sorinmustaca.com – Sorin Mustaca – personal blog. Security software, agile development, scrum, programming and more

http://www.networkworld.com/news/2012/012412-authorities-prepare-to-close-down-255242.html?hpg1=bn

“If your computer was infected at some point in time and it was using one of the DNS servers which are now controlled by FBI, after March 8, it will no longer be able to make any DNS requests through these servers,” Avira product manager and data security expert Sorin Mustaca said in a blog post. “In layman’s terms, you will no longer be able to browse the web, read emails and do everything you usually do on Internet.”

Article written in Techblog on Monday,23.1.2012, question from the journalist sent on Tuesday with deadline one hour (or less), article published the same day.

I love online media

Post initially published in Avira Techblog.

You must have heard already about the already “famous” malware DNSChanger which manipulates the DNS settings of the computer in order to silently direct the users to malicious websites.

FBI and others took action against this malware and in November 2011 have managed to break the botnet. According to FBI, more than 4 million computers were affected world-wide. The thieves manipulated DNS entries in order to block antivirus programs and the operating systems to update delivering this way even more malware on users’ computers. The DNSChanger malware was used also to redirect users to rogue servers controlled by the fraudsters, allowing them to control users’ web activity and generate income through online advertising. When FBI shut down the botnet, they also replace the servers which were directing to malicious domains with valid DNS servers.

So, if the botnet is shut down why all this trouble?

FBI will deactivate those new valid DNS servers on March 8, 2012.

If your computer was infected at some point in time and it was using one of the DNS servers which are now controlled by FBI, after March 8, it will no longer be able to make any DNS requests through these servers. In layman’s terms, you will no longer be able to browse the web, read emails and do everything you usually do on Internet. So, it is mandatory that the DNS settings of the computer are restored to their original state.

After an infection with DNSChanger malware, until now it was needed to restore the settings manually. Here are tutorials in German and in English.

With the Avira DNS-Repair tool released (press release in German only) on Friday, January 20,  you can revert to the default settings of Windows only with a few clicks.

You can download the tool free of charge from the Avira Support’s Knowledge Base website in German and in English.

Avira cooperated also with the German Federal Office for Information Security (BSI) and published the tool also on the special website created to check if the DNS requests are made to the right places: www.DNS-OK.de. Note that on this website you see the link to the Avira DNS-Repair-Tool only if it is detected that your system is affected by the malware.

If you own such a device, then the first thing you do with it is to upgrade its firmware to NextFW.

The Support forum of Fujitsu-Siemens is full of useful How-Tos which help you reach your goal.

After you’ve done that, you may want to enable the rsync daemon . With a running rsync service you can have basically your own private online backup service.

This is at least what I tried to achieve. But it is tricky to make it run correctly.

Read here about rsync utility and here about rsync daemon (aka rsyncd).

Here is how I configured it so that it works also on Windows:

amsadmin# cat /etc/rsyncd.conf
lock file = /var/run/rsyncd.lock
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
use chroot = no
#max verbosity = 1
gid = wheel
uid = amsadmin

[backup]
path = /mnt/home/storage/backup
comment = bck export area for storage
auth users = amsadmin
secrets file = /mnt/.zap/etc/rsyncd.secrets
read only = no
write only = yes
list = yes

Make sure you make symlinks to /etc/rsyncd.conf and /etc/rsyncd.secrets.

# ln -s /mnt/.zap/etc/rsync.conf /etc/rsyncd.conf

# ln -s /mnt/.zap/etc/rsync.secrets /etc/rsyncd.secrets

The file rsyncd.secrets is a standard plain text file containing something like:

user:password

Make sure you symlink rsync.sh from /mnt/.zap/etc/rc.d/rsync.sh to /mnt/.zap/etc/rc0.d/rsync.sh

 # ln -s /mnt/.zap/etc/rc.d/rsync.sh /mnt/.zap/etc/rc0.d/rsync.sh

Then restart and it will do the job.

If you wonder from where you should get the rsync on Windows, then just think to Cygwin.

This is how I use rsync.exe to backup my T drive:

rsync.exe -urtav –ignore-errors –exclude=outlook –exclude=RECYCLER –exclude=$RECYCLE.BIN –exclude=”System Volume Information” –delete /cygdrive/T amsadmin@sblan2::backup/

Let me know if I can be of any help.

I saw this picture while being logged in on LinkedIn. I wasn’t doing anything specific and definitely not something related to job  search.

This appeared on the right side of the window.

The funny thing is that if you click on Apply Now you see that actually the ad is location dependent.

This job was in Germany (where I live) and actually relatively near me (Munich is 200 KM near me).

No, I didn’t apply

So easy… http://www.google.com/security/

1. Passwords
2. Gmail settings
3. Security tools
4. Malware
5. Phishing
6. Secure sites
7. Safe networks
8. Mobile security
9. Family safety
10. Shopping safety

Here are some articles I wrote in the Avira Techblog about how to improve your security:

Improve your security #5: use dedicated accounts for each user

Improve your Security #4: Update your Software often

Improve your Security #3: Online Protection

Improve your Security #2: Securing your notebook

Improve your Security #1: Complex passwords aren’t always better 

Boulevard Magazine has published my photos about Bodensee in their latest edition.

The article starts at page 43 and is 7 pages long (incl. pictures).

Here are the screenshots:

The VB2011 - the 21st Virus Bulletin International Conference took place between  5-7 October 2011 in Barcelona, Spain.

The city of Barcelona is a wonderful place to be. Pity that I didn’t have enough time to see all of its wonders.

Here is the article about the Opening of the conference.

Here are the reports from the three days of the conference:

Day 1

Day 2

Day 3

The source is an article I wrote for the Avira press release : http://www.avira.com/en/press-details/nid/528/news/consumers-concerns-online-shopping-safety

Here are the tips:

I recommend that consumers watch for a few things in order to not become a victim of the online fraudsters:

• Always check that the connection to the online store where the payment is done is secured. This can be observed first if the URL is starting with “https” and second if a small lock is present in the top left corner of the browser in the URL field (in Chrome) or the name of the website is written in a colored rectangle(in Firefox,IE). If the web browser gives any warnings about the security certificate of the website, then do not proceed to purchase anything from that website.
• If you don’t know the website you plan to buy from, always check its reputation first. Search for comments from other users about that website. Searching for “<website> reputation” usually gives good and relevant results.
• Give your financial details like credit card data only if the website is properly secured and its reputation is good.
• Try to choose payment methods which don’t require payment upfront. If PayPal is an option, choose that whenever possible. Otherwise, if you’ve ensured the safety of the website you’re on and you feel good about its reputation, then pay with a credit card.
• Always double check your bank accounts to make sure the amount you spent is the amount that was charged. If there is a discrepancy, contact the website where you made the purchase.