Windows 8 users prefer third-party antivirus to bundled tool

Microsoft's Security Essentials (MSE) remains a hugely popular consumer antivirus product but new figures suggest that its Windows 8 successor, Defender, is losing out to third-party alternatives.

Security tools firm OPSWAT has carried out market share analysis of antivirus clients using numbers from its AppRemover tool in the past, but the latest stats are derived from its new security assessment application, Security Score, released in June.

This time the firm divided its results into three categories; the most popular vendors overall, the most encountered individual products and the most encountered individual products that had real-time protection enabled (or not), coming up with some interesting numbers.

Not surprisingly, the frequency of Microsoft's Security Essentials (the standard Windows antivirus client) and Windows Defender (which was upgraded to succeed it on Windows 8) topped the list at a combined 25.8 percent, just ahead of Avast Software's 23.6 percent. A clutch of other familair vendors scored under 10 percent, including AVG, Symantec, Eset, Avira, and Kaspersky.

The top individual product was in fact Avast's Free Antivirus with 19.5 percent, followed by MSE on 18.3 percent, with the Windows 8-only Windows Defender on 7.7 percent.

There were some limitations to this element of the study, starting with the small installed base of Security Score due its recent release. However, the numbers it generated chime with past OPSWAT products share results that used larger data sets.

More interestingly, when the company logged the number of occurrences of each vendor where real-time protection was not enabled (i.e. where the software was present but inactive or disabled), they found that two thirds of Windows 8 users were using a second program for real-time protection.

Windows Defender comes enabled on every install so users who choose to supplement it are making a positive choice to do so. By contrast, MSE on Windows 7, Vista, and XP was far more likely to be enabled, 98 percent of the time to be precise.

"RTP status can be seen as a metric for product usability and/or effectiveness; if a user views an antivirus product as effective and easy to operate, the user is more likely to have that product actively running on his or her machine," concludes OPSWAT's researchers.

It could also be the case that Windows 8 users are confused about the level of protection offered by Defender or even whether, given its self-effacing design, it is present at all. A study by OPSWAT from 2012 found that antivirus programs were often poorly configured.

On cloud backup use, OPSWAT found Google's Drive on 22.5 of systems, Dropbox on 19.5 percent, and Microsoft's SkyDrive (soon to have its name changed) on 15.4 percent. The top ten vendors accounted for more than 83 percent of the market, which suggests that this particular market is now too mature for outsiders to make headway.

Vine’s not dead, but its 40 million users don’t prove much else

Twitter’s video-sharing app Vine swelled from 13 million users to 40 million in two months, the company tweeted Tuesday. It’s a very impressive number, especially considering Vine’s face-off with new challenger Instagram video. But those 40 million users actually don’t say much about Vine’s success.

Vine reported the 13 million figure in early June, when the app was iOS-only. You can probably guess what happened then: Vine rolled out an Android app. As predicted, Vine’s user base exploded.

Vine also didn’t reveal how many of those 40 million users are active, which is a key metric pretty much every app uses to tout its success. Tens of millions of people have signed up, which is great, but how many of those people regularly post Vines? That’s the number we want to know. (Side note: Instagram also took a while to start disclosing monthly actives instead of registered users.)

Disney Infinity Promotion: Pre-order the Disney Infinity game and receive a free character (value $12.99) There’s no denying that Vine is incredibly popular—in June, it climbed to the top of the iOS store’s non-game apps, according to the App Annie Index. Instagram ranked at No. 5, but that could change when July’s numbers are released—Instagram didn’t add video until the end of June, and the 3-year-old app has a more established user base than the 8-month-old Vine. Instagram now has 130 million monthly active users.

Vine introduced its Android app in June.
Vine wasn’t even a blip in the Google Play store for June, when it debuted on Android. That could also change when July’s numbers are released. If Vine has a big showing, then it will become clear how important Android is to an app’s success.

Now, 40 million registered users is nothing to sneeze at. Nearly a year after Instagram popped up in the iOS store, the photo-sharing app had only 10 million users. Of course, Vine has the powerful backing of Twitter to help it along—Instagram didn’t gain Facebook’s assistance until the spring of 2012—but the number is still impressive.

Vine may in fact be winning the mobile video-sharing war, but until the app discloses the facts behind the numbers, all we can tell for certain is that Vine is far from dead.

Twitter tosses power users a bone in Windows 8 app update

Windows 8 socialites rejoice! Twitter recently beefed up its Windows 8 app, extending functionality for power users and adding the ability to follow specific people or lists from the Start Screen.

Available now in the Windows Store, the biggest addition to Twitter for Windows 8 is the ability to add multiple accounts. Most Twitter fans won’t have any use for the feature, but power users will welcome the upgrade, as will anyone who needs to maintain separate personal and professional accounts.

To sign-in with multiple accounts, you just swipe down from the top or bottom of your tablet, or right-click on a PC. In the drop-down bar that appears, tap the user icon in the top right corner. This will switch the icon to a plus sign and a second tap brings up an account credentials entry window, allowing you to add another account. You can also sign-up for a new account from this page, but in my tests, adding a new account hung every time I tried to choose a Twitter username.

Switching between accounts is as simple as swiping down or right-clicking again, and then tapping on the account you want to use.

The latest Twitter update also brings Twitter lists to the Windows 8 app, and the ability to pin user profiles or Twitter lists to the Start Screen. Pinning is a great addition if you don’t want to miss any updates from a specific users or set of users. Twitter lists aren’t confined to your own lists either; you can pin any Twitter list you can find to your start screen.

Pinned lists and profiles are relegated to small tile status on the Start screen.
Say, for example, you wanted to pin blogger Robert Scoble’s Tech Pundits list. You’d navigate to Scoble’s list inside the Twitter app, swipe down or right-click, and then select the option to “Pin to Start” in the lower left corner. Pinned profiles and lists appear as small tiles with live updates. The only downside is you don’t have the option to upgrade your pinned tiles to a more reading-conducive larger-sized tile.

Twitter’s new update for Windows 8 also addresses some bugs and overall performance issues, such as faster response times. Many users posting comments on the Windows Blog say the new update has fixed their stability issues that were causing numerous crashes with the previous version of Twitter. Users have also noticed several unannounced features such as user tagging when composing tweets, improve responsiveness to touch, and more frequent feed updates.

It’s good to see Twitter continuing to update its Windows 8 app as it is one of the few truly useful social networking apps available right now in the Windows Store.

New digitally signed Mac malware confuses users with right-to-left file name tricks

A new piece of digitally signed spyware for Mac OS X uses a special Unicode character in its file name to hide its real file extension from users and trick them into installing it.

The malware, which has been dubbed Janicab.A, is written in Python and is packaged as a stand-alone Mac application using the py2app utility, researchers from security firm F-Secure said Monday in a blog post.
It is distributed as a file called “RecentNews.?fdp.app” where the “?” is actually the right-to-left override (RLO) character known as U+202E in the Unicode encoding standard.

Unicode supports characters from most languages, including those written from right to left like Arabic and Hebrew. The special RLO character tells software that the text following it should be displayed from right to left.

Apple displays double extensions for security reasons in the Mac OS X file manager, said Sean Sullivan, a security advisor at F-Secure, Tuesday via email. “Here, the RLO trick is being used to counter that and to make the .app appear to be a .pdf.”

The trick itself is not new and has been used by Windows malware in the past, including by the Bredolab email spam malware and the Mahdi cyberespionage Trojan program that targeted computers in the Middle East.

Opening the Janicab .app file will trigger a standard Mac OS X pop-up dialog warning the user that the file was downloaded from the Internet. However, because of the RLO character in the file name, the entire warning text will be written right to left making it confusing and hard to read.

If users agree to open the file, the malware will install itself in a hidden folder in the user’s home directory and will open a decoy PDF document containing what appears to be a news article in Russian.

Janicab continuously takes screenshots and records audio and uploads the collected data to command and control (C&C) servers that it finds by parsing the description of specific YouTube videos. It also queries the C&C servers for commands to execute, the F-Secure researchers said in the blog post.

Based on statistics for the YouTube videos whose descriptions are parsed by the malware, the malware’s functionality and the contents of the decoy document, F-Secure researchers believe the malware is being used in targeted attacks, Sullivan said. However, the company doesn’t have any information about the identity of the targets, he said.

Janicab samples were uploaded to the VirusTotal malware scanning service from five countries, but that information might reflect the locations of different security researchers, not victims, Sullivan said.
The malware’s installer is digitally signed with a code-signing certificate—an Apple Developer ID—issued by Apple to a person named “Gladys Brady.”

In May, security researchers found several samples of a Mac OS X backdoor-type program called KitM or HackBack, that were digitally signed with a valid Apple Developer ID issued to “Rajinder Kumar.” One of those samples was collected from the Mac laptop of an Angolan activist attending the Oslo Freedom Forum, a human rights conference in Norway.

Researchers linked the KitM samples to a larger cyberespionage campaign of Indian origin dubbed Operation Hangover.

F-Secure reported the new certificate being abused by the Janicab malware to Apple, but has yet to receive confirmation of any action taken by the company, Sullivan said. “They quickly revoked the certificate in the previous KitM case,” he said. “I have no doubt they’ll also revoke this developer [ID] soon if they haven’t already.”

The F-Secure researchers believe that Apple is likely to create a removal tool for Janicab as it did for the “Pintsized” Mac OS X malware discovered in February.


“As the popularity of OS X continues to grow, Apple users have to get used to the fact that they will become targets for malware authors,” said Gavin Millard, EMEA technical director at security firm Tripwire, via email. “Although the RLO (Right Left Override) approach of obfuscating the true extension of a file is simple to spot, users will still click, especially as they are not used to being targeted.” 

Cloud databases less of a leap for users now, but some hurdles remain

With the growing adoption of cloud-based applications, it's natural that cloud databases would follow. Not that long ago, cloud-based database offerings were very limited -- so much so that organizations really didn't have a compelling reason to embrace them, other than for exploratory purposes. But in recent years, the landscape has changed: The number of available products and services has expanded significantly, as have their capabilities, reliability and application support.

Initial cloud offerings often were nothing more than a service provider running a database for an organization in a virtual machine on the provider's network. That shifted the database system off-premises, eliminating the capital costs associated with it and converting the outlay still required to operating expenses -- i.e., the service provider's charges for hosting the system. The benefits were purely economic in nature, and the user organization typically still needed to manage the database itself.

Now there's a large variety of cloud database options for IT managers and data management professionals to consider. Oracle, IBM and other database vendors make their software available for deployment in private clouds or on public cloud services, such as Amazon's EC2 and Microsoft's Windows Azure. Database as a Service platforms let users set up databases in the cloud without having to install or manage any software. Managed hosting services blend those two approaches: Service providers deploy database instances on their systems for users and manage the environments as well.

Both commercial and open source databases are available for use in the cloud; the choices also include a mix of mainstream SQL-based relational databases and schema-less NoSQL technologies that increasingly are being embraced for use in big data analytics applications. Even data warehouses can be stood up in the cloud, a point embellished by Amazon's announcement of its Redshift data warehousing service in late 2012.
The primary business drivers for adopting cloud-based databases are anticipated cost savings, increased flexibility and reduced database administration and systems management requirements. Another common driver is a decision by corporate and IT executives that deploying and managing database technologies in-house isn't strategic to a company's business and can be farmed out to a service provider.

The vendor sales pitch that cloud databases are more cost-effective and less resource-intensive than on-premises products, resulting in a lower total cost of ownership, may well be true. But cloud services and tools do cost money (as they should), so it's incumbent upon IT managers to do a return on investment (ROI) calculation comparing the various options -- including sticking with on-premises software.

The deployment flexibility made possible by cloud computing can factor into the ROI equation. With cloud database services, organizations can scale their database instances and processing capacity up or down as business requirements dictate, paying for additional technology resources only when they're needed instead of having to worry about buying new hardware and software, installing it in time to meet increased demands and then being saddled with it if those demands dissipate. The diminished admin burden is another potential ROI booster: Database configuration, backups, mirroring, uptime and disaster recovery procedures, software updates, and other tasks can all be redirected from internal database administrators to cloud service providers, as can systems management workloads.

Of course, there are some issues to take into account as well. Data security, privacy and regulatory compliance concerns needn't be the cloud showstoppers they often were treated as in the past, but they still need to be addressed before taking the leap and putting databases in the cloud.

Many IT managers remain reluctant to send important business data outside the corporate firewall. In addition, privacy laws and security regulations, particularly in Europe, restrict where data can be kept -- a possible complication with cloud services that run on systems distributed across data centers in various locations, including different countries. As the use of cloud databases has increased, so too has the ability of service providers to support the levels of security and privacy needed by almost all enterprises. In fact, cloud services may well be more secure than many corporate networks are -- after all, a cloud provider's business reputation rides on having robust security and privacy protections. But companies looking to take advantage of the cloud need to determine their security and compliance requirements up front and work closely with providers to ensure successful implementations.

Other issues that must be addressed before deploying cloud database software or services include integration with on-premises databases and applications and ensuring that sufficient network bandwidth is available to support the data needs of business users. If a company is primarily running cloud-based applications or is looking to collect big data and other information from external sources, cloud databases are an attractive option, and integrating them with existing systems might not be a big hurdle to get over. But if most applications are still on in-house systems, the integration demands could be high -- and keeping databases in-house as well might be the more appropriate way to go.


Similarly, if network bandwidth is limited and users need to download significant amounts of data for business intelligence and analytics applications, on-premises databases likely are called for. Database location must be transparent to end users; all they care about is being able to access data when they need it, no matter where it's coming from. Assuming that there is enough bandwidth and the other issues can be dealt with, there's no reason why that place can't be the cloud.

HP offers to help Microsoft users migrate from expiring Windows XP OS

HP has collaborated with Microsoft to provide hardware and software tools to simplify businesses' transition from the Windows XP operating system (OS). Microsoft is ending support for the widely-used OS and its Office 2003 suite in April 2014.

Although Windows XP support will end in less than 10 months, as many as 40% of businesses have not yet deployed an alternative OS, according to a study by HP.

Research firm Gartner has predicted that more than 15% of medium and large enterprises will still be running Windows XP on at least 10% of their PCs after Microsoft support ends next year.

In April this year, Microsoft posted a warning on its website: “If your organisation has not started the migration to a modern desktop, you are late.”

The average enterprise deployment can take 18 to 32 months from business case through full deployment. Analysts have warned that companies without a Windows XP migration plan risk facing compliance issues.

“Many businesses have been avoiding the XP migration, fearing lack of compatibility and loss of productivity during the transition process,” said Enrique Lores, senior vice-president and general manager, commercial PCs, at HP.

Organisations that continue to use Windows XP past its end-of-support status will incur additional IT costs to develop software security patches to prevent breaches as Microsoft will not support the OS, HP warned.

Migrating to a newer platform such as Windows 7 can help businesses reduce their technical support needs by up to 70% per PC and save as much as $700 (£463) annually per user from reduced support and power costs, HP’s study showed.

According to an IDC whitepaper titled Why sticking to Windows XP is a bad idea, the research firm estimated that businesses can halve their lost productivity costs per PC by migrating away from Windows XP. For every 230 supported PCs, a move to Windows 7 frees up the equivalent of one full-time resource, the paper showed.

While HP’s products will help businesses migrate to a more current version of Windows, HP Financial Services (HPFS) will help businesses do it for a “minimal upfront investment”, Lores added.

The financial services offerings provide customers easy payment plans to simplify their Windows XP transition. The HP service offers payment deferrals for up to 90 days, or cashback options to encourage users make the transition.

The company is also offering consulting and support services to enterprises for all stages of the Windows XP transition.

By working with a company such as HP, which has hardware and services solutions in place, businesses can immediately start realising the benefits of Windows 8 and Windows 7 Erwin Visser, Microsoft.

When transitioning to a new OS, organisations must take a holistic view across hardware and software to achieve full optimisation, according to HP. This means they must factor in newer working trends and changing work styles to accommodate a bring your own device (BYOD) policy.

Microsoft welcomed HP’s investment in enabling customers move from the popular XP system.

“By working with a company such as HP, which has hardware and services solutions in place, businesses can immediately start realising the benefits of Windows 8 and Windows 7,” said Erwin Visser, general manager, Windows, at Microsoft.

Some UK enterprise customers such as Jaguar Land Rover and Centrica have already started migrating to Microsoft Windows 7.

The upgrade is part of Jaguar Land Rover’s multi-million pound five-year IT project, its CIO told Computer Weekly.

Meanwhile, Centrica is set to complete migrating its 26,500 staff from Microsoft Windows XP to Windows 7 before the end of 2013.

Alert! Study finds Internet users heed browser warnings

Security warnings displayed by Web browsers are far more effective at deterring risky Internet behavior than was previously believed, according to a new study.

The study looked at how users reacted to warnings displayed by Mozilla's Firefox and Google's Chrome browsers, which warn of phishing attempts, malware attacks and invalid SSL (Secure Sockets Layer) certificates.

It was widely thought that most users ignored the warnings, based on several studies released between 2002 and 2009. However, in the past four years, browser warnings have been redesigned, but the effect of the new designs on users had not been studied.

For example, toolbars that warned of possible phishing attacks have been replaced with full-page warnings that may have influenced people's behavior, the researchers who conducted the study wrote.

More than 25 million warning impressions displayed by Chrome and Firefox in May and June were analyzed. The data was collected from telemetry programs used by Mozilla and Google, which collect what the researchers term 'pseudonymous' data from the browsers of consenting users.

In the case of both browsers, less than 25 percent of users opted to bypass malware and phishing warnings, and only a third of users cruised through the SSL warnings displayed by Firefox.

"This demonstrates that security warnings can be effective in practice; security experts and system architects should not dismiss the goal of communicating security information to end users," according to the paper, which was submitted to the Usenix Annual Technical Conference 2013 in San Jose, California, late last month.

The analysis uncovered other interesting details. It appears that more technical users bypassed security warnings more often. The researchers considered technical users as those who used Linux and pre-release browsers.

"Technically advanced users might feel more confident in the security of their computers, be more curious about blocked websites or feel patronized by warnings," the paper said.

Despite the positive influence of the warnings, the researchers found users clicked through more than 70 percent of Google's SSL warnings. By contrast, Firefox users clicked through them just 33 percent of the time.

There are a few thoughts why Chrome's SSL click-through rate is higher. Users can bypass Chrome's warning with a single click, whereas Firefox requires three clicks. Firefox displays a more stern warning, showing an image of a policeman and using the word "untrusted" to describe the site.

There may also be other mitigating factors, the researchers said. Nevertheless, Chrome's high SSL click-through rate "is undesirable," they wrote. "Our positive findings for the other warnings demonstrate that this warning has the potential for improvement."

The study was written by Devdatta Akhawe of the University of California, Berkeley, and Adrienne Porter Felt, a research scientist at Google.

Chrome rich notifications go live for all Windows users; good luck using them

Richer notifications are now available in the latest stable version of Chrome for Windows, version 28.

Chrome has offered notifications outside of the browser window for some time, first introducing the feature for Gmail in 2011. The difference now is the richer-notifications feature lets developers of Chrome apps and extensions send interactive pop-up notifications to your desktop. Hangouts could, for example, send you a chat pop-up notification with options to reply, email, or call the person you’re chatting with.

The new feature also adds the oft-discussed notification center to Chrome for Windows, which allows you to get updates on the desktop from online services—even when the full Chrome browser isn’t running.

Although richer notifications and the notification center are activated by default, you won’t see anything new unless you’re using a Chrome app or extension that has enabled the feature.

Google did not provide a list of which apps and extensions the feature currently works with, but after publication, a Google representative contacted us to offer three specific examples of Chrome apps with rich notifications that Windows users can try out.

A Google spokesperson told PCWorld that richer notifications have to be enabled on a per-app basis. You can enable Gmail, for example, to send desktop notifications by clicking on the gear icon on the right-hand side of your inbox and selecting Settings>General.

Scroll down to “Desktop notifications” on the next screen and turn on notifications for mail and chat. These are the same settings that have been around for two years, so most users probably already have enabled them.

A Google spokesperson said the richer notifications should appear by activating this feature but, in my tests Wednesday, I couldn’t see any interactive features in the Gmail version.

I also tried getting notifications using the Hangouts extension for Chrome that puts Hangouts in the Windows taskbar. But again, no richer notifications. Checking out forums and sites around the Web, it seems other users are also coming up empty in the search for richer notifications and the notification center.

Update: After this story went live, a Google representative contacted us to offer three specific examples of Chrome apps with rich notifications that Windows users can try out. They are:
Ouistiti: A simple example application that prompts you to take a photo with your Webcam every day.Checker Plus for Gmail: Desktop rich notifications for new email.Checker Plus for Google Calendar: Desktop rich notifications for calendar events.

Examples of desktop rich notifications for Checker Plus for Gmail (giving you the chance to mark the message as read or delete it), left, and Ouistiti (giving you the chance to take a webcam shot or to remind you to take it later).
Richer notifications, once they do work, are part of a larger push from Google to take features from Chrome OS and put them in Chrome for Windows and Mac that create a mini-OS inside your PC’s regular operating system.

Beyond richer notifications, Google is working on bringing packaged apps to Windows, which are Chrome-based apps that act as regular desktop apps. Packaged apps also come with a separate app launcher that allows you to launch specific Chrome apps right from the taskbar. This feature currently is only available to users in the Chrome Dev update channel.

Another long-anticipated service expected to land on Chrome for PCs is Google Now, the company’s take on a personal digital assistant that delivers information as you need it. The service can, for example, alert you when to leave for an appointment across town based on current traffic conditions, or let you know about the flight status for an upcoming trip. Google Now was spotted in Chrome Canary, the alpha build of Chrome, back in March, but was not operational.

The Richer notifications feature isn’t the only significant change to the latest stable edition of Chrome for Windows. The new build is also using the Blink browser engine first announced in April after Google split with WebKit. The new version of Chrome also fixes more than 15 bugs and security fixes affecting Windows users.

By now, most people should be using the updated version of the Chrome browser. If you want to verify you’re on the latest build, type chrome://chrome in your browser’s address bar. The version number at the top should be 28.0.1500.71m.

A New Tool Aims to Help Facebook Users Dig Deep

But just try finding that photo of Mom and Dad in front of the Eiffel Tower during their 2008 trip to Paris, or the name of that lovely bistro nearby that they mentioned in a status update. Odds are, you would have to plow through a lot of old posts and photos to dig out that information, if you could find it at all.

Now, Facebook is trying to make it easier to find that lost photo or restaurant recommendation and unearth other information buried within your social network with a tool it calls Graph Search.

On Monday, the company will roll out the feature to its several hundred million users in the United States and to others who use the American English version of the site. Other languages will follow.

Developing a sophisticated search feature is vital to Facebook’s long-term success, both to deepen users’ engagement and to make it more appealing to advertisers.

Experts say that Facebook’s technical achievement so far is impressive. Privacy could still be an issue, however, as more user data becomes easily accessible. Also, the feature is dependent on Facebook users volunteering more information about their likes and dislikes.

Ever since Facebook released an early version of the tool in January, the development team has been observing and listening to millions of testers and making improvements. “We launched it early, when it still was in a pretty raw state,” Lars Rasmussen, the engineering director of the project, acknowledged in a recent interview.

Early on, Mr. Rasmussen said, users had trouble even finding the search box, which was blue and melded into the border at the top of every Facebook page. The team eventually made the box white and used words to explicitly describe its purpose.

The tool also has struggled to understand how people actually use language.

For example, typing in “surfers who live in Santa Cruz” confounded the search engine, which was tuned to recognize the phrase “people who like to surf” but not synonyms like surfers or “people who like surfing,” said Loren Cheng, who leads the team of linguists who are working to refine the tool’s natural language capabilities.

The engineers also had to adapt the algorithms to consider the many ways that people express interest in a topic.

For example, Mr. Rasmussen, a ballet fan, said that when he looked for “friends who like ballet,” only two popped up. But many more friends had liked the pages of individual ballet companies. So the search engine now takes into account related pages when assessing whether users like a topic.

Facebook’s Graph Search is still a work in progress, as company officials are quick to acknowledge. Its recognition of synonyms and related topics is spotty. It cannot yet find information in status updates, a top request from users. It does not yet incorporate information from third-party apps like Yelp or Instagram, which is owned by Facebook. And the new search tool is not available on Facebook’s mobile apps, which are increasingly the way that people use the service.

But Facebook believes it is now good enough for wide release. And despite the tool’s limitations, technologists praised the company’s work.

“There is a near infinite variety of ways to say anything in English or in any other language,” said Nick Cassimatis, an associate professor at Rensselaer Polytechnic Institute and a co-founder of SkyPhrase, a start-up working on similar natural-language search technology. “They are trying to memorize all the ways of saying something.”

Unlike Google’s familiar search engine, which typically takes the keywords entered into a search box and matches them to the most relevant Web pages that contain them, Facebook’s search looks primarily at structured data.


Follow me on Twitter @sajilpl

UK users hit with 3,000 phishing attacks per day, says Kaspersky Lab

UK Internet users were subjected to 3,000 phishing attacks per day in the year to April 2013, a small part of the swelling global tide of web-based fraud, Kaspersky Lab has reported using data from its own user base.

At around a million attempted attacks per year, this puts the UK in the middle of the pack as a target, accounting for 3.2 percent detected by the firm globally. In the previous year, the number of attacks ran at around 1,000 per day.

The most attacked countries were Russia, at 18.7 percent, the US at 12.2 percent, India at 9.9 percent, and Germany at 6.2 percent; the UK and France vied for fifth place with identical volumes.

All countries showed large percentage rises over 2011-2012, led by the US at 134 percent and India at 128 percent.

To be clear, these are attempted attacks, that is those detected by the firm presumably before they did any damage. They are also only those registered by consenting users from Kaspersky Lab alone. Therefore, the figures show only a fraction of the true scale of global phishing crime as detected by one security vendor.

In terms of the national picture, they must also reflect the countries in which Kaspersky Lab has the most participating users.

Kaspersky found that 1,739 firms whose sites were used (that is copied) as lures for the phishing scams, 250 more than the previous year. Predictably, banks made up 921 of these, although this doesn't include other types of financial firm such as credit cards and investment funds.

In the UK, the top non-bank sites that phishers copied were Facebook, Yahoo, Google and Amazon. In the US, Yahoo was still the most copied site, ahead of Facebook, Google and Amazon.

“The volume and variety of phishing attacks detected during the analysis indicates that phishing is not merely one tool among many for the illegal enrichment of fraudsters, but represents a significant and visible threat,” said Kaspersky Lab research deputy CTO,  Nikita Shvetsov.

“These attacks are relatively simple to organise and are demonstrably effective, attracting an increasing number of cybercriminals to this type of illegal activity.”

Fascinating to report but the firm even noticed phishing attacks by criminals on other criminals, with 9,000 scams based on Liberty Reserve, the currency system heavily used by the underground until shuttered earlier this year.

Follow me on Twitter @sajilpl

Citadel malware variant uses content localization to target brands and users in different countries

A new variant of the Citadel financial malware uses in-browser injection techniques combined with extensive content localization to steal log-in credentials and credit card information from users in different countries, according to researchers from security vendor Trusteer.

 

Citadel has the ability to modify or replace websites opened by users on infected computers. This is known as a man-in-the-browser attack and is frequently used by financial Trojan programs to trick users into exposing their log-in details and other sensitive information.

 

The new Citadel variant targets users of social networks, banks and major e-commerce sites, including Amazon and its local versions in France, Spain, Italy and Germany, the Trusteer researchers said in a blog post.

 

International as well as local brands are targeted, said Etay Maor, fraud prevention manager at Trusteer, Thursday via email.

 

When the targeted websites are accessed from computers infected with the new Citadel variant, the malware replaces them with rogue versions that claim users' accounts were blocked because of suspicious activity. The victims are then asked to input their personal and credit card information in order to confirm that they are the legitimate owners of the accounts and proceed to unlock them.

 

This particular social engineering technique has been used for years in phishing attacks. However, unlike in traditional phishing, when websites are modified locally by Citadel or similar malware, the URLs displayed in the browser's address bar are those of the legitimate websites.

 

The use of localized HTML injections by financial malware is not new, but the extra effort put into this new Citadel variant to make the rogue content believable makes it stand out, Maor said.

 

The particular variant uses some interesting technical tricks to create the injection screens, Maor said. For example, it includes customized drop down menus and requests for information generated in local languages, he said.

 

These implementation aspects, the operating team's behavior and the botnet's command-and-control structure point to a detail-oriented and professional operation, Maor said.

 

Based on data collected and analyzed by Trusteer, the company's researchers estimate that several thousands of computers have been infected with this new Citadel variant so far.

 

Earlier this month Microsoft said that it worked with the FBI and other technology industry partners to disrupt more than 1,400 botnets based on the Citadel malware. The company estimated at the time that those botnets were responsible for more than US$500,000 million in losses to people and businesses around the world.

 

Microsoft's effort disrupted the operation of many Citadel botnets, but anyone with a Citadel builder -- an application used to build customized versions of the Trojan program -- can create a new variant and start a new operation of his own, Maor said. "We actually see new Citadel botnets in play."

 

Follow me on Twitter @sajilpl

Bugs & Fixes: Users report Internet loss with new MacBook Airs

Apple’s latest updates to its MacBook Air laptops have been getting rave reviews for their incredible battery life: the 13-inch model clocks more than 12 hours on a single charge. Unfortunately, these new Airs have also been getting some unwanted attention for a potential Internet connection failure. In particular, numerous users report that their Internet connection drops out within minutes of them getting online. A bit surprisingly, this occurs even though the computer’s Wi-Fi connection still shows a normal strong signal.

 

I first became aware of this matter via a Gizmodo article that provocatively asked: “Is Your New MacBook Air’s Wi-Fi Crappy?” The article claims that “a couple of thousand disenfranchised Apple customers seem to have descended on the Apple Support Forums.” Given that there were less than 150 posts in the cited Support Communities thread, Gizmodo’s claim of “a couple of thousand” complaints seems to be a significant exaggeration. Still, as there are likely many affected users who have not posted their dismay online, the claim is probably true in the larger sense.

 

Although the new models support 802.11ac Wi-Fi, the problem happens primarily, if not entirely, with older connection technologies. More precisely, the dropped connections appear to occur most often with third-party routers as opposed to Apple AirPort routers, especially routers that are too old to have even 802.11n support. This means that if you take your Air to a Genius Bar at an Apple Store, the Air will likely work fine (as many people have confirmed). This, in turn, means that the Genius will most likely conclude that the problem is in software rather than with the Air’s hardware. However, in my view, a hardware cause remains a possibility; it may be one that only gets triggered when connected to certain types of routers.

 

At this early juncture, there is still no consensus solution. Some users found that switching channels on their router eliminated the drops. Others claimed that deleting one or more files in the SystemConfiguration folder (as described in a 2012 OS X Daily article) solved the problem. Others found that the symptom went away after a complete reinstall of OS X.

 

As is too often the case, for each of these solutions, other users failed to get the reported success. On the other hand, numerous owners of the latest MacBook Airs have never had this symptom at all.

 

My guess is that an Apple-supplied software or firmware update will be required to ultimately resolve the matter. In the meantime, if you’re planning on buying one of these new machines, be sure to test its Internet connectivity right away—so that you have the option to return the machine if it turns out you are a victim of this bug and cannot get any solution to work.

 

 

Microsoft's 'Bing Boards' allows users to curate search results

Microsoft’s push to make its Bing search engine more social will take it in a new direction—actually letting a select group of users curate results.

Microsoft’s “experiment,” known as Bing Boards, will allow a small group of food and lifestyle bloggers, experts, and social influencers to cultivate their own selection of search results on a given topic. The Board will be a visual collection of images, videos and links that tell the story from the blogger’s point of view, Microsoft said.

These results won’t replace the search result that Bing normally returns, but will sit alongside them within the middle column of Bing’s search results, Chen Fang, program manager of Bing Experiences, said in a blog post.

When one searches Bing, the results show up in the middle of the page on a 4:3 screen, or on the left hand of a widescreen monitor. The Bing Board appears as a larger image to the right of the main search results. When clicked on, the Board opens up to a larger image, with additional links and images inside.

Microsoft

“Most people spend at least some time every day on sites dedicated to a particular area in which they have a special interest,” Fang wrote. “It could be a hobby, a political or social issue, an area of pop culture: the topics are as varied as the people who are interested in them. Now, in the same way that we’ve brought knowledge from friends and recognized experts into search, we’re providing a new way for passionate people to create highly specialized content, specifically for search.”

Microsoft said that it will use a team of editors to bring on new contributors with content that  “shares an interesting point of view and is visually unique,” a spokesman said an email, factoring in metrics such as traffic and online influence as well. In an example search, searching for “photo booth backdrop” generated a Bing Board by Chelsea Costa of Lovely Indeed, a DIY blog. All of the links within the Bing Board went to the Lovely Indeed site.

“Bing Boards are another way for creative online influencers to express their words, images and point of view on their passions and reach readers who are interested in the content they are producing,” Microsoft representatives said in response to a question about whether bloggers would be responsible for curating third-party content.

Microsoft said that the Bing Boards are but one of hundreds of minor tweaks Microsoft engineers apply to the site on a regular basis. “Most are nearly invisible, ranging from small tweaks to the search algorithm, to changes in our ad selection, to optimizations in the color, size, and placement of features,” Fang wrote.

The Bing Board appears to the right of search results.

About 17.4 percent of all U.S. search results are returned via Bing, according to May data collected by comScore. That puts Microsoft a distant second to Google, which controls 66.7 percent of the U.S. search market.

In 2010, Microsoft and Facebook joined forces to create an instant personalization feature for search results, with some results tagged as “Liked by your Facebook Friends.” The partnership grew closer over time: Microsoft added a “social” column to allow users to ask questions of Twitter and Facebook friends, and then integrated results if those friends had commented, liked, or referred content from a variety of social networks, including LinkedIn and even Google+. Bing even allowed users to search Facebook Photos, if logged in, via a feature that predated Facebook’s own Graph Search.

In March of this year, Bing added Facebook and Twitter data to people searches. And in May, Bing allowed users to comment and Like search results, directly on the Bing site.