By JOHN MARKOFF 
 
A new digital plague has hit the Internet, infecting 
millions of personal and business computers in what seems to 
be the first step of a multistage attack. The world’s leading 
computer security experts do not yet know who programmed the 
infection, or what the next stage will be. 
In recent weeks a worm, a malicious software 
program, has swept through corporate, educational and public 
computer networks around the world. Known as Conficker or 
Downandup, it is spread by a recently discovered Microsoft 
Windows vulnerability, by guessing network passwords and by 
hand-carried consumer gadgets like USB keys. 
Experts say it is the 11 infection since the Slammer 
worm exploded through the Internet in January 2003, and it may 
have infected as many as nine million personal computers 
around the world. 
Worms like Conficker not only ricochet around the 
Internet at lightning speed, they harness infected computers into 
unified systems called botnets, which can then accept 
programming instructions from their clandestine masters. 
Many computer users may not notice that their 
machines have been infected, and computer security 
researchers said they were waiting for the instructions to 
materialize, to determine what impact the botnet will have on PC 
users. It might operate in the background, using the infected 
computer to send spam or infect other computers, or it might 
steal the PC user’s personal information. 
Microsoft rushed an emergency patch to defend the 
Windows operating systems against this vulnerability in October, 
yet the worm has continued to spread even as the level of 
warnings has grown in recent weeks. 
Earlier this week, security researchers at Qualys, a 
Silicon Valley security firm, estimated that about 30 percent of 
Windows-based computers attached to the Internet remain 
vulnerable to infection because they have not been updated with 
the patch, despite the fact that it was made available in October. 
Unraveling the program has been particularly 
challenging because it comes with encryption mechanisms that 
hide its internal workings from those seeking to disable it. 
The program uses an elaborate shell-game-style 
technique to permit someone to command it remotely. Each day 
it generates a new list of 250 domain names. Instructions from 
any one of these domain names would be obeyed. To control 
the botnet, an attacker would need only to register a single 
domain to send instructions to the botnet globally, greatly 
complicating the task of law enforcement and security 
companies trying to intervene and block the activation of the 
botnet. 
Several computer security firms said that although 
Conficker appeared to have been written from scratch, it had 
parallels to the work of a suspected Eastern European criminal 
gang that has profited by sending programs known as 
“scareware” to personal computers that seem to warn users of 
an infection and ask for credit card numbers to pay for bogus 
antivirus software that actually further infects their computer. 
One intriguing clue left by the malware authors is that 
the first version of the program checked to see if the computer 
had a Ukrainian keyboard layout. If it found it had such a 
keyboard, it would not infect the machine, according to Phillip 
Porras, a security investigator at SRI International who has 
disassembled the program to determine how it functioned.

Three of the most aggressive buyers of online advertising
space today agreed to __53__ fines and reform their advertising
practices as part of a landmark anti-spyware settlement.
Mobile phone giant Cingular Wireless LLC, and travel
sites Priceline.com and Travelocity.com agreed to settle their
part in an ongoing investigation by the New York State Attorney
General's office, which last year sued adware/spyware purveyor
DirectRevenue for deceptively and fraudulently installing its pop-
up ad serving and Web tracking software on millions of PCs
__54__ approval or consent of consumers.
This is an important settlement on a number of levels.
Online help forums are awash in desperate messages from
consumers __55__ machines were besieged by pop-up ads after
visiting a Web site that used slimy drive-by tactics to install
DirectRevenue's software, which is notoriously difficult to
remove from a host machine.
Perhaps more significantly, these advertisers were just
as culpable for supporting DirectRevenue's sleazy business
practices long after anti-spyware activists like Ben Edelman,
Suzi Turner and others published evidence of the illegal
distribution methods of DirectRevenue and the Webmasters it
paid to install its software. Experts consistently documented
adware bundles like the ones distributed by DirectRevenue
being installed on computers that contract distributors had
already infected with computer viruses and worms.
Ari Schwartz, deputy director for the Center for
Democracy & Technology, a consumer policy group in
Washington, D.C., said today's settlement was important
because it recognizes the oft-overlooked role that advertisers
continue to play in supporting the adware and spyware industry.
"The dirty secret about unwanted adware is that many
legitimate companies − knowingly or not − fund its proliferation
with their advertising dollars. Until we cut off that funding, there
will always be a financial incentive for companies to bombard
users with adware that they neither want nor need," Schwartz
said in a written statement.
While the settlement is a welcome and important one, the
terms and fines could have been a bit stiffer. Under the terms of
the agreement, all three companies will have to pay between
$30,000 and $35,000 each to New York state. In addition, "prior
to contracting with a company to deliver their ads, and quarterly
thereafter, the companies must investigate how their online ads
are delivered. The companies must immediately cease using
adware programs that violate the settlement agreements or their
own adware policies."
By Brian Krebs  January 29, 2007

SAN FRANCISCO, March 14 — Web search companies
collect records of the searches that people conduct, a fact that
has long generated 16 among privacy advocates and some
Internet users that valuable personal data could be misused.
 Now Google is taking a step to ease those concerns. The
company keeps logs of all searches, along with digital identifiers
linking them to specific computers and Internet browsers. It said
on Wednesday that it would start to make those logs anonymous
after 18 to 24 months, making it much harder to connect search
records to a person. Under current practices, the company
keeps the logs intact indefinitely.
 “We have decided to make this change with feedback
from privacy advocates, regulators worldwide and, of course,
from our users,” said Nicole Wong, Google’s deputy general
counsel.
 But it is unclear whether the change will have its intended
effect. Privacy advocates reacted with a mix of praise and
dismay to it.
 “This is really the first time we have seen them make a
decision to try and work out the conflict between wanting to be
pro-privacy and collecting all the world’s information,” said Ari
Schwartz, deputy director of the Center for Democracy and
Technology, an advocacy group. “They are not going to keep a
profile on you indefinitely.”
 Others were less enthusiastic. “I think it is an absolute
disaster for online privacy,” said Marc Rotenberg, executive
director of the Electronic Privacy Information Center.
 Ms. Wong said Google uses the search data internally
only to improve its search engine and other services. She added
that Google would release search data only if compelled by a
subpoena. Even so, Google was the only major search engine to
resist a Justice Department subpoena for vast amounts of
search data last year — a move that drew praise from privacy
advocates.
 Just how personally revealing such data can be became
evident last year, when AOL released records of the searches
conducted by 657,000 Americans for the benefit of researchers.
17 AOL did not identify the people behind the searches,
reporters from The New York Times were able to track down
some of them quickly through their search requests.
 The ensuing flap caused AOL to tighten its privacy
policies. The company now keeps search histories for only 
months and does not link them to Internet protocol addresses —
digital tags that can identify a specific computer.
 For its part, Yahoo keeps search data for “as long as it is
useful,” said a spokeswoman, Nissa Anklesaria. And Microsoft
said that while it does not keep search histories alongside I.P.
addresses, it can connect the two if law enforcement requests it.

Questões de Elementos gramaticais