Google ads attacked by Trojan

Web ads sold by search giant Google are being hijacked by so-called trojan software that replaces the intended text with ads from a different provider, antivirus company BitDefender has warned.

The trojan redirects queries meant to be sent to Google servers to a rogue server, which displays ads from a third party instead of ads from Google, BitDefender said in a statement.

Google said: "We have cancelled customer accounts that display ads redirecting users to malicious sites or that advertise a product violating our software principles."

"We actively work to detect and remove sites that serve malware in both our ad network and in our search results. We have manual and automated processes in place to detect and enforce these policies."

The trojan, named after the mythic Trojan Horse because of its ability to enter computer systems undetected, attacks Google's AdSense service, which targets advertisements to match web page content.

"This is a serious situation that damages users and Webmasters alike," said BitDefender virus analyst Attila Balazs.

"Users are affected because the advertisements and/or the linked sites may contain malicious code," he said. "Webmasters are affected because the trojan takes away viewers and thus a possible money source from their Websites."
BitDefender's website describes the trojan, which it identifies as Trojan.Qhost.WU, as spreading at a "low" level and causing "medium" damage.

Technorati Profile

Technorati Profile

Microsoft expands XP SP3 testing

Microsoft said Monday that it has expanded its testing of Windows XP Service Pack 3, to include subscribers of its MSDN and TechNet programs. Last month, Microsoft made available a test version of XP Service Pack 3 to a group of about 15,000 testers.

The update is significant in that it is the largest change in some time to Microsoft's most-used operating system. However, the XP update is largely a collection of previously issued bug fixes and security updates.

A public beta is scheduled for some later date, with a goal of having it released in final form in the first half of next year. However, Microsoft cautioned that its "timing will always be based on customer feedback as a first priority."

Anticipation over the timing and features of the release has been going on for years. XP SP3 was initially expected as early as 2006, but was delayed as Vista work remained the priority for the Windows team. The first service pack for Windows Vista is also due out in the first half of next year.

CCleaner 2.03.532

CCleaner (formerly Crap Cleaner) is a freeware system optimization and privacy tool. It removes unused and temporary files from your system - allowing Windows to run faster, more efficiently and giving you more hard disk space. The best part is that it's fast! (normally taking less than a second to run) and Free.

Cleans the following:


Internet Explorer Cache, History, Cookies, Index.dat.

Recycle Bin, Temporary files and Log files.

Recently opened URLs and files.

Third-party application temp files and recent file lists (MRUs).
Including: Firefox, Opera, Media Player, eMule, Kazaa, Google Toolbar, Netscape, Office XP, Nero, Adobe Acrobat, WinRAR, WinAce, WinZip and more...

Advanced Registry scanner and cleaner to remove unused and old entries.
Including File Extensions, ActiveX Controls, ClassIDs, ProgIDs, Uninstallers, Shared DLLs, Fonts, Help Files, Application Paths, Icons, Invalid Shortcuts and more... Backup for registry clean.

Windows Startup tool.

Change Log

- Improved support for IE7 Autocomplete cleaning.
- Added Vista Recycle Bin secure deletion.
- Fixed bug in secure deletion of filenames.
- Fixed bug in "Other Explorer MRUs" cleaning.
- Fixed minor bug in Temp file deletion.
- Added better secure deletion for cookies.
- Fixed Autocomplete cleaning on Win98.
- Improved Hotfix Uninstaller cleaning to ignore Desktop Search.
- Fix bug in saving CCleaner window position.
- Improved System Info routines.
- Minor bugs fixes and GUI tweaks

Download video from youtube without sofware

Did You know youtube?
Well, i hope u dont say no :d
If u dont know youtube what cek at this
If u already know,,

Sometimes we must be instaled software to download video from you tube.
Now, u can download it without must be installed software at your computer.
But how?

Good question.

I'll tell u.

First,

Open ur browser, type http://www.keepvid.com at address bar.

Binggo!

You must be at this :)

And then, like u see, just follow the instruction.

Thats it.

If u cannot download it just give ur comment
I help u.

Thanks

Microsoft WGA Issues and On-line Activation

The recent failure with its Genuine Advantage (WGA) validation system (see Gregg Keizer's Computer World story) illustrates the downsides of using on-line activation for licensing and software protection. Although activation holds promise for helping to deter software piracy, it introduces a dependency and point of failure that is not be acceptable for all applications. However, it’s a difficult problem to resolve without greater software protection, because as soon as you allow an offline licensing scenario to exist it will be exploited by the piracy crack groups.

Vic

Auditing open source software

Google encourages its employees to contribute back to the open source community, and there is no exception in Google's Security Team. Let's look at some interesting open source vulnerabilities that were located and fixed by members of Google's Security team. It is interesting to classify and aggregate the code flaws leading to the vulnerabilities, to see if any particular type of flaw is more prevalent.

1. JDK. In May 2007, I released details on an interesting bug in the ICC profile parser in Sun's JDK. The bug is particularly interesting because it could be exploited by an evil image. Most previous JDK bugs involve a user having to run a whole evil applet. The key parts of code which demonstrate the bug are as follows:



TagOffset = SpGetUInt32 (&Ptr);
if (ProfileSize < TagOffset)
return SpStatBadProfileDir;
...
TagSize = SpGetUInt32 (&Ptr);
if (ProfileSize < TagOffset + TagSize)
return SpStatBadProfileDir;
...
Ptr = (KpInt32_t *) malloc ((unsigned int)numBytes+HEADER);


Both TagSize and TagOffset are untrusted unsigned 32-bit values pulled out of images being parsed. They are added together, causing a classic integer overflow condition and the bypass of the size check. A subsequent additional integer overflow in the allocation of a buffer leads to a heap-based buffer overflow.

2. gunzip. In September 2006, my colleague Tavis Ormandy reported some interesting vulnerabilities in the gunzip decompressor. They were triggered when an evil compressed archive is decompressed. A lot of programs will automatically pass compressed data through gunzip, making it an interesting attack. The key parts of the code which demonstrate one of the bugs are as follows:


ush count[17], weight[17], start[18], *p;
...
for (i = 0; i < (unsigned)nchar; i++) count[bitlen[i]]++;


Here, the stack-based array "count" is indexed by values in the "bitlen" array. These values are under the control of data in the incoming untrusted compressed data, and were not checked for being within the bounds of the "count" array. This led to corruption of data on the stack.


3. libtiff. In August 2006, Tavis reported a range of security vulnerabilities in the libtiff image parsing library. A lot of image manipulation programs and services will be using libtiff if they handle TIFF format files. So, an evil TIFF file could compromise a lot of desktops or even servers. The key parts of the code which demonstrate one of the bugs are as follows:


if (sp->cinfo.d.image_width != segment_width ||
sp->cinfo.d.image_height != segment_height) {
TIFFWarningExt(tif->tif_clientdata, module,
"Improper JPEG strip/tile size, expected %dx%d, got %dx%d",


Here, a TIFF file containing a JPEG image is being processed. In this case, both the TIFF header and the embedded JPEG image contain their own copies of the width and height of the image in pixels. This check above notices when these values differ, issues a warning, and continues. The destination buffer for the pixels is allocated based on the TIFF header values, and it is filled based on the JPEG values. This leads to a buffer overflow if a malicious image file contains a JPEG with larger dimensions than those in the TIFF header. Presumably the intent here was to support broken files where the embedded JPEG had smaller dimensions than those in the TIFF header. However, the consequences of larger dimensions that those in the TIFF header had not been considered.


We can draw some interesting conclusions from these bugs. The specific vulnerabilities are integer overflows, out-of-bounds array accesses and buffer overflows. However, the general theme is using an integer from an untrusted source without adequately sanity checking it. Integer abuse issues are still very common in code, particular code which is decoding untrusted binary data or protocols. We recommend being careful using any such code until it has been vetted for security (by extensive code auditing, fuzz testing, or preferably both). It is also important to watch for security updates for any decoding software you use, and keep patching up to date.

source : Chris Evans, Security Team

200% Growth in Severe Malware Infections

An infections graph released by the Trend Micro Threat Analytics shows that the growth in severe malware infections grew 200% throughout 2007. See below.
evere malware place user data and credibility at risk by damaging possibly critical user and system data (which may render the system unusable or lead to irreparable data loss), compromising user systems, or using complex rootkit techniques allowing the malware to become virtually untraceable. This trend also shows us the increasing importance of keeping anti-malware scan engines as up-to-date as possible.

Thanks to Anthony Arrott and Paul Ferguson for the analysis and preparation of this material.

source: http://blog.trendmicro.com/