Project Honeypot published this nice article which contains all kind of data and graphics here:
1 Billion Spammers Served

All nice and shiny, but I have a problem with this graphic:

Notice that PayPal is about 1% …

Our data, gathered by the URLCheck service, gives us completely different numbers:

So, don’t believe everything what you see…

I have to confess, I never ever read anything on www.shadowserver.org and everything I write here is taken from this page from McAfee Avert Labs Blog

Shadowserver names 183 country codes and 5994 autonomous systems with Conficker IP in their network space:

* 1086 for the Russian Federation (RU)
* 597 for the United States (US)
* 422 for Ukraine (UA)
* 271 for Romania (RO)
* 244 for Brazil (BR)
* 243 for Republic of Korea (KR)
* 184 for Poland (PL)
* 166 for Bulgaria (BG)
* 147 for Europe (EU)
* 129 for Indonesia (ID)
* 113 for Japan (JP)
* 95 for China (CN)
* 94 for India (IN)

I can not stop myself to notice a very stupid mistake created by ignorance.
If you look at the above quotation you see:
* 271 for Romania (RO)
* 184 for Poland (PL)
* 166 for Bulgaria (BG)
* 147 for Europe (EU)

Well, useless to say… I hope … that the 3 countries are already part of the European Union.
Have a look here: http://europa.eu/abc/european_countries/index_en.htm

Not every Christmas card wishes you well : http://techblog.avira.com/2009/12/03/not-every-christmas-card-wishes-you-well/en/

Avira switches to new update system:
http://techblog.avira.com/2009/11/19/avira-switches-to-new-update-system/en/

… but only for a short period of time.

Just click here to go to the Dropbox website

Resources:

The APR pools are some big tables which contain references to consecutive
memory areas which are used by the application. Once the application releases
such an area, the pool marks the memory area as available, but it doesn’t give
it back to the OS.

Let’s take an example which better illustrates this situation:
We have 100 memory areas in the pool, each of 10 K RAM . Some of them are used,
some of them not.
10 consecutive objects are released, so we have a block of 100K of continuous
memory (in the pool and in the RAM).
If there comes a request to reserve 80K of RAM, a big part of this block will
be used (8 out of 10 areas). This is reutilization of the pool and from the
outside, there will be no memory increase seen.

But, if there comes a request to allocate 200K of RAM, the pool doesn’t have
enough consecutive areas to allocate 20 blocks of 10K RAM so, it has to
allocate 20 new blocks of 10 K. This means from outside, that the pool has been
enlarged and this amount of RAM will NOT be released until the end of the
program or until the application decides to flush the pool.

Some time later, if the application requests 80K of RAM, the old 10 Blocks will
be used, but at this moment, the pool has been enlarged.
AFAIK, there is no limit until which size can such a pool grow.
I’ll check this…

Social engineering and the redefinition of spam

I own mustaca.ro since a couple of years now… maybe 6 years ?
However, I didn’t use it so far because I couldn’t register a DNS record for it.
Now, with the help of my friends I was able to redirect it to mustaca.de

Also the emails sent to mustaca.ro are redirected to mustaca.de

Read here the entire article on DDJ.com: http://www.ddj.com/architect/221600058

I love this remark:
“NP-completeness “tells you something very specific:It tells you that if you’re going to look for an algorithm that’s going to work in every case and give you the best solution, you’re doomed: don’t even try. That’s useful information.”

The spam trend continues: more and more malware

Kaspersky Internet Security 2010 : http://usa.kaspersky.com/shakeitup/
IObit Security : http://db.iobit.com/license-free/win7-special-offer.php
Panda Security : http://us.pandasecurity.com/windows7party/index.html
are offering free one year subscriptions to everyone…

http://windows7news.com/2009/10/22/free-anti-virus-1-year-subscriptions-to-celebrate-windows-7-launch/

Avira is also offering Free-Av to absolutely everyone, all the time, since 10 years.
And this no matter which Windows you run.

Bastards …

There will be interrupts today because I’ve moved my website from 1und1.de to Netbeat.

Malware-Spam with alleged OWA settings

Got the invitation for Google Wave (http://ping.fm/gxgq6). Still trying how to use it. My Google user name is sorin.mustaca.
Everything still looks pretty simple developed out there.

A brief look at some Twitter Spam

High Risk Level Alert

I usually do not start with a conclusion… But now I will.
Simply stay away from this dreadful software… !!!
It is simply buggy !

Outlook 2007 crashes almost at every signed email that this crappy software tries to display.

STAY AWAY FROM http://www.gpg4win.org/ at least until they fix these crashes !!!

Posted in General, News Tagged: gpg, gpg4win, outlook, pgp ]]> http://msorin.wordpress.com/2009/10/08/email-insecurity-using-gnupg-for-windows-and-outlook/feed/ 0 msorin kleopatra-outlook crash-kleopatra crash-kleopatra2 http://msorin.wordpress.com/2009/09/30/avert-labs-%e2%80%94-malware-experience-dont/ http://msorin.wordpress.com/2009/09/30/avert-labs-%e2%80%94-malware-experience-dont/#comments Wed, 30 Sep 2009 06:44:24 +0000 msorin http://msorin.wordpress.com/?p=338 ]]>

With a huge surprize I’ve read here that McAfee is teaching people how to play with Malware.

I do not think that everybody needs to know this. Already too many script kiddies are doing this with catastrophic effects.

http://www.mcafeefocus.com/focus09/sessions/GroupMeetings.aspx#avert2

Avert Labs — Malware Experience
(By appointment only)
Tuesday, Oct. 6
1:00 pm – 5:00 pm
You’ve often heard that the Internet is a dangerous place and you’ve probably read about threats such as botnets, keystroke loggers and drive-by installations of malware through rigged Web sites. But what is malware really? How do cybercriminals launch their malicious attacks? McAfee is offering you the chance to find out with the unique and exclusive McAfee Malware Experience.

Join experts from McAfee Avert Labs and have a chance to work with a Trojan horse, commandeer a botnet, install a rootkit and experience first hand how easy it is to modify websites to serve up malware. Of course this will all be done in the safe and closed environment, ensuring that what you experience first hand doesn’t actually go out onto the Internet. To sign up, contact Shiva Mandalam at shiva_mandalam@mcafee.com or 408.346.3866.

McAfee, do not consider that just by using a “safe environment” the problem doesn’t exist. Those guys who enjoy the feeling will repeat the experiment… maybe outside of the safe environment.

And then what ?

Posted in antivirus, News Tagged: course, mcafee, rootkit, teach malware ]]> http://msorin.wordpress.com/2009/09/30/avert-labs-%e2%80%94-malware-experience-dont/feed/ 2 msorin http://msorin.wordpress.com/2009/09/28/avira-techblog-zbot-outbreak-in-form-of-irs-phishing/ http://msorin.wordpress.com/2009/09/28/avira-techblog-zbot-outbreak-in-form-of-irs-phishing/#comments Mon, 28 Sep 2009 12:18:37 +0000 msorin http://msorin.wordpress.com/?p=335 ]]>

Avira Techblog: ZBot outbreak in form of IRS Phishing

Posted in News, Spam & Phishing ]]> http://msorin.wordpress.com/2009/09/28/avira-techblog-zbot-outbreak-in-form-of-irs-phishing/feed/ 0 msorin http://msorin.wordpress.com/2009/09/28/virus-bulletin-2009-conference-reports/ http://msorin.wordpress.com/2009/09/28/virus-bulletin-2009-conference-reports/#comments Mon, 28 Sep 2009 08:58:18 +0000 msorin http://msorin.wordpress.com/?p=333 ]]>

Day 1 : http://techblog.avira.com/2009/09/24/vb-conference-day-1/en/

Day 2 : http://techblog.avira.com/2009/09/25/vb-conference-day-2/en/

Day 3 : http://techblog.avira.com/2009/09/28/vb-conference-day-3/en/

Posted in antivirus, News, Spam & Phishing Tagged: geneva, report, virus bulletin conference 2009 ]]> http://msorin.wordpress.com/2009/09/28/virus-bulletin-2009-conference-reports/feed/ 0 msorin