Posts

Posted on

Wall Street Journal, Apple and Bull-Pie Journalism

Here’s my reaction to Wall Street Journal article regarding Apple cutting down iPhone 5 order.

For some reasons I sense that Wall Street Journal is forgoing good writing in the name of page views.

iVA-Twitter-WSJ-page-views

Immediately I sensed the bull-pie Wall Street Journal made.

BGR’s Tero Kuittinen felt the same way and said:

In what world did Apple expect to order components for 65 million iPhone 5 handsets in the seasonally soft March quarter?

Perhaps the weirdness of the math is why the current version of the WSJ article no longer cites the 65 million unit figure. Sometime between Sunday at 8:00 p.m. EST and Monday at 7:00 a.m., the Journal decided to drop the number from its article. But if the 65 million number is not right, is the estimate for halving March orders correct, either?

John Gruber also agrees:

The reports claiming 65 million displays for next quarter make little sense; the reports that claim component orders have been “halved” but without any specific numbers can’t be verified three months from now when Apple reports its actual iPhone sales for the coming quarter. In the meantime, of course, Apple’s stock took a beating today on these reports. If you don’t smell stock manipulation here, I have a bridge to sell you.

Then I also said:

If WSJ story about iPhone 5 orders turned out to be a bull-pie, should SEC investigate them?

iVA-Twitter-WSJ-SEC

Posted on

There’s Something About Java

Current news about Java vulnerabilities have been the talk of both tech and mainstream press. The U.S. Department of Homeland Security issued a warning of this vulnerability on Thursday January 10, 2013. On Friday January 11, 2013 we received numbers of called from users that their computers were infected by malware on that day. Security softwares such as Malwarebytes Anti-Malware and Microsoft Security Essentials detected the presence of malicious Java codes in the computers.

Companies like Apple and Mozilla Foundation have been pro-actively blocked Java on their platform.

Mozilla-blocks-Java

This is certainly not the first time Java has been exploited to deliver malware. Back in August 2012 similar outbreak of malware used Java vulnerability as point of entry. Oracle says that they are preparing an update to Java to address the vulnerability.

Posted on

Ransomware, Part 2 – The Java Connection

So, I have successfully removed the ransomware/malware form the infected computer.

Booting the computer up to Safe Mode or Safe Mode with Networking would still activate the malware. That’s because it replaces the registry entry for Windows Shell from “Explorer.exe” to something else. So, boot the computer to “Safe Mode with Command Prompt” and type “regedit.exe” at the command prompt.

In registry editor, go to:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

In this particular case it was replaced with:

C:PROGRA~3dsgsdgdsgdsgw.bat

Ransomware Infected Windows Shell

Delete the entry and replace it with:

Explorer.exe

Reboot the computer into “Safe Mode with Networking” and launch a web browser. Download, install and run the following programs if you haven’t already:

There are also other programs to scan and remove the malware.

Combofix detects that userinit.exe s also infected.

Ransomware Combofix userinit

Microsoft Security Essentials also detected presence of Trojan:JS/Reveton.A, which was detected on January 11, 2013.

Ransomware through Java

This computer was infected on Friday January 11, 2013, shortly after news about Java vulnerability was reported. After further investigations, I found that the infection happened through Java vulnerability. The infected computer had both Java 6 and 7 installed. Malwarebytes AntiMalware Free detected and removed the malicious Java module. Similar vulnerability was found back in August 2012.

Let’s take a look at the ransomware/malware.

It takes over Windows User Interface (UI) and replaces windows shell with the threatening message purporting from United States Department of Justice: “YOUR COMPUTER HAS BEEN LOCKED”

Ransomware

The message says that the computer has been locked for one or more violations:

  • Article – 184. Pornography involving children (under 18 years)
  • Article – 171. Copyright
  • Article – 113. The use of unlicensed software

They are pretty much the same language used in other ransomware/malware purporting from FBI, Police Cybercrime Investigation Department, etc. Some people might fall for this.

Ransomware 3 violations

The malware also tries to activate the computer camera, for the purpose of scaring the user. Even though the infected computer doesn’t have any cameras installed, the malware pretends that it is recording video of the user.

Ransomware video recording

The malware demands $300 to be paid in MoneyPak so users can unlock the computer.

Ransomware MoneyPak

So convenient that the malware tells you where to get this MoneyPak.

Anyway, you need to disable Java from your browsers.

If you’re using Mozilla Firefox, follow the instruction here: How to turn off Java applets

If you’re using Google Chrome, go to:

Settings > Privacy > Content Settings > Plug-ins > select “Click to play”

Also go to chrome://plugins/ to manually disable Java if necessary. (type in chrome://plugins/ in the address bar / omnibox)

If you are using Safari, go to:

Preferences > Security > uncheck “Enable Java”

If you are using Internet Explorer, follow the instruction from Sophos.

Posted on

Ransomware, Part 1

I’ve gotten a call earlier today from a friend because his computer has been locked by “The United States Department of Justice”.  In addition to that “The United States Department of Justice” demands computer owner to pay $300 to unlock the computer “avoid other legal consequences”.

First and foremost, The United States Department of Justice does not run such operation.

This is a ransomware. It replaces Windows 7 shell with its own executable file. Booting the computer to plain “Safe Mode” or” Safe Mode with Networking” will load the malicious executable. Instead, boot to “Safe Mode with Command Prompt” and manually remove the malicious software.

I’ll describe what I did in the next post.

Ransomware

Proudly powered by WordPress