The Security Skeptic

Will Fake AV turn to legit names in force?

The Security Blog article With Great Name Comes Great Liability discusses how rogueware authors have entered the identity theft business. No, they're not stealing identities of natural persons but the names and logos of  legitimate antivirus programs for their fake products.

Admittedly,  the recent fake version of the popular AVG antivirus raises concerns that this is the beginning of a worrisome trend. I'm not convinced yet. Dozens of new variants of Fake AV and rogueware appeared in 2010 and the incidents of  impersonation among them are not enough yet to indicate a shift in rogeware strategy. Scammers have carefully avoided using names protected by IP & T for some time. I'm thinking they still want to stay off the radar of the online  protection measures that most major brands implement or hire 3rd parties to do so for them.

The Security Blog suggests that users have "become smarter in distinguishing the name of fake and real antivirus programs". I'd love to believe that this is true, but I'm inclined to believe that there are simply too many security terms scammers can mix and match to create seemingly legit names or approximations of legit names. The names become a blur, vendors re-brand their own products and the distinctions are lost over time. Moreover, distinguishing among names is a thoughtful activity. Fake AV programs are often designed to take users by surprise or cause panic,  appeal to a user's attraction to free stuff... basically any means to make a user act before or without thinking. Are users really pausing to distinguish AVG from AGV in these situations? Enough for rogueware scammers to increase the risk of early detection by online brand protection agents?

Irrespective of whether impersonation of legt AV is growing or not, follow the advice offered in The Security Blog article. If you have any doubt whatsoever, don't download brand AV from third parties; instead, go directly to the AV vendor for  free or fee versions of antivirus software.

NoScript: Whitelist your way to a safer web experience

I've been using the NoScript Addon for Firefox by Giorgio Maone for some time now. NoScript provides a whitelisting capability for JavaScript, Java, and other active content types.  A key card identity system is a real world example of whitelisting: it allows only individuals with key cards to enter a facility whose doors are protected by the system. NoScript is basically an identity card reader for your browser. It ensures that only the browser content you trust can execute on your computer.

Whitelister in Training

I'm not going to summarize NoScript's features or describe how to use it. Visit the NoScript Basics page for this, but it is honestly a very intuitive and simple interface. Instead, I'll tackle the common, biggest obstacle for all whitelisting measures: the training period. In a word, it is continuous. How you decide what sites to trust and how much work you want to put into this decision process is up to you. I use several methods to decide what domains to trust. If I'm familiar with the site and have had a positive experience, I'll trust the scripts associated with the site domain (e.g., typepad.com or its content delivery network). If I'm uncertain, I'll check the scorecard for the domain at MyWot and consider the reputation reported there.  If I'm suspicious I submit the domain to VirusTotal and scan to see if the page contains malware. I may Google the domain: if it is a tracking company, I permanently forbid execution (yes, NoScript also has a blacklisting feature).

Over time, you'll teach NoScript  which scripts to trust when you visit your most frequently visited sites. Note that you won't have to trust every script associated with a page you visit (although this can affect how or whether certain content is displayed, but this is actually quite useful because many sites execute scripts from other domains, and while many of these scripts are beneficial, some are intrusive and others might be malicious. In the absence of a perfect web, NoScript let's me decide what is beneficial and what is not.

Rewards

Training NoScript may seem inconvenient for a while, but let's consider the rewards you reap from whitelisting scripts:

• You automatically block ad services tracking and analytics scripts
• You defend against click-jacking, cross-site script attacks, Flash, and plugin attacks
• You gain a really powerful insight into what is really happening when you visit a web page

So the reward for taking the time to train NoScript is that (1) you protect against information leakage to evil marketing types, (2) protect against unwitting (drive-by) execution, redirection, or insertion attacks, and (3) learn what's going on behind your browser and who's responsible for the going's on. If this sounds like a bargain, grab the addon. If it sounds like too much trouble and you trust your own good judgment, good luck and take note of where your OEM/OS recovery disks are.