Please create an account to participate in the Slashdot moderation system


Forgot your password?
Slashdot Deals: Prep for the CompTIA A+ certification exam. Save 95% on the CompTIA IT Certification Bundle ×

Submission + - Shifu Banking Trojan Has an Antivirus Feature to Keep Other Malware at Bay

An anonymous reader writes: Shifu, a banking trojan that's currently attacking 14 Japanese banks, once it has infected a victim's machine, it will install a special module that keeps other banking trojans at bay. If this module sees suspicious malware-looking content (unsigned executables) from unsecure HTTP connections, it tries to stop them. If it fails, it renames them to "infected.exx" and sends them to its C&C server. If the file is designed to autorun, Shifu will spoof an operating system "Out of memory" message.

Comment Re:To be expected (Score 1) 203

The problem with this idea is: how do you get all the ISVs to cooperate? It won't happen; they'd have to come up with some way for the OS to prevent 3rd-party software from installing itself the normal way, and force it to go through the package manager somehow. Or just create some kind of VM for every single application to keep them all separate and unable to change anything on the system, but that seems like it'll add a lot of overhead.

Comment Re:To be expected (Score 1) 203

Unfortunately, Windows has trained users to expect to install software from all manner of different internet locations. I think that's the biggest flaw of Windows.

I wouldn't say they "trained" them to do that (after all, they're trying to push their new Windows App Store and that's going over like a lead balloon), that's simply the way things evolved. When Windows first became popular, people didn't even use the internet with it. What we're seeing now is simply the culture that has evolved, and that culture is what's causing them these problems. I have no idea what they could do to change it.

Comment Re:Sounds like what we need (Score 1) 43

But surely if the product starts to function in a degraded manor [sic] because it was pwned due to bad security, this affects the manufacturer too when people don't buy that product any more because it is crap...

That's not a problem for two reasons:

1) People are stupid. They'll just buy another one, blame "the hackers", etc.

2) Even if the company's reputation gets dragged through the mud, it won't matter because the CEO will have already left with his golden parachute. The only thing that's important is the next quarter's financials.

Comment Re:Epix was one reason they were forced to stream. (Score 1) 278

Yes, but Arizona's not quite that way. Remember, the infamous Sheriff Joe Arpaio is in Maricopa County, which is the county that has almost all the Phoenix metro area (only Apache Junction, east of Mesa, is outside of it, in Pinal County). He keeps getting re-elected by the voters in the Phoenix metro area, not a bunch of rural people. Also, the majority of the state's population is in that same county, and they keep electing Republican senators.

Comment Re:I understand this (Score 1) 416

Yeah, I don't understand motorcycles either. I mean, I sorta understand the appeal, as I'm a bicyclist and enjoy that, but I don't have to worry much about getting killed by bad drivers as long as I don't ride on main roads (I stick to bike trails mostly). My biggest worry for my safety when riding my bike is not going off the trail and hitting a tree or going in a ditch, but that isn't too hard to avoid... Motorcyclists OTOH get killed all the time in traffic accidents. I even saw one die when I was a small kid; his shoe came off his foot and landed in front of our car. So now I have a new compact car (Mazda3) that was a IIHS top pick for safety, and even did well in small-offset frontal crashes. It's also well-built and reliable, with lots of technology. Plus, it has a really nice interior for this class of car (I got the model with leather seats).

Comment Re:Is this even legal? (Score 1) 167

you need a huge number of informants (something like 2-3% of the whole population) placed everywhere who are paid and willing to rat you out to the state.

They don't need informants, they have automated surveillance now. They didn't have the internet, cellphones, NSAKEY backdoors, Stingray interceptors, etc. back in the 40s-70s. Having a typewriter in East Germany was a big deal.

Someone having some data on what might be you isn't the same thing as a guy in your workplace who knows you and who knows when it is time to call in the Stasi to detain you because you slipped and said something in their presence or worse, trusted them for some reason.

They don't need an informant; they can detain you based on what you wrote to your buddies on Facebook.

Comment Re:Trading one set of problems for another (Score 1) 789

100F in Phoenix is *at night* (in the summer). In the daytime, you're looking at 110-120.

Why the hell would you build a new house in a place you think is a shithole? Why not move someplace you like better, and where you like the climate better, especially if you're going to make that kind of long-term investment? I'm not real wild about the place I'm living currently either, but there's a good reason I have no intention of buying a house here: I hope to get the hell out of here in a year or three. I made the house-buying mistake before, and I'm not ever doing it again (esp. with values not appreciating like they used to) until I'm living someplace that I actually like a lot, and plan to stay for a good long while.

Comment Re:To be expected (Score 1) 203

The problem is Microsoft decided to trust the application to remove itself.

I don't think it's any different on Linux; if you run some crappy proprietary program's install script as root, it can do anything it wants. It's just a really different culture between the two OSes; Linux users generally don't use proprietary software at all, they get most of it from their blessed repos, and anything else is usually some other open-source program straight from the project page. Whereas on Windows proprietary software frequently all they use, or worse, they get some shit from places like which could have anything in it.

Also, Android and iOS have package managers and people aren't crying about that.

Again, the culture is totally different. Android and iOS don't generally allow you to get software from outside the official app store. (iOS absolutely doesn't allow it, on Android it's possible but takes conscious effort, and usually isn't done much; aside from some mfgr-provided crapware that they distribute through their own app store, people just get everything from the Google Play store.) People aren't crying about it because they're used to it. This is the way Android and iOS have *always* been, whereas Windows has always had a culture of buying some boxed software from an ISV and installing it from disc (and later, downloading an .exe or .msi file and installing that). So Microsoft suddenly trying to push everyone into an app store for regular Windows software isn't going over well because it's a sea-change from what they're used to. They're not used to that freedom with phones, so they don't complain about it there (plus, they don't try to do all the stuff with phones that they do with PCs, so the expectations are lower).

Comment Re:Sounds like what we need (Score 1) 43

Right now, companies have no liability for writing products with shit security. So on pretty much a daily basis we hear about products with shit security.

At this point I mostly assume any consumer technology which is designed to connect to a network is riddled with security holes. Because companies are lazy, incompetent, cheap, unaccountable, indifferent, and greedy.

It's a company's **job** to be greedy. Their sole purpose is to make money, so anything that detracts from that is by definition a bad thing.

The reason they have shit security is because their customers don't care about it, don't value it, and don't demand it. Customers want things that are cheap, and easy-to-use. Making something highly secure goes against both of these, both in developer effort needed, and in eliminating features that make things easier for consumers but are inherently insecure.

Comment Re:Sounds like what we need (Score 1) 43

I just don't understand how people who design commodity networking gear can be so bad at network security.
I am by no means a network expert, but it seems as though some of these things are just common sense....

To you maybe, but not to a manager.

- Don't have ports open to the Internet ("stealth" or otherwise) by default

But then their back doors won't work.

- Don't use unencrypted protocols... period

But then some idiot customers will complain.

- Don't enable wireless by default

But this makes it easy for idiot customers.

Seems like just doing those things our routers would be a lot safer than they are now.

Yes, but these things all have rational reasons behind them, which managers demand, and which increase profitability for the company. Consumers don't care about security, they just want it to work out-of-the-box and be easy. As long as it says it's "secure", that's good enough for them. It's just like the TSA and other security theater: people want to be told that they're safe, and the want to see stuff that makes it look like they're being kept safe, even if in reality they're not safe at all and all those security measures are completely worthless because the security protocols have wide-open back doors.


Ask Slashdot: Can Any Wireless Tech Challenge Fiber To the Home? 156

New submitter danielmorrison writes: In Holland, MI (birthplace of Slashdot) we're working toward fiber to the home. A handful of people have asked why not go wireless instead? I know my reasons (speed, privacy, and we have an existing fiber loop) but are any wireless technologies good enough that cities should consider them? If so, what technologies and what cities have had success stories?

"Life begins when you can spend your spare time programming instead of watching television." -- Cal Keegan