card may be subject for temporary suspension.

To securely confirm your PayPal information please click on the link bellow:


https://www.paypal.com/cgi-bin/webscr?cmd=_login-run


We encourage you to log in and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure.

For more information about how to protect your account please visit PayPal Security Center. We apologize for any incovenience this may cause, and we apriciate your assistance in helping us to maintain the integrity of the entire PayPal system.


Thank you for using PayPal!
The PayPal Team

----------------------------------------------------------

Here is another version of the mail.. with another address..received few hours back. Do not enter any information in the site.. as it could still be active.
----------------------------------------------------------


Dear PayPal Member!

Attention! Your PayPal account has been violated!

Someone with ip address 149.225.126.87 tried to access your personal account!

Please click the link below and enter your account information to confirm that you are not currently away. You have 3 days to confirm account information or your account will be locked.

Click here to activate your account




You can also confirm your email address by logging into your PayPal account at
http://paypal.com/. Click on the "Confirm email" link in the Activate Account box and then enter this confirmation number: 1036-8535-4511-9500-3892

Thank you for using PayPal!
The PayPal Team


--------------------------------------------------------------------------------


Please do not reply to this e-mail. Mail sent to this address cannot be answered. For assistance, log in to your PayPal account and choose the "Help" link in the footer of any page.



You click on the link(Now you can safely click it as its already banned)
It takes you to a site that exactly looks like paypal.
That asks you to enter all your details including credit card details, paypal account details etc. It behaves exactly like paypal and at last shows up a page saying our servers are under maintenance, please try after some time.

Whats exactly happening.
The link that’s shown is different from the link to which user is taken on clicking it. Whole paypal site is simulated on the site very intelligently and your account details are stored in their databases which is used to lift money from your account.

Life of these sites are very small. Most of such sites are banned as soon as they are found involved in cyber crimes.

How to fight back.

Before clicking on any link from your email, think for a while. If it’s not worth a click don’t (They could be mails from email farms which are just validating existence of your email ids).

If you are tempted to click (Recently I received an email related to an offer from ICICI bank that which was pointing to such a site) Check the link to which its taking you to. Observe the URL in the above example (take the mouse pointer on the link, url of that link is shown in your status bar of the browser) http://203.215.94.193/.www.paypal.com/paypal/das676bsda6… don’t get carried away with paypal in the URL. It should exactly begin with www.paypal.com and not just a part of that else essentially it’s an illegal one.

If you find that a site is illegal, inform the concerned people and get the site banned so that others wont fall pray. Your few minutes of social

I had another such mail, which had an interesting title. I clicked on the site, and it went to a yahoo site. As usual I entered my id and password. It showed me message asking me to try after some time. After verification I found that it was a fake site collecting my yahoo id and password. (That site got banned within 24 hours of my complaint to ban it) So be watchful about before giving out any of your passwords.

Lets make use of internet as a safe and effective means.
Here is a sites where you can lodge your complaints against cyber crimes http://www.ifccfbi.gov/index.asp
A nice detailed Indian article related to cyber crimes http://cybercrime.planetindia.net

Hoax mails..give away phones, bill gates sharing his fortune !

Ah! another spam mail.. asking you to spread word of mouth and they are giving away cell phones free... Or bill gates is sharing his fortune..and you need to cc to some one.
I keep receiving such hoax mails and finally thought let write something on this topic.

Here is a sample mail.

Dear ALL ,
I just want you guys to take hold of this opportunity from Ericsson . Ericsson is distributing cell phones for free over the internet to compete with Nokia, which is doing the same. They want to be better known through the Internet by word of mouth and so they are giving away their new WAP phone.
All you need to do is mail this to 8 of your acquaintances. In two weeks you will receive an Ericsson T18. If you send this email to 20 people or more, you will receive an Ericsson R320 Wap Phone. Don't forget to mail a copy of this email to anna.swelund@ericsson.com to ensure that your participation is noted.

What do they get?
The company or the product gets benifited, surely word of mouth will spread their name to every corner of the world. But people wake up! You are just distributing the garbage..

How can you avoid spreading such mails
Thumb of rule! There is nothing called free lunch. Always strings are attached. So before expecting anything free think again. If you are in doubt, just search few keywords of that mail on any search engine, that will reveal the truth.
Checkout some similar mails collection at www.breakthechain.org

And finally if you still want to try your luck sending these mails.. here is a good list of such letters in circulation. http://hoaxbusters.ciac.org
:p Hehe just kidding..

Do continue to send/forward mails to your friends that are worth their time and attention. Happy mailing ;)

Windows Anti-Spyware

Do you get popus of software/websites for which you never subscribed or installed any application? That must be a spyware.
Windows anti-spyware is a security technology that helps protect Windows users from spyware and other potentially unwanted software.
This helps you to reduce negative effects caused by spyware including slow PC performance, annoying pop-up ads, unwanted changes to Internet settings, and unauthorized use of your private information. Continuous protection improves Internet browsing safety by guarding over fifty (50) ways spyware can enter your PC.

Supported by xp and windows 2000 series of operating systems
Download from http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en#requirements

Good thing about this software, detects and lets you removes existing spywares and It will ask you before it lets any application installs itself permanently on your pc (like a shortcut on your desktop, a startup item etc).
Such complementary applications will make your operating system more reliable.