The online leak of the Microsoft free tool which helps law enforcement agencies to retrieve forensic evidence in the first ‘rush’ of a crime scene is perhaps not as serious as first thought.

This site ran a story a while back which announced that Interpol’s Global Security Initiative (GSI), which focusses on international security challenges, has been given free use of Microsoft’s Computer Online Forensics Evidence Extractor (hence COFEE) to help the fight against cyber crime.

COFEE help scene of the crime officers gather computer evidence in-situ and quickly. This type of evidence is regarded as volatile and not as efficiently collected as traditional forensic evidence. Microsoft hoped that by giving Interpol, and others, COFEE, it would go a long way to help combating the spread of cyber crime.

But reports from various sites online say that Microsoft does not regard the leak as a major leak. It is said to be investigating the circumstances behind it, but pointed out that COFEE is fundamentally an application which contains a collection of digital forensic tools which are common throughout the world. In other words, it is not ‘secret’ code which will unlock forensic tricks and techniques for the criminal community.

What’s more, those in the know said that the leaked version of COFEE was incomplete, with maybe less than 50% of the programme out there. Which leads watchers of the saga to the conclusion that COFEE is about procedure and technique in the heat of the incident, rather than a magical code which allows the police to get the upper hand.

Indeed, some experts have stated their disappointment that COFEE was not better than they had expected. Some went as far as to suggest that other similar programmes on the market would do a better job.

Some cynics have also stated that maybe Microsoft is deliberately downplaying the incident to avoid any embarrassment over its leaking which is not a great advertisement for the company, or the product. Also, others have challenged Microsoft’s relaxed attitude, given that maybe some criminals could learn from the leak and adapt their browsing and internet use accordingly.

Guest Article by Neil Camp 

Along with Symantec and McAfee, and a whole host of other computer security companies, BitDefender has announced that its new line-up of products which are compatible with Microsoft’s new operating system Windows 7.

BitDefender’s products – including Total Security, Internet Security and Antivirus – have all received certification ensuring that they work with Microsoft Windows 7. And they claim they provide customers with enhanced security, as well as innovative user interface features and reliability improvements.

The 2010 BitDefender line-up includes a number of new features:

• optimised scanning improvements
• active Virus Control
• first-ever usage profiles
• key system enhancements which is aimed at providing industry-leading proactive protection against all internet security threats, without slowing PC performance.

Ross Brown, Vice President of ISV and Solutions Partners for the Worldwide Partner Group at Microsoft, said:
“Our ISV community is alive with innovation, and we’re committed to helping our partners drive the next generation of software experiences. Adding compatibility for the latest Microsoft operating systems helps ISVs to stay ahead of the competition and give their customers access to cutting-edge technologies.”

Vince Hwang, BitDefender Global Director, Product Management, said:
“Working together with Microsoft to achieve this certification allows BitDefender to meet the changing needs of our customers and provide the very best in security solutions to our users. These include intuitive user interfaces with usage profiles that cover anyone from gamers to parents, as well as improved security and reliability features including Active Virus Control, an innovative technology that monitors programs running on a user’s computer and detects malware-like actions as they execute.”

BitDefender claims to be the creator of one of the industry’s fastest and most effective lines of internationally certified security software.

The Company’s Antivirus 2010 product BitDefender Antivirus 2010 has also just received AV-Comparatives’ top certification level for its quality of performance. In all, some 16 antivirus products were tested by AV-Comparatives in August. They sought to find out which software had the highest detection rates and lowest false positives.

Viorel Canja, BitDefender’s head of antimalware lab, said:
“We are particularly pleased with this achievement as it is further proof that BitDefender provides the highest level of protection. The test shows that on this occasion we have outperformed our rivals in terms of false positive ratings with the lowest number of occurrences.”

Guest Article by Neil Camp

Reports form the BBC suggest that Google’s Gmail and Microsoft’s Hotmail have been under siege from phishing attacks which have targeted thousands of service users in an industry wide scheme.

Both Google and Microsoft have moved to stem any damage. Users of Yahoo and AOL email services were also hit.

The BBC stated that they were shown two lists which contained the name and passwords of 30,000 people who use Gmail, Hotmail, Yahoo and AOL email services. And the lists were said to have been posted on the web for anyone to access.

Google told the BBC that only 500 of its customers had been named, although it said a third list was in existence, but declined to give numbers.

A Google spokesperson said:
“We recently became aware of an industry-wide phishing scheme through which hackers gained user credentials for web-based mail accounts including Gmail accounts.

“As soon as we learned of the attack, we forced password resets on the affected accounts. We will continue to force password resets on additional accounts when we become aware of them.”

Google appeared keen to highlight that the scheme did not actually breach Gmail security, but involved a none too uncommon scam which persuaded people to give away their personal information to cyber criminals.

A phishing scheme is one which usually involves bogus emails purporting to be from a bona fide organisation which invites recipients to send back their personal details, log-in usernames and secure passwords. And despite frequent warnings from the organisations themselves and computer security experts not to give away personal details to anyone, phishing attacks remain very successful in their simplicity and ruthlessness. Most are based on a good copy of a bona fida email and most introduce an element of bullying into their message: act now, or account will be closed down.

This particular scheme started when 10,000 Hotmail addresses were posted online at Pastebin, a website mostly used by developers to share code. But that was just the start, with a further 20,000 names being uploaded which contained e-mail addresses and passwords from Hotmail, Yahoo, AOL, Gmail and other service providers.

Although some of the details were old, or indeed fake, many were genuine.

A Microsoft spokesperson said:
“Our guidance to customers is to exercise extreme caution when opening unsolicited attachments and links from both known and unknown sources, and that they install and regularly update their anti-virus software.”

A person from Yahoo reiterated the rest, urging its customers to “…
take measures to secure their accounts whenever possible, including changing their passwords…”

Computer security industry experts called for the providers to do more to educate their customers as regards the dangers of such phishing attacks.

Guest Article by Neil Camp

A new virus is in town and this time it’s got a specific target: online banking customers. Known as the Clampi virus, it represents a major threat to those that bank via the internet.

The Clampi virus is whats known as a Trojan, mainly because of its ability to secretly penetrate a computer, wait patiently until needed, then report bank to its creator, or indeed, take instructions from its creator.

And the cyber criminals behind the Clampi virus have on objective in mind: to steal personal details from a computer.

It is spreading rapidly through the US and UK, infecting computers and then waiting until the time is right to strike. When the user of the computer logs into their bank account for example, the Clampi virus makes a note of the username, password and other pertinent details, which are then sent back to the hackers.

These details are then used by the hackers to enter financial sites and either transfer money, change account details, or set-up frauds.

It is believed that people behind the Clampi virus monitor in the region of 5,000 financial websites and amongst these are most of the UK high street banks. But it’s not just banks; sites run by mortgage lenders, online casinos, shopping operations and email providers are also targeted.

In the US the Clampi virus has already been responsible for thefts of thousands of dollars and its been reported that many schools and businesses have been affected.

The Clampi virus is not new, having been around since 2005, but computer security experts think that this is a new, more virulent strain and poses a major threat to online banking. And they believe it attacks in waves, the UK banks being a major target.

They are unsure as to the true extent of the damage caused in the UK, especially given the covert nature of Clampi’s operation, but think that over 1,000 computers have already been affected. And those running Microsoft Windows operating systems seem to be more vulnerable than most.

And the computer security experts are warning again that people should remain vigilant at all times, reiterating the fact the such viruses are usually distributed embedded in emails, website downloads and instant messages, as attachments and links. They urge anyone not to open links, or attachments, from sources they cannot trust.

What’s more, they remind computer users that they should never send emails, or surf the web, without an up-to-date anti-virus software application on their machines.

Guest Article by Neil Camp

Seattle based software giant Microsoft has reportedly developed an antivirus programme that it will give away free, alarming certain computer security experts that it will fall short of a number of key features and expose users to attacks.

Believed to be called Morro, the software will initially only take on viruses, and not offer such additional features as parental controls for surfing.

The irony is of course, that many virus attacks come about because of holes (‘bugs’) in such operating systems as Microsoft’s Windows, hence the need for constant patching (in the form of Service Packs) after the release of the product.

This will be Microsoft’s second foray into the highly competitive world of computer security. Its first, called the Windows Live OneCare, made little impression on the overall market for sophisticated security products. It is thought that Live OneCare will be dropped once Morro is ready for release (a Beta version will come first).

Morro has been created to tackle viruses in the shape of spyware, rootkits and trojans.

But, as many computer security experts fear, this is not enough to counter attacks from modern day hackers who employ a whole raft of viruses and techniques in order to attack people’s computers. The danger many feel is that many computer users will be lulled into a false sense of security by using such a package as Morro. And they will eventually discover that they need a more sophisticated programme in order to keep them safe from viruses.

Guest Article by Neil Camp