Fake Conficker.B Infection Alerts Impersonate Microsoft

An ongoing spam campaign is once again attempting to impersonate Microsoft’s security team — the same campaign was first seen in April — by mass mailing Conficker.B Infection Alerts (install.zip), which upon execution drop a sample of the Antivirus Pro 2010 scareware.

Whereas the theme remains the same, the botnet masters have slightly modified the message:

“Dear Microsoft Customer,

Starting 18/10/2009 the ‘Conficker’ worm began infecting Microsoft customers unusually rapidly. Microsoft has been advised by your Internet provider that your network is infected. To counteract further spread we advise removing the infection using an antispyware program. We are supplying all effected Windows Users with a free system scan in order to clean any files infected by the virus.

Please install attached file to start the scan. The process takes under a minute and will prevent your files from being compromised. We appreciate your prompt cooperation.

Regards,
Microsoft Windows Agent #2 (Hollis)
Microsoft Windows Computer Safety Division”

The use of email as propagation vector for scareware campaigns (The ultimate guide to scareware protection), and in particular the use of email attachments is an uncommon practice, compared to the single most effective way of hijacking traffic through blackhat search engine optimization where the cybercriminals rely on real-time news events.

The campaign is an example of a — thankfully - badly executed one in the sense that with Microsoft’s Security Essentials recently gained momentum, even the average Internet user would notice the suspicious timing of the offered “antispyware program”.

H1N1: Rules of Contact and Engagement

“In Samoa, people do not touch when they greet each other,” the linguistic anthropologist Alessandro Duranti says.

There is, of course, a catch: “When people whom they respect highly come into a house, they sit down across from you, and there is an elaborate ceremonial greeting: mentioning each person’s titles and social connections, one at a time, usually for an extended period.”

For those outside Samoa, the era of swine flu poses the thorny challenge of how to express cordiality, friendship, even love — while staying, as the authorities recommend, at least three to five feet away from anyone who coughs, sneezes or might otherwise show signs of infection with the H1N1 virus. Let's hope good sense prevails.

Swine Flu H1N1 Level 4: Can business survive this after severe lay-offs

The business world is growing increasingly concerned about a quickly developing H1N1 swine flu outbreak, with cases now appearing all over the world, and hundreds more in Mexico.

This should ring loud alarm bells for IT managers and spur them on to take a close look at the dusty old influenza pandemic plans, developed several years ago in response to a potential bird flu pandemic.

The additional problem that IT managers are facing today, is that following the recent consolidations, layoffs and restructurings, they will have less staff and reduced capability to deal with events. They will also have disjointed and inadequate response plans to correct because the old ones were drafted in more favourable times. People who once took a pivotal role as part of a critical team, may now be on garden-leave, collecting unemployment money or re-assigned to another location or position.

Clearly, it is very important that managers pay close attention to what's going on; the H1N1 pandemic situation is a dynamic event and is still emerging. It has been developing quickly over a short period of time. This is something that needs to be monitored and taken very seriously.

Now, the World Health Organization has raised its threat level to Level 4 in its six-level scale because the swine flu currently has "a sustained limited human-to-human transmission."

While the business world figures out just what this means, the Contingency managers are already pushing and recommending that the business seriously reviews and updates their call lists and decision-making chains. It is essential that they close any gaps and weaknesses in plans caused by recent organisational restructuring and downsizing, in particular.

If an organisation has not developed a specific pandemic plan, then they should do so quickly. Develop one by concentrating on one key factor; making a continuity plan that is business focused and that considers a "significant absence" of employees. Give serious thought about how your business could support its clients and sustain services by the use of tele-working methods and virtual environments, from your employees homes.

The standard model used in pandemic planning is to consider what would happen to a business if 40% of the workforce was absent, for an extended period of time. In this case it would be pertinent to consider a range of options, taking into consideration absentee levels of between 25 and 40%.

The WHO is in the midst of its initial investigations of the illness, and they currently believe that it may not be anywhere near the threat envisaged, specifically if the bird flu became a human influenza pandemic.

Gartner Inc.'s response in 2006 was to suggest stringent measures to IT departments, such as storing 42 gallons of water per data centre worker, enough for a six-week quarantine. Even at the time this was felt to be excessive.

Asked if Gartner was offering any advice in response to the Mexican outbreak, analyst Ken McGee, the author of that Gartner report, said today that it will go into "full-force advisory mode" not when the virus jumps from birds or swine to people, but when it jumps from people to people. So, that will be quite soon then. Worryingly, it does show a slight lack of foresight and planning on Gartner's side, as well as a reactive rather than proactive response.

If nothing else, the Mexican situation will acts as a wake-up call for businesses and clients that need to develop meaningful infectious virus disease-related influenza plans. If you consider this as a meaningful step for you, then the next sensible thing to do would be to have your plans checked and reviewed by a risk and contingency expert. These simple measures are by far preferably to having a 'live' and potentially destructive test being inflicted upon your business by the virus itself, in whatever form it takes. Your choice or no choice.