Malicious Tunes

Here's an interesting fact for you: crab sticks do not actually contain any crab. Yup, thought you'd all be impressed. Actually I've got tons of facts. Another one I learned today is that music files are one of the four most popular mechanisms for spreading malware. Of course, i know you'll get the others - flash drives, malicious scripts and email attachments - but music files?

We learnt this at the Kaspersky Lab New Dimensions press event today, where the vodka-soaked hacks from around the globe sat before Timur Biyachuev, project manager for R&D at the vendor, for a DIY computer security lesson.

In October this year, for example, the biggest threat found by Kaspersky Lab was a Trojan Downloader named WMA Wimad.n - a Trojan masquerading as a WMA file. The Kaspersky advice is if you open a music file and your media player asks you to download a codec or read a licence agreement, don't.

The other topic of interest at today's event was the presentation given by chief security expert at Kaspersky Lab, Costin Raiu. He demoed a new feature in the firm's upcoming 2009 security product - yes, a blatant product plug, but it was still interesting. It's a new virtual keyboard function which enables users to enter sensitive information on their PC - log-in details for online banking for example - without the risk of that information being recorded by keylogging software. As he rightly explained, some banks have their own virtual keyboard tools to be used at log-in time, but these can be circumvented by Trojans which take screenshots of the computer screen, which enables the hackers to see which digits you are clicking on anyway.

It's not revolutionary but just another step in the right direction, which will probably be overcome by the criminals in time. But until then it could be a valuable tool for protecting the online assets of your customers.